Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Windows 7 will not load, all option safe mode... end up at a black scr

Started by khphoto1 , May 27 2014 03:37 PM

  • Please log in to reply

#1
khphoto1
Posted 27 May 2014 - 03:37 PM

khphoto1

    Member

  • Member
  • PipPipPip
  • 102 posts

Computer is a HP G72 running Windows7. When I turn on the computer it goes to the safe mode options screen. No matter what option I choose it loads the drivers down to CLASSPNP.SYS and then goes to a black screen with the (larger) white arrow. The mouse will move the arrow around but there is nothing else. I was able to use f2 to get into the HP Diagnostics, but each one showed nothing wrong. 

 

I have tried using the System Repair disc created when laptop was first purchased.  No help.  I've tried system restore to the oldest checkpoint available, no luck. 

 

I've used Geeks to Go before with great success, would you please help me with the steps to go through?

 

 


  • 0

Advertisements

#2
khphoto1
Posted 28 May 2014 - 10:37 AM

khphoto1

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 102 posts

I have downloaded the lastest copy of FRST and here is the resulting txt file:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02
Ran by SYSTEM on MININT-HO6O7BB on 27-05-2014 17:04:03
Running from H:\
Platform: Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingc...can-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingc...can-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo...very-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2012-07-14] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6486120 2012-07-14] (Realtek Semiconductor)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [Bing Bar] => C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\mswinext.exe [243544 2010-04-13] (Microsoft Corp.)
HKLM-x32\...\Run: [Microsoft Default Manager] => C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [288088 2009-11-11] (Microsoft Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ApnUpdater] => C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1646216 2013-03-31] (Ask)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Sendori Tray] => C:\Program Files (x86)\Sendori\SendoriTray.exe [83232 2013-10-07] (Sendori, Inc.)
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Default\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\User\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\User\...\Run: [Facebook Update] => C:\Users\User\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-20] (Facebook Inc.)
HKU\User\...\Run: [NETGEARGenie] => C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe [1044224 2013-04-07] ()
HKU\User\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [134648 2013-10-28] ()
HKU\User\...\Run: [Weather] => C:\Program Files (x86)\AWS\WeatherBug\Weather.exe [1653760 2012-11-20] (AWS Convergence Technologies, Inc.)
HKU\User\...\Run: [BackgroundContainerV2] => "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\User\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [1316640 2013-10-31] (Conduit)
AppInit_DLLs:  c:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL => C:\Program Files (x86)\Optimizer Pro\OptProCrash_x64.dll [4333896 2013-10-31] ()
AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [1008928 2013-10-31] (Conduit)
AppInit_DLLs-x32:  c:\progra~2\optimi~1\optpro~1.dll => C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll [4268872 2013-10-29] ()
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Severe Weather Alerts App.lnk
ShortcutTarget: Severe Weather Alerts App.lnk ->  (No File)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Severe Weather Alerts.lnk
ShortcutTarget: Severe Weather Alerts.lnk ->  (No File)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Services (Whitelisted) =================

S2 70e6ca8c; C:\Program Files (x86)\Optimizer Pro\OptProCrashSvc.dll [192664 2013-10-31] ()
S2 Application Sendori; C:\Program Files (x86)\Sendori\SendoriSvc.exe [120096 2013-10-07] (Sendori, Inc.)
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-19] (Just Develop It)
S2 DefaultTabSearch; C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe [573952 2013-10-07] ()
S2 DefaultTabUpdate; C:\Users\User\AppData\Roaming\defaulttab\defaulttab\dtupdate.exe [107520 2013-10-31] ()
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [240736 2013-10-07] (WildTangent)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S2 N360; C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
S2 NETGEARGenieDaemon; C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [232192 2013-04-07] (NETGEAR)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 Service Sendori; C:\Program Files (x86)\Sendori\Sendori.Service.exe [22304 2013-10-07] (sendori)
S2 sndappv2; C:\Program Files (x86)\Sendori\sndappv2.exe [3623200 2013-10-07] (Sendori)

