[Kyndri]

Hi, this is my first time coming to this forum. I can master software in no time at all, but anything about the computer itself and I'm stumped. I bought a Dell Windows 7 computer in July of 2012. Within 6 months I'd already "killed" it. I got a laptop soon after so I haven't really tried to fix the desktop, but I'd sure like to get it working again.

I used to download games from torrent sites. I never really had any issues until one day none of the torrents for a game that I wanted would work. I decided to do a simple Google search and downloaded the game from a link. BAD IDEA! The programs that I had running all shut down, one by one, then the computer did. I knew I was in trouble. Sure enough, starting it back up got me past the Dell screen, but when it is supposed to go on to loading Windows I get invalid boot option.

I went online to try and figure out how to fix it. Since then I've gone thru the F12 menu to repair, re-setup, revert to factory; tried the Kapersky Rescue Disk and the complete image backups that I'd made the day I brought home the computer. All to no avail. I searched some more and downloaded the online Kapersky Rescue disk onto a flash drive, ran it and it found the Rootkit.Pilar.c virus, but it says it cannot be deleted or disinfected. Thanks a lot!! More searching and I've run the AVG Rescue disk which continually hangs up at about 70% scanned. DrWeb Rescue doesn't find anything. Avira rescue wouldn't even load. I dont remember the error message, but I couldn't even get to the scan.
About the only thing I've been able to get to work is the Farbar thingie. I've attached the scan log. What should I try next? After all the things I've done so far, I'm no longer getting an invalid boot option, now I'm getting a no operating system error on boot. I can't get to the F8 menu, only F12 works. I was able to get to the F8 menu once, but I don't remember how I went about it, F8 wont do anything except the no operating system error.

I await the masters' assistance. Thank you in advance!!!!

Ky

Attached Files

•  Farbar.txt   6.11KB   108 downloads

[Advertisements]

For x86 (x32) bit systems please download Listparts

For x64 bit systems please download Listparts64
and save it to a flash drive.

Also Download the enclosed file to the flash drive:

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Click on Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\ListParts.exe (for x64 bit version type e:\ListParts64.exe) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Then Press on Fix button and wait.
• When it is done close the notification pop up.
• Put check mark on List BCD.
• Press Scan button.
• It will make a log (Result.txt) in the flash drive. Please copy and paste it to your reply.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Boot in Normal Mode. Let me know of any error message.

[JSntgRvr]

For x86 (x32) bit systems please download Listparts

For x64 bit systems please download Listparts64
and save it to a flash drive.

Also Download the enclosed file to the flash drive:

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Click on Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\ListParts.exe (for x64 bit version type e:\ListParts64.exe) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Then Press on Fix button and wait.
• When it is done close the notification pop up.
• Put check mark on List BCD.
• Press Scan button.
• It will make a log (Result.txt) in the flash drive. Please copy and paste it to your reply.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Boot in Normal Mode. Let me know of any error message.

[Kyndri]

Hi, thank you for replying so quickly. I can't get to the F8 menu though, unless you could help me get there from the F12 menu somehow. Or, unless what you're asking me to download will get me there. Hitting the F8 repeatedly on boot isn't working, but the F12 will. I think I made a Windows Installation Disk last time and that's how I got the Farbar to run it's scan. Okay, never mind, I'll try getting the F8 menu that way tonight when I get home from work. I can't wait!!! Thank you again ...
Ky

[JSntgRvr]

Do you have another computer using the same version of Windows 7?

[JSntgRvr]

How did you run FRST?

[Kyndri]

Do you have another computer using the same version of Windows 7?

No I don't.
I ran FRST by first putting in a Windows System disk that I made with my laptop, then using that to get to the command prompt, notepad, find the flash drive letter, etc. It worked before, so I'll try that method when I get home tonight.
~Ky

[JSntgRvr]

Ok. It is the same process.

