Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Heur Exploit Script virus looping to blue screen on start up


  • This topic is locked This topic is locked

#16
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 255 posts
I am very sorry for the delay in replying but I was unexpectedly called away.

I have deleted the original C:\Windows\ntbtlog.txt file and repeated your instructions several times but no new ntbtlog has been created in the Windows file
  • 0

Advertisements


#17
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
Did you tap on F8 and "Enable Boot Logging". This is a must to produce the report. I tested it in my XP machine and it worked.

While in the Reatogo environment, browse to the C:\ folder. Copy the Boot.ini to the USB drive, open it in Notepad and post its contents in your next reply.

Also, browse to the C:\WINDOWS\system32 folder and copy the ntoskrnl.exe to the USB drive. Scan this file at Jotti and post the address of the report for my viewing.

Is there a chance you can get a Windows Installation CD? I would like to run an application to check the drive for errors.
  • 1

#18
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 255 posts
I will try again and post the files that you have requested. I do have a copy of Windows XP
  • 0

#19
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
If you do, boot the computer with the XP Installation CD.

If prompted, select any options required to boot from the CD. You will be prompted with the following options:

A. To setup Windows XP, press Enter.
B. To repair Windows XP installation using recovery console, press R.

Choose the option, "To repair the Windows XP installation using recovery console", press R. If an Administrator Password have been established, you will be prompted to type it in. If no Administrator Password exists, just press ENTER.

You will be presented with the following:

Microsoft Windows® Recovery Console
The Recovery Console provides system repair and recovery functionality.
Type EXIT to quit the Recovery Console and restart the computer.

1: C:\WINDOWS

Which Windows Installation would you like to log onto
(To cancel, press ENTER)?


Press the number assigned to the installation you need access to on your keyboard and hit Enter.

In this case and if only the above is displayed is 1.

At the C:\Windows> command prompt, type the following command and press Enter:

CHKDSK /R

It will take a considerable amount of time to finish. Do not interrupt the process.

Once finished, type Exit and press Enter to restart the computer. Let me know if able to boot into Normal Mode.
  • 0

#20
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 255 posts
I have tried the F8 Enable Boot Logging again and even though the screen states that it is enabled, there is still no file.

Here is the Boot.ini

[boot loader]
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /safeboot:minimal

I am also having trouble copying the ntoskrnl.exe folder as I get the message "the Windows\system32\ntoskrnl.exe application cannot be run in Win32 mode". I tried just copying it without opening it but it appears in the documents file as NTUSER.DAT and it wants me to use the web service to find the appropriate program to open it.

I will try the Windows XP disk now.

I have tried the Windows XP disk but it is saying that Setup cannot find any hard disk drives installed on my computer and it cannot continue.

Edited by Jan1959, 01 January 2011 - 06:32 AM.

  • 0

#21
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
Chances are you have a SATA drive for which drivers are not available in the XP CD.

The Boot.ini seems to have been modified to boot in Safe Mode, perhaps throughout MSconfig (Configuration Manager).

Download the enclosed folder. Extract its contents to the Flash drive. Throughout the Reatogo environment, rename the C:\Boot.ini to Boot.old, and copy the file extracted to the C:\ folder. That should replace the file with a boot.ini that wont be calling Safe Mode upon startup.

Attempt to boot the computer in Normal Mode and let me know the outcome.
  • 1

#22
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 255 posts
I am trying to follow your instructions but when I try to rename boot.ini to boot.old the keyboard is still corrupt and when I try to type old it comes up as 63d. I have managed to find out that the 'M' is a capital O and the D is still working but I cannot find the L anywhere on the keyboard.
  • 0

#23
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
Wonder if the keyboard is your main issue.

Make sure the new boot.ini is in the flash drive

  • Copy the entire contents of the Quote Box below to Notepad.
  • Name the file as fix.bat
  • Change the Save as Type to All Files
  • and Save it in the Flash drive next to the new boot.ini file
  • In the Reatogo environment browse to the USB drive and double click on the fix.bat file. If successful, the fix.bat will disappear, the C:\boot.ini with have been renamed and replaced by the new file, and a copy the ntoskrnl.exe should appear in the Flash dive. Have that file scanned


cd /d %~dp0
Attrib -s -h -r C:\Boot.ini
Ren c:\Boot.ini Boot.old
Copy Boot.ini c:\
Attrib +s +h +r C:\Boot.ini
Copy C:\WINDOWS\system32\ntoskrnl.exe
Del %0


If successful, attempt to boot in Normal Mode.
  • 0

#24
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 255 posts
I am very sorry, perhaps I am doing something wrong? I saved the fix.bat to notepad as text and clicked on all files but when I open it on the corrupt laptop it just opens without anything else happening.
  • 0

#25
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
I have compiled the .bat file i case you still experiencing problem with the keyboard. Extract its content to the Flash drive, next to the new boot.ini.
  • 0

Advertisements


#26
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 255 posts
Once again I am sorry but I cannot get the text file boot.ini next to the fix.zip file that you sent me. When I open the fix.zip file on the corrupt laptop in says that it cannot find the boot.ini file. I am guessing that they both have to be in the same format but I am unable to change the zipped file to text or the boot.ini to zipped.
would you explain how to do this please? Again many apologies
  • 0

#27
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts
Let see if we can make it easier.

Download the enclosed folder. Extract its contents to the Flash drive. It is a folder, boofix, containing the Boot.ini and Runme, a batch file.

In the Reatogo environment, browse to the Flash drive, open the boofix folder and doubleclick on the RunMe.bat file. That may expedite the replacement of the boot.ini and the copying ntoskrnl.exe within the boofix folder.
  • 1

#28
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 255 posts
I think that this might have worked as the ntoskrml.exe file has increased in size. What would you like me to do now?
  • 0

#29
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,017 posts

I think that this might have worked as the ntoskrml.exe file has increased in size. What would you like me to do now?

If present in the USB drive, have the ntoskrml.exe file scanned at Jotti and post its report or report address..

Have you tried booting in Normal Mode after the Boot.ini was replaced?
  • 1

#30
Jan1959

Jan1959

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 255 posts
The scan at Jotti said no viruses were found, see below

Scanners

2010-12-04 Found nothing

2010-12-04 Found nothing

2010-12-03 Found nothing

2010-12-04 Found nothing

2010-12-03 Found nothing

2010-12-03 Found nothing

2010-12-03 Found nothing

2010-12-03 Found nothing

2010-12-04 Found nothing

2010-12-03 Found nothing

2010-12-04 Found nothing

2010-12-03 Found nothing

2010-12-04 Found nothing

2010-12-04 Found nothing

2010-12-04 Found nothing

2010-12-03 Found nothing

2010-12-03 Found nothing

2010-12-03 Found nothing

2010-12-04 Found nothing

I have rebooted my laptop and the blue screen has finally gone and Windows has loaded but there is a message on the screen called Rundll saying that there was an error loading c:\Windows\iclx40.dll. I am also changing the system configuration to normal set up as it is on diagnostic if you agree?
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP