[Sab30]

I have seen a few examples in previous forums but the solution seems to vary by individual. I'm not sure if it's malware etc but I powered down the computer tonight and it is now stuck in a "checking for errors" screen on start up that never goes away. We have 2 years of photos and videos that were never backed up. (Lesson learned) and my wife is freaking they may all be gone. Is there anyone that could help take me through step by step on how I may be able to recover the data...even long enough to get it copied?

[Advertisements]

Hello Sab30,

Welcome to Geekstogo.

Have you tried this one?

Please download Farbar Recovery Scan Tool and save it to a flash drive.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select English as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Choose your language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.
[*]When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will create a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
[/list]

[emeraldnzl]

Hello Sab30,

Welcome to Geekstogo.

Have you tried this one?

Please download Farbar Recovery Scan Tool and save it to a flash drive.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select English as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Choose your language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.
[*]When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will create a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
[/list]

[Sab30]

I haven't tried anything yet I wanted to get confirmation first on the steps....Im in the process right now...I will let you know ASAP

[Sab30]

I downloaded both files to the flash and inserted to USB. When I boot up nothing happens it just hangs at the THINKPAD screen...f8 f5...nothing....it's like its frozen on that screen. The light is on the flash drive so it is attempting to read it...but nothing.

[emeraldnzl]

What OS is your machine and is it 32-bit or 64-bit.

Also you could try formatting the flash drive you are using, then download FRST to it and try again.

[Sab30]

Windows 7...I'm not sure if it's 32 or 64 so I down loaded both as per the instructions. I will try formatting the USB....are there any tricks to doing that?

[emeraldnzl]

I'm not sure if it's 32 or 64 so I down loaded both as per the instructions.

If you are not sure, yes do try them both, but try them separately i.e. one at a time by itself on the flash drive.

Try the 32-bit one first.

To format your USB stick follow the instructions at the link below:

http://www.ntfs.com/quest22.htm

Tell me how you get on.

We do have other options but this one would be the best if we can make it work.

[Sab30]

Formatted successfully...tried both files separately and still hangs at the THINKPAD screen no matter what f key I use. Again their is a solid red light on the USB so it is being read but doesn't appear to be working.

[Sab30]

It doesn't take me to the "attempting to fix errors" loop while the USB is in but again just hangs.

[emeraldnzl]

Time for a different approach then.

This is a way to access your computer using a disk we will create.

Before starting you might like to print these instruction out so that you know what you are doing

• Download OTLPE.iso and save it somewhere you can get it.
• Insert a writable blank CD/DVD in your CD drive and click on the OTPLE.iso to burn a CD. NOTE:
• Reboot your infected system using the boot CD you just created.

Note : If you do not know how to set your computer to boot from CD follow the steps here

• The CD needs to detect your hardware and load the operating system...can take a bit of time, just be patient
  
• Your system should now display a Reatogo desktop.
  Note : as you are running from CD it is not exactly speedy
• Double-click on the OTLPE icon.
• Select the Windows folder of the infected drive if it asks for a location
• If asked "Do you wish to load the remote registry", select Yes
• If asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
  
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system.
• Right click the file and select send to : select the USB drive.
• Confirm that it has copied to the USB drive by selecting it
• You can backup any files that you wish from this OS
• Please post the contents of the C:\OTL.txt file in your reply.

[Sab30]

I completed the CD and the CD Rom does spin when booting, do I need to be hitting any buttons because if I don't while it is spinning it continues on to the "StartUp repair is checking your system for problems" screen and then the CD just quits.

Just as a note at that screen where it hangs up I also have a warning box entitled RecEnv - Corrupt File and described it as D:\Windows\System32\csrss.exe is corrupt and unreadable. Not sure if that is common with the normal error loop you have seen.

[Sab30]

I tried changing the boot order making the CD first but that didn't seem to help

[Sab30]

OKAY not sure what happened but I have accessed the Lenovo Rescue and Recovery page...I have a couple options available to "rescue files" or "full restore" I wont touch anything until I hear back...

[emeraldnzl]

I tried changing the boot order making the CD first but that didn't seem to help

Hmm... I don't know what is going on there. You should be booting to the Reatgo desktop per instructions. That would allow us to access your computer and data. It is a good way to back up things when your computer won't boot normally. It would also allow us to carry out actions to remove malware or fix other problems.

Maybe a bad burn or corrupt download... don't really know.

OKAY not sure what happened but I have accessed the Lenovo Rescue and Recovery page...I have a couple options available to "rescue files" or "full restore" I wont touch anything until I hear back...

I am not familiar with the rescue feature on Lenova (even though I have a Lenova thinkpad myself lol). Might allow you to access and backup your data or maybe fix corrupt files...

I found this, see link below:

http://support.lenov...cID=MIGR-4Q2QAK

I don't know what version you have but maybe you can download the instructions and they will be a help to you.

My guess would be that the full restore will remove all your data which would then be lost but you need to check it out.

[Sab30]

Okay Im going your way...the restore option from Lenovo may restore to a point that didn't exist and thus losing everything.

I reburnt the CD and it did boot from it starting to load the Reatogo - X-PE once the status bar is complete it attempts to load the Windows screen and then gives me the blue screen error of "a problem has been detected and windows has been shut down to prevent further damage"