[Ianthe]

Hi, please help

I can't really find out where it all started and now the computer won't boot into win.

I just updated for windows and a couple of days after my kaspersky av said something about problems with updating database.

Then my harddisk makes some wird noise the nex few days(like it runs on full speed all the time). I get some different bluescreens and some popups shows up about my regkeys being fixed and stuff.

The first few times when booting it kept saying something about wanting to run check disk cause of my harddisk.

I started to reset everything and got into windows a couple of times. Then i tried to msconfig and unmark the startups. Now it wont load anymore.

please help.

Regards


Ianthe.

[Advertisements]

Hey User,
Sorry for the late replay
Hi
Welcome to Geeks to Go! My name is Michael and I am here to help you fix your computer.
If you have already received help elsewhere please inform me so that this topic can be closed.
If you haven't, please keep reading:
Note: Before we start the process you should:

• Know that I'm still in training here, so there may be a small delay between my answers, as each reply must be approved by a resident expert before I will be allowed to post it to you.
• POST your logs, don't attach them, as it makes it harder to read.
• Save or print these instructions as a part of the fix will be in safe mode where you will not be able to access the internet.
• Disable ANY programs that offer real-time protection features while executing my instructions. That includes your antivirus, antispyware, windows defender or any other program that offers protection. When you're clean or waiting for my next set of instructions, re-enable them .If you need any help disabling them, ask.
• Each time I instruct you to download a file to use it, please do it even if I have told you before to download it again. This is because these tools are frequently updated to detect newer infections.
• Last, as most of the tools we use here need administrative rights in order to function properly, I expect that you will be running them from an administrator account.

First I want to ask you some questions:

• What operating system are you using? (Like Windows XP/ Vista etc..)
• Do you have your Windows Installation disk? This is the disk that was used to install your operating system.
• When you try to boot the computer, what errors are popped up and what does it do?
• Can you access safe mode? To try this read here. If you can't what errors are popped up and how the computer acts?

Thank you

[michaelg9]

Hey User,
Sorry for the late replay
Hi
Welcome to Geeks to Go! My name is Michael and I am here to help you fix your computer.
If you have already received help elsewhere please inform me so that this topic can be closed.
If you haven't, please keep reading:
Note: Before we start the process you should:

• Know that I'm still in training here, so there may be a small delay between my answers, as each reply must be approved by a resident expert before I will be allowed to post it to you.
• POST your logs, don't attach them, as it makes it harder to read.
• Save or print these instructions as a part of the fix will be in safe mode where you will not be able to access the internet.
• Disable ANY programs that offer real-time protection features while executing my instructions. That includes your antivirus, antispyware, windows defender or any other program that offers protection. When you're clean or waiting for my next set of instructions, re-enable them .If you need any help disabling them, ask.
• Each time I instruct you to download a file to use it, please do it even if I have told you before to download it again. This is because these tools are frequently updated to detect newer infections.
• Last, as most of the tools we use here need administrative rights in order to function properly, I expect that you will be running them from an administrator account.

First I want to ask you some questions:

• What operating system are you using? (Like Windows XP/ Vista etc..)
• Do you have your Windows Installation disk? This is the disk that was used to install your operating system.
• When you try to boot the computer, what errors are popped up and what does it do?
• Can you access safe mode? To try this read here. If you can't what errors are popped up and how the computer acts?

Thank you

[Ianthe]

Hi Michael

I use win xp. Some different blue screens have showed up. I can not access safe mode anymore. It stop loading windows and either i have to reboot or a blue screen shows up saying something about hardware error or drivers for hardware is missing.

[michaelg9]

OK but do you have you Windows XP installation Disk? This is the disk that was used to install your operating system.
Thank you

[Ianthe]

Yes, i have got the win xp installation cd.

[michaelg9]

Hey,

Follow this guide to enter the Recovery Console. At the prompt type:

chkdsk /F

Then see what the output is, if there is any waring or error, and if any bad sectors or anything other was found and tell me.

Thank you

Edited by michaelg9, 22 June 2010 - 01:15 PM.

[Ianthe]

hi

I should check disk by typing CHKDSK /F or CHKDSK only?

[michaelg9]

Sorry, write this:

chkdsk C: /F

Supposing that the problematic driver is C:\
Tell me the results

[Ianthe]

Yes, it's C:. I typed CHKDSK and it just said there were one or more errors. I think i can get into win now. It also repaired some files i think.

[michaelg9]

Hey,

• Can you make sure that you can access windows now?
• Can you access safe mode now?
• Are there any errors in either mode?

Thank you

[Ianthe]

Hi

I can enter safe mode now.

When i boot to win, after it has run the loading with the windiws logo i get a blue screen.

[michaelg9]

Sorry. Posted without approval.
I'll be back in a little

Edited by michaelg9, 23 June 2010 - 03:41 AM.

[michaelg9]

Hey,

What is the blue screen in normal mode saying?

If you haven't access to internet from safe mode, you should download these tools from a clean computer and then add them in a usb. Then use that usb to copy these tools at your infected computer.

Download OTL to your Desktop (Firefox users right click and select save as..)

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scan box paste this in
  
  
  drivers32
  netsvcs
  %SYSTEMDRIVE%\*.*
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  nvraid.sys
  /md5stop
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\drivers\*.sys /90
  %systemroot%\system32\user32.dll /md5
  %systemroot%\system32\ws2_32.dll /md5
  
  
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs
• Note: To make it easier, if you can't find a way to post these commands under the custom scan box, you can download the file below to your usb, and then drag and drop it into the custom scan box:
  [attachment=42850:scan.txt]

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

• Double click GMER.exe.
  
• If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
• In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ...
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
    
    Click the image to enlarge it
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
• Save the log where you can easily find it, such as your desktop.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOTKIT" entries
Please copy and paste the report into your Post.

Thank you

[Ianthe]

Both safe mode and normal win boot makes a bluescreen.

When i go booting in normal, it asks if i want to check disk. I skip it.

It goes fast so i could only read something about dump.rep and mem equals none or something, couldn't see it.

I also tried to boot from a bootfix cd with OTL on. here it said PFN_LIST_CORRUPT and Technical information: *** STOP: 0x0000004E.

Running the CHKDSK Helped fix some files would it help to run it again?

[Ianthe]

Hi, sorry i post doubble, but i tried to boot from the bootfix cd again and this time i got into the desk and can run OTL from that CD.

Should i post the list in here or wait for other instructions from you?