[mfrank1]

Last night, I went to bed while a Spyware Doctor scan was running. In the morning, I saw a clank screen with the message "Press F2 to enter Setup Utility or F1 to continue". Every Ctrl-Alt-Delete or hard shut down brought me right back to that screen. I've done all I know to do, including: open the tower, vacuum it and reseat all cables; run original XP disk and repair console - chkdsk ran OK and fixed some problems; run a SYSTEM MECHANIC utility that said the Master Boot Record was OK. After Chkdsk, I was able to get a boot menu, but when I selected "Last Known Good Configuration," it either returned me to that boot menu screen or back to Press F2 to enter Setup Utility or F1 to continue. I'd like to get this machine going at least one more time to be able to extract some data since my last backup. Please help!

[Advertisements]

Sorry. Should have mentioned I'm using a Dell Dimension 8250 desktop with Windows XP SP3.

[mfrank1]

Sorry. Should have mentioned I'm using a Dell Dimension 8250 desktop with Windows XP SP3.

[Salagubang]

Hi mfrank1,

Welcome to Geekstogo. My name is Salagubang and I'll be helping you with this problem.

I am still a trainee so all my posts will be checked by an Expert. It's your advantage that there are two people looking at your log but responses may be a little delayed so please be patient.

• Please read all of my response through at least once before attempting to follow the procedures described. I would recommend printing them out, if you can, as you can check off each step as you complete it. If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
  
• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste so as to include the log in your reply. You can do this in separate posts if it's easier for you
  
• English is not my first language, so please do not use slang or idioms, as this makes it difficult to understand for me.

Step One

Restart your computer with Automatic Restart on System Failure disabled

• You can do this by restarting your computer and continually tapping the F8 key until a menu appears.
  Use your up arrow key to highlight "Disable Automatic Restart on System Failure" then hit enter.

• If windows failed to boot, windows will not restart and will show a blue screen indicating the source of the error as shown in the example below
  
  
  
• Copy the technical information (as shown in the above example enclosed in red boxes) and post it on your next response.

Step Two

On the clean computer.

• Download the attached Scan.txt and save it to your USB stick.
   scan.txt   381bytes   604 downloads
• Download OTLPEStd.exe to your desktop
• Ensure that you have a blank CD in the drive
• Double click OTLPEStd.exe and this will then open imgburn to burn the file to CD

On the infected computer.

• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads
  
• Your system should now display a Reatogo desktop.
  Note : as you are running from CD it is not exactly speedy
• Double-click on the OTLPE icon.
• Select the Windows folder of the infected drive if it asks for a location
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
• Double click Custom scans and fixes box, a dialogue box will appear. Choose the scan.txt saved previously on your USB drive.
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system.
• Right click the file and select send to : select the USB drive.
• Confirm that it has copied to the USB drive by selecting it
• You can backup any files that you wish from this OS
• Please post the contents of the C:\OTL.txt file in your reply.

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them if you need to start a new topic.

[mfrank1]

Salagubang -- Thanks for your reply. Since I have to use a work computer to communicate (the non-booting computer) is at home, I may have to do this in steps. I completed step one, and here is the information:

***STOP: 0x0000007E (0xC0000005, 0xF6CD7A83, 0xF78C017C, 0xF78BFE78)
***GOBACK2K.sys - Address F6CD7A83 base at F6CD5000, DateStamp 3fc294c0

ALso, can you please tell me where your suggestions are heading? I mean are you trying to get the computer to boot back into Windows XP or just to enable me to copy files from the drive?

Thank you again for your help.

[Salagubang]

Hi mfrank1,

ALso, can you please tell me where your suggestions are heading? I mean are you trying to get the computer to boot back into Windows XP or just to enable me to copy files from the drive?

I was thinking of repairing your computer back to A-working condition.

The bootable OTLPE will enable you to copy/backup files. Are you intending to do a full reinstall after the backup?

Regards

[mfrank1]

Well, is there a chance my current Windows can be repaired so I don't have to do a full reinstall??

[Salagubang]

Hi mfrank1,

Well, is there a chance my current Windows can be repaired so I don't have to do a full reinstall??

We cannot determine yet how we will fare in removing norton goback from your system outside of windows environment. It alters the harddisk MBR so a repair install would not work.

If you can spare a few days, I would like to attempt to repair your computer. However, if you will be needing the immediate use of the computer, I would also be just as happy to help you backup your files so you can perform a full reinstall

Edited by Salagubang, 03 November 2010 - 04:31 PM.

