[BrendanQ]

Hi

My Dell E520 running XP had a Trojan virus (maybe more than one) and all attempts to remove it failed - it kept coming back after being apparently deleted by Sophos, MalwareBytes or Norton tools. I copied my important documents to an external hard disk and tried to wipe the infected hard disk back to Dell Factory settings using the Restore partition (pressing CTRL-F11). This has worked once before when I somehow had some missing XP files and the PC would not boot. This time the Restore operation did not work - went part way through and then said the backup image was corrupt and stopped. Until this the system would boot up fine and was usable though still had the Trojan popping up - I kept it disconnected to the Web from the time I first detected the Trojan.

Now, after the failed attempt to use the Dell Restore, it wont boot up and stops at a black screen with a blue band at the top saying www.dell.com and a message below in white text saying "Loading PBR for descriptor 2 .. done" and then a flashing cursor on the next line.

I have seen on the web that lots of other people have had this message but I dont know how to proceed now. I dont have an original XP disk (I found out) because Dell use this Recovery partition thing - but this is no good if you have a virus. I dont know whether just paying out (reluctantly) for a new copy of XP would fix this. Dell will only help by charging me a lot and want to charge full MSoft price if I just want the XP disks.

I have downloaded a couple of boot disks that are supposed to help (from reliable sources I believe) - one would not boot but the other one (Avira) showed that my C: drive is no longer visible though my D: drive is (another partition on my HD) and also some other partitions which I think are system or recovery partitions are also still visible from the Avira boot disk.

Can anyone help please? I'm reasonably technical (eg I can program in lots of languages) but have not done much at this malware fixing / operating system level.

So to summarise - can I fix this problem by buying a new XP disk and reformatting and reinstalling? Or does this MBR business mean that wont work. I'm not worried about wiping this hard disk as I have copied the important data, though not any drivers as I did not think of that.

Brendan Q

[Advertisements]

Hi, BrendanQ! My nick name is CompCav and I will be assisting you with your Malware/Security problems. Please make sure you read all of the instructions and fixes thoroughly before continuing with them. If you have any questions or you are unsure about anything, just ask and I will help you out.

If you have resolved the issues you were originally experiencing, or have received help elsewhere, please let me know so that this topic can be closed.

I am currently still in training and my posts have to be approved by an expert so please expect a delay between my posts.

Please make sure you are saving and printing the instructions out prior to each fix, this way you will have them on hand just in case you are unable to access this site. One of the steps I will be asking you to do requires you to boot into Safe Mode and this process will be much easier for you to perform if the instructions are printed out for you to follow.

If you are ready to get started, please review and follow these guidelines so that we resolve your issues in a timely and effective manner:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
• Please make sure to carefully read any instructions that I give you. Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. These instructions are not suitable for any other computer, even if the issues are fairly similar.
• Do not do things I do not ask for, such as running a spyware scan on your computer. However, the one thing that you should always do, is to make sure your anti-virus definitions are up-to-date!
• Please do not use the Attachment feature for any log file. Just do a Copy/Paste of the entire contents of the log file inside your post and submit.
• You must reply within four days failure to reply will result in the topic being closed!
• Please do not PM me directly for help. If you have any questions, post them in this topic. PM me only if I have not responded to your last post in 2 days.
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to ultimately reformat your hard drive and reinstall the operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Please have the software and storage media for backing up your data available.

Do you want to format and reinstall or try to fix?

If reinstall you should have these disks that came with your computer:

Drivers and Utilities
Application
Reinstallation CD Microsoft Windows (your version)

If it did not come with the reinstallation CD I checked with Dell and this is their answer:

Upon checking the restore disc can be easily be requested through Technical Support as long as the system is under warranty. But if not, no worries you could order them at 1-800-357-3355. It will only be around $10 to $20

If trying to fix:

What happened leading up to this when it was working? Had it been working fine until the recent attack or were there symptoms of malware earlier?

Do you have another computer we can use to download files? If so what is the operating system (i . e. XP, Vista, Windows 7)

Do you have a small USB flash drive to transfer files?

Do you have some blank CD's to make CD's on the good machine?

Edited by CompCav, 29 February 2012 - 02:31 PM.

[CompCav]

Hi, BrendanQ! My nick name is CompCav and I will be assisting you with your Malware/Security problems. Please make sure you read all of the instructions and fixes thoroughly before continuing with them. If you have any questions or you are unsure about anything, just ask and I will help you out.

If you have resolved the issues you were originally experiencing, or have received help elsewhere, please let me know so that this topic can be closed.

I am currently still in training and my posts have to be approved by an expert so please expect a delay between my posts.

Please make sure you are saving and printing the instructions out prior to each fix, this way you will have them on hand just in case you are unable to access this site. One of the steps I will be asking you to do requires you to boot into Safe Mode and this process will be much easier for you to perform if the instructions are printed out for you to follow.

