[Nikolina]

Hello I'm having problems with Thinkpad edge, Windows 7, 64bit.
I had a pop out message from Symantec that my computer is infected with backdoor. Tidserve virus.
I followed their advice, downloaded their removal and the removal was apparently succesful.
However, when I tried to boot it up it goes into the Startup Repair Loop.
When I try to start windows normally, as soon as the windows logo animation appears, a blue screen very briefly flashes (So brief I can't read the message).
Then I am directed to another screen which indicates my options as either commencing the Startup Repair or Start Windows normally. If I start the Startup Repair, the process is not able to fix the problem automatically.
I have tried using Lenovo rescue and recovery to fix it with no luck.
I tried restoring the system using backup restore points but no luck again.

Also, prior to the problem occurring I was experiencing Google search redirect problem.

I hope someone can help :-) and thank you in advance!

[Advertisements]

Hi there

OK lets go in outside of windows. We will need to create a CD and additionally use a USB drive

Please print these instruction out so that you know what you are doing

• Download OTLPENet.exe to your desktop
• Download Farbar Recovery Scan Tool x64 and save it to a flash drive.
• Ensure that you have a blank CD in the drive
• Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads
• Your system should now display a Reatogo desktop
  Note : as you are running from CD it is not exactly speedy
• Insert the USB with FRST64
• Locate the flash drive with FRST64 and double click
• The tool will start to run.
  
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

[Essexboy]

Hi there

OK lets go in outside of windows. We will need to create a CD and additionally use a USB drive

Please print these instruction out so that you know what you are doing

• Download OTLPENet.exe to your desktop
• Download Farbar Recovery Scan Tool x64 and save it to a flash drive.
• Ensure that you have a blank CD in the drive
• Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads
• Your system should now display a Reatogo desktop
  Note : as you are running from CD it is not exactly speedy
• Insert the USB with FRST64
• Locate the flash drive with FRST64 and double click
• The tool will start to run.
  
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

[Nikolina]

Hi

Thank you for getting back to me.

I have burned the CD and saved FRST on USB.

When i tried to boot from CD it simply goes back to the same screen giving me two options:
1.to try recovery and fix with lenovo recovery
2. to start windows normally

It doesn't seem to even attempt to boot from CD.

I have changed BIOS priority options to
1. USB CDROM
2. USB HDD

I have also tried, by pressing F12 to enter temporary boot but the pop up window doesn't list CDROM as an option.

I have managed, by pressing F8, to get into Advanced Boot options including:
Safe mode,
Safe mode with networking,
Safe mode with command prompt
Enable Boot Logging
Enable low resolution video
Last known Good configuration (advanced)
Directory services restore mode
Debugging mode
Disable automatic restart on system failure
Disable Driver Signature enforcement

Start windows normally

Was i doing something wrong when trying to boot from CD? Or maybe my thinkpad edge is not enabled to boot from CD?
I have checked that the files have been burned on the CD so i'm assuming it is bootable.

Is there another way of doing this via Advanced Boot options?

Thank you!!!

[Essexboy]

Try last known good first

If that fails then try safe mode

Followed by safe mode with command prompt

Let me know which options work and we will proceed from there

[Nikolina]

I have tried all in that order.
Last known is followed by bluse screen immediately.
Safe mode and safe mode with command prompt start loading windows files and then they switche to blue screen and restart.

[Nikolina]

Just wondered if I should have inserted usb stick together with the CD when i tried booting from the CD earlier on?

[Essexboy]

OK I still have a few tools left

We will use an mobile operating system called xPUD, and a script called rst.sh to restore your computer.

Download http://unetbootin.so...dows-latest.exe & http://noahdfear.net.../xpud-0.9.2.iso to the desktop of your clean computer

• Insert your USB drive
• Press Start > My Computer > right click your USB drive > choose Format > Quick format
• Double click the unetbootin-xpud-windows-387.exe that you just downloaded
  
• Press Run then OK
• It will install a little bootable OS on your USB
• After it has completed do not choose to reboot the clean computer simply close the installer
• Download the following tool and save it inside the bootableUSB
• rst.sh
• Remove the USB and insert it in the sick computer
• Boot the Sick computer
• Press F12 and choose to boot from the USB
• Follow the prompts
• A Welcome to xPUD screen will appear
• Press File
• Expand mnt
• sda1,2...usually corresponds to your HDD
• sdb1 is likely your USB
• Press Tool at the top
• Choose Open Terminal
• In the open terminal window, type in the following:
  
  bash rst.sh
  
• Press "Enter" and let it run uninterrupted.
  
  (The program lists available Restore Points and will save a report enum.log located in the USB drive.)
  
• The program is finished when it say's "Done".
• Type "Exit" to close the terminal window.
• Please attached the enum.log file in your reply. (You may remove your USB drive when transferring log to a clean computer).

[Nikolina]

Hi

During bootloader installation onto USB a message pops up

"un32328.exe has encountered a problem and needs to close"

I have tried booting from USB still but a "Missing operating system" message appears.

Is the download link for xpud-0.9.2.iso ok because i had some problems downloading from there and had to open link in another window and save from there instead of usual download (if this makes sense).

Thanks

[Essexboy]

The link is good for me... We need to be able to get into the system somehow. When you boot with a CD in the drive do you get "press any key to boot from CD " prompt ?

Do you have the windows CD at all as we may well need to use the recovery console, although if the CD detection is not working there may be some difficulties there

I am just testing a way to put the recovery console onto a USB drive... May take a few hours for me to work out how it goes

[Nikolina]

No, i don't get "press any key to boot from CD" prompt, unfortunately.

I don't have windows CD either as the computer came pre-loaded with it from the shop

I have tried xPUD installation on another computer in the meantime, but continued getting the same error message.

Thank you for trying...

[Essexboy]

OK here we go I have tried this on my system and it works a treat

Download the following three programmes to your desktop :

1. Wintoboot
2. Windows 7 64bit RC
3. Farbar Recovery Scan Tool x64

Extract wintoboot to your desktop
Insert a USB drive of at least 4GB
Run Wintoboot



Drag and drop the Windows 7 ISO to the programme in the space indicated
Tick the Format box and accept the warnings
Press Do It

You will see it progressing



It will let you know when it is done
Then copy FRST to the same USB




Insert the USB into the sick computer and start the computer


When you reboot you will see this although yours will say windows 7. Click repair my computer


Select your operating system


Select Command prompt


At the command prompt type the following :

FRST64.exe and press enter
The tool will start to run.

When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

[Nikolina]

OK.
I've downloaded 3 files. I copied FRST64 to USB.

I've managed to get to the command prompt as per instructions.
This is what comes up in command prompt window:

Microsoft Windows [Version 6.1.7600]
X:\windows\system32>

When I type FRST64.exe i get the following...
'FRST64.exe' is not recognised as an internal or external command, operable program or batch file.

Edited by Nikolina, 05 May 2012 - 07:47 PM.

[Essexboy]

OK at the command prompt do the following :

Type .. (two dots)
Hit enter and that should take you up to X:\windows
Repeat and it will take you to X:\
Then type FRST64.exe


Sorry should have added that

[Nikolina]

I type .. but the same message comes up saying '..' is not recognised as an internal or external command, operable program or batch file.

[Essexboy]

The problem with the TDLserv infection is that there are several variants.. And I am not sure which one was on your system

I will run through several commands, one at a time to determine which variant it was

From the command prompt in the recovery console type the following and then try a boot to normal windows :


bootrec /FixBoot