[Octagonal]

Hi

A neighbour said that they had pop-ups etc on their computer and I suggested that they run the obvious scanning programs and save a HJT log for me. Apparently, they had run CWS first and found and fixed a couple of CWS infections. Now this is where the problem lies. They can't boot their computer into either Normal or Safe mode. I went around and had a "look" and what they say about not being able to boot is true. When trying to boot the system it stops at the blue windows start screen (Normal and Safe mode). It would appear that the CWS removal has something to do with this. Can someone please point me in the right direction to enable me to help them to boot their computer.

The OS is XP Home Sp2.

I've tried "last known good configuration and can't get xp to load with that as well. I haven't tried a Windows Repair as I don't know how that would go as there is obviously infections on the system.

Thanks
Octagonal

Edited by Octagonal, 17 December 2005 - 04:02 PM.

[Advertisements]

did you get this resolved?

[coachwife6]

did you get this resolved?

[Bobbi Flekman]

What is the blue Start Screen? Could you be a little more specific in that? Can you explain exactly what happens? What do you see? Does it crash in a blue screen? If so, what is the error code? Etc.

The more I know, the easier it would be to help. It might be that one of the programs run killed off something vital...

If push comes to shove, does (s)he have a Windows CD?

[Octagonal]

Thanks for the assistance. It will be interesting to see a HJT log.

coachwife6
No not yet.

Bobbi Flekman
To answer your Q's.

1. Does not come up with BSOD, so no error code.

2. The computer starts to boot up. It goes as far as the black windows splash screen with the progress bar and then to the blue windows start screen as if windows is starting to load. That is as far as it gets, as if some (?) of the startup files are corrupt or missing. The system seems to just hang at this point. This happens when trying to boot into either Normal or Safe mode.

3. I was told that only CWS was run and that CWS found and fixed two or three instances. A reboot was prompted and then this was as far as they were able to progress.

4. Yes, a windows CD is available. When I had a look at the computer, I inserted the XP CD and was able to get to Recovery Console on the CD.

5. Just found out that the computer has a broadband connection, and is always connected to the internet. I don't know if this has any bearing on the problem.

Thanks again
"O"

[Bobbi Flekman]

5. Just found out that the computer has a broadband connection, and is always connected to the internet. I don't know if this has any bearing on the problem.

Yank out the cord for the broadband connection, and reboot... Does it? Otherwise start up in Recovery Console and run chkdsk, see if the disk is okay.

From memory, the point you describe where it hangs is the point where device drivers and vital services are loaded. One of them is messed up. Can you startup with a bootlog? That may explain which one is failing.

[Octagonal]

I'll do as you suggest. It's late here, so I won't be able to try your suggestions for about another 10 hours. Will post back with results then. Is it your opinion that CWS may not have caused this? Just curious.

Thanks again
"O"

[Bobbi Flekman]

Of course I can't rule out anything, but so far I never noticed CWS doing this.

[Octagonal]

The neighbours have been out all day. I caught up with them a short while ago and they were kind enough to let me have their computer while I try to sort this out. Will do as you suggested in your last post and reply shortly.

"O"

[Octagonal]

1. Unplugging the broadband connection and rebooting didn't make any difference.

2. Recovery Console - chkdsk reported OK without the /p switch, run with the /p switch and reported that a couple of areas require fixing. I didn't fix.

3. I enabled bootlog, but can't view the log. Currently setting up a bootable CD to view ntbootlog.txt

"O"

[Octagonal]

OK.

1. Not successfull with viewing the Ntbtlog.txt file.

2. When trying to boot to Safe mode, the last file loaded is Windows\System32\Drivers\Mup.sys then get the black screen with Safe Mode written at the top,bottom left and right sides. Then goes in the blue loading screen as described in previous post. Researching mup.sys is like looking counting the grains of sand on a beach, it just never stops.

Hmmm....just read this thread and I get the same thing about no P.O.S.T. beep until the blue loading screen appears. Becoming very confused.

It's starting to get late and I am becoming irriatable. Will persevere a little longer, then leave it till tomorrow. Starting to think about taking my chances with a Windows Repair.

"O"

Edited by Octagonal, 20 December 2005 - 07:32 AM.

[Octagonal]

Bobbi Flekman

Just got home from work and I am considering doing a drive image and then applying a Windows Repair. What would you suggest? Do you think that this may not be CWS related and maybe the topic moved to the Windows XP forum?

"O"

Edited by Octagonal, 21 December 2005 - 03:42 AM.

[Bobbi Flekman]

I think it is not malware related. I have no idea as of yet what the problem is, but if I have ideas I will post again.

[Octagonal]

Thank you for the sticking with this. I'll do the image and then the Repair. Will post back with results when completed.

"O"

[Octagonal]

UPDATE

I took the HD out and connected to another computer to do a drive image. Other system immediately found 2 trojans (win32.Vivada.A & win32.Secdrop.IK). Put HD back in original system and did a Windows Repair. Worked just fine. Currently installing, updating and scanning with obvious programs. Appears to have many infections. Will get owner to post a HJT log in this forum for further instructions.

Hope that this thread can help anyone else who runs into the bootup problem that I encountered.

"O"

[coachwife6]

Appears to have many infections.

I am interested in what infections it had. You can post the log in this thread and I will move it to malware. I would like to follow it.