If you are ready to get started, please review and follow these guidelines so that we resolve your issues in a timely and effective manner:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
• Please make sure to carefully read any instructions that I give you. Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. These instructions are not suitable for any other computer, even if the issues are fairly similar.
• Do not do things I do not ask for, such as running a spyware scan on your computer. However, the one thing that you should always do, is to make sure your anti-virus definitions are up-to-date!
• Please do not use the Attachment feature for any log file. Just do a Copy/Paste of the entire contents of the log file inside your post and submit.
• You must reply within four days failure to reply will result in the topic being closed!
• Please do not PM me directly for help. If you have any questions, post them in this topic. PM me only if I have not responded to your last post in 2 days.
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to ultimately reformat your hard drive and reinstall the operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Please have the software and storage media for backing up your data available.

Do you want to format and reinstall or try to fix?

If reinstall you should have these disks that came with your computer:

Drivers and Utilities
Application
Reinstallation CD Microsoft Windows (your version)

If it did not come with the reinstallation CD I checked with Dell and this is their answer:

Upon checking the restore disc can be easily be requested through Technical Support as long as the system is under warranty. But if not, no worries you could order them at 1-800-357-3355. It will only be around $10 to $20

If trying to fix:

What happened leading up to this when it was working? Had it been working fine until the recent attack or were there symptoms of malware earlier?

Do you have another computer we can use to download files? If so what is the operating system (i . e. XP, Vista, Windows 7)

Do you have a small USB flash drive to transfer files?

Do you have some blank CD's to make CD's on the good machine?

Edited by CompCav, 29 February 2012 - 02:31 PM.

[BrendanQ]

Thanks very much CompCav for your prompt response.

I think my best option now is probably to reformat/reinstall XP if possible because I feel I cant really trust any other way or removing Trojans. After I had used MalwareBytes etc to "delete" the Trojan I had identified, others kept coming up as soon as I reconnected to the internet so it was clearly not clean.

I have another computer, a laptop from my work, which I can use to download and to burn DVDs if needed. I also have two USB memory sticks including one with a switch to make it read-only.

There were no disks with the Dell PC which I bought 5 years ago - it has a recovery partition which stores an image of the "factory" state of the hard disk and which should restore XP, drivers etc. As I said in my first post this restore process was what failed this time and Dell UK support suggested that the virus(es) could have corrupted the backup data - hence this is a pretty useless backup system!

I am in the UK so Dell may behave differently about support. Dell UK told me that if I wanted XP disks I would have to buy them as if I was a new customer at a cost of £59 ($94) which seems rather expensive for something I thought I had already bought. Ultimately if paying $94 is the only way to get my PC back I may have to do this but I'm not happy about that.

So I hope this gives you a bit more to work on. If you agree that reinstallation is the best option in these circumstances I may try contacting Dell again to see if they can be persuaded to send me XP disks for a more reasonable price. I checked for my XP product key which is on a sticker on the machine, but unfortunately after 5 years there has been some minor wear and tear and the edge of the sticker is missing along with two characters of the product key.

Thanks

Brendan Quinn

[CompCav]

I agree with reinstallation as the most efficient and complete option.

I do not know if you have tried the recovery partition more than once. If you have not, you should try it again.

When you ask them for the disk it should be a "Reinstallation CD" to restore the computer not XP disks. The reinstallation CD or CD's would be specific to your computer model and would include all the necessary drivers for the factory state. That should be cheaper.

Dell can give you the product key if you can give them your service tag number. If they do not we may be able to retrieve it using a boot CD with Magic Jellybean on it.

Given all of this we can try to recover it but it is highly unlikely unless the recovery only deleted the partition and did not do a complete low level format before it stopped.

CompCav

[BrendanQ]

Dear CompCav

I have now spoken to "Dell UK" (whose support staff are actually in India!) and after some discussion they offered me a "discount" on the necessary disks which should contain both XP and the relevant drivers, so I hope that is what you meant. I just missed the chance to get them before weekend so they should arrive on Monday UK time. I will most likely try to use these on Monday evening UK time so will let you know m how this goes at some time late Monday or perhaps early on Tuesday.

I have never installed an OS from scratch - I upgraded a machine to Windows 7 once for my daughter but that was just a question of putting in disks and pressing OK mainly. I'm a bit concerned because what was the C: drive on my machine seems to be now invisible, whereas the D: drive (a backup partition set up in the original configuration by Dell) and two other partitions(the restore and the system partitions?) are visible using a boot CD that I downloaded from Avira. I'm assuming this problem will go away if I reformat/reinstall but I'm a bit hazy about how much reformattting or defining of partitions I may need to do.

The Dell member of staff was quite helpful - as well as asking his manager about the "discount" he also said that it is possible that there could be hardware errors on my hard disk (in addition to the virus problem) - in his (3 year) experience of support, he said that hard disk errors sometimes cause these sort of problems ( I think he meant the restore failure ). Presumably that is something that will show up when I try to reinstall.

Thanks for your help so far

Brendan

[CompCav]

If the disks are the true reinstall we will need you to get any data you want to keep off of the hard drive.

You can use a boot disk and an external drive, even a USB flash drive if you do not have many files.


Step 1.

