[Dshield] Strange Safe Mode behavior in Windows XP Professional/Eliminating possible virus

Michael forposts at aol.com
Thu Dec 11 19:50:30 GMT 2008


I am experiencing strange behavior in Windows XP Professional under  
Safe Mode With Networking.  When I started up the computer in Safe  
Mode,  instead of seeing a bunch of drivers appear as they are loaded,  
all I saw was a thin white line move across the bottom.  Normally when  
I start Safe Mode, I see a list of drivers display as they are  
loaded.  I am wondering if the computer might be infected with a virus  
or possibly a rootkit, so I ran SmitFraudFix (http://siri.geekstogo.com/SmitfraudFix.php 
); it seemed to restore the list of device drivers as Safe Mode with  
Networking did its boot.

My questions:

(1)  I ran a VirusScan with Sunbelt Software's VIPRE Antivirus/ 
Antispyware, and it comes up clean (or at least only cookies were  
found).  I then ran a scan using Webroot Antvirus with Antispyware,  
which also came out clean after a full scan.
(2)  The computer is running very slowly.  It has 512K of RAM and 75%  
of 250 GB available hard drive space and is six years old, and is  
constantly trying to increase the size of virtual memory.  I realize  
the computer is old, but is there any way to *prove* that there is no  
malware present?  The computer never ran this slow before.
(3)  Is there any specific algorithm that one should follow if they  
suspect their computer MAY be infected with a virus?  I have anti- 
rootkit tools (e.g., GMER, IceSword), but am not sure if I need them.
(4)  Is there any way to get Windows XP to do a "step-by-step"  
confirmation of drivers as it boots?  I think this would help me  
troubleshoot situation
(5)  After the problem is fixed (if there is one), how can I prevent  
it from happening again (i.e., how can I create a more 'survivable  

Your comments/insights/questions on this are welcomed.  I am stumped.   
Thanks in advance for your help.


More information about the Dshield mailing list