[hidy]

Folks I need your expertise and assistance in helping me with my desktop PC. I believe this issue is a mix of Hardware and software (malware) problems. So i am posting it in this forum.

I have a HP Pavilion desktop PC having windows XP professional Operating System. (When I purchased this desktop, it came with Windows XP home edition. I purchased a legal copy of 'Upgrade Windows XP Professional' and I have been using this desktop without any issues for the 3 years).

Over the last month while browsing, my PC got infected with malware (red circle with 'X' mark in the taskmanager and lots of pop-ups). I tried running few spyware/adaware programs but everything was the same. I just left it thinking I will purchase Antivirus software.

Few days backs after I started the PC and tried to login, the system logs me off. I tried with Admin account and the Guest account but it's logs me off. I see the blue screen for a few seconds and logs me off. Then I tried in the Safe Mode, and still the same issue. I did some Googling on this issue and they recommended booting from the Windows XP CD and enter the recovery console. Also it says the reason behind the login and logoff issue is because one of the antispyware/malware might have removed the wsaupdater.exe.

Based on the above suggestion, I tried booting using the 'Upgrade windows xp professional CD'. The System prompted me to hit any key to boot from the CD. It went through loading the drivers,etc, and then a message 'System starting the windows' at the bottom was displayed. After few seconds it displayed the below message ( I couldn't get to the recovery console menu). Below is the message displayed:

"A problem has been detected and windows has been shut down to prevent damage to your computer. If this is the first time you've seen this stop error screen, restart your computer. If this screen appears again follow these steps:
Check for viruses on your computer. Remove any new installed hard drives or hard drive controllers. Check your hard drive to make sure it is properly configured and terminated. Run CHKDSK /F to check for hard drive corruption, and then restart your computer.
Technical Information:
**** STOP: 0X0000007B (0XF78D663C, 0XC0000034, 0X00000000, 0X00000000)"

I think the above message refers to a hardware issue (I might be wrong).
Now, I am not able to login or do anything. What options do I have. I do have important data in the hard drive.

So, my questions are:
1) Firstly, is there a device to back-up the data in the harddrive (I can remove the hard drive from the pc)
to my laptop or any other external hard drive.
2) Secondly, how can i get through the 0X0000007B (0XF78D663C, 0XC0000034, 0X00000000, 0X00000000) issue, so that I can try to recover
3) How do i format the drive (after the backup is done) or clean up the malware/spyware'.

Finally, below are some of the details of my desktop pc:
Mother board Manufacturer: Asustek Computer NC
Release date: 09/18/2006
ROM: 1024 KB

Intel® core ™2 CPU 6300 @1.86GHz
Memory Module: 1024 MB DDR2-SDRAM(PC-4200/PC2-4300/33MHz)
Memory : 2GB

Hope somebody can help me

[Advertisements]

First lets try and find the problem
Here's a possible reason for your stop message

This BSOD (which is actually the common name for a STOP Error) could mean that there's a serious hardware problem with a hard drive controller, a driver issue, or even a boot sector virus.


Let's find out what is causing this. Boot the system up and at the HP splash screen start tapping on F8. this will bring up the boot menu. Go down to the line thats says
Disable automatic restart on error. Make sure to click on it. Then reboot. If setup right when it gets the BSOD it will stop and allow you to write down the error with hopefully the problem cause
Pleas epost back with the results

[rshaffer61]

First lets try and find the problem
Here's a possible reason for your stop message

This BSOD (which is actually the common name for a STOP Error) could mean that there's a serious hardware problem with a hard drive controller, a driver issue, or even a boot sector virus.


Let's find out what is causing this. Boot the system up and at the HP splash screen start tapping on F8. this will bring up the boot menu. Go down to the line thats says
Disable automatic restart on error. Make sure to click on it. Then reboot. If setup right when it gets the BSOD it will stop and allow you to write down the error with hopefully the problem cause
Pleas epost back with the results

[hidy]

Thankx for the reply.

I boot the system up and hit F8 button. I selected the 'Disable automatic restart on System failure' using the arrow keys and hit the Enter key. In the next screen, System displayed the following :
"Please seelct the operating system to start:
Windows XP Media Center Edition
Microsoft Windows Recovery Console
Use the up and down arrow keys to move the highlight to your choice:
Press Enter to choose.

For troubleshooting and advanced startup options for Windows, press F8.
Disable automatic restart on system failure".

Now, what am i supposed to do at this screen and/or what options do i need to select so that the next reboot would display the error message?

[rshaffer61]

Choose this one

Disable automatic restart on system failure".

I'm not sure why it did what it did. It should have continued booting up.

[rshaffer61]

The symptoms you are describing are common when a virus or malware has infected your system. Once we can get you back into windows then you would need to go to malware forum. I will post instructions for that when we have finished with the bootup issue.

Edited by rshaffer61, 02 May 2009 - 07:14 PM.

[hidy]

'Disable automatic restart on System failure' is the option i selected using the arrow keys.

I hit the Enter key and it displays the options as mentioned in my previous reply. It does not boot up automatically.

The system displays these 2 options and I have to choose one of them.
"Please seelct the operating system to start:
Windows XP Media Center Edition
Microsoft Windows Recovery Console

I tried both. The first option takes me to the login screen and again logging in it logs me of with either the admin account or the guest account
The second option gives me like a DOS prompt message but i did not go further than that..

