BleepingComputer.com: Boot virus from nowhere....

Jump to content

Forum Rules

When posting your problem, do not run and post a ComboFix log. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.

If you have not received help after three days, please post a link to your topic HERE.
Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

Boot virus from nowhere.... Computer will not complete boot, recycles, no safemode start

#1 User is offline   mrmatt2 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 36
  • Joined: 17-June 09

Posted 13 April 2011 - 07:17 PM

Hi, I am not sure from where this came from, - from what site, but here it sits on my computer..

I have a homebuilt computer, XP OS,
MotherBoardECS Elitegroup A790GXM-AD3

I knew I had a virus as it downloaded a bunch of nasty things, including it stopping MSE from running. There was also the virus "WIN 7 antivirus" running. I hit RKILL 2x to stop everything. I ran spybot, and Malwarebytes. Mal found over 50 items, spybot found a few. Even after this the MSE would not start. Running spybot again, it came up with the one same item as it tried to delete previously - something called MSE overide.

SOoo Malwarebytes told me to reboot, I did, now the computer cycles to boot, but will not boot completely, it goes up to the windows screen just for half a sec then the computer reboots itself. Upon reboots, I see a flicker of a blue screen which I think would give me some info on what is being halted, but is waaay to quick.
Any Safemode option does not work, tries to launch, but reboots. Because of this I cannot put up any log files, etc.

I believe I have a boot virus.

I am able to get to the recovery console, but never dealt with that.
Read the information on the recovery console here at this site, -and on the computer proceeded as far as to it asking "Which windows installation would you like to log onto?" I hit "1" as I only have one OS loaded. ( I do have 2 HD though)

I am thinking the next step would be to type "FIXMBR" then "FIXBOOT".

Is this correct? I need some help here, just a little nervous about doing it and am looking for confirmation.

I did find this comment from browsing - came from hardforum:

FIXMBR grabs the original MBR code from the drive's EEPROM chip and restores it, effectively wiping out anything that might be in there, be it LILO, GRUB, a Windows bootloader, and any possible traces of a virus, etc. When that command is finished, the MBR is as good as it was the moment the drive passed QA testing at the factory.

FIXBOOT restore the native ability for Windows to boot with the NTLDR file and bootloader, simply put.

There's also BOOTCFG which lets you modify boot time parameters just like you can inside Windows by modifying the boot.ini file under Advanced System Properties.

There's also a proper order for the commands if you need to use them from the Recovery Console:

FIXMBR first, then FIXBOOT right after that, then type exit and press Enter to reboot the 'puter.

Hope this helps...



I would greatly appreciate some help or input. You guys have helped me in the past, so to me you are the last word on what to do. If possible I would rather not loose all my data here.


I figure even when this gets fixed, the virus still may be lurking?...another prob.

Thank you very much!

Matt

Also during the infection, my WIN PATROL was telling me new programs were being added and I denied them all. Hopefully this was not a mistake having it delete pertinent things that exist already on my computer (!?)

This post has been edited by mrmatt2: 13 April 2011 - 07:28 PM

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users