Question Malware preventing itself from being removed, in addition to: ACPI.sys/apphelp.dll errors, SFC unable to fix, no networking.

[atanih23]

Hi there everyone! I'm having some errors with a domino effect and it's stumping me. Help please!

I was just browsing YouTube when suddenly I got a BSoD which said:

"Stop code: PAGE FAULT IN NONPAGED AREA
What failed: ACPI.sys"
(Unfortunately I couldn't find a dump file even though I have it set to make one, and the issue hasn't repeated.)

After that, my computer restarted, and I encountered this error:

"C:\WINDOWS\SYSTEM32\apphelp.dll is either not designed to be run on Windows or it contains an error. Try reinstalling the program again using the original installation media or contact your system administrator or the software vendor for support. Error status 0xc0000020"

In addition to that error, after restarting my networking was inoperable and couldn't find any networks. I tried using the built in diagnostic tool and this came up:

"Package ID: NetworkDiagnostics
Path: C:\WINDOWS\diagnostics\system\Networking
Error code: 0x80040154
Source: Engine
User: PCNAME\USER
Context: Restricted"
(Restricted changed to elevated after starting on safe-mode.)

So I was looking up guides, and was recommended to use the system file checker. So I do that and it gets 95% through before getting "Windows Resource Protection found corrupt files but was unable to fix some of them."

So I tried to use the DISM tool after that since some guides said it'd help the SFC work. But the DISM came back with error: 2.

Also tried a clean boot which didn't help, and I didn't want to mess with the registry. I figured it'd be best to ask here before a system restore.

I have a hunch that it has something to do with my Nvidia drivers, as attempting to launch the Nvidia GeForce Experience Panel yields the same apphelp.dll error.


System specs:

Windows 10 Home 64-bit (10.0, build 17763)
System Manufacturer: Gigabyte Technology Co., LTD.
System Model: H67MA-USB3-B3
BIOS: Award Modular BIOS v6.00PG
Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz (8 CPUs), ~3.7GHz
Memory: 16384MB RAM

 

[onespeedbiker]

First your page error usually has something to do with the swap file on your harddrive Windows uses when your RAM is overloaded. First try a cold boot. Unplug your PC and hold the power button down for 10 seconds, wait 10 minutes, then plug your PC back in and push the power button to boot to windows. If that doesn't work, here is a link with a number of other fixes. https://www.xtremerain.com/fix-page-fault-nonpaged-area/. It can also be caused by a virus or malware trying to access the swap file.

The apphelp.dll error is often the result of a virus/malware infection. Interestingly enough the file is used in compatibility mode as it was used with Windows XP. https://www.solvusoft.com/en/files/...rosoft/windows-xp-service-pack-3/apphelp-dll/

For both issues you should do a malware/ virus scan (I use malwarebytes) to scan your computer. You can also go to C:/Windows/system32/apphelp.dll and run a malware scan on apphelp.dll itself.

 

[atanih23]

Unfortunately the virus is preventing me from accessing Avast, or installing Malwarebytes. I'm also not sure what else is being affected by the virus other than it preventing me from opening programs. Should I just do a system restore? Or would that not resolve the issue?

 

[onespeedbiker]

See if you can down load malwarebytes on another computer and put it on a USB drive. Plug it in your computer and if you can run it from the USB, or possiblity move the file onto the computer and then run it. here is another antivurs from MS https://www.microsoft.com/en-us/download/malicious-software-removal-tool-details.aspx

Also Microsoft has a downloadable file you can make a bootable usb/cd from.

edit. here are some other bootable anti virus https://www.techsupportall.com/best-bootable-antivirus-rescue-severely-infected-computer/

 

[onespeedbiker]

There is also this https://www.malwarebytes.com/chameleon/

 

[atanih23]

I tried both of those first two* things to no avail. Also tried windows defender offline and it's preventing me from resetting my PC to default too, ughhhh.

* EDIT: Trying those other two things, gimme a bit. Thank you for patiently helping me.

 

[onespeedbiker]

I edited my post make sure you refresh it.

also try this https://www.malware-board.com/blog/remove-error-status-0xc0000020-using-quick-guide

 

[atanih23]

No luck. Pretty sure I'm going to have to just format the hard drive since this seems like it's way too deeply embedded for me.

 

[onespeedbiker]

Well heck. Did you try any of the bootable anti viruses? If yes, what happened? Do you have a Windows 10 install media? They have a good instruction thread on doing a clean install her. Most of it is self explanatory, but it's there if you need it. https://forums.tomshardware.com/faq/how-to-do-a-clean-installation-of-windows-10.3170366/

 

[Mattp2017]

If you have a recent system restore option I would try that before doing a clean install. If that doesn't work try doing a reset..... then if still no lucky maybe do the fresh install.

Also did you try downloading the malwarebytes installation file then rebooting into safe mode and installing it and running it?

 

[atanih23]

I did try to use safe-mode and installing malwarebytes, as well as running Chameleon. When I ran Chameleon on a USB where I had Malwarebytes installed, it came up with an error saying the process couldn't be started, which it seems the malware is doing for everything. I don't have a clean USB drive or a disc I can use for one of the bootable antiviruses. I'm not sure what the malware is aiming for so I'm okay with doing a clean install. However, the malware is preventing Windows from doing a factory reset, as it says it's encountering an error, and nothing more than that. So since I can't reset it, I was thinking about wiping the SSD. However, I can't find a good way to wipe the SSD while Windows is on it since it's kind of difficult in my tired-out-trying-to-fix-this-for-hours state. If anybody can offer help for that stuff it'd be great, as I'm well and truly stumped, and will probably need to sleep soon.

 

[onespeedbiker]

One of the first things a virus does is to disable down loading and restore programs.

You will need an windows 10 install media. If you did not get one with your PC, you will need to download it and create an install media from a different computer. https://forums.tomshardware.com/faq/how-to-do-a-clean-installation-of-windows-10.3170366/ While you are at it, you may as well download some bootable anti-virus programs you can load on an USB or CD and try and remove the virus.

edit: IOW, you can't do anything from inside windows. you will need a bootable media that works outside of windows, such as posted in the link.