Windows XP Boot Failure?

[The_Marksman]

New guy here and forgive me if this isn't the place for this.  Move it if it shouldn't be here.

 

Today I did a MBAR scan on an XP computer that I have in the other room and at the beginning of that scan a popup window came up mentioning that a .dll file had been detected that "might" be related to a rootkit.  It stated that if I didn't know what it was to click "No" and if MBAR crashed then run it again and click "Yes" to remove that .dll file. 

 

I stated MBAR and sure enough the computer crashed and then rebooted itself?  Ok so I restarted MBAR and it again asked me if I wanted to delete that .dll file so following the instructions I clicked yes and that message disappeared.  The scan started and about 10 minutes later that computer crashed again and now the only way I can get it to boot is in Safe Mode?

 

So I got my Windows XP install disk out and did a "Repair" but it still won't boot? 

 

So my question is, does anyone know what the name of that .dll file might be and is it possible for me to copy that file off of another computer and reinstall it in this one that won't boot?  I have another Windows XP box that I may be able to get that file from but it's different hardware?  Will that work?

 

And yes, I know I should have copied the name of that file before it was deleted but I'm 68, suffer from CRS at times and today was one of those days

 

Any help. 

 

Thanks

[exile360]

Greetings and welcome

I'm sorry that you encountered this issue. When launched, Malwarebytes Anti-Rootkit checks the AppInitDLLs registry key to look for any DLLs listed there. If it finds any, it displays the notification you saw, and when you allow it to do so by clicking "Yes" as you did, it removes it from the registry. The reason for this is because that registry key is often used by malware, in particular certain rootkits that would otherwise be able to prevent Malwarebytes Anti-Rootkit from detecting and removing them unless that entry is removed from the registry.

That said, it does not necessarily mean that the item was malicious, however Microsoft themselves advise software developers against ever using the AppInitDLLs key (more info direct from Microsoft about that may be found here).

It's possible that this was caused by an infection of some kind or that simply something was removed that should not have been. Unfortunately at this point there is no way of knowing, however I can offer this information which should prove helpful in getting your system up and running again without losing any of your data.

If you are unable or uncomfortable attempting any of the repair instructions listed on that page then please follow the instructions here and create a new topic in the area referred to in that post and they will assist you one on one with guided steps to attempt to get your system back up and running again and free of infection or if you prefer to be assisted via email, you may contact Malwarebytes Support and they will assist you via email to get your system back in working order again.

[The_Marksman]

Sorry for the late reply but "real life" interfears sometimes.  And thanks for the link as I did get that thing to boot again so it's up and running OK at this point.  

 

And thanks to all of you for the Malwarebytes software!!  I've used that software countless times over the yeas as it seems to be one of only a handful that will actually remove the crapware that's out there now. 

 

This was one of my few attempts at using MBAR and the first that gave me any sort of problems.  The computer in question has been infected multiple times in the past and probably needs to be reloaded, which was the next thing on my agenda had I not been successful at getting it to boot up. 

 

Ennywho, thanks again for your help.

 

The Marksman

[exile360]

Great, thanks for letting me know. I'm glad you were able to get it up and running again.

Please let us know if there's anything else we can do to help or any more info that we can provide to help you out .