[tbqin]

I cancelled the System Configuration Utility" window without making any changes. It appears that this may have been spawning many ntvdm.exe processes (about 25) which are using up about 99% of CPU. Please advise if I can end these processes. It appears that these are needed if you are running any DOS programs, I was not sure if your prior instructions started any DOS programs. I will wait for further instructions on these processes and the boot.ini I posted earlier.

Thanks again.

[Advertisements]

you can go ahead and load msconfig again and choose NORMAL startup, or you can manually edit the boot.ini file

when you ran msconfig last time, it simply added this
/safeboot:minimal

to your normal OS start up switch.

Setting it to normal should get you back to normal; however, we are going to want to remove the second OS switch before we are done.

Before we do that, though, set to normal and reboot. Choose the original OS in the boot menu

Work?

You should now go to the malware forum to get that (and perhaps other trojans) cleaned out.

Afterward, return here and we can work out the second switch and also consider why you could not load in safe mode (do you have Nero Rom cd burning software?)

[gerryf]

you can go ahead and load msconfig again and choose NORMAL startup, or you can manually edit the boot.ini file

when you ran msconfig last time, it simply added this
/safeboot:minimal

to your normal OS start up switch.

Setting it to normal should get you back to normal; however, we are going to want to remove the second OS switch before we are done.

Before we do that, though, set to normal and reboot. Choose the original OS in the boot menu

Work?

You should now go to the malware forum to get that (and perhaps other trojans) cleaned out.

Afterward, return here and we can work out the second switch and also consider why you could not load in safe mode (do you have Nero Rom cd burning software?)

[tbqin]

gerry,

thank you. I will go to the malware forum as you suggestted. Do you know anything about the ntvdm processes. I know that I will need to do some down loading of hjt and other programs and these processes are using the majority of CPU time.
Also, to the best of my knowledge I do not have Nero CD ROM burning software - at least I have not installed it.

[gerryf]

ntvdm is a virtual machine used to run 16-bit programs.

Windows xp is 32-bit and and to improve stability and security, it will not allow 16-bit programs to run natively. To get around this, Windows xp creates a computer inside a computer, a virtual pc, and runs the program in it.

msconfig, I believe, is a 16-bit program, as are a number of malware programws

[tbqin]

Gerry,

when i changed the setting in MSCONFIG to no longer boot in safe mode and rebooted my machine all I get is a black screen with the cursor displayed. This happened when I choose either OS system (WINDOWS2 or Windows Home).
Have I done something wrong?
I even tried to follow your directions again and create another OS and it still does not work. Only one windows install was found during the scan of my system, so I used WINDOWS2 again.

[gerryf]

just so we are clear, they are not two distinct OS installs. They are two different switches pointing to the same OS install

The only difference is one had the /safeboot:minimal switch; the other did not

Now, this is a different issue--this only began after msconfig change? Did you do anything else in that session?

Reboot with the disk you used to create the other OS switch, but this time, instead of running bootcfg. type

chkdsk /r
<enter>

Take a walk, let it run (it will take a long time)

When complete, type EXIT

Windows should reboot.

Does it allow you into Windows again?

[tbqin]

Gerry,

I will run chkdsk when I get home tonight.

As far as doing anything else in the session. I changed the setting by typing MSCONFIG at the run prompt, applied the changes and tried to shutdown. I had to end a ntvdm process that was using 100% of CPU. I only did this after waiting for 2 hours for shutdown to start. During shutdown a fax process (I can't recall the exact name) needed to be stopped. I let windows end the process (ie. did not click the end now button in the dialog box - I let it end on its own.)

Just one more thing so I am clear - Should I still have the Boot Sequence to go to CD-ROM first?

Thanks again.

[gerryf]

to get to the recovery console, yes

Here is what I think occured...the ntvdm process had a file open and forcibly shutting down corrupted the file and causes a start up error. A chkdsk may take care of this, depending on what it is.

It is not msconfig--i checked it, and it is 32-bit.
Perhaps the taskdir trojan is running in the 16-bit virtual machine? Withouth seeing your system it is difficult to say what it is--but we need to get rid of that.

When you get the machine up, get over to malware

[tbqin]

gerryf,

I ran chkdsk and it completed - it did indicate that a problem was found and fixed.

After typing EXIT. I was prompted to select one of the OS switches - I chose Window Home (original) OS switch. I was then prompted as to which method I wanted to boot in I chose Boot windows Normally.

The windows XP splash screen appeared with the "working bar" scrolling 3 dots. At one point this stopped for just a second and the lights on the key board blinked. Then it went to the black screen with only the cursor displayed.

[gerryf]

go back to the recovery console as outlined above and at the command prompt type

fixmbr
<enter>

exit
<enter>

[tbqin]

gerryf,

when windows begins the startup process which OS switch and boot method should i choose? or does it matter?

thanks

[gerryf]

wait a second....did you try both? For some reason I thought you did

[tbqin]

Yes, I did try both switches Windows Home and Windows2 (with all different combinations of boot methods (normal, last known, safe, etc.) none seemed to work. They all went to the black screen. I even tried creating a new switch and trying that and it didn't work. I currently have 4 OS switches. The newly created ones do not work either.

I just wanted to make sure that choosing the wrong one would not cause any problems.

Sorry for being such a pain.

[gerryf]

your not a pain, I just want to be clear that the problem is what I think it is (or might be).

It does not matter what one. The problem is no longer an issue of a crapped up boot.ini, it seems to have gotten deeper.

Before we do the fixmbr, do one more chkdsk and reboot.

If it still does not work, try the FixMBR in post 25

If that fails, back to the recovery console and type FIXBOOT

Without getting overly complicated, your harddrive has a master boot record that tells your PC where to find needed Windows files. When you start your PC, your motherboard looks at the MBR on the disk, which then points to the system disk partition for more code, which then loads the windows kernal and everything procedes from there.

I want to ensure your mbr and system boot record are pointing to the right places.

Usually, we get the blinking cursor beofre you see the windows splash screen.

The way you are describiing things sounds like fundamental windows file is missing or damaged. That will be a problem without a windows disk--the rc.iso is not going to cut it.

We may end up having to use the Dell recovery method, but that will likely mean loss of data. It may be necessary that you find another computer so you can pull this drive, copy files to a second PC, replace this drive, run the recovery process, then restore the file laters

[tbqin]

gerryf,

I will do as you suggested when I get home this afternoon.

Regarding the blinking cursor before the splash screen. That may have happened I will check on my next attempt to reboot.

If it comes down to that a fundamental windows file missing or damaged. Can I use any Windows disk? I can probably get a Windows XP Pro disk or a Windows XP Home disk (Home will be more difficult to find). But I do not want to break any license agreements. I currently have a XP home license ( at least I assume I do since XP home came installed on my machine.)

If it comes down to recovery with my Dell reinstall disk that is find also. The majority of the files that I deem important I have backed up on jump drives and CDs. Other less important files are being held ransom by what looked like a version of the CryZip virus (which I will post in malware forum later). Who knows a reinstall might be the best alternative - if it removes all the spyware, malware and virus' - but I do hate the thought of applying all the windows patches to get me back to where I am now.