[mfrank1]

Here is the OTL.txt file created by the scan. I would absolutely prefer to repair my computer, even if it takes a few days (and I thank you for your time). I assume no confidential info is copied into these OTL files? Isn't it ironic that GoBack, a program designed to enable the computer to recover from a crash, seems to be part of my problem!

Attached Files

•  OTL.Txt   130.23KB   610 downloads

[mfrank1]

I ran quick scan and it created another OTL.txt file, but a second Notepad screen never opened and there seems to be no Extras.txt created.

[Salagubang]

Hi mfrank1,

I am currently reviewing your logs and formulating a fix. Please be patient as all my fixes are reviewed by an expert prior to posting. Expect my reply tomorrow.

In the meantime, please confirm when you've finished copying/backing up all of your important files.

I assume no confidential info is copied into these OTL files?

Yes, OTLPE do not to include sensitive information in the logs.

I ran quick scan and it created another OTL.txt file, but a second Notepad screen never opened and there seems to be no Extras.txt created.

Its Ok as we won't be needing the extras.txt yet.

Edited by Salagubang, 03 November 2010 - 05:06 PM.

[mfrank1]

I will not have the opportunity to back up all the files I need until the weekend. When I'm able, I assume I can just follow your instructions to run the OTLPE program again, click on My Computer and copy what I need. By the way, I have two hard drives in this computer. One was mapped as C, the other was always mapped as F. When I click on My Computer in OTLPE, I can see the C drive, but the F drive does not appear in the drive list. That's unfortunate, because I have important files on that drive, as well. Also, do think it would be possible to use OTLPE to get to System Restore and try to restore the system to the day before the crash?

[Salagubang]

Hi mfrank1,

Also, do think it would be possible to use OTLPE to get to System Restore and try to restore the system to the day before the crash?

Yes we can try that route and possible. I will create a fix for a system restore approach and post it later.

[mfrank1]

Salagubang -- I connected an external drive to the computer with the intention of backing up some files. OTLPE doesn't recognize the drive. And, as I mentioned, it also doesn't recognize the second internal hard drive that is physically present in the tower. Is there a way I can get OTLPE to recognize these drives?

[Salagubang]

Hi mfrank1,

Salagubang -- I connected an external drive to the computer with the intention of backing up some files. OTLPE doesn't recognize the drive. And, as I mentioned, it also doesn't recognize the second internal hard drive that is physically present in the tower. Is there a way I can get OTLPE to recognize these drives?

GoBack seems also to alter the partition information in all the drive present whilst it is active and working. You cannot perform windows reinstall as the modified MBR will not let you.










We will use an mobile operating system called xPUD, and a script called rst.sh to restore your computer.

On the clean computer.

Creating a bootable USB using xPUD

• Please download the following files and save it to the desktop
  
  • Unetbootin.exe
  • xPUD latest version is xpud-0.9.2.iso
• Insert the USB device to make bootable to the computer. (Make sure that no other USB's are inserted)
• Double-click on unetbootin.exe to run
• Select Disk Image, ISO and in the space provided, enter the path location of xpud-0.9.2.iso (ex. C:\Documents and Settings\yourusername\Desktop\xpud-0.9.2.iso)
• Select USB Drive type and the drive letter assigned to your USB stick.
• Click "OK" and wait until the program finishes. You now have a bootable xPUD.
• Download the following tool and save it inside the bootable USB
  
  • rst.sh

Please note: if you prefer to create a bootable CD using xPUD, you may download the ISO image found here and burn it to a CD.



On the infected computer.

• Reboot your system using the xPUD bootable USB you just created.
  Note : If you do not know how to set your computer to boot from USB follow the steps here
• Your system should now display a xPUD desktop.
• Select on the File icon; on the right pane click on the "mnt" folder and highlight "sdb1" - this is your USB device.
  

  sda1,2...usually corresponds to your HDD
  sdb1 is likely your USB

• Click on the "Tool" menu and select Open Terminal
  
• In the open terminal window, type in the following:
  
  bash rst.sh
  
• Press "Enter" and let it run uninterrupted.
  (The program lists available Restore Points and will save a report enum.log located in the USB drive.)
• The program is finished when it say's "Done".
• Type "Exit" to close the terminal window.
• Please attached the enum.log file in your reply. (You may remove your USB drive when transferring log to a clean computer).

Please note: If you have an ethernet connection you can access the internet by way of xPUD (Firefox). You can perform all these steps on your sick computer. When you download the download will reside in the Download folder. It can be found under the File tab also. You can similarly access our thread by way of this OS too so you can send the logs that way.

Edited by Salagubang, 04 November 2010 - 03:48 PM.

[mfrank1]

Should I follow these steps before backing up important files? If the answer is no, I will need help to get OTLPE to recognize the two drives it does not now see.