==================== Drivers (Whitelisted) ====================

S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-18] (Symantec Corporation)
S1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-12-16] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-20] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\IPSDefs\20140404.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\VirusDefs\20140405.003\ENG64.SYS [126040 2014-03-11] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\VirusDefs\20140405.003\EX64.SYS [2099288 2014-03-11] (Symantec Corporation)
S2 NPF; C:\Windows\system32\drivers\npf.sys [35344 2013-10-05] (CACE Technologies, Inc.)
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-22] (Realtek Semiconductor Corp.)
S1 SRTSP; C:\Windows\System32\Drivers\N360x64\1404000.028\SRTSP64.SYS [796760 2013-05-15] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\N360x64\1404000.028\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-04-06] ()
S0 SymDS; C:\Windows\System32\drivers\N360x64\1404000.028\SYMDS64.SYS [493656 2013-05-20] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\N360x64\1404000.028\SYMEFA64.SYS [1139800 2013-05-22] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-22] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\N360x64\1404000.028\Ironx64.SYS [224416 2013-03-04] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\N360x64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-27 17:03 - 2014-05-27 17:04 - 00000000 ____D () C:\FRST
2014-05-24 12:33 - 2014-05-24 12:33 - 00641928 _____ () C:\Windows\Minidump\052414-89622-01.dmp

==================== One Month Modified Files and Folders =======

2014-05-27 17:04 - 2014-05-27 17:03 - 00000000 ____D () C:\FRST
2014-05-25 18:56 - 2012-05-11 10:13 - 00000000 ____D () C:\ProgramData\Recovery
2014-05-24 12:33 - 2014-05-24 12:33 - 00641928 _____ () C:\Windows\Minidump\052414-89622-01.dmp
2014-05-24 12:33 - 2014-04-14 13:55 - 00000000 ____D () C:\Windows\Minidump
2014-05-24 12:33 - 2014-04-14 13:54 - 413657603 _____ () C:\Windows\MEMORY.DMP

Files to move or delete:
====================
C:\ProgramData\mq7tdimqrj.bxx
C:\ProgramData\mq7tdimqrj.fvv
C:\ProgramData\mq7tdimqrj.reg


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-03-21 00:12:40
Restore point made on: 2014-03-21 01:08:44
Restore point made on: 2014-03-23 15:31:28
Restore point made on: 2014-03-23 16:52:59
Restore point made on: 2014-03-24 01:25:01
Restore point made on: 2014-03-24 01:27:23
Restore point made on: 2014-03-24 01:44:24
Restore point made on: 2014-03-25 00:35:56
Restore point made on: 2014-03-26 01:41:07
Restore point made on: 2014-03-28 00:12:00
Restore point made on: 2014-03-28 00:15:14
Restore point made on: 2014-03-28 00:48:09
Restore point made on: 2014-03-30 10:04:18
Restore point made on: 2014-03-30 16:18:33
Restore point made on: 2014-04-04 23:39:13
Restore point made on: 2014-04-05 01:59:24
Restore point made on: 2014-04-05 06:11:47
Restore point made on: 2014-04-05 10:25:55

==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3893.86 MB
Available physical RAM: 3191.59 MB
Total Pagefile: 3892.01 MB
Available Pagefile: 3187.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:446.45 GB) (Free:388.91 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.98 GB) FAT32
Drive f: (RECOVERY) (Fixed) (Total:17.01 GB) (Free:2.46 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: () (Removable) (Total:14.53 GB) (Free:14.52 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 1D505CB8)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=446 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=2 GB) - (Type=0C)
Partition 4: (Not Active) - (Size=17 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)


