15 replies to this topic

[fender]

Hi,

This has been a tough one. I had troubles getting MB to run at first. Then after following instructions from AdvancedSetup's post, I was able to do so. It went through the cleaning process fine and instructed me to reboot. Now, unfortunately Windows won't boot at all in any mode. It just reboots when Windows is loading and continues on an endless loop? I've been able to fix this in the past w/ the windows disk. But their isn't a disk for this particular computer and it won't let me do a repair with mine. Any ideas?

Thanks in advance

[exile360]

Greetings fender, you might try the Microsoft Diagnostic and Recovery Toolset (30 day trial) which can be downloaded here: http://www.microsoft.com/downloads/details...;displaylang=en
Install it on a working XP computer and burn the ISO then boot the infected computer from the ISO and see if you can use the System Restore function to get it to boot again.

Once you've done that please read the instructions here, but this time just save the log from MBAM and don't remove the infections yet:
http://www.malwareby...?showtopic=2936

and post your logs in a new topic here:
http://www.malwareby...php?showforum=7



When you post your topic in that forum explain why you didn't remove what MBAM found and paste a link to this topic in your post. Please be sure not to install any software or use any removal/scanning tools exept those that you are
instructed to by the expert who will be assisting you as doing so can make their job much more difficult.


I hope I was helpful. Good luck and safe surfing.

[fender]

exile360, on Dec 21 2008, 04:50 PM, said:

Greetings fender, you might try the Microsoft Diagnostic and Recovery Toolset (30 day trial) which can be downloaded here: http://www.microsoft.com/downloads/details...;displaylang=en
Install it on a working XP computer and burn the ISO then boot the infected computer from the ISO and see if you can use the System Restore function to get it to boot again.

Thanks for your help. While the program seems like it could very useful, unfortunately it seems all the restore points have been wiped out. The only one that showed up gave an error saying it couldn't find the .wdm file.

Since I originally posted, I went into the recovery console and ran a chkdsk /p. After I did that, it wouldn't even recognize windows at all. It kept booting to the gateway restore program (which I have no disk for). I felt I had no choice but to do a fixboot and a fixmbr. Nothing changed after I did. After running the MS D&R tool set, it at least recognizes windows again. It now brings up an error: unable to find system32\hal.dll . That seems like a pretty bad error to me. I did a search for it with the tool and it didn't come up. I'm starting to think this windows is trashed.

[AdvancedSetup]

It depends on how much time and effort you want to put into saving it and what resources you have available.

Did you create the bootable CD that Exile referred you to ?

That can check and restore many things for Windows. I've not run the tool in a long while though but it may not allow remote Registry editing which might be what is needed.

Does it get to the actual Logon window or does it reboot long before that?

You might need a tool like Ultimate Boot CD 4 Windows which has many remote tools for repair of a non operational Windows system.
If you can build this CD then you might be able to repair this broken one.

Ultimate Boot CD for Windows

[fender]

AdvancedSetup, on Dec 21 2008, 10:44 PM, said:

It depends on how much time and effort you want to put into saving it and what resources you have available.

Did you create the bootable CD that Exile referred you to ?

That can check and restore many things for Windows. I've not run the tool in a long while though but it may not allow remote Registry editing which might be what is needed.

Does it get to the actual Logon window or does it reboot long before that?

You might need a tool like Ultimate Boot CD 4 Windows which has many remote tools for repair of a non operational Windows system.
If you can build this CD then you might be able to repair this broken one.

Ultimate Boot CD for Windows

Yes, I did create the CD. It does allow me to edit the registry. But I really don't know what to do with it.
No, it never made it to the logon window. It would reboot as soon as you saw the windows logo. Now it doesn't reboot at all. It just stops with an error. It says "Windows could not start because the following file is missing or corrupt: <windows root>\system32\hal.dll. Then it says "Please re-install a copy of that file" which I did from the recovery partition. That didn't have any effect.

[fender]

AdvancedSetup, on Dec 21 2008, 10:44 PM, said:

You might need a tool like Ultimate Boot CD 4 Windows which has many remote tools for repair of a non operational Windows system.
If you can build this CD then you might be able to repair this broken one.

Ultimate Boot CD for Windows

I'll try to build this CD. It's funny because I actually have a copy of the Bart'sPE CD that a friend of mine gave me. But I don't think I know how to use it to it's full capabilities.

[AdvancedSetup]

Well a BartsPE disk alone is not enough, you need the other tools like those installed by UBCD4W

Okay, let us know when you have that CD built and we'll see if we can get the system repaired or not.

[fender]

Ok, I built the CD. I played around in it a bit. I stayed away from making any changes. I think a lot of this is over my head.

[AdvancedSetup]

No problem. It's quite late here for me so I'll have to provide some feedback tomorrow for you.

[AdvancedSetup]

Start the PC with the UBCD and there in the REGISTRY tools you'll find one that has the word REMOTE in it. Launch that one and allow it to load ALL profiles.

Then browse to this location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

What is in this key: Userinit


It should be this and only this in almost all cases: C:\WINDOWS\system32\userinit.exe,

Please post back what you find.

[fender]

AdvancedSetup, on Dec 23 2008, 07:49 PM, said:

Start the PC with the UBCD and there in the REGISTRY tools you'll find one that has the word REMOTE in it. Launch that one and allow it to load ALL profiles.

Then browse to this location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

What is in this key: Userinit


It should be this and only this in almost all cases: C:\WINDOWS\system32\userinit.exe,

Please post back what you find.

Sorry, been busy with Christmas stuff.

Yes, that is exactly what it says. Even with the comma. I made sure the load all profiles button was checked like you said.

[fender]

I don't guess there's a program in there that can help me a bit more automated. I know basic registry entries, but I don't know much more.

[AdvancedSetup]

I'm sorry Fender, don't have time to fire up UBCD right now - limited time and many other posts to respond to but take a look at the system disk repair tools and see if any of them can help ensure the disk, system integrity.

I'll try to get more time later tonight, or tomorrow to assist you with this. I was expecting that Reg entry to be invalid.

[exile360]

Greetings again Fender. You might take a look at this page, it has very thorough instructions on fixing that error: http://pcsupport.about.com/od/findbyerrorm...ssinghaldll.htm If you want to wait for AdvancedSetup to reply that's ok too of course, but you can at least familiarize yourself with the issues and fixes listed. I browsed through it and they know what they're talking about. Options 4, 5 and 6 in the list of fixes would be the most likely to help your situation. Good luck.

[fender]

exile360, on Dec 29 2008, 09:56 PM, said:

Greetings again Fender. You might take a look at this page, it has very thorough instructions on fixing that error: http://pcsupport.about.com/od/findbyerrorm...ssinghaldll.htm If you want to wait for AdvancedSetup to reply that's ok too of course, but you can at least familiarize yourself with the issues and fixes listed. I browsed through it and they know what they're talking about. Options 4, 5 and 6 in the list of fixes would be the most likely to help your situation. Good luck.

Hi, Thank you for that page. It was the boot.ini. I knew there was a way to repair it but I couldn't remember. I'll be saving that page. I think I did Fixboot, which didn't work.

[exile360]

Excellent, I'm glad it helped out. Good luck and safe surfing.