[Mr Lucky]

Update...

As I couldnt save the D drive (only the C partition) via Dos because it stopped saying "insufficient memory", it gave me an idea to check my old external hdd where to I saved my c and d drive last year. Kaspersky found the Trojan win32 Scar nycd, leae and ktgr. As I cant run none of the rescue disks and something overwrites the shell, I will check among my dvds there was a windows se or whatever it is called window repair cd. I will attach an external dvd player to the sick laptop and lets see what it does.

Edited by Mr Lucky, 04 September 2016 - 04:25 AM.

[Advertisements]

Since it appears you have a good handle on how to run the fixes I won't repeat the instructions. Please download the attached file to your USB drive and run the fix. Please post back the resulting log and let me know if your machine now boots.

 

Thanks.

Attached Files

•  fixlist.txt   1.86KB   172 downloads

[BrianDrab]

Since it appears you have a good handle on how to run the fixes I won't repeat the instructions. Please download the attached file to your USB drive and run the fix. Please post back the resulting log and let me know if your machine now boots.

 

Thanks.

Attached Files

•  fixlist.txt   1.86KB   172 downloads

[Mr Lucky]

Fix results are attach FYI. thank you (I am still searching that windows fixer cd)

 

Fix result of Farbar Recovery Scan Tool (x86) Version: 27-08-2016
Ran by SYSTEM (08-09-2016 15:11:52) Run:2
Running from F:\
Boot Mode: Recovery

==============================================

fixlist content:
*****************
cmd: copy c:\windows\system32\config\software c:\windows\system32\config\software.g2g
S2 AVP15.0.1; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO)
S0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [143968 2014-03-31] (Kaspersky Lab ZAO)
S2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [36928 2014-07-02] (Kaspersky Lab ZAO)
S3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [119816 2015-01-14] (Kaspersky Lab ZAO)
S1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [36536 2014-08-12] (Kaspersky Lab ZAO)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [673976 2015-03-14] (Kaspersky Lab ZAO)
S1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2014-02-25] (Kaspersky Lab ZAO)
S3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [24672 2014-03-28] (Kaspersky Lab ZAO)
S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-08-08] (Kaspersky Lab ZAO)
S1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)
S1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [44992 2014-06-05] (Kaspersky Lab ZAO)
S1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [64200 2015-01-14] (Kaspersky Lab ZAO)
S1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [146240 2014-07-09] (Kaspersky Lab ZAO)
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbnmeaext; system32\DRIVERS\ZTEusbnmeaext.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

 
*****************


========= copy c:\windows\system32\config\software c:\windows\system32\config\software.g2g =========

The process cannot access the file because it is being used by another process.
        0 file(s) copied.

========= End of CMD: =========

AVP15.0.1 => service removed successfully.
kl1 => service removed successfully.
kldisk => service removed successfully.
klflt => service removed successfully.
klhk => service removed successfully.
KLIF => service removed successfully.
KLIM6 => service removed successfully.
klkbdflt => service removed successfully.
klmouflt => service removed successfully.
klpd => service removed successfully.
kltdi => service removed successfully.
Klwtp => service removed successfully.
kneps => service removed successfully.
ew_hwusbdev => service removed successfully.
ew_usbenumfilter => service removed successfully.
huawei_cdcacm => service removed successfully.
huawei_enumerator => service removed successfully.
huawei_ext_ctrl => service removed successfully.
huawei_wwanecm => service removed successfully.
massfilter => service removed successfully.
ZTEusbmdm6k => service removed successfully.
ZTEusbnmea => service removed successfully.
ZTEusbnmeaext => service removed successfully.
ZTEusbser6k => service removed successfully.

==== End of Fixlog 15:11:53 ====

 

restarted normally - last good known config - both black screens.

Edited by Mr Lucky, 08 September 2016 - 07:11 AM.

[BrianDrab]

Can you reboot and select "Enable Boot Logging" from the menu? And then attach the ntbtlog.txt file again.

[Mr Lucky]

here u r. and thank you for your help and patience.

 

http://expirebox.com...1e438c2538.html

[BrianDrab]

Darn. Unfortunately if you can't even get your machine running in Safe mode I'm not sure what else I can do here. Do you have the option to restore back to factory settings? I know you said that you really didn't want to but I'm not sure what else we can do here. If you have data that you need backed up first I can help you with this. Just let me know.

[Mr Lucky]

Ahhh. U were my only hope! Lets wait a bit, that windows fixer dvd is with my friend, that should find that malware which overwrites the shell. I managed to copy the entire C drive to an external hdd in dos. So reinstall windows will be the last option. I would like to find the reason as others might will have the same issue. now I am lucky that using the latop is not an urgency, we can test different things.

Are you aware of any kind of antivirus,malware finder which runs in dos? I tried to run the kaspersky dos starting icon but nothing happened. The only cd I can run is the win7 cd. It is interesting , as even ubuntu wont run! None of the antivirus rescue disks run, always says missing bootmgr. This thread is very clever. It is on drive D, as it has stopped the copy process and referred to not enough memory. when explorer.exe not running, the background still can be seen! This black layer between the mouse cursos and the desktop maybe not the explorer.exe . I have a feeling a virus scan in dos would work.

Edited by Mr Lucky, 10 September 2016 - 12:52 PM.

[BrianDrab]

If you copied your information over to another drive, couldn't you plug in that external drive to another computer and then run a scan of your choice? Or am I missing something?

[Mr Lucky]

On C drive couldnt find anything. The d drive was copied up to a certain point, then stopped due to the threads. However, I found the D drive stuff on an external hdd and there I found the 3x trojans. I cant delete them on the computer's D drive as nothing is working there. Is there any way to connect the sick computer in dos to my healthy one? So i can do a virus and spyware check. As u know I can go into dos via the win7 cd , or if I boot normally with the black screen maybe there is a way I can attach the 2 systems together. Any advice?

Edited by Mr Lucky, 13 September 2016 - 06:22 AM.

[BrianDrab]

I would try Windows Defender Offline.

http://go.microsoft..../?LinkId=215854

 

The general steps are to download the file to a working machine and run it. You will be prompted to put in a USB Thumb drive. Do this and follow the prompts to create a bootable USB drive.

 

Then boot the "sick" computer with this and run a full scan.

[Mr Lucky]

Ok, i do as u say!

[Mr Lucky]

So, nothing found, I downloaded the update fixer from Microsoft but it stopped in the middle of the process. I reinstalled windows for the C drive. As I have the sick B (boot) and C (windows with black screen) drives saved on the external hdd, my idea is to copy all the new windows folders to the external hdd and overwrite those files. Then format C and copying back everything from the external C to the empty C drive. What do u think of this rationale?

[BrianDrab]

Honestly I think your best way forward is to ensure you have a backup of your personal documents and data and re-install windows.

[Mr Lucky]

Yes, the newly installed windows has no black screen. So it was a system error. I just wanted to know what caused the explorer not opening.

[BrianDrab]

Unfortunately I don't believe I can help you determine exactly why this occurred. There are too many variables.