[wharriss]

Hello everybody:

I am new to this forum and not very experienced in computers, but have worked hard to solve this problem by myself by googling, etc, and have been defeated. All help will be greatly appreciated.

HP Pavilion a320n Windows Home xp AMD Athlon 2.08 GHz I have been running the latest Norton 360 antivirus for 2 years. I did allow a symantec technician from an Asian country to control my computer in November through Rescue Me login for a problem with a compatibility issue between Firefox and Norton Identity Safe.

When trying to boot in normal the boot process appears normal up to the blue screen with the windows logo and the bars moving across for maybe 30 seconds and then the bars stop and the screen goes completely black. (no cursor or anything) The power button won't shut the pc down I have to unplug the power source to shut down.

I can use F8 to boot in the safe mode and connect to the internet and use my Firefox browser.

My Outlook Express 6 email program account is set up properly and I can receive emails, but when I click to create an email Outlook Express crashes (closes completely) When I restart Outlook Express it says that "Outlook Express did not shut down properly and in case it was the last email I viewed, that one email is not being shown opened." This may or may not be a problem associated with the boot problem. I don't know.I do have a windows 7 computer sitting beside this xp and I can email from there.

I have run chkdsk/r in safe mode. Results: * C:\WINDOWS\System32\srsvc.dll [NoSig]

I have downloaded and burned bootable CD's and from F1 setup I ran bootable CD's of Avira Rescue, AVG rescue, Norton Bootable recovery tool, and Kaspersky rescue.

I can and have run the VIPRRescue, rkill, Norman Malware programs from desktop in safe mode.

I am not sure when I started having this boot problem in normal mode, but it may have been when my computer was booting OK in normal mode, but I suspected some type malware infection, and I downloaded Malwarebytes to my desktop and I could not get it to run. I suspected some type malware that prevented MBAM from running so I downloaded and ran SuperAntiSpyware while my computer was in normal mode, also downloaded and ran AVG free. Then, I downloaded and ran Avast boot time scan, and that's when I think the computer quit booting in normal.

No threats found in all except rkill notes:
* C:\WINDOWS\System32\srsvc.dll [NoSig]

Some of these applications have text reports of scan which I have on my desktop.

If anyone can help, Thanks

[Advertisements]

Have you tried Last Known Good Configuration in the menu where you go to Safe Mode?

[rshaffer61]

Have you tried Last Known Good Configuration in the menu where you go to Safe Mode?

[wharriss]

Yes I tried last known config, but it wouldn't allow that. Neither would it allow system restore. Said "system restore is not able to protect your computer. Please restart your computer and then run system restore again.

I am right now running AVG rescue cd again and it has found a couple of corrupted executable files--- one in System volume information/-restore and one in windows/installer/SI38.exe.

When AVG finishes I will post every error found.
Thanks

[rshaffer61]

Is this a branded system like Dell or HP?
If not do you have a OS installation disk?

[wharriss]

Yes, this is a store purchased HP Pavilion a320n desktop. Windows XP Home SP3. AMD Athlon processor NVIDIA GeForce 4 mx graphics

I do have the Operating System CD XP Home SP2 and I have the Application and Driver Recovery DVD both of which came with the computer.

I did not want to do a complete reinstall of windows if I can find a way to fix this boot problem.

[rshaffer61]

Is the OS disk a branded disk with HP on the disk? Normally it would say Recovery disk or something like that.
What I am trying is to do a Repair Installation but it won't work with a branded disk.

[wharriss]

I have two disks that came with the HP computer:
1.Operating System CD microsoft windows xp home sp2 contains software and drivers aalready installed. For software reinstallation and repair only.
2.Application and Driver Recovery DVD. Contains software and drivers already installed for software and reinstallation and repair only.
Both these diskssay "for distribution only with a new HP or Compaq computer.

I ran Avira Rescue disk again and it found a lot of problems. Most all of the files were in /media/ devices. master boot sector had 10 alerts.

Master boot sector had 10 errors such as "error reading file Master boot sector (disk/dev/hdc/)". All 10 of the errors were either "error reading file" or "no such file in directory"

On the full scan Avira showed 495 alerts:
There was a trojan in 2 files: (TR/Crypt.XPACK.Gen)/media/devices/hdb1/1386/MML.EX>>mmc.exe<<is the trojan horse TR/Crypt.Gen(archive scan abort) The trojan was quarantined by Avira

Bad archive header/media/devices/hdb1/1386

Unexpected end of file /media/devices/hdb1/hp/patches/34ww1ati/video_ati_7_92_0_0_all_ww_xp_6296_01.exe

unexpected end of file /media/devices/hdb1/hp/patches/34ww|7/1/7_in_1_cardreader.exe

most of the other 400 plus errors were "error opening file (input/output error) and most all of these errors were in files beginning with /media/devices

Avira didn't doo anything with the above errors and they still exist

THANKS

[rshaffer61]

Yes the OS disk won't work for the repair installation for sure.

Master boot sector had 10 errors such as "error reading file Master boot sector (disk/dev/hdc/)". All 10 of the errors were either "error reading file" or "no such file in directory"

This could indicate a hard drive issue which we will check with the below.

Run hard drive diagnostics: http://www.tacktech....ay.cfm?ttid=287
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: http://www.imgburn.com/ to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.