LastRegBack: 2014-03-30 12:52

==================== End Of Log ============================


  • 0

#3
DonnaB
Posted 30 May 2014 - 10:37 AM

DonnaB

    Miss Congeniality

  • GeekU Moderator
  • 8,529 posts
Hi khphoto1,

My name is Donna. I do apologize for the long wait in responding. No member is ever intentionally overlooked here at GTG.
My first post is going to be long, drawn out and full of questions, so please bear with me here.
Please read this post completely before beginning the fix. If there's anything that you do not understand, please don't hesitate to ask before proceeding.
  • Please note that I am a volunteer. I'm sure that at one point or another yours and my schedule may prevent immediate responses to meet our needs. Our patience will be a virture during this process
  • First of all, the procedures we are about to perform are specific to your problem and should only be used on this specific computer.
  • Please! Do not make any changes to your computer that include installing/uninstalling programs, deleting files, modifying the registry, nor running scanners or tools of any kind unless specifically requested by me.
  • Please read ALL instructions carefully and perform the steps fully and in the order they are written.
  • If things appear to be better, let me know. Just because the symptoms no longer exist as before, does not mean that you are clean.
  • Continue to read and follow my instructions until I tell you that your machine is clean.
  • If you have any questions at all, please do not hesitate to ask before performing the task that I ask of you, and please wait for my reply before you proceed.
  • Scanning with programs and reading the logs do take a fair amount of time. Again, your patience will be necessary. :)
Questions, questions, (sigh) and more questions. :upset:

I need you to be my eyes so I have a lot of questions here. Do elaborate as much as needed. The more you tell me, the better I can grasp the concept from your point of view.

Was an Addition.txt log created on the flash drive along with the FRST.txt after you ran the tool? If so, please post that log for my viewing pleasure.


When I turn on the computer it goes to the safe mode options screen

What does the screen say exactly at the top? Advanced Boot Options ~ Recovery ~ etc. Could make a difference.
 

No matter what option I choose it loads the drivers down to CLASSPNP.SYS and then goes to a black screen with the (larger) white arrow.

What happens when you do a hard shut down by pressing the Power button to turn if off? Which screen does it boot to when you reboot the computer and options do you have?
 

I was able to use f2 to get into the HP Diagnostics, but each one showed nothing wrong.

Each one what? When you access HP System Diagnostics you get the following options:

Start up test ~ did you try that? What were the results?
Run in test ~ did you try that? What were the results?
Hard Disk test ~ same questions as above
Memory test ~ again as above
Battery test ~ and again
Error log ~ is there anything of importance found within?

Was there any software or hardware changes just prior to when the problem began??
 

I've tried system restore to the oldest checkpoint available, no luck.

Did you try them all? What were the results. Any errors?
 

I have tried using the System Repair disc created when laptop was first purchased.

Is this a system repair disc or the system recovery discs? There is a difference. Recovery discs are to restore the computer to factory condition. The repair discs do not.

I'll be reviewing your FRST.txt log while I await your response.

Thank you,
Donna :)
  • 0

#4
khphoto1
Posted 30 May 2014 - 03:35 PM

khphoto1

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 102 posts

Thank you for picking up my 'ticket'/issue.  I am going out for today and will be very busy over the weekend.  I understand to not make any changes whatsoever unless instructed to.  I will be reading your response in detail and get back to you in the next day.  Kathy


  • 0

#5
DonnaB
Posted 30 May 2014 - 06:40 PM

DonnaB

    Miss Congeniality

  • GeekU Moderator
  • 8,529 posts
Hi Kathy,

Not to worry. At your convenience.

Donna :)
  • 0

#6
khphoto1
Posted 31 May 2014 - 10:38 PM

khphoto1

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 102 posts

Ok, here goes:

1. There was no Addition.txt log created on the flash drive.

2. When the computer goes to the SAFE mode options the top of the screen says "Windows Error Recovery".  Windows did not shut down successfully........

3. All shut downs have been 'HARD' shut downs, I do not know of another method without windows active.  On restart it repeats step two.

