[tradewinds]

Hey guys,
I just got sent over here from the viruses forum.
I have the Vundo/Virtumonde virus, and I've been trying to do some fixes.
Earlier I posted a fix to my computer, and on reboot, it would not reboot.
It just gets hung before the user selection screen, and I tried restarting it in safe mode with the last known good configuration, and it would not work.
Here's the link to the thread that I just came from:
http://www.geekstogo...91#entry1413191

If you guys could help I would really appreciate this; it's my parent's computer, and they have no backups.
Thanks a lot

[Advertisements]

Hello tradewinds...

Do you have a Windows XP cd?

Do you know if the System Restore feature is turned on?

wannabe1

[wannabe1]

Hello tradewinds...

Do you have a Windows XP cd?

Do you know if the System Restore feature is turned on?

wannabe1

[tradewinds]

Hey there,
I do have an XP cd, and I don't think System Restore feature is turned on.
Is there a way I can tell?

[wannabe1]

Let's find out if system restore has been disabled...we'll see if we can load an earlier system hive. If we can do this, Rorschach112 may have a little more cleanup to do.

Boot from the Windows XP installation CD...after the first several screens load, you will be given a choice to choose R for Recovery Console. You will then be asked to log in. Choose the installation to be repaired by number (usually 1) and press "Enter". When you are asked for the Administrator password, leave it blank and press "Enter".

When you get to the recovery console prompt:

• Type cd \ and press "Enter".
• Type cd system~1\_resto~1 and press "Enter".
• Type dir and press "Enter".

After you press enter you will see a list of folders (like rp1, rp2) If the list of restore points has more than one page then press the "Enter" key until you reach the end of the list

• Type cd rp {number of the second to last folder in the list} and press "Enter". (Example: Type cd rp9 if rp10 is the last restore point.)
• Type cd snapshot and press "Enter".
• Type copy _registry_machine_system c:\windows\system32\config\system and press "Enter".
• Type copy _registry_machine_software c:\windows\system32\config\software and press "Enter".
• Type exit and press "Enter".

Your PC will reboot.

If you get an access denied error when doing the above, then do the following at the recovery console:

• Type cd \ and press "Enter".
• Type cd windows\system32\config and press "Enter".
• Type ren system system.bak and press "Enter".
• Type exit and press "Enter".

Your PC will reboot, go back into the Recovery Console and start from the beginning.

Let me know if you run into problems with this.

[tradewinds]

Well, when I leave the administrator password blank, it just continues to come up with the password prompt. Is that how it's supposed to work?

[wannabe1]

No, it's not.

Do you have a system password set?

[tradewinds]

I'm trying to guess it. Honestly, my parents set up their computer when I wasn't here a few years ago, and I'm trying to figure out what they did exactly, and what their password was and everything. Ugh.

[wannabe1]

Have you ever had to supply a password when starting the machine?

What make and model computer are we working on? Is the disk you are using the one that came with it?

[tradewinds]

The computer is a Dell Dimension E521
I'm using the disk that came with my dad's dell laptop.
Whenever they logon they choose their user, but they don't have to enter the password.

[wannabe1]

This is certainly not an ideal situation...

Let's try a Repair installation using the disk you have. If you are asked for a product key, use the one for the machine you are fixing...it should be on a sticker on the left side panel.

Try this REPAIR to your installation of XP. This procedure will not damage or change your current files or settings...it will just repair or replace damaged system files. You will be asked for your Installation CD and may be asked for your product key. Follow the instructions carefully...print them out if you can. Note: This option is not always available on OEM Recovery Cd's.

[tradewinds]

Okeydokey, I tried following that guide (which usually would be great, thanks!)
but I am getting these errors:

OTSCAN2:OTSCAN2.EXE
The exception unknown software exception (0x0eedfade) occurred in the application at location 0x7c81eb33.

The instruction at "0x7643785c" referenced memory at "0x0837500". The memory could not be "read".

And then it restarts the install.

Do you have any advice?

Thanks,
Phaedra

[wannabe1]

How far into the installation do you get before getting the errors? Are you getting to the point to where it's installing devices or is it hanging earlier than that?

The files appear to be related to one of the tools you were using just before the problem began. I'm going to want to research this a little and talk with the tool developer before we go further.

[tradewinds]

It's when it says it has 39 minutes left on the install.
It looks like it's moving along pretty well, then throws those errors and tells me to restart. It then restarts itself on its own.

[wannabe1]

That's pretty close. What does it say on the lower left above the progress bar when you get to that point?

I ask because there is a way to open a command prompt at "Installing Devices", but you have to be at that point in the installation.

Let's also try a different disk to try Recovery Console...maybe we can get past the password prompt. Download RC.iso and burn it to a cd as an ISO image. You may need a burning tool like ISO Recorder to do this...be sure to get the version for the operating system you'll be creating the disk on.