[msmx2]

Hello all. I am a new registered user but have been here often.

My mothers computer is experiencing an issue where when the system boots it gets to the black screen that asks you to select Safe Mode, Safe Mode with Networking, Safe Mode to Command Prompt, Last Known Good Configuration or Normal Startup for Windows XP.

The system is a Dell Dimension E521, BIOS Version 1.0.3 (10/2/06) with 2.5 GB RAM

When you select the Normal Windows Startup the following error appears on a BSOD:

stop 0x0000007E (0x80000003, 0x805BA6EC, 0xBA4C32B8, 0xBA4C2FB4)

When you select any of the other Windows startups the follow happens, a list appears with this line first:

multiple(0)disk(0)rdisk(0)partition(2)\windows\system32\drivers\ntoskrnl.exe

followed by a long string of the same type of strings only all the files are .sys files.

This computer experienced a trojan attack about 2 months ago which I fixed using the utilities I found on this website in the MALWARE Removal section.

I also upgraded the RAM from 512 MB (factory) to the 2.5 GB after the Trojan removal. The memory is installed with the factory set in the first slot and the other two in the number two and three slots. The memory is always recognized.

I have tried to boot the system from the Dell supplied Utilities and Drivers CD. I ran through the system check which took about 6 hours and all the items it checked passed.

I would appreciate any help to restore the system to functionality without losing any of the stored items if possible.

Thank you in advance!

Sincerely,

Michael

[Advertisements]

When you select any of the other Windows startups the follow happens, a list appears with this line first:

multiple(0)disk(0)rdisk(0)partition(2)\windows\system32\drivers\ntoskrnl.exe

followed by a long string of the same type of strings only all the files are .sys files.

...and?

[Broni]

When you select any of the other Windows startups the follow happens, a list appears with this line first:

multiple(0)disk(0)rdisk(0)partition(2)\windows\system32\drivers\ntoskrnl.exe

followed by a long string of the same type of strings only all the files are .sys files.

...and?

[msmx2]

Sorry for not expanding on what happens after the string of lines shows up.

Nothing happens. The screen full of text is there. You have to reboot to get back to the Windows selection screen.

[Broni]

The screen full of text is there

What file does it stop at?

[msmx2]

The last line has the multiple(0)disk... line and file name is Mup.sys

thanks.

[Broni]

MUP.SYS is rather nasty problem.
Nasty, because there is not sure solution to it.
The best, I can do for you, are two links:
http://www.aitechsol...s-resolved.html
inside, there another sub-link to:
http://www.aitechsol...inxpnoboot.html

[msmx2]

Thank you.

I will try the fixes from the links you provided.

I am wondering if there is a way to access the hard drive to pull items off, pictures and such. I was thinking of removing the hard drive and connecting it as a slave to my PC. Then I would remove the items I need. When I am done I would be open to re-formatting the drive, if needed, and reloading everything from the restore disks.

I just need to know if that is possible if I need to get to that point.

[Broni]

I was thinking of removing the hard drive and connecting it as a slave to my PC. Then I would remove the items I need

Not a problem...
Look here: http://www.dtidata.c...ave-hard-drive/

[msmx2]

I just explained to my mom what needs to be done. She brought up a good question.

Do I need to be concerned about anything being transferred to my PC if I connect the hard drive to it?

Thanks again for the help. I will be trying the link fixes tomorrow.

[Broni]

Do I need to be concerned about anything being transferred to my PC if I connect the hard drive to it?

I'm not sure, if I understand...

[msmx2]

Sorry, I guess I should have explained better.

The infected computer is my mothers.

If I connect the infected hard drive to my PC so that I can remove files, will the infection be transferred to my PC without me knowing?

Thanks.

[Broni]

I thought, you said, the infection was taken care of...
If you're not sure, do this...
On your computer, install Panda USB Vaccine: http://research.pand...un-Vaccine.aspx
It'll prevent any program from any external source (external to your C drive) from autorunning.
Then, you're pretty safe to connect your mom's drive.
Now, BEFORE you move ANY single file from slaved drive to your drive, scan it with your AV program.

[msmx2]

Broni you've been great with this, thanks.

I got rid of a Trojan on my moms PC a couple months ago. I think this is a new issue.

I won't be able to run any fixes on the infected PC until tomorrow. If the fixes you sent to me originally work then I won't have to worry about connecting the drive to my PC. I will post here the results.

If the fixes do not work I will try the connection fix later in the week.

Thanks again.

[Broni]

No problem

[msmx2]

Hi. Ok I was away on business, just got around to trying the fix from the link you had included.

I went through the boot with XP CD, ran chkdsk twice, didn't help.

I reran chkdsk then followed instructions to restore the base registry files. I backed up old ones, restored from original files, changed the system date and it still didn't work.

I still get the windows black screen with start up choices. Normal gives me BSOD, others give me driver list with mup.sys as last one.

I am ready to wipe everything out and reinstall XP.