[Tyler5690]

Today while I was browsing the web I inadvertently got some malware which pretended to be some security software. I immediately downloaded and ran Malwarebytes Anti-malware, and it found and removed the items. Upon reboot, however, I got a Windows bluescreen with the error Stop 0x0000007B. I don't know what happened. Any ideas on how to restore my Windows?

THANKS!!!

[Advertisements]

Advanced troubleshooting for "Stop 0x0000007B" errors in Windows XP
http://support.microsoft.com/kb/324103

[SpywareDr]

Advanced troubleshooting for "Stop 0x0000007B" errors in Windows XP
http://support.microsoft.com/kb/324103

[Tyler5690]

I've read the suggestions from Microsoft. This isn't a hardware issue, the drive is a month old and everything was working perfectly until the malware. It was that Internet Security 2010 junk. If a boot virus is keeping me from getting into Windows, how can I remove it?

[rshaffer61]

I hate to crowd in but this statement ..

This isn't a hardware issue, the drive is a month old

Is based on you don't believe because of the age the drive is bad?
I just spent 2100.00 USD for a new system with 2x1tb drives and a 500 gig drive for the main OS drive.
One day after getting everything up and running one of the 1 tb drives died.
Don't kid yourself in thinking it can't be a hardware issue.
I suggest you do some diagnostics on the hardware as followed.

Run hard drive diagnostics: http://www.tacktech....ay.cfm?ttid=287
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: http://www.imgburn.com/ to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.

NOTE. If your hard drive is made by Toshiba, unfortunately, you're out of luck, because Toshiba doesn't provide any diagnostic tool.

Thanks to Broni for the instructions


Then after the above is finished do the next step.

If you have more than one RAM module installed, try starting computer with one RAM stick at a time.

NOTE Keep in mind, the manual check listed above is always superior to the software check, listed below. DO NOT proceed with memtest, if you can go with option A

B. If you have only one RAM stick installed...
...run memtest...

1. Download - Pre-Compiled Bootable ISO (.zip)
2. Unzip downloaded memtest86+-2.11.iso.zip file.
3. Inside, you'll find memtest86+-2.11.iso file.
4. Download, and install ImgBurn: http://www.imgburn.com/
5. Insert blank CD into your CD drive.
6. Open ImgBurn, and click on Write image file to disc
7. Click on Browse for a file... icon:



8. Locate memtest86+-2.11.iso file, and click Open button.
9. Click on ImgBurn green arrow to start burning bootable memtest86 CD:



10. Once the CD is created, boot from it, and memtest will automatically start to run. You may have to change the boot sequence in your BIOS to make it work right.

To change Boot Sequence in your BIOS
Reboot the system and at the first post screen (where it is counting up memory) start tapping the DEL button
This will enter you into the Bios\Cmos area.
Find the Advanced area and click Enter
Look for Boot Sequence or Boot Options and highlight that click Enter
Now highlight the first drive and follow the directions on the bottom of the screen on how to modify it and change it to CDrom.
Change the second drive to the C or Main Drive
Once that is done then click F10 to Save and Exit
You will prompted to enter Y to verify Save and Exit. Click Y and the system will now reboot with the new settings.


The running program will look something like this depending on the size and number of ram modules installed:




It's recommended to run 5-6 passes. Each pass contains very same 8 tests.

This will show the progress of the test. It can take a while. Be patient, or leave it running overnight.



The following image is the test results area:



The most important item here is the “errors” line. If you see ANY errors, even one, most likely, you have bad RAM.

Edited by rshaffer61, 13 February 2010 - 11:36 AM.

[Tyler5690]

I haven't yet run a memory test, but I did run a test for the hard drive and it is okay. The main reason I think this is software related is that it happened on my first reboot after removing the IS 2010 malware with Malwarebytes Anti-malware. It seems like it may have damaged windows somehow.

[rshaffer61]

Got your XP installation disk?
It can't be a recovery disk.

[Tyler5690]

I do have an installation disc. I tried doing a repair install before opening this thread, and the same error still occurs.

[rshaffer61]

Nope not going to try a repair installation. Going to start with exactly what you asked about.

If you have Windows XP CD...

1. Boot from the CD.
2. When the text-based part of Setup begins, follow the prompts. Select the repair or recover option by pressing R:



3. You'll find yourself at this screen:



4. Once you are at the Recovery Console you will be given at least one choice of Windows installations. Normally the choice you want is the number 1 choice. Click the number 1 key at the "top" of the keyboard and click enter.

NOTE: at this point your numbers to the right of your keyboard are turned off. If you insist on using these keys for your numbers remember to hit the Numbers Lock key before clicking a number over there or your computer will automatically reboot and you will have to wait through the previous steps to get back to the console.