What to and not to backup before reformat

1) Backup all your important data files, pictures, music, work etc... and save it onto an external hard-drive. These files usually include .doc, .txt, .mp3, .jpg etc...
2) Do not backup any executables files or any window files. These include .exe's, .scr, .com, .pif etc... as they may contain traces of malware. Also, .html or .htm files that are webpages should also be avoided.


Here is a guide for backing up your data:

Puppy Linux for Backup


That guide takes you to a puppy install download but not the 5.20 Lupo as there is a new edition.
Use the 5.20 and then follow the guide
Here is the separate link to 5.20 Lupo
5.20 Lupo

Once you have completed these steps you are ready to test the hard drive.


Step 2.

Let's diagnose your HD.

Run hard drive diagnostics: http://www.tacktech....ay.cfm?ttid=287
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Download the .iso file to make a bootable CD.
If downloaded file is of .iso type, use your current image burning software, Burn CDCC from the step above, or ImgBurn: http://www.imgburn.com/ to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.


By following these steps we will secure your data and insure the integrity of the hard drive before reinstallation with the Dell CD's.

[BrendanQ]

Thanks very much for this.

I think I have already backed up all the files I need to an external drive. I did this before trying the Dell Restore.

However it might be good to test the hard drive so I will try following the instructions for that while waiting for the Dell disks to arrive.

Brendan

[CompCav]

I am glad you have your data backed up.

If you have any questions along the way in testing your hard drive please let me know.


Once you get the disks we can review the process for reinstallation as well.

[CompCav]

I am glad Dell is sending you the disks. They may come with written instructions but if not the Dell website has the following instructions for the manual reinstallation. Please note that the repair partition is not restored so any future restoration will require the disks that you receive

The complete instructions are here

Since you have already done your backup you can go to step 2, Remove non-essential peripherals.

Review these steps and if you have any questions please let me know.

Edited by CompCav, 05 March 2012 - 09:32 AM.

[BrendanQ]

Thanks for this advice. I'm still waiting for the disks due to the difficulty of ensuring someone is in during the week to receive them from a courier company that can call any time of day it seems. With our normal mail from the Post Office we know roughly what time it arrives. So now expecting the disks to be redelivered on Wednesday (second attempt) when I am at home all day.

I burned the hard disk testing boot disk from your previous message, choosing the Hitachi version to match my hard disk. This did boot and gave various menus but it did not work - could not find any devices (aka drive letters). There is a built in Hitachi disk check of some sort on one of the Dell boot up menus and I ran this - it reported no errors but I dont know what it actually checks and it seemed suspiciously quick.

Anyway, will just try the Dell disks tomorrow assuming they arrive!

Thanks

Brendan

Edited by BrendanQ, 06 March 2012 - 03:23 PM.

[CompCav]

Hitachi version to match my hard disk. This did boot and gave various menus but it did not work - could not find any devices (aka drive letters).

When you boot up on the disk it gives you two choices:

1. SCSI and ATA support
2. ATA support only

Select 2 then ENTER
Agree to the EULA
It will search now
This should find your device!
Click Y
Do the Quick Test first with Q, note the results.
Do the Advanced Test second A, note the results.

If any errors please let me know what they are.

CompCav

[BrendanQ]

Yes I have already tried the boot disk with those options that you suggested, but it did not detect any "devices". Showed me an empty table of devices. Should I be worried about this? I also tried most of the other options too, just in case I had selected the wrong ones but same result. I'm sure I did not select any options that might write to the disk (none were offered given that no devices were visible) so it wont have done any harm.

The Dell disks have arrived now and I am going to try them later on today.

Thanks

Brendan

[CompCav]

Well let's try the Dell disks and see if it goes well. If they do not recognize the drive let me know or if you have any other issues.

CompCav

[BrendanQ]

Bad news, I'm afraid.

The PC booted up using the Dell XP disk and started off ok with Screens headed "Setup", reporting loading various drivers, getting to saying "Setup is starting Windows". It then went to a Blue Screen of Death saying "A problem has been detected and Windows has been shut down to prevent damage to your computer", followed by more text saying things like "check for a virus or for hard disk corruption .." and showing the following hex error codes:

STOP 0x0000007B (0xF7A8A524, 0xC0000034, 0x00000000, 0x00000000)

I found a website indicating that STOP 07B means "inaccessible boot device" and that 0xC0000034 means "disks or storage controllers defective or improperly configured".

The hard disk seemed to be working fine before the Trojan showed up and only gave these problems after the failed Dell Restore operation. It is of course possible that the Trojan has corrupted things or also that the Restore operation (which seemed to go part-way before failing) has also corrupted things.

Could it be related to the "PBR" message I quoted in my first post? I have seen things about fixing the MBR etc wiing a program called FIXMBR but I dont know how to get to the point of being able to run anything ..

Any suggestions welcome!

Brendan

[CompCav]

I am testing two different approaches on another computer I have that is a Dell. Please tell me the Service Tab number in case I need to look up something particular to this BIOS.

Regards,

CompCav