[Josh Hua]

Hello,
I am working on a friends laptop (Vaio PCG-7M1L). Just last week I got it from him infested with malware and viruses. I cleaned it up, performed all of the updates and updated windows to Sp3 (from sp1). Everything was working fine, and last week he said that the USB ports stopped working. He had someone else try to fix it because i was on vacation. They got on with Microsoft who used remote desktop who had him downgrade it to SP2 and attempted to load new drivers from the .inf file. After that the computer wouldn't start at all, it is getting a blue screen error, but it is restarting too fast for me to get the error code. He tried doing a windows repair from the xp disc but says it didn't work.

Now, I'm looking at the computer now and when i try to do a windows repair it is getting to the point of "setup is starting windows" and i get the error below
Session3_initialization_failed
Stop: 0x0000006f (0xC0000020, 0x00000000, 0x00000000, 0x00000000)

I have gone into the BIOS and tried to disable the cd-rom, and to keep the computer from automatically restarting so i could at least get the error code, but it is PhoenixBIOS and I'm not having any luck.

There is a second partition on the HD that loads up to the login screen just fine with no errors, and I am pretty much at a loss of what to do, any help would be appreciated.

Thanks



****Update****
I was able to get it to stop automatically restarting, see below for the error code when starting up XP normally.
STOP:0X0000007B (0xF79E3528, 0xC0000034, 0x00000000, 0x00000000)

Edited by Josh Hua, 05 January 2009 - 03:10 PM.

[Advertisements]

Does the second error say INACCESSIBLE_BOOT_DEVICE ?

In any case, both errors, STOP:0X0000007B, and Stop: 0x0000006f point to similar, possible culprits:
- system/driver file(s) corruption (since you're trying reinstall/repair, it may be caused by bad CD, bad CD drive, or bad HD)
- boot virus

This is, what I'd try:
1. Try Windows CD on another computer.
2. Try any other bootable CD on this computer.
3. Test HD: http://www.tacktech....ay.cfm?ttid=287

[Broni]

Does the second error say INACCESSIBLE_BOOT_DEVICE ?

In any case, both errors, STOP:0X0000007B, and Stop: 0x0000006f point to similar, possible culprits:
- system/driver file(s) corruption (since you're trying reinstall/repair, it may be caused by bad CD, bad CD drive, or bad HD)
- boot virus

This is, what I'd try:
1. Try Windows CD on another computer.
2. Try any other bootable CD on this computer.
3. Test HD: http://www.tacktech....ay.cfm?ttid=287

[Josh Hua]

Does the second error say INACCESSIBLE_BOOT_DEVICE ?

In any case, both errors, STOP:0X0000007B, and Stop: 0x0000006f point to similar, possible culprits:
- system/driver file(s) corruption (since you're trying reinstall/repair, it may be caused by bad CD, bad CD drive, or bad HD)
- boot virus

This is, what I'd try:
1. Try Windows CD on another computer.
2. Try any other bootable CD on this computer.
3. Test HD: http://www.tacktech....ay.cfm?ttid=287

Thank you for your help

There must have been an error with the Windows CD he had because I used a different one and it ran the windows setup just fine. I am now stuck on the admin password to be able to do the windows recovery console because his son set the laptop up and doesn't remember what it is.

At any rate it's starting to look like this is most likely a boot virus, since none of the other options above are issues. What would be the next procedure to getting rid of that short of reinstalling windows?


***edit***
Oh, and no the error does not have "INACCESSIBLE_BOOT_DEVICE" anywhere on it.

Edited by Josh Hua, 06 January 2009 - 10:40 AM.

[Broni]

Obviously, I can't help you with the password, but the rest is unclear.
You ran Windows setup, and what? Windows is installed? Why do you need to use Recovery Console?

As for boot virus...
I suggest you go to the Malware Forum and run all the steps located in the START HERE. These self-help tools will help you clean up 70% of problems on your own. If you are still having problems after doing the steps, then please post a HiJackThis Log in THAT forum. If you are unable to run and/or post a HJT log, then post that in your initial post in the topic you create in that forum.

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

[wannabe1]

Hello Josh Hua...

Have you tried leaving the password blank and just pressing Enter instead when accessing Recovery Console?

wannabe1

[Josh Hua]

Yes, and unfortunately that was not it. He had changed it, but i was able to find it using ophcrack. In recovery console I did chkdsk /p which found errors so I ran chkdsk /r which was able to repair them. Still no dice though the computer will not get past that error message when starting up.

I had posted this on the malware forum that Broni had forwarded me to, but I have taken the following steps and still no luck
-Ran windows repair with a second XP disc which did not give any visible results to startup and ruled out error with CD-ROM drive
-Ran a Drive Fitness Test and was given 0x00 result (no errors)
-Removed each stick of RAM one at a time to verify it was not the problem

One curious thing is the laptop is set up with two partitions for each with windows xp loaded (one for work, and one for home). The work partition is working fine, it's the home one that is having these problems.

[Broni]

Keep in mind, that, IF we're dealing with the infection, none of the steps, you took, will cure it.
Let's see what malware people have to say.

[wannabe1]

I haven't seen a boot sector virus in quite a long time, but it IS quite possible we're dealing with a rootkit of some kind. Unfortunately, we need the operating system to be running to work on it.

Both of the BSOD codes can also point to hardware or device driver problems, which is something a rootkit can cause. If we can get this rig running, you'll definitely need to pay out malware forum a visit.

Will the operating system start in Safe Mode?

[Josh Hua]

Negative, nor will it start using the "last known good configuration".