5. You will be given a message asking for the administrator password. Unless someone or something has messed with your computer there is no password so you just click the Enter key.

6. This will bring you to a prompt that says:

C:\WINDOWS>

7. Type:

cd \

Press Enter

Note: between "cd" and "" there should be a "blank space" otherwise the command won't work

8. The prompt should now say:

C:\>

9. Type:

cd system~1\_resto~1

Press Enter.

Note: If it gives an error "Access Denied" while accessing the folder, follow the method below

Type: cd \

Press Enter

Type: cd windows\system32\config

Press Enter

Type: ren system system.bak

Press Enter

(note the spaces between ren and system, and then between system and system.bak)

Type: exit

Press Enter

now the computer should restart, then follow steps 1-6

10. Type:

dir

Press Enter

NOTE: When you hit enter it will list all the restore points folders like "rp1", "rp2" we have to see the last restore point to copy the file from a recent backup. If the restore points have more than one page then you have keep on hitting the key to view the last restore point folder.

NOTE: It is a good rule of thumb to choose the files from the restore point folder which the second to the last one.

11. Type:

cd rp{with the second to the last restore point number }

Press Enter

Example: cd rp9. if rp10 is the last restore point

12. Type:

cd snapshot

Press Enter.

NOTICE: Now the command prompt will look like this:

c:\system~1\resto~1\rp9\snapshot

Note : restore point 9 assumed for clarity of the content.


13. Type:

copy _registry_machine_system c:\windows\system32\config\system

Press Enter

14. Type:

Exit

Press Enter.

Final note : If the above procedure won't solve the problem, repeat all steps, but in step 13 type:

copy _registry_machine_software c:\windows\system32\config\software

Alternatively, select different restore point.


Thanks to Broni for the instructions

[Tyler5690]

I am going through the instructions. Just one question, how do I type the inline tilde?

Edited by Tyler5690, 13 February 2010 - 01:43 PM.

[Tyler5690]

Okay, I was able to get in through the recovery console, but I had system restore turned off, and as such my RP folders (I have 3) do not contain the file specified to copy.

[rshaffer61]

Well this just got a little more difficult.
I know you said you did a repair installation but did you do it this way?


Repair Installation Instructions

· Insert your Windows XP CD in your CD-ROM and then Restart your computer.
· At the first post screen start tapping the Del key to enter System Bios
· Find the Advance Options or Boot Sequence screen.
· You will need to change the boot sequence so that the CDrom is first and the HD is second.
· Press F10 to Save and Exit and then press Enter to accept.
· The system will now reboot
· When the "Press any key to boot from CD" message is displayed on your screen, press a key to start your computer from the Windows XP CD.
· When you see the following message displayed on the Welcome to Setup screen, press ENTER
· To setup Windows XP now, press ENTER.
· At this point an option to press R to enter the Recovery Console is displayed. DO NOT SELECT THIS OPTION.

· On the Windows XP Licensing Agreement screen, press F8 to agree to the license agreement.
· Make sure that your current installation of Windows XP is selected and highlighted in the box, and then press the R key to repair Windows XP.
· Follow the instructions on the screen to complete Setup.

You can also go HERE
to read a step by step tutorial with screenshots.

[Tyler5690]

Yep, that's exactly what I did. It went through the Windows installation, asked me for the serial, the works. After it was all done, the same blue screen returned.

[rshaffer61]

OK now we can try to bypass this one by doing a Parallel Installation
This will install a second XP on your system but allow the data to remain safe so you can put it over after the malware has been cleaned.

Parallel Installation of Windows XP

Boot to the Windows XP installation cd by pressing a key when the "Press any key to boot from cd" prompt appears at the top of the screen.

• At the "Welcome to Setup" screen, press Enter to set up Windows XP.
• Accept the License Agreement by pressing F8
• With your current installation selected in the box, press Esc
• Select C: Partition1 [NTFS] in the box and press Enter
• To continue setup using this partition, press C
• Now you should see formatting options...choose the last one, Leave the current file system intact (no changes), and press Enter
• To use a different folder, press Esc
• Name the folder WINDOWS0 (just type a 0 (zero)) and press Enter

The Windows installation should begin. This will install Windows to a new folder, leaving your data intact. Any programs installed on the old directory will have to be reinstalled to the new one. Device drivers will also have to be installed for all the hardware to work as it should.

The data will be located in the Documents and Settings folder (C:\Documents and Settings) under your old user account name...so when you set up the new installation, give yourself a slightly different user account name.

[Tyler5690]

Okay, I'll try that. Will this allow me to recover my first Windows installation? My biggest reason for wanting to save my old installation and not reformat is not my data, which I have backed up, but all the programs I have installed that I do not want to have to reinstall and hunt down all the discs and updates and such.

[Tyler5690]

Just an update, I have a second Windows installed and running now.