Bsod - usbport.sys (dmp attached)

[magic_mat]

Hi Guys.

Hopefully someone here can help me.

My pc has been running more or less fine for a while now. Ages ago I used to get usbport.sys blue screens and other bits. but ive forgoten how I got it etc....but up until today I started to get it today.

I just installed Macro Express a few days ago. Now when im running a macro, about half way through...BSOD!

Thanks Guys

Matthew

 

[DelJo63]

get online and Update the USB driver(s)

 

[magic_mat]

for my mother board?

There arnt anynew ones...... the latest is 11/14/2002

Ive got a Asrock, K7 Upgrade 600

 

[peterdiva]

You have an infection. https://www.techspot.com/vb/topic65943.html

PROCESS_NAME: hldrrr.exe
efb94000 efbaf730 srosa srosa.sys Sat Jan 26 16:12:50 2008 (479ADD72)

 

[magic_mat]

hmmmm

Dont have either of them files on my pc.

Dont have them running, never seen them running either.

And I dont have any of the symptoms which other sites say about it...

 

[Route44]

Tooso.R is a Trojan that downloads other threats onto the compromised computer. Once executed, the worm copies itself as the following file: hldrrr.exe

 

[magic_mat]

i dont have that file on my pc though, neither the other one or hldr

and i dont have any of the files it downloads or creates, and none of the folders either.

ive looked it up on google and i dont have it.

about to do a virus scan now just to make sure

 

[magic_mat]

just tried to do an online virus scan, getting to the end and then BSOD but it wasnt usbport.sys

restarted pc, as it loaded up BSOD not usbport.sys

restarted again, had to go into regedit and change the value to get Wireless Zero Config to enable.

Restarted

Everythings how it was before the scan....

hmmm

any suggestions?

 

[Route44]

Post your new minidump files. notice the description of the trojan. It can be replicated in a lot of hidden places.

 

[magic_mat]

ive posted the last 3 just incase

from what i gather though, ive had 2 different bsod happening today....?

 

[Route44]

The first was inconclusive. The second was memory corruption and the third was USBPORT.sys

Have you run MemTest for a minimum of 7 passes?

Also, if you are infected you will continue to have BSODs. Try running Kasperky's and Trend-Micros free online scanners if you are able access the internet.

 

[magic_mat]

I have ran memtest before for a while, it all seems ok.

The main consern I have is with usbport.sys

As this is what comes up when I try to run my macros, which i really need.
Also, it could that thats stopping my zune from functioning correctly.

What can I do about usbport.sys?

Thanks

Matthew

 

[peterdiva]

Run the following program. Don't delete anything, just report back the results. RootkitRevealer.

 

[magic_mat]

Right

First time I tried to scan, I got Page Fault in Non Page Error BSOD 0x00000050

(but i was doing things while it was scanning, maybe that caused it?)

Second attempt........BSOD USBPORT.SYS

Third Attempt............BSOD USPORT.SYS !!!!!!!

Also, when ever my computer turns on, i have to go into the registery and manualy enable Wireless Zero Config by changing the value for 4 to 1. Then i have to restart to get it working again. (i dont know if this is because i changed my usb adapter thinking it was that thats causing usbport.sys)

WHAT THE HELL IS THIS USBPORT.SYS

I cant find anything about it on the internet either!

Thanks for you time everyone

Cheers

 

[peterdiva]

Start a thread in the security forum asking how to remove srosa.sys. Include a link to this thread as well.

Read the Rootkit info on the link I gave you. It explains why you can't see the file/s.

 

[magic_mat]

Hmm Ok will do.

So in those minidumps i posted, does it actauly say im infected with those files?

 

[Route44]

As peterdiva has pointed out two trojans, yes, you are infected. The minidumps didn't say you were infected, i.e., "You are infected.". They pointed to a probable cause and the last one he listed is sorosa.sys. This is a trojan and it is in your PC.

Please ggo to this link and read on it: http://www.greatis.com/appdata/d/s/srosa.sys.htm

 

[magic_mat]

Right
Ive done the scan

its saying its removed srosa.sys ntdlrrr.exe and wintems.exe

tried to run rootkit revealer.........again after a bit bsod usbport.sys!!!


And still, i have to go into registery, enable Wireless Zero config, and restart to get internet working

 

[Macdead3]

Viruses

If you want to scan without any bsod then download this iso antivirus then burn into a cd/dvd then just run it on the bios and he will scan the windows (its from kaspersky lab)

softpedia.com/get/Antivirus/Kaspersky-Rescue-Disk.shtml [(Copy/paste)]

good luck!