NOTE. If your hard drive is made by Toshiba, try the Hitachi DFT CD Image version of the software

Thanks to Broni for the instructions

[wharriss]

rshaffer61

A couple of things have happened since last post. I burned iso Windows System Sweeper which ran as Windows Defender. It completed the scan and found Pup.Brainistaller virus in the registry, which I told it to remove. After that, I can no longer boot into safe mode.

I am having trouble finding the correct diagonostic tool to run on my hard drive. I didn't know which hard drive was on my 2003 model HP Pavilion a320n, so I tried the Seagate which is listed in the first paragraph of your link to the tools. This tool said it would run on most hard drives and it did run on mine. It showed that my HD was a "Samsung SV 120 3n, supports security features, supports SMART (enabled), Smart has NOT been tripped, and DST is supported." The scan completed and it said there were 8 errors, but did not say what they were. The dialog said since this was not a Seagate drive, I should contact manufacturer. I watched the scan run and the 8 errors came up fairly evenly spaced throughout the scan. The first error appeared about 10% through the scan and the last one appeared about 80% finished through the scan.

After I found out my drive was a Samung SV 120 3N, I finally found the utility that has to be used on this drive. It is HUTIL. HUTIL comes in a zipped iso file, which I downloaded, burned to CD and tried to run it, but it loaded to the first screen, but wouldn't run on my HD. I googled some other other forums and found comments that on certain drives this HUTIL had to be run from a floppy disk with dos commands.

I finally found the HUTIL.exe file. It was from a site in Russia, the only place I have been able to find it. I have an old Windows 98 computer which is still working and since none of my newer computers have floppy disk drives, I used the windows 98 to put this HUTIL.exe file on a floppy.

I am a little apprehensive about trying to run this floppy on the bad computer.

What do you say.

Many Thanks

[rshaffer61]

The scan completed and it said there were 8 errors, but did not say what they were.

This is something to worry about as it may be indicating a failing hd.
The fact that your program deleted, modified or changed something in the registry most likely is the issue with not being able to boot.
Is it just Safe Mode or will it not boot into normal mode either?
Have you tried going to the advance boot menu and trying Last Known Good Configuration That Worked?

[wharriss]

rshaffer61

I gave up on trying to boot to recover my hard drive files. I decided to use the Windows Operating System CD that I had on hand to try to restore without removing data. After I did that I could boot the computer in normal and safe mode and ran some virus scans, but strange things were still happening,so I did a full restore with the Operating system disk and brought the system back to the state of purchase. I have updated to SP3 installed and ran several virus scans.

I was surprised that on the very first scan AVG found 2 files infected with Trojan:Tracur.gen. One of the files had to do with Norton 360 which was the antivirus I had on the computer before I reinstalled. AVG doesn't have a log and I didn't see what the other infected file was. I am a novice, but I thought a reinstall would remove viruses.

I have been using the computer and slowly adding back the applications I like to have on it.

I guess we will contribute the problems to deeply imbedded viruses.
The physical hard drive seems to be working OK. I hope the viruses are all gone now. I have used rkill, SuperAntispyware, Malwarebytes, and AVG and run them in both safe and normal. The only thing found was the two files with the trojan tracur.gen.

However, this is something very strange that I would like an opinion on:
I decided to put the Norton 360 antivirus back on this PC, so I signed in my Norton Account with my password and clicked on the download button provided for me to down load the 360 product I had. As soon as the download started AVG gave a virus alert and removal.

It was Trojan horse30.CFBW. Object name: lcdls.symantec.com was the first part of the infected , then a lot of numbers, symbols, etc and the end of the file read N360Downloader.exe?LNG=ENG-USA&latest=true.

I tried this again and the same thing happened. Do you think the 360 download from my Norton account is infected or do you think AVG was preventing me from downloading another antivirus?

This is troubling to me after my experience with giving a Symantec technician full remote control of my computer last month.

Many thanks for the help

[Wolfeymole]

What's happening here Wharris is that AVG is saying that Norton is a False Positive, in other words AVG thinks it's a virus when in actual fact it is not.

Personally I'd uninstall AVG and also dump the Norton download and instead obtain Avast.

[rshaffer61]

You can also have one of our malware techs go through the system and check everything. If there is a hidden infection they will find it and get rid of it.

I suggest you read the 'Start Here' topic found HERE. With these self-help tools you have a high chance of fixing the problems on your own. If you are still having problems after following Step 3 of the guide, continue with Step 4 and 5 and post in the Malware Forum. If you are unable to run any programs, Please create a topic stating what you have tried so far and that you are unable to run any programs. Also, Please do NOT post the logs in this thread.

If you are still having issues after the malware expert gives you a clean bill of health, Please return to THIS thread and we will pursue other options to help you solve your current problem(s).
Add a link to this topic so that malware tech can see what steps have been taken here

[wharriss]

Thank you for the good advice. I have posted in the malware forum asking for some help. Ran into a problem over there already. None of the versions on OTL will run all the way. Stops when it gets to "scanning foxfire settings"

Hopefully someone over there can figure that out.
Many thanks for your help

[rshaffer61]

IF one of the suggested programs doesn't run just make sure to mention that in your first post so they can recommend another program to try.