4. The HP System Diagnostics have the following results:

   Start Up Test - passed (took 45 minutes to run)

   Run in Test - I let run for 4 iterations - all items passed

   Hard disk test - passed

   Memory test - passed

   Battery Test - passed

   Error Log file only shows date and time of these tests and if they passed or failed.

5. I did not check all of the system restor checkpoints - only the one farthest back.

6. I made sure the disc if for a System Repair and not a System Recovery Disk.

 

I believe my brother saw a message that said 'update now' and he pressed it.  With all the fake ones out there, I believe he caught a virus.

 

What would you like me to do next?


  • 0

#7
DonnaB
Posted 31 May 2014 - 11:00 PM

DonnaB

    Miss Congeniality

  • GeekU Moderator
  • 8,529 posts

What would you like me to do next?

Thank you kindly! That does definitely fill in the gaps for me. :)

This is what I would like you to do:

For this process, we will need a USB Flash drive.

First. Let's protect the flash drive from becoming infected and transferring the infection.

If McSheild is not installed on the good computer, please do so by following the instructions below:

Download McShield2 to your desktop and install with default settings.
In the control center, select scanner and check unhide items on flash drives
mcshield%20unhide.JPG
Anytime you plug in a USB drive, McShield will scan the device.

Next:

Fix with FRST

Plug in the flash drive on the working computer:
  • Open notepad (Start > All Programs = > Accessories > Notepad).
  • Please copy the entire contents of the quote box below and paste into notepad.

    HKLM-x32\...\Run: [] => [X]
    HKU\User\...\Run: [BackgroundContainerV2] => "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\User\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun
    AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [1316640 2013-10-31] (Conduit)
    AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [1008928 2013-10-31] (Conduit)
    Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Severe Weather Alerts App.lnk
    ShortcutTarget: Severe Weather Alerts App.lnk -> (No File)
    Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Severe Weather Alerts.lnk
    ShortcutTarget: Severe Weather Alerts.lnk -> (No File)
    GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
    C:\ProgramData\mq7tdimqrj.bxx
    C:\ProgramData\mq7tdimqrj.fvv
    C:\ProgramData\mq7tdimqrj.reg

  • Click on File > Save as.., name it fixlist.txt and save it to the flash drive.


    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Next:

    Plug the flashdrive into the infected PC.

    To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Click on Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

    On the System Recovery Options menu you will get the following options:

    Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt
  • Select Command Prompt

    Next:
  • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press the Fix button.
  • It will make a log (Fix.txt) in the flash drive. Please copy and paste this log in your Topic.
    Try to start windows in normal mode now and let us know the results.

    Donna :)

  • 0

#8
khphoto1
Posted 01 June 2014 - 10:04 AM

khphoto1

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 102 posts

I have downloaded McShield2, run it against the flash drive, created the fixlist file on the flash drive.

I have plugged the flashdrive into the infected PC, ran frst64.exe and the log is:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-05-2014 02
Ran by SYSTEM at 2014-06-01 11:46:41 Run:1
Running from H:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKLM-x32\...\Run: [] => [X]
HKU\User\...\Run: [BackgroundContainerV2] => "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\User\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [1316640 2013-10-31] (Conduit)
AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [1008928 2013-10-31] (Conduit)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Severe Weather Alerts App.lnk
ShortcutTarget: Severe Weather Alerts App.lnk -> (No File)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Severe Weather Alerts.lnk
ShortcutTarget: Severe Weather Alerts.lnk -> (No File)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
C:\ProgramData\mq7tdimqrj.bxx
C:\ProgramData\mq7tdimqrj.fvv
C:\ProgramData\mq7tdimqrj.reg
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
HKU\User\Software\Microsoft\Windows\CurrentVersion\Run\\BackgroundContainerV2 => Value deleted successfully.
"C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll" => Value Data removed successfully.
"c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll" => Value Data removed successfully.
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Severe Weather Alerts App.lnk => Moved successfully.
ShortcutTarget: Severe Weather Alerts App.lnk -> (No File) not found.
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Severe Weather Alerts.lnk => Moved successfully.
ShortcutTarget: Severe Weather Alerts.lnk -> (No File) not found.
C:\Windows\System32\GroupPolicy\Machine => Moved successfully.
C:\Windows\System32\GroupPolicy\GPT.ini => Moved successfully.
C:\ProgramData\mq7tdimqrj.bxx => Moved successfully.
C:\ProgramData\mq7tdimqrj.fvv => Moved successfully.
C:\ProgramData\mq7tdimqrj.reg => Moved successfully.