[Kyndri]

I'm sorry, I ended up having to work late, then had to go to the grocery store, got home & hubby ticked me off, so I didnt feel like messing with the computer last night. I'll get on it tonite, promise!
~Ky

[JSntgRvr]

[Kyndri]

Okay, got it all done. I've attached all of the logs. One note, I wasn't sure whether or not you wanted the "include BSD" option checked on the list scan so I ran both. I await your next instructions.
~Ky

Wow, this is my "Fixlog":
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2013
Ran by SYSTEM at 2013-04-02 19:04:43 Run:1
Running from F:\

==============================================


==== End of Fixlog ====

Listparts NO BSD
ListParts by Farbar Version: 10-03-2013
Ran by SYSTEM (administrator) on 02-04-2013 at 19:05:41
Windows 7 (X64)
Running From: F:\
Language: 0409
************************************************************

========================= Memory info ======================

Percentage of memory in use: 9%
Total physical RAM: 6126.46 MB
Available physical RAM: 5554.17 MB
Total Pagefile: 6124.66 MB
Available Pagefile: 5542 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB

======================= Partitions =========================

1 Drive c: (OS) (Fixed) (Total:919.22 GB) (Free:888.69 GB) NTFS
2 Drive e: (Repair disc Windows 7 64-bit) (CDROM) (Total:0.16 GB) (Free:0 GB) UDF
3 Drive f: () (Removable) (Total:0.96 GB) (Free:0.95 GB) FAT32
8 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
9 Drive y: (RECOVERY) (Fixed) (Total:12.25 GB) (Free:4.72 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 931 GB 0 B
Disk 1 Online 980 MB 0 B
Disk 2 No Media 0 B 0 B
Disk 3 No Media 0 B 0 B
Disk 4 No Media 0 B 0 B
Disk 5 No Media 0 B 0 B

Partitions of Disk 0:
===============

Disk ID: 2C0C533A

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 OEM 39 MB 31 KB
Partition 2 Primary 12 GB 40 MB
Partition 3 Primary 919 GB 12 GB

======================================================================================================

Disk: 0
Partition 1
Type : DE
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 8 FAT Partition 39 MB Healthy Hidden

======================================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y RECOVERY NTFS Partition 12 GB Healthy

======================================================================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C OS NTFS Partition 919 GB Healthy

======================================================================================================

Partitions of Disk 1:
===============

Disk ID: 01287000

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 980 MB 16 KB

======================================================================================================

Disk: 1
Partition 1
Type : 0B
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT32 Removable 980 MB Healthy

======================================================================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 2C0C533A

Partition 1:
===========
Hex: 80002C00000000002B00000000000000
Active: YES
Type: 00
Size: 0 byte
ATTENTION ===> 0 byte partition bootkit on partition 1

Partition 2:
===========
Hex: 00010100DEFE3F043F00000086390100
Active: NO
Type: DE
Size: 39 MB

Partition 3:
===========
Hex: 8019150507FEFFFF0040010000F08701
Active: YES
Type: 07 (NTFS)
Size: 12 GB

Partition 4:
===========
Hex: 00FEFFFF07FEFFFF003089010030E772
Active: NO
Type: 07 (NTFS)
Size: 919 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 01287000

Partition 1:
===========
Hex: 800101000B01FFFF20000000E0A31E00
Active: YES
Type: 0B
Size: 980 MB


****** End Of Log ******

Listparts With BSD
ListParts by Farbar Version: 10-03-2013
Ran by SYSTEM (administrator) on 02-04-2013 at 19:06:30
Windows 7 (X64)
Running From: F:\
Language: 0409
************************************************************

========================= Memory info ======================

Percentage of memory in use: 9%
Total physical RAM: 6126.46 MB
Available physical RAM: 5547.71 MB
Total Pagefile: 6124.66 MB
Available Pagefile: 5540.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

======================= Partitions =========================

1 Drive c: (OS) (Fixed) (Total:919.22 GB) (Free:888.69 GB) NTFS
2 Drive e: (Repair disc Windows 7 64-bit) (CDROM) (Total:0.16 GB) (Free:0 GB) UDF
3 Drive f: () (Removable) (Total:0.96 GB) (Free:0.95 GB) FAT32
8 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
9 Drive y: (RECOVERY) (Fixed) (Total:12.25 GB) (Free:4.72 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 931 GB 0 B
Disk 1 Online 980 MB 0 B
Disk 2 No Media 0 B 0 B
Disk 3 No Media 0 B 0 B
Disk 4 No Media 0 B 0 B
Disk 5 No Media 0 B 0 B

Partitions of Disk 0:
===============

Disk ID: 2C0C533A

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 OEM 39 MB 31 KB
Partition 2 Primary 12 GB 40 MB
Partition 3 Primary 919 GB 12 GB

======================================================================================================

Disk: 0
Partition 1
Type : DE
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 8 FAT Partition 39 MB Healthy Hidden