Any suggestions why it is not automatically booting even if i select the 'Disable automatic restart on System failure'

[rshaffer61]

hmm, seems we may have a corrupt userinit.exe issue. Lets try this make sure your xp cd is in cdrom drive
reboot and get to these options again

"Please seelct the operating system to start:
Windows XP Media Center Edition
Microsoft Windows Recovery Console
choose Recovery console
at the dos prompt
Type the following

expand d:\i386\userinit.ex_ c:\windows\system32
click enter

Once it says 1 file copied
Then type exit and click enter
System will reboot
Make sure to remove winxp pro cd before it boots up and let it boot fully
Windows should start normally

If not post with result

[hidy]

For the second option from below i wanted to give some more details (Not sure if it would help)

"Please seelct the operating system to start:
1) Windows XP Media Center Edition
2) Microsoft Windows Recovery Console"

I highlighted the 'Microsoft windows recovery console' and hit the enter key.

There was a message indicating 'System starting window'. The next screen it gave me the following details:

"Microsoft Windows XP™ Recovery Console.

The Recovery Console provides system repair and recovery functionality.

Tyep Exit to quit the Recovery Console and restart the computer.

1: C:\WINDOWS
2. D:\MiniNT
3. D:\I386

Which Windows installation would you like to log onto
<to Cancel, press Enter>?: "

Here i hit enter to come out of this option. The above messages are seen only if i select the "Microsoft Windows Recovery Console' option.

[rshaffer61]

3. D:\I386

then when the black window comes up
Type the following

expand d:\i386\userinit.ex_ c:\windows\system32
click enter

Once it says 1 file copied
Then type exit and click enter
System will reboot
Make sure to remove winxp pro cd before it boots up and let it boot fully
Windows should start normally

If not post with result

Edited by rshaffer61, 19 April 2009 - 04:06 PM.

[hidy]

I think our replies crossed around the same time.
The reply that i posted was not based on your suggestions. I just thought of providing some info.

Anyways now i am going to try your suggestion/approach. I have a question though. If i put the XPCD then even though i press F8 the system gives me the option of booting from the CD and I do not get to the options that i would get if i press F8.

So, the questions is should the XP CD be in the CD drive with your apprach?

[rshaffer61]

yes it will need to be either way. the recovery is looking for it in either case

[hidy]

I am unable to get to the 'Windows Recovery Console' option if the Windows XP CD is in the CD drive at the time of system boot up.
If the Windows xP cd is available then the system always trys to boot from CD (even though i press F8) and it starts loading the drivers and then it displays a message indication 'System is starting the windows'. After a few seconds it displays the same error CHKDSK /F Error.

Since, you said the XP CD should be there, the only way i could get to is by following the steps:
1) Booted the system without the XP CD in the CD drive
2) hit the F8 button
3) selected the 'Disable automatic restart on System failure' using the arrow keys and hit the enter key
4) Now i inserted the XP CD in the CD drive ==> Here is where i put the XP CD
5) System displayed as before
"Please seelct the operating system to start:
Windows XP Media Center Edition
Microsoft Windows Recovery Console"
6) Now i selected the 'Microsoft windows Recovery Console
7) There was a message indicating 'System starting window'. The next screen it gave me the following details:

"Microsoft Windows XP™ Recovery Console.

The Recovery Console provides system repair and recovery functionality.

Tyep Exit to quit the Recovery Console and restart the computer.

1: C:\WINDOWS
2. D:\MiniNT
3. D:\I386

Which Windows installation would you like to log onto
<to Cancel, press Enter>?: "

8) Now i followed your suggestions/approach while the XP CD is in the CD Drive
9) I entered 3 and hit the enter key
10) System displayed "D:\i386>
11) I typed expand d:\i386\userinit.ex_ c:\windows\system32 at the prompt
12) System displayed "Overwrite userint.exe? (Yes/No/All/Quit)>
13) For the above selection i typed 'Y' and hit the enter key
14) System displayed a message 'Userinit.exe" 1 file(s) expanded and the prompt was set back to D:\i386>
15) I enter Exit and hit the enter key
16) I removed the XP CD while the System about to boot normally
17) I let it boot normally and it displayed the login message. I tried logging in and the same result as it logged me off again.

[rshaffer61]

hmm interesting
Then lets redo our steps to where you get to here

The Recovery Console provides system repair and recovery functionality.

Tyep Exit to quit the Recovery Console and restart the computer.

1: C:\WINDOWS
2. D:\MiniNT
3. D:\I386

click 3 again, then type in cd\ then click enter

now type in
chkdsk /r then enter

this test will take awhile so sit back and relax. If it doens't work then without leaving the recovery console type in this
sfc /scannow click enter

let me know what the results are for each

[hidy]

The results for chkdsk /r are as below:

The volume serial number is 4b6e-6bc0
CHKDSK is checking the volume...
CHKDSK is performing additional checking or recovery...
CHKDSK is performing additional checking or recovery...
CHKDSK has finished checking the volume.
9051800 kilobytes total disc space
405504 kilobytes are available.

8192 bytes in each allocation unit.
1131475 total allocation units on disk.
50688 allocation units available on disk.
D:\>

Can you confirm the command for sfc /scannow as the command is not recognized.
D:\>sfc \scannow (This is what i typed at the prompt)
The command is not recognized Type HELP for a list of supported commands.

I tried HELP and in the letter S the possible commands are 'SET' & 'SYSTEMROOT'. I did not see any SFC command.

[hidy]

Sorry a type mistake

D:\>sfc \scannow (This is what i typed at the prompt)

I actually typed
D:\>sfc /scannow (This is what i typed at the prompt) (Forward slash) and still the same result