12 replies to this topic

[anon3134]

someone sent me a laptop that is having trouble booting. I can already tell I'm going to need to use Windows Recovery, but I don't know whether or not to get a copy of WinXP Pro or WinXP Home. I've put the hard drive in a desktop machine, and all of the files were hidden, but I'm able to see the files. Is there some way I can determine which copy I'm going to need?

[anon3134]

I tend to agree, but some guides say otherwise. Example: http://www.techspot..../topic8356.html

Please make sure it is the same version of Windows that is currently installed on your computer (ex. XP Home cannot repair XP Professional)

I already have a WinXP Home edition CD, but the person said it might actually be WinXP Pro, I'll just use the disk I have for now, because I don't see why it really should make a difference, unless the recovery console were to reached a point where it needed to copy new system files. What's the worse that can happen? lol

[anon3134]

Well, I'm able to get the F8 and OS choice menu. When I disable the automatic restart, I see that it's Windows XP Professional. I was hoping that this would just be a simple MBR issue, but the fact that I get the the boot menus to make me think it's seems to be something a little more serious. I'll try a boot.ini restore, and go from there. I hope it's not frowned upon here, but I've downloaded a WinXP Pro torrent. All I want to do is repair the computer. =/

[DarkSnakeKobra]

Well, I'm able to get the F8 and OS choice menu. When I disable the automatic restart, I see that it's Windows XP Professional. I was hoping that this would just be a simple MBR issue, but the fact that I get the the boot menus to make me think it's seems to be something a little more serious. I'll try a boot.ini restore, and go from there. I hope it's not frowned upon here, but I've downloaded a WinXP Pro torrent. All I want to do is repair the computer. =/

I highly suggest you don't do that. You never know what lies in the disc image as they could easily tamper with it and embed rootkits or other malware so that it silently installs into the system in the background. That's also illegal.

[exile360]

Well, I'm able to get the F8 and OS choice menu. When I disable the automatic restart, I see that it's Windows XP Professional. I was hoping that this would just be a simple MBR issue, but the fact that I get the the boot menus to make me think it's seems to be something a little more serious.

It still may be an MBR issue. The OS choices menu is the boot manager, which is something separate from the MBR, and most MBR infectors don't alter the OS choices menu at all.

[anon3134]

I highly suggest you don't do that. You never know what lies in the disc image as they could easily tamper with it and embed rootkits or other malware so that it silently installs into the system in the background. That's also illegal.

Are rootkits possible to detect when scanning from a separate installation of Windows?

[anon3134]

Btw, I've downloaded an alleged untouched copy of WinXP Pro, which didn't even include a CD key. I just hoping the integrated SATA drives work, and the recovery console will even find my hard drive. I might end up having to slip stream some drivers into my Home edition copy.

[anon3134]

Okay, I discovered a "native sata driver" setting in the BIOs, disabled it, booted with WinXP Home recovery, and so far so good. =]
I guess I can just get rid of those WinXP pro files I downloaded. I realize they often include malware, but those are just last resort things before I end up having to just install WinXP home on this computer.

[anon3134]

Update:

I was able to use the WinXP Home edition recovery console to get Windows to boot, so that guide was wrong. This is just for future references. I no longer need those illegally obtained WinXP copies, so I've deleted them. I booted into Windows, and it is pretty bad, but I've managed to get to the ComboFix website and run it. It has installed Windows Recovery Console on the machine, and is now scanning. There are MANY Windows options that have been altered. Things like right click, desktop icons, and worse the ctrl-alt-del. Basically all of the simple things we take for granted are all disabled. There's no real way of telling to what extent the installation has been altered. What's even worse, is that there's a timer that's resetting it all every so often. Is there some utility to restore common Window's settings?

In fact, as I write this, it doesn't look like ComboFix is making any progress at all. I'm afraid the malware may be blocking it from scanning or doing it's thing.

So far I've been working by using the winkey + r to get around and do what I can. I haven't tried yet, but I may be able to get the task manager up to with this... I just tried it while ComboFix is open, and the entire system locked up. This is definitely going to be a challenge. Any advise/help would be greatly appreciated, but I'm tooling along so far.

[anon3134]

(small update, for future references)
Ok, so I've managed to disable all non-microsoft startup services and processes, which has made a huge difference so far.

[Firefox]

Hello and welcome to Malwarebytes

This computer is definitely infected, and you should stop running all sorts of tools to fix it as it will make it harder to fix, and much worst, you may make it to where there will be no hope to to erase the whole drive. You should seek help from the experts to clean it up. Please follow the instructions below to get it cleaned up.


If you think you are infected, here are the steps needed to get your computer cleaned....

Please read the following so that you can begin the cleaning process:

Don't use any temporary file cleaners unless requested - this can cause data loss and make recovery difficult

You have 3 Options that you can choose from as listed below:

• Option 1 —— Free Expert advice in the Malware Removal Forum
• Option 2 —— Paying customer -- Contact Support via email
• Option 3 —— Premium, Fee-Based Support

OPTION 1

As we don't deal with malware removal in the General Malwarebytes' Anti-Malware Forum, you need to start a topic in the
Malware Removal forum so a qualified helper can help you fix any malware related problems/infections you may have.

• Please read and follow the directions here (http://www.malwareby...?showtopic=9573), skipping any steps you are unable to complete.
• After posting your new post, make sure under options, you select Track this topic and choose Immediate Email Notification,
  so that you're alerted when someone has replied to your post.

NOTE: Please do not post back to (bump) your topic within the first 48 hours.
Replying to your own posts changes the post count and helpers are looking for topics with zero replies.
If you reply to your own post helpers may think that you're already being helped and thus overlook your post.

• If there is no reply from any experts after 48 hours, you can reply to the topic, asking for help again.
  Or
• You may send a Private Message to a Moderator asking for assistance.

OPTION 2

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home)

OPTION 3

If you would like to use our Malwarebytes Premium Services, Comprehensive solutions to all your computer support needs—from installation and set-up to troubleshooting and tune-ups go to our Malwarebytes Premium Services support site here (http://www.malwareby...ium-support.php)

Please be patient, someone will assist you as soon as possible.

PS: Please use the "Reply to this topic" button not the Reply button when you start replying.