======================================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y RECOVERY NTFS Partition 12 GB Healthy

======================================================================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C OS NTFS Partition 919 GB Healthy

======================================================================================================

Partitions of Disk 1:
===============

Disk ID: 01287000

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 980 MB 16 KB

======================================================================================================

Disk: 1
Partition 1
Type : 0B
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT32 Removable 980 MB Healthy

======================================================================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 2C0C533A

Partition 1:
===========
Hex: 80002C00000000002B00000000000000
Active: YES
Type: 00
Size: 0 byte
ATTENTION ===> 0 byte partition bootkit on partition 1

Partition 2:
===========
Hex: 00010100DEFE3F043F00000086390100
Active: NO
Type: DE
Size: 39 MB

Partition 3:
===========
Hex: 8019150507FEFFFF0040010000F08701
Active: YES
Type: 07 (NTFS)
Size: 12 GB

Partition 4:
===========
Hex: 00FEFFFF07FEFFFF003089010030E772
Active: NO
Type: 07 (NTFS)
Size: 919 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 01287000

Partition 1:
===========
Hex: 800101000B01FFFF20000000E0A31E00
Active: YES
Type: 0B
Size: 980 MB


Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=Y:
description Windows Boot Manager
locale en-US
inherit {globalsettings}
default {default}
resumeobject {f3faa820-f61d-11e1-8f2f-e5bdfe11f19d}
displayorder {default}
{f3faa81f-f61d-11e1-8f2f-e5bdfe11f19d}
{8b868726-92bf-11e0-9001-782bcb9af543}
toolsdisplayorder {memdiag}
timeout 3

Windows Boot Loader
-------------------
identifier {8b868726-92bf-11e0-9001-782bcb9af543}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale en-US
inherit {bootloadersettings}
recoverysequence {8b868727-92bf-11e0-9001-782bcb9af543}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {8b868725-92bf-11e0-9001-782bcb9af543}
nx OptIn

Windows Boot Loader
-------------------
identifier {8b868727-92bf-11e0-9001-782bcb9af543}
device ramdisk=[Y:]\Recovery\WindowsRE\Winre.wim,{8b868728-92bf-11e0-9001-782bcb9af543}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[Y:]\Recovery\WindowsRE\Winre.wim,{8b868728-92bf-11e0-9001-782bcb9af543}
systemroot \windows
nx OptIn
winpe Yes

Windows Boot Loader
-------------------
identifier {f3faa81f-f61d-11e1-8f2f-e5bdfe11f19d}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale en-US
inherit {bootloadersettings}
osdevice partition=C:
systemroot \Windows
resumeobject {f3faa81e-f61d-11e1-8f2f-e5bdfe11f19d}
nx OptIn
detecthal Yes

Windows Boot Loader
-------------------
identifier {default}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale en-US
inherit {bootloadersettings}
osdevice partition=C:
systemroot \Windows
resumeobject {f3faa820-f61d-11e1-8f2f-e5bdfe11f19d}
nx OptIn
detecthal Yes

Resume from Hibernate
---------------------
identifier {8b868725-92bf-11e0-9001-782bcb9af543}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale en-US
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No

Resume from Hibernate
---------------------
identifier {f3faa81e-f61d-11e1-8f2f-e5bdfe11f19d}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale en-US
inherit {resumeloadersettings}
filepath \hiberfil.sys

Resume from Hibernate
---------------------
identifier {f3faa820-f61d-11e1-8f2f-e5bdfe11f19d}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale en-US
inherit {resumeloadersettings}
filepath \hiberfil.sys

Windows Memory Tester
---------------------
identifier {memdiag}
device partition=Y:
path \boot\memtest.exe
description Windows Memory Diagnostic
locale en-US
inherit {globalsettings}
badmemoryaccess Yes

EMS Settings
------------
identifier {emssettings}
bootems Yes

Debugger Settings
-----------------
identifier {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200

RAM Defects
-----------
identifier {badmemory}

Global Settings
---------------
identifier {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}

Boot Loader Settings
--------------------
identifier {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}

Hypervisor Settings
-------------------
identifier {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200

Resume Loader Settings
----------------------
identifier {resumeloadersettings}
inherit {globalsettings}

Device options
--------------
identifier {8b868728-92bf-11e0-9001-782bcb9af543}
description Ramdisk Options
ramdisksdidevice partition=Y:
ramdisksdipath \Recovery\WindowsRE\boot.sdi


****** End Of Log ******

Attached Files

•  Listparts64 Results - With BCD.txt   9.9KB   70 downloads
•  Listparts64 results - NO BCD.txt   4.56KB   76 downloads
•  Fixlog.txt   226bytes   64 downloads

[JSntgRvr]

I believe you ran the wrong program when applying the Fix.