==== End of Fixlog ====

 

I 'exit'ed the command prompt and then selected "restart".

 

It boots back up in the 'windows error recovery' screen but I selected to start up Windows normally.  Same results It says loading windows with a pulsing windows logo and then goes to the black screen with  a small arrow.

 

What's next?


  • 0

#9
DonnaB
Posted 01 June 2014 - 10:26 AM

DonnaB

    Miss Congeniality

  • GeekU Moderator
  • 8,529 posts
I'd like to see another FRST log. The instructions below should also generate a 2nd log named Addition.txt

Entering System Recovery Options.

To enter the System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Click on Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
On the System Recovery Options menu you will get the following options:


Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

  • Select Command Prompt

    Next:
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select Computer and find your flash drive letter and close the notepad.
  • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Under Optional Scan place a checkmark in Addition.txt
  • Press Scan button.
  • It will make 2 logs FRST.txt and Addition.txt on the flash drive. Please copy and paste this log in your Topic.
Thank you,
Donna :)
  • 0

#10
khphoto1
Posted 01 June 2014 - 11:18 AM

khphoto1

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 102 posts

Addition.txt was not created. Here is the other log:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02
Ran by SYSTEM on MININT-CRL81CJ on 01-06-2014 13:12:04
Running from H:\
Platform: Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingc...can-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingc...can-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo...very-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2012-07-14] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6486120 2012-07-14] (Realtek Semiconductor)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [Bing Bar] => C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\mswinext.exe [243544 2010-04-13] (Microsoft Corp.)
HKLM-x32\...\Run: [Microsoft Default Manager] => C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [288088 2009-11-11] (Microsoft Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [ApnUpdater] => C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1646216 2013-03-31] (Ask)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Sendori Tray] => C:\Program Files (x86)\Sendori\SendoriTray.exe [83232 2013-10-07] (Sendori, Inc.)
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-13] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Default\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\User\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\User\...\Run: [Facebook Update] => C:\Users\User\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-20] (Facebook Inc.)
HKU\User\...\Run: [NETGEARGenie] => C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe [1044224 2013-04-07] ()
HKU\User\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [134648 2013-10-28] ()
HKU\User\...\Run: [Weather] => C:\Program Files (x86)\AWS\WeatherBug\Weather.exe [1653760 2012-11-20] (AWS Convergence Technologies, Inc.)
AppInit_DLLs: c:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL => C:\Program Files (x86)\Optimizer Pro\OptProCrash_x64.dll [4333896 2013-10-31] ()
AppInit_DLLs-x32: c:\progra~2\optimi~1\optpro~1.dll => C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll [4268872 2013-10-29] ()
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)

==================== Services (Whitelisted) =================

S2 70e6ca8c; C:\Program Files (x86)\Optimizer Pro\OptProCrashSvc.dll [192664 2013-10-31] ()
S2 Application Sendori; C:\Program Files (x86)\Sendori\SendoriSvc.exe [120096 2013-10-07] (Sendori, Inc.)
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-19] (Just Develop It)
S2 DefaultTabSearch; C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe [573952 2013-10-07] ()
S2 DefaultTabUpdate; C:\Users\User\AppData\Roaming\defaulttab\defaulttab\dtupdate.exe [107520 2013-10-31] ()
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [240736 2013-10-07] (WildTangent)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S2 N360; C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
S2 NETGEARGenieDaemon; C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [232192 2013-04-07] (NETGEAR)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 Service Sendori; C:\Program Files (x86)\Sendori\Sendori.Service.exe [22304 2013-10-07] (sendori)
S2 sndappv2; C:\Program Files (x86)\Sendori\sndappv2.exe [3623200 2013-10-07] (Sendori)

