BleepingComputer.com: Windows won't boot in any mode

Okay, so I did something fairly stupid, although it seemed like a perfectly logical idea at the time. I had been having problems with spyware on my PC that I was trying to clean with limited results. Apparently, this little bugger was hijacking my browser and lowering my security settings, including not allowing me to boot up in safe mode. So, I took the advice of someone from another forum to Run msconfig and manually pick "SAFEBOOT" from the BOOT.INI tab in the configuration settings, which should "force" my computer to only boot in safe mode.

Well, when I restarted my computer I discovered that it STILL wouldn't boot in safe mode, obviously because that virus/spyware program was still preventing it. Problem is (and you can probably see where this is going), it won't boot in normal mode either because my computer is set to only boot in safe mode! I even tried picking the option to return to the last known configuration and that doesn't work either. Windows will try to boot, and then I'll keep being returned to the boot options screen.

The worst part of all this is that I've continually procrastinated about backing up, and yes, I know that's stupid and yes, I'm kicking myself now! Obviously, the worry is that I can't get to my personal files. The spyware has not erased or corrupted those files - if I could boot up Windows, everything on the C drive would load normally, so it's not like having a virus that's wiped out my computer. So, is there a way to extract the files? Would I have to take it to the Geek Squad or some other place that specializes in that? Or is there a simpler way to handle this - some type of way to override the configuration settings so that I can boot up in normal mode?

Thanks in advance for any help!!
Becky

Just remove the hard drive from the system...temporarily attach it to a different system...and then move the data files you want to the media of your choice.

Of course...you will not be able to extract any programs installed or the O/S.

Louis

Thanks, Louis. But wouldn't I run the risk of infecting the other computer if there is still spyware on mine? Also, my work computer is a Mac and most people I know have Macs, so I doubt I could do that anyway.

Well...if the other system was unprotected or poorlly protected...yes, you'd run that risk.

I guess that it's just foreign to my nature to even think about making myself susceptible to infection...I tend to not ever consider such as a possibility on any system I deal with (be it mine or a friend's).

The way to negate such fears/possibilities...does not have to be enumerated, it's an old message that some users choose to ignore, as is their right.

Louis

I really don't understand your response. Are you actually interested in helping or just doing some metaphorical finger wagging? I have both Malwarebytes and Symantec security, both of which I update and run often. I don't open strange emails, I don't click random links, and I don't visit questionable websites. Somehow, I still got spyware on my computer. Acting as if you are impervious to infection (and I don't think ANYONE is) is very condescending. I really don't see how that type of an answer was warranted.

If there is only one way to salvage the files on my hard disk - the method you first suggested - then fine. But I'm guessing there are other ways to do this. If you don't know what they are, that's also fine, but then there was no reason for a disrespectful response.

I browsed these forums quite a bit before deciding to ask for help. Every thread I looked at seemed to be full of helpful and polite responses. I don't know...I guess all of those members are busy today.

There is a clever malware situation where in an attempt to remove malware by adding the /SAFEBOOT option through MSCONFIG or manually editing the boot.ini file, the system will never boot in any mode to allow you to remove the /SAFEBOOT option.

Read the article (at least the section above Conclusion) here:

http://www.bleepingcomputer.com/tutorials/how-to-start-windows-in-safe-mode/


What you should do is create a bootable XP Recovey Console CD, boot on that, rename you boot.ini, recreate your boot.ini without the /SAFEBOOT option, boot normally (although possibly still infected), then work on removing the malware.

Even if you still have a problem to fix, you will know what it's not when you get finished with this.

Here are my copy/paste directions to get you started:

You should first boot your PC into the XP Recovery Console using a bootable XP installation CD or a bootable CD with the XP Recovery Console on it.

You can make a bootable Recovery Console CD by downloading an ISO file and burning it to a CD.

The same XP Recovery Console commands can be run from the bootable Recovery Console CD.

The bootable ISO image file you need to download is called:

xp_rec_con.iso

Download the ISO file from here:

http://www.mediafire.com/?ueyyzfymmig

Use this free and easy program to create your bootable CD:

http://www.imgburn.com/

It would be a good idea to test your bootable CD on the computer that is working.

You may need to adjust the computer BIOS settings to use the CD ROM drive as the first boot device instead of the hard disk. These adjustments are made before Windows tries to load. If you miss it, you will have to reboot the system again.