If you downloaded the Fix.txt above next to Listparts64, run listparts64 as follows:

• Run ListParts as you did before.
• This time around Press Fix button.
• When it is done close the notification pop up. Click Scan and copy and paste the log (Result.txt) it makes.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

[Kyndri]

You are so right, I'm sorry. I was giving you the fix log from Farbar, not List. I've attached the fix log correctly, and I went ahead & re-scanned without the BSD after applying the fix, just so that you could see if it did what it was supposed to do. Thank you ...
~Ky

PLixlog.txt
Script used: "Disk=0 Partition=1 inactive"
Script used: "Disk=0 Partition=1 active"
Script used: "Disk=0 Partition=1 inactive"
Script used: "Disk=0 Partition=2 active"
Script used: "Custom"

An error occurred while attempting to delete the specified data element.
Element not found.


Re-Scan with ListParts64
ListParts by Farbar Version: 10-03-2013
Ran by SYSTEM (administrator) on 02-04-2013 at 21:59:23
Windows 7 (X64)
Running From: F:\
Language: 0409
************************************************************

========================= Memory info ======================

Percentage of memory in use: 9%
Total physical RAM: 6126.46 MB
Available physical RAM: 5544.82 MB
Total Pagefile: 6124.66 MB
Available Pagefile: 5530.75 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB

======================= Partitions =========================

1 Drive c: (RECOVERY) (Fixed) (Total:12.25 GB) (Free:4.72 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive d: (OS) (Fixed) (Total:919.22 GB) (Free:888.69 GB) NTFS
3 Drive e: (Repair disc Windows 7 64-bit) (CDROM) (Total:0.16 GB) (Free:0 GB) UDF
4 Drive f: () (Removable) (Total:0.96 GB) (Free:0.95 GB) FAT32
9 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 931 GB 0 B
Disk 1 Online 980 MB 0 B
Disk 2 No Media 0 B 0 B
Disk 3 No Media 0 B 0 B
Disk 4 No Media 0 B 0 B
Disk 5 No Media 0 B 0 B

Partitions of Disk 0:
===============

Disk ID: 2C0C533A

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 OEM 39 MB 31 KB
Partition 2 Primary 12 GB 40 MB
Partition 3 Primary 919 GB 12 GB

======================================================================================================

Disk: 0
Partition 1
Type : DE
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 8 FAT Partition 39 MB Healthy Hidden

======================================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C RECOVERY NTFS Partition 12 GB Healthy

======================================================================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 D OS NTFS Partition 919 GB Healthy

======================================================================================================

Partitions of Disk 1:
===============

Disk ID: 01287000

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 980 MB 16 KB

======================================================================================================

Disk: 1
Partition 1
Type : 0B
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT32 Removable 980 MB Healthy

======================================================================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 2C0C533A

Partition 1:
===========
Hex: 00010100DEFE3F043F00000086390100
Active: NO
Type: DE
Size: 39 MB

Partition 2:
===========
Hex: 8019150507FEFFFF0040010000F08701
Active: YES
Type: 07 (NTFS)
Size: 12 GB

Partition 3:
===========
Hex: 00FEFFFF07FEFFFF003089010030E772
Active: NO
Type: 07 (NTFS)
Size: 919 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 01287000

Partition 1:
===========
Hex: 800101000B01FFFF20000000E0A31E00
Active: YES
Type: 0B
Size: 980 MB


****** End Of Log ******

Attached Files

•  Result.txt   4.4KB   77 downloads
•  PLfixlog.txt   291bytes   71 downloads

[JSntgRvr]

The Fix went thru. Were you able to boot now in Normal Mode?

[Kyndri]

The Fix went thru. Were you able to boot now in Normal Mode?

Nope. Still giving me a No Operating System error.

[JSntgRvr]

Please run FRST64 once again, remove the checkmarks on the first line of whitelisted items and click on the Scan button. Post or attach the (FRST.txt) log produced. If too large, have it uploaded here.