Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

"System Check" and "Zeroaccess!kmem" Virus


  • This topic is locked This topic is locked

#16
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,798 posts
  • MVP
Since you can still run the recovery partition, do that now and try the


cd  \windows\system32



(Prompt should change to show you are in C:\Windows\System32)

ren  mbackmonitor.dll  mbackmonitor.bad

then reboot. We might get lucky.
  • 0

Advertisements


#17
malmbor

malmbor

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
No luck with that - same blue screen appears on reboot.
  • 0

#18
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,798 posts
  • MVP
Go back into the recovery console and try

fixmbr
fixboot
  • 0

#19
malmbor

malmbor

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
I keep getting the same blue screen. Is there anything I can do with the Hiren's Boot Cd or the G-parted Cd?
  • 0

#20
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,798 posts
  • MVP
I'd be interested to see if you can boot from Hiren's and get into the miniXP.

Gparted will let you look at the partitions and tell you if the C:\ is set to be active and bootable.
  • 0

#21
malmbor

malmbor

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
I can get into the mini XP. I tried it earlier today.
  • 0

#22
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,798 posts
  • MVP
OK that's good to know.

See if you can follow the instructions here:

http://support.microsoft.com/kb/307545

You can start at part 2 since the minXP gives you access to the files.

Hopefully the malware or Norton hasn't deleted your system restore points. Assuming you have some, pick one of the older ones.
  • 0

#23
malmbor

malmbor

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
I got to Part 4, but System Restore would not run in the mini XP.
  • 0

#24
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,798 posts
  • MVP
At the end of step 3 it says:

Type exit to quit Recovery Console. Your computer restarts.


You should try to let it boot normally (remove the CD). IF it does boot OK then you don't need to do anything else on that page.
  • 0

#25
malmbor

malmbor

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
I did try to let it boot normally, but it gave me the same blue screen.
  • 0

Advertisements


#26
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,798 posts
  • MVP
Preferably from a clean computer, I need you to download: gparted-live-0.10.0-3.iso (115.1 MB)


Create a bootable CD, 1 for Gparted from the ISO image. You can use ImgBurn do this.

Now boot off of the newly created Gparted CD.

Posted Image
You should be here...
Press ENTER

Posted Image
By default, "do not touch keymap" is highlighted. Leave this setting alone and just press ENTER.

Posted Image
Choose your language and press ENTER. English is default [33]

Posted Image
Once again, at this prompt, press ENTER

Posted Image
Is "boot" next to your OS drive?

If "boot" is not next to your OS drive under "Flags", right-mouse click the OS drive while in Gparted and select Manage Flags

In the menu that pops up, place a checkmark in boot like the picture below:
Posted Image

Now double-click the Posted Image button.

You should receive a small pop up like this:
Posted Image
Choose reboot and then press OK.

Now reboot into the Windows XP Recovery Console and execute the following commands:

  • fixmbr \Device\HardDisk0
  • fixboot c:
  • exit

  • 0

#27
malmbor

malmbor

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
No luck. Same blue screen.
  • 0

#28
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,798 posts
  • MVP
Go back into the recovery console and type:

chkdsk  c:  /p

This should check your disk for errors. Perhaps we will get lucky and it will find something.
  • 0

#29
malmbor

malmbor

    Member

  • Topic Starter
  • Member
  • PipPip
  • 72 posts
I ran that and it indicated that it "found one or more errors on the volume."
  • 0

#30
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,798 posts
  • MVP
But it still doesn't boot into windows?
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP