BleepingComputer.com: BSOD after I installed a fresh copy of XP Prof.

Hello,
SO yesterday I installed a fresh copy of XP professional and moved all my family pictures and other docs form an existing HD to the newly installed HD. I installed MacFee (from the ATT site) and scanned my HD. No issues.
Everything looked great till I went to a site which probably some how infected my PC. I noticed that the Antivirus Pro boxes started popping up. SO I started task manager and killed one of the tasks which looked like that was starting the Antivirus Pro. After that I just wanted to reboot the PC to make sure that Antivirus Pro didnt startup on next power up. But the PC is not starting up and always gives me BSOD for like a second and then reboots. I cannot even read what hex address it is pointing to. I tried starting the PC up in SAFE mode (or SAFE mode with networking or any other options that there for PU) and nothing works. I even inserted my XP disc in the CD ROM and set my BIOS so that PC boots up from CD but that doesnt even work.
Can any one help me with this issue?
Thanks in advance

Regards

Go into Task Manager and end all tasks
Then start a new task and type explorer.exe

Then try running this

We Need to check for Rootkits with RootRepeal

• Download RootRepeal from the following location and save it to your desktop.
  • Direct Download (Recommended)
    • Primary Mirror
      
    • Secondary Mirror
      
    • Secondary Mirror
      
    • Secondary Mirror
    
    
  • Zip Mirrors (Recommended if you have a slower connection or if the Direct Download mirror is down)
    
    • Primary Mirror
      
      
    • Secondary Mirror
      
      
    • Secondary Mirror
    
    
  • Rar Mirrors - Only if you know what a RAR is and can extract it.
    
    • Primary Mirror
      
      
    • Secondary Mirror
      
      
    • Secondary Mirror
  
  
• Extract RootRepeal.exe from the archive (If you did not use the "Direct Download" mirror).
  
• Open on your desktop.
  
• Click the tab.
  
• Click the button.
  
• Check all seven boxes:
  
• Push Ok
  
• Check the box for your main system drive (Usually C:), and press Ok.
  
• Allow RootRepeal to run a scan of your system. This may take some time.
  
• Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

----------------------------------

Please note: If Rootrepeal fails to run, try this step: Click Settings - Options. Set the Disk Access slider to High

Also try: right-click on rootrepeal.exe and rename it to tatertot.scr

Hi Mark
Thanks for the response.
But the problem is that I cannot go to windows at all (neither in normal mode nor in safe mode).
In normal mode when the windows startup I get the BSOD
In normal mode I dont even get that far. The computer reboot by itself (I havent even seen the windows getting to start up in safe mode).

Regards

All I can suggest is to try one of these rescue disks and maybe you can get it so it will at least boot


Vipre rescue disk
http://live.sunbeltsoftware.com/


If you cannot bootup normally, cannot transfer required tools to the infected machine and cannot download anything while in safe mode, then your options are limited to what security tools you have on your computer. If those tools do not work, then your options become even more limited.

Have you tried using System Restore from a command prompt in Safe Mode to return to a previous state before your problems began?

If that doesn't work. these are links to Anti-virus vendors that offer free LiveCD or Rescue CD utilities that are used to boot from for repair of unbootable and damaged systems, rescue data, scan the system for virus infections. Burn it as an image to a disk to get a bootable CD. All (except Avira) are in the ISO Image file format. Avira uses an EXE that has built-in CD burning capability.

• Avira AntiVir Rescue System - Tutorial for Avira Rescue CD.
  If you encounter problems running the Rescue Disk, you can get further assistance at the Avira Support Forum.
  
• Dr Web LiveCD. Be sure to print out and follow the instructions provided in the User Manual.
  
• F-Secure Rescue CD - Current version download & Rescue CD User’s Guide.
  Video: How to Remove Malware with F-Secure Rescue CD
  If you encounter problems running the Rescue CD, you can get further assistance at the F-Secure Support Forum.
  
• BitDefender LiveCD - Index of /rescue_cd
  If you encounter problems running the Rescue CD, you can get further assistance at the BitDefender Support Forum.
  
• Kaspersky RescueDisk - Index of /devbuilds/RescueDisk/
  If you encounter problems running the RescueDisk, you can get further assistance at the Kaspersky Support Forum.
  
• Users of Panda products can also try Panda SafeCD. The download consists of an ISO that you can either burn into a CD/DVD or create a more convenient Boot USB stick.
  If you encounter problems running SafeCD, you can get further assistance at the Panda Support Forum.

If you are not sure how to burn an image, please read How to write a CD/DVD image or ISO. If you need a FREE utility to burn the ISO image, download and use ImgBurn.

Note: In order to use a rescue disk, the boot order must be set to start from the CD-ROM drive. If the CD is not first in the boot order, the computer will attempt to start normally by booting from the hard drive. The boot order is a setting found in the computer’s BIOS which runs when it is first powered on. This setting controls the order that the BIOS uses to look for a boot device from which to load the operating system. The default will normally be A:, C:, CD-ROM. Different computers have different ways to enter the BIOS. If you're not sure how to do this, refer to:

• Changing Your Computers Boot Order
  
• How to Change the Boot Order in BIOS

Thanks Mark.
I think I will try your suggestion about the rescue disk
I did try to startup in Safe mode with command prompt and it doesnt even boot completely and reboots

One more thing. I curently have my BIOS set so that it should start from CD-ROM first. Now when I have my MS XP disc in shouldnt it start with the MS setup for windows which will allow me to "repair" my XP? Curently when I have the BIOS set to start with CD-ROM first I still see it starting up with the hard drive (boot seq. I have selected is 1. CD 2. Floppy 3. HD

Regards

garmanma, on Nov 19 2009, 09:07 PM, said:

When you have your BIOS set to boot to the CD drive and you insert the XP disk, it should start the setup process and then ask you what you want to do.
Either Repair or continue with installation

HI All,
So I bit the bullet and reinstalled the WIN XP (after backing up all the data)
But before I put it back on the network I wanted to get some suggestions as to what measures I can take so that I don't get into a similar situation again (or atleast I have some malware or some other app installed which can detect any intrusion). I plan on installing all the updates from MS first followed by installing anti-virus (MacFee or Norton). Any other advice? Any tutorial about this?

Thanks in advance for all the help.

BR

Read the pinned topics here:
AntiVirus, Firewall and Privacy Products and Protection Methods
http://www.bleepingcomputer.com/forums/forum25.html
You can post any questions you have there also



Tips to protect yourself against malware and reduce the potential for re-infection:
• "Simple and easy ways to keep your computer safe".
• "How did I get infected?, With steps so it does not happen again!".
• "Hardening Windows Security - Part 1 & Part 2".
• "IE Recommended Minimal Security Settings" - "How to Secure Your Web Browser".

• Avoid gaming sites, underground web pages, pirated software, crack sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.