Hi, all

Since yesterday I have my PC damaged. I was navigating in internet when suddenly one virus entered my computer without being blocked by Zone Alarm firewall. An exclamation icon in red appeared at the bottom (right) of the screen advising of the presence of malware in computer. Afterwards, a message appeared in the center of the screen signaling the presence of a Trojan: Trojan Adware.W32.ExpDwnldr and by choosing yes, a software would be installed in computer in order to remove it, I remember something about a web called onlinestability.com . Of course, I chose no, but after a few minutes the red signal of exclamation appeared again, as well as the message of Trojan and this happened repeteadly. The fact is that appeared in the screen 3 theoric software to remove malware:one of them called WinDoctor if I'm not wrong.
As a result of all of this, I started to run my antispyware programs: Ad-aware, Spybot, AVG antispyware, a-squared. I run Hijackthis to see the processes running. Moreover, I was looking for software which could remove this malware, Error Safe and Drive Cleaner were also detected for the first time since the last scan, which I did a few days ago.

After a while, a blue screen appeared and the computer restarted itself. By choosing safe mode, normal mode, or the last good configuration of the system, the PC always restarts itself. In safe mode, the Windows screen of loading doesn't appear and the computer restarts before. In normal mode or the last good configuration, the windows loading screen is showed but after some seconds, the load is blocked and the system restarts.


The problem is that now I don't have access to the Windows session to remove the malware I have mentioned. I don't know if it is usual not having access in safe mode, in other ocassions I had access in safe mode and fortunately I was able to solve the problems, this time I'm quite worried.

I need extremely urgently your help, any advice you could give me, any explanation of what may have happened would be appreciated.

Thank you very much for your help. I carry on finding possible solutions.

Hey maxijanko,
This is not sounding too good, how about a straight boot to safe mode.


1. Configure the computer to start from the CD-ROM or DVD-ROM drive. For information about how to do this, see your computer documentation, or contact your computer manufacturer.
2. Insert the Windows XP CD-ROM into your CD-ROM or DVD-ROM drive, and then restart your computer.
3. When you receive the "Press any key to boot from CD" message, press a key to start your computer from the Windows XP CD-ROM.
4. When you receive the "Welcome to Setup" message, press R to start the Recovery Console.
5. If you have a dual-boot or multiple-boot computer, select the installation that you have to use from the Recovery Console.
6. When you are prompted, type the administrator password, and then press ENTER (if none was set, leave it blank and press ENTER).
7. At the command prompt, type bootcfg /list, and then press ENTER. The entries in your current Boot.ini file appear on the screen.
8. At the command prompt, type bootcfg /rebuild, and then press ENTER. This command scans the hard disks of the computer for Windows XP, Microsoft Windows 2000, or Microsoft Windows NT installations, and then displays the results. Follow the instructions that appear on the screen to add the Windows installations to the Boot.ini file. For example, follow these steps to add a Windows XP installation to the Boot.ini file:

a. When you receive a message that is similar to the following message:
Total Identified Windows Installs: 1
[1] C:\Windows
Add installation to boot list? (Yes/No/All)
Press Y hit ENTER.

b. When, you receive a message that is similar to the following message:
Enter Load Identifier
This is the name of the operating system. Type the name of your operating system, and then press ENTER. The name is either Microsoft Windows XP Professional or Microsoft Windows XP Home Edition.

c. When you receive a message that is similar to the following:
Enter OS Load options
Type /fastdetect, and then press ENTER.

Take the CD out of the drive.

Type exit then press ENTER.

Note The instructions that appear on your screen may be different, depending on the configuration of your computer.

Lets see what happens after this.

Harry

Hi Harry,

Thanks for your explanation.

I have followed your instructions, these are the results obtained:

At 7th step I have executed command bootcfg /list.
Result (I have to translate but it is something like this): Currently there are not available startup entrances to be showed.

At 8th step I type bootcfg /rebuild.
Result: Error: Disks can not be succesfully checked for the installations of Windows. It is possible that this error is caused because Files system is corrupted, which avoids that Bootcfg is succesfully checked. Use chkdsk to detect any error on disk.

After this, I execute chkdsk command.
Result: chkdsk have found one or more errors in the volume.

In case I use chkdsk with the parameter /f it is possible to repair the errors.
The syntax for this command is this:
chkdsk [volume:] [access route] file name] [/f]

If i'm not wrong, this would be the correct command (I have not executed yet) :
chkdsk c: Setup boot.ini /f

However, I wait for your advice in order to know your opinion about this results and how to continue successfully with the process.
I want to avoid the loss of data I have in the HD so I prefer not doing unknown things (for me), I'm a newbie so I prefer to wait for your replies and carry on properly.


Many thanks again for your help.

Hey maxijanko,
Hang in there, I just asked one of our experts to take a peek at your problem.
Harry

Hey maxijanko,
I asked for this thread to be moved to the Operating System forum, I think the people here might be the right ones to give you advice on trying to get your system up and running. I will watch this thread, and if your succesful we will see about getting a log from you.

Good luck
Harry