When you boot on the CD, follow the prompts:

Press any key to boot from CD...

The Windows Setup... will proceed.

Press 'R' to enter the Recovery Console.

Select the installation you want to access (usually 1: C:\WINDOWS)

You may be asked to enter the Administrator password (usually empty).

You should be in the C:\WINDOWS folder. This is the same as the C:\WINDOWS folder you see in explorer.

RC allows basic file commands - copy, rename, replace, delete, cd, chkdsk, fixboot, fixmbr, etc.

From the command prompt window run the chkdsk command on the drive where Windows is installed to try to repair any problems on the afflicted drive. Running chkdsk is fine to run even if it doesn't find any problems.

Assuming your boot drive is C, run the following command:

chkdsk C: /r

Let chkdsk finish and correct any problems it might find. It may take a long time to complete or appear to be 'stuck'. Be patient. If the HDD light is still flashing, it is doing something. Keep an eye on the percentage amount to be sure it is still making progress.

Remove the CD and type 'exit' to leave the RC and restart the computer.

You do not have to adjust the BIOS again to boot on the HDD since the CD will not be present.

Before rebuiling your boot.ini file, read this article:

http://support.microsoft.com/kb/291980

cd \
attrib -s -h -r boot.ini
ren boot.ini boot.ini.bak
bootcfg /rebuild

When bootcfg /rebuild asks for Load identifier enter whatever is appropriate such as:

Windows XP Professional

When it asks for load options type:

/fastdetect

Press Enter.

Here is additional information about how to start Recovery Console:

http://support.microsoft.com/kb/314058

Here is additional information about the Recovery Console commands you will be using:

http://support.microsoft.com/kb/314058

You can consider adding RC as a boot option to your system.

A good idea (now that you have had this experience) is to create a bootable XP installation CD with the latest Service Pack already installed.

This post has been edited by joseibarra: 22 September 2009 - 05:00 PM

Here is the easiest way out.
Get any Linux Live CD. Boot into it. You will be able to see all your drives. Connect an external drive and copy all your folders.

Ofcourse assuming here that none of your folders are infected. But you can do a AV check from Linux (Clam AV) on those folders before doing the transfer.
Once you are comfortable with that you can format the HDD and install Windows from scratch.

Thank you both!

Since I am buying an external drive anyway (no more procrastination where backing up is concerned!) I will try skambale's suggestion first. I also finally got in touch with my brother who knows a lot about this stuff and he suggested the same and gave me a link to download Ubuntu. He also suggested that once I reinstall my OS that I could just install Ubuntu and use that instead of Windows since it's similar, free, and less susceptible to infection. Has anyone used that and, if so, does it work well? Better than Windows or pretty comparable?

Again, thanks so much for all your help.

If you are ok with using Linux i would suggest using Linux Mint. Its a derivative of Ubuntu - uses the same repositories and has all media codecs by default. Its a more jazzed up version of Ubuntu and follows the same development cycle.

Although, it will still be some learning curve, esp when it comes to doing the more techie stuff - like upgrades and driver installs. But once you get the gist of it - its much more intuitive and simpler than Windows and fun too. Not to mention its free of viruses.

-Sharad

This post has been edited by skambale: 23 September 2009 - 02:05 PM

I concur.

I have Ubuntu 9.04 Desktop Live CD and also Linux Mint 7 (Gloria) Live CD.

I prefer Mint 7 because you need additional plugins for Ubuntu and I am quite lazy.
Mint 7 has them already ( (inter alia) movies and soundfiles).

Both recognise external USB devices,
so if you only want to run the desktops from
the CDs, rather than install, it is useful, for recovery purposes,
as you can view the contents of your hard disk
without the interference of the installed OS
and copy anything off to an external disk,
or even a small flash/pen drive.

1. You MUST read the guides before choosing to install.
2. See 1.

To becky219

You were harsh with your countryman, Louis (Hamluis).
If you look through the forum, you will see
that he has helped on innumerable occasions.

becky219, on Sep 24 2009, 03:49 AM, said:

It is DIFFERENT ....

Go ahead with getting the external hard drive.
Go ahead with downloading and using the Ubuntu/Mint operating systems. Use them as LIVE CD operating systems to back up your data and to get "the feel" of them.
BUT ...
Don't be too rash about disposing of your tried and true XP ... Linux is not for everyone, and you may not be entirely comfortable without your XP! In that case you are able to use both or either as you choose.