==================== Drivers (Whitelisted) ====================

S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-18] (Symantec Corporation)
S1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-12-16] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-20] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\IPSDefs\20140404.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\VirusDefs\20140405.003\ENG64.SYS [126040 2014-03-11] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\VirusDefs\20140405.003\EX64.SYS [2099288 2014-03-11] (Symantec Corporation)
S2 NPF; C:\Windows\system32\drivers\npf.sys [35344 2013-10-05] (CACE Technologies, Inc.)
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-22] (Realtek Semiconductor Corp.)
S1 SRTSP; C:\Windows\System32\Drivers\N360x64\1404000.028\SRTSP64.SYS [796760 2013-05-15] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\N360x64\1404000.028\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-04-06] ()
S0 SymDS; C:\Windows\System32\drivers\N360x64\1404000.028\SYMDS64.SYS [493656 2013-05-20] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\N360x64\1404000.028\SYMEFA64.SYS [1139800 2013-05-22] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-22] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\N360x64\1404000.028\Ironx64.SYS [224416 2013-03-04] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\N360x64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-01 08:57 - 2014-06-01 08:57 - 00650280 _____ () C:\Windows\Minidump\060114-38797-01.dmp
2014-05-31 08:03 - 2014-05-31 08:03 - 00611488 _____ () C:\Windows\Minidump\053114-88218-01.dmp
2014-05-31 06:49 - 2014-05-31 06:49 - 00624688 _____ () C:\Windows\Minidump\053114-90012-01.dmp
2014-05-30 19:49 - 2014-05-30 19:49 - 00573208 _____ () C:\Windows\Minidump\053014-86549-01.dmp
2014-05-27 17:03 - 2014-06-01 13:12 - 00000000 ____D () C:\FRST
2014-05-24 12:33 - 2014-05-24 12:33 - 00641928 _____ () C:\Windows\Minidump\052414-89622-01.dmp

==================== One Month Modified Files and Folders =======

2014-06-01 13:12 - 2014-05-27 17:03 - 00000000 ____D () C:\FRST
2014-06-01 11:46 - 2009-07-13 19:20 - 00000000 ___HD () C:\Windows\System32\GroupPolicy
2014-06-01 08:57 - 2014-06-01 08:57 - 00650280 _____ () C:\Windows\Minidump\060114-38797-01.dmp
2014-06-01 08:57 - 2014-04-14 13:55 - 00000000 ____D () C:\Windows\Minidump
2014-06-01 08:56 - 2014-04-14 13:54 - 413137411 _____ () C:\Windows\MEMORY.DMP
2014-05-31 21:37 - 2012-05-11 10:13 - 00000000 ____D () C:\ProgramData\Recovery
2014-05-31 08:03 - 2014-05-31 08:03 - 00611488 _____ () C:\Windows\Minidump\053114-88218-01.dmp
2014-05-31 06:49 - 2014-05-31 06:49 - 00624688 _____ () C:\Windows\Minidump\053114-90012-01.dmp
2014-05-30 19:49 - 2014-05-30 19:49 - 00573208 _____ () C:\Windows\Minidump\053014-86549-01.dmp
2014-05-24 12:33 - 2014-05-24 12:33 - 00641928 _____ () C:\Windows\Minidump\052414-89622-01.dmp

