65 replies to this topic

[D-FRED-BROWN]

Let's give this a shot:

For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
  
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  
• Use the arrow keys to select the Repair your computer menu item.
  
• Select US as the keyboard language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
  
• Restart your computer.
  
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  
• Click Repair your computer.
  
• Select US as the keyboard language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

• 
  
  Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt
• Select Command Prompt
  
• In the command window type in notepad and press Enter.
  
• The notepad opens. Under File menu select Open.
  
• Select "Computer" and find your flash drive letter and close the notepad.
  
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
  
• The tool will start to run.
  
• When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

[jahjaylee]

I'm at work, but is there anyway to do this without using system recovery? The repair your Computer page shows up blank. There are no options just a some background.

[D-FRED-BROWN]

I suspect the reason your computer chocked is because ComboFix accidentally deleted a critical system file. We'll attempt to recover that and restore your computer to a working state.

Please do the following. You will need a USB drive with no less than 64 mb of space.

• Insert your USB drive.
  
• Press Start > My Computer > right click your USB drive > choose Format > Quick format
  
• Download xPUD 0.9.2 iso, saving the file to your Desktop.
  
• Download UNetbootin and save it to your Desktop as well.
  
• Double click the unetbootin-windows-latest.exe that you just downloaded.
  
• Select the DiskImage option then click the browse button located on the right side of the textbox field.
  
• Browse to and select the xpud-0.9.2.iso file you downloaded
  
• Verify the correct drive letter is selected for your USB device then click OK
  
• It will write files to your USB device and make it bootable
  
• Once the files have been written to the device you will be prompted to reboot ~ do NOT reboot and instead just Exit the UNetbootin interface
  
• Next, download dumpit and save it to the same flash drive where you installed xPUD.
  
• Remove the USB and insert it in the ailing computer
  
• Power on the computer and press F12 then choose to boot from the USB
  
• After selecting a language and readying the system, a Welcome to xPUD screen will appear
  
• Click the File tab
  
• Expand mnt by clicking the plus sign to it's left
  
• sda1,2...usually corresponds to your HDD
  
• sdb1 is likely your USB
  
• Double click dumpit.
  
• It will create some MBR copies on the USB drive.
  
• When it completes press Enter to exit the Terminal window.
  
• Remove the USB drive, then locate on it an mbr.zip file, and upload that here as an attachment please.

mbr.zip should be created on your flash drive, please attach it to your next reply.

[jahjaylee]

--------------. Ok, I'll try this as soon as possible.



Profanity removed -screen317

Edited by screen317, 14 June 2012 - 06:44 PM.
Profanity

[D-FRED-BROWN]

Please keep in mind this is a family forum. Foul language is not appreciated.

Let me know how things go. If you need any help, I'm here to assist you.

[screen317]

Are you still with us? This topic will be closed in a few days if we do not hear back from you.

[jahjaylee]

Hey Sorry. I've been swamped with work. I'm gonna try this out tonight and I'll get back to you. Sorry about the silence.

[jahjaylee]

Is this the correct dumpit?
http://www.downloadc...le/23854-dumpit

[D-FRED-BROWN]

The correct link is in my post along with the xPUD instructions.

[jahjaylee]

for me that just shows up as a txt file. Is that what it should be?

[D-FRED-BROWN]

It should be a zip file called mbr.zip

[jahjaylee]

it shows up as dumpit.txt and when i click on it, it is a wall of text.

[D-FRED-BROWN]

Okay, go ahead and upload that here .

[jahjaylee]

The Dumpit Txt is attached

Attached Files

•  dumpit.txt   86.63K   7 downloads

[D-FRED-BROWN]

Did you go through the procedure of accessing dumpit through the xPUD main screen?

[jahjaylee]

That is the original dumpit file downloaded from the link that you provided. I was not able to get the mbr.zip file you were referring to.
Sorry for the trouble.

[D-FRED-BROWN]

That's okay, no worries.

Go ahead and run ComboFix once again and post the new log it creates. If asked to update to a newer version, please allow it to do so.

[jahjaylee]

Sorry I haven't actually done the process yet. Is it important for me to have the actual dumpit file or can I run this without the dumpit file?

[D-FRED-BROWN]

Please re-read the instructions I've posted for you to use here. http://forums.malwar...ndpost&p=558657

Everything you need is outlined for you there.

[jahjaylee]

After choosing the language, the screen flashes white and the computer restarts. Thoughts?