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-03-21 00:12:40
Restore point made on: 2014-03-21 01:08:44
Restore point made on: 2014-03-23 15:31:28
Restore point made on: 2014-03-23 16:52:59
Restore point made on: 2014-03-24 01:25:01
Restore point made on: 2014-03-24 01:27:23
Restore point made on: 2014-03-24 01:44:24
Restore point made on: 2014-03-25 00:35:56
Restore point made on: 2014-03-26 01:41:07
Restore point made on: 2014-03-28 00:12:00
Restore point made on: 2014-03-28 00:15:14
Restore point made on: 2014-03-28 00:48:09
Restore point made on: 2014-03-30 10:04:18
Restore point made on: 2014-03-30 16:18:33
Restore point made on: 2014-04-04 23:39:13
Restore point made on: 2014-04-05 01:59:24
Restore point made on: 2014-04-05 06:11:47
Restore point made on: 2014-04-05 10:25:55

==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3893.86 MB
Available physical RAM: 3189.89 MB
Total Pagefile: 3892.01 MB
Available Pagefile: 3188.86 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:446.45 GB) (Free:388.91 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.98 GB) FAT32
Drive f: (RECOVERY) (Fixed) (Total:17.01 GB) (Free:2.46 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (GEEKS DEBUG) (Removable) (Total:14.53 GB) (Free:14.52 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 1D505CB8)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=446 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=2 GB) - (Type=0C)
Partition 4: (Not Active) - (Size=17 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)


LastRegBack: 2014-03-30 12:52

==================== End Of Log ============================


  • 0

Advertisements

#11
DonnaB
Posted 01 June 2014 - 04:56 PM

DonnaB

    Miss Congeniality

  • GeekU Moderator
  • 8,529 posts
Hi Kathy,
 

I believe my brother saw a message that said 'update now' and he pressed it.

Do you know what happened after that? Did he continue using the computer for awhile before he (or whoever) shut it down, or did the computer instantly shut itself down?

Please do the following. This scan could take an undisclosed amount of time to complete.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Click on Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
  • Select Command Prompt

    Next:
  • In the command window type c: and press Enter
  • In the command window type sfc /scannow and press Enter
  • Please note the space between sfc and /scannow
When the scan completes, the results will display in the command prompt window. A log will not be created so I will need for you to be my eyes and tell me if any fills were fixed from the results provided at the bottom of the window.
  • 0

#12
khphoto1
Posted 01 June 2014 - 05:36 PM

khphoto1

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 102 posts

He does not remember what happened.

 

The system scan will not run.  the comment is "There is a system repair pending which requires reboot to complete. Restart Windows and run sfc again." I typed exit and did pushed the 'shutdown' button but bringing it up again made no difference.  Same message occured.


  • 0

#13
khphoto1
Posted 01 June 2014 - 05:42 PM

khphoto1

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 102 posts

fyi

when I was trying to fix this myself I found I have multiple drives:

System is      C

HP Tools is    E

Boot        is    X

Local Disk     D

Recovery      F

CD drive       G

Flash drive   H

 

 

Also found F11 is System Recovery - I never tried this.


  • 0

#14
DonnaB
Posted 01 June 2014 - 07:09 PM

DonnaB

    Miss Congeniality

  • GeekU Moderator
  • 8,529 posts
This is a laptop, right? Disconnect everything from the computer except the power adapter and try booting into normal mode. I doubt it will boot, but I want to make sure it is not trying to boot into one of the other drives. Real shot in the dark.

F11 System Recovery is that same thing as restoring the computer to factory condition as it was when it was taken out of the box after purchase. This will solve all your problems. It will wipe the drive and reinstall the OS, correcting the fill corruption, removing all malicious files, etc. though if you have any personal files in this computer they will be gone forever unless you have a backup. You could also create and Use Puppy Linux Live CD to Recover Your Data .

I would like to discuss this with issue with my fellow associates, though I will hold off till you decide if you would like to restore to factory condition or not. I'm sure someone has a trick up their sleeve that could resolve the unbootable issue.

Let me know what you decide.

Donna :)
  • 0

#15
khphoto1
Posted 01 June 2014 - 08:27 PM

khphoto1

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 102 posts

is there anything in the bios I should check to be sure it is coming from the correct disk - is it C or X?


  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP