Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Blue Screen After Malware Removal Attempt


  • This topic is locked This topic is locked
21 replies to this topic

#1 cumulonimbus

cumulonimbus

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 12 January 2010 - 04:06 PM

Hi,

My Windows XP computer became infected with the Internet Security 2010 malware. I went through the steps given by Bleeping Computer to abort and remove it. Everything proceeded normally until the Malware Malbytes was just starting to remove/quarantine the thirty infections found when the BSOD appeared. I restarted my computer and the blue screen reappeared before Windows could start.

I don't know how to proceed further. I did not get a Windows disk from Dell when I bought the computer and did not make a record of the updates beforehand. Is there anything I can do? Thank you.

Jeff

BC AdBot (Login to Remove)

 


#2 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:31 AM

Posted 12 January 2010 - 06:46 PM


Hello! smile.gif
My name is Sam and I will be helping you.

In order to see what's going on with your computer I will ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.



Do you have access to another computer where you can burn a recovery disc?
If so, follow the steps here.
http://www.bleepingcomputer.com/forums/t/276527/how-to-create-a-bootable-xp-recovery-console-cd/

Let me know when you have the disc and we'll go from there.


Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#3 cumulonimbus

cumulonimbus
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 13 January 2010 - 10:41 PM

Thank you Sam. Sorry if there are delays between postings. I only have access to my daughter's laptop periodically, and I work most days.

I made a recovery disk thanks to the information you supplied and am ready to proceed. Thank you again.

Jeff

#4 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:31 AM

Posted 14 January 2010 - 08:36 AM

No problem. I'll work at your pace.


Insert the Recovery Disc that you burned and restart the computer.
Boot to the cd so you can access the recovery console.

When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER.
That should bring you to C:\Windows prompt. Type following command:

FIXMBR

You may get a prompt that says:

This computer appears to have a non-standard or invalid master boot record. FIXMBR may damage your partition tables if you proceed. This could cause all the partitions on the current hard disk to become inaccessible. If you are not having problems accessing your drive, do not continue. Are you sure you want to write a new MBR?

Answer Y

After that, type exit to reboot back into normal mode.


Let me know how it goes.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#5 cumulonimbus

cumulonimbus
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 14 January 2010 - 07:43 PM

Sam,

I installed the CD and booted to the CD. I wasn't prompted to enter a password, nor did I get any warning messages. Windows Setup sterted and took about a minute to load a bunch of files (visible at the screen bottom). After this was finished, I got the BSOD and this was the Stop message:

0x0000007E, (0xC0000005, 0xF748E0BF, 0xF78DA208, 0xF78D9F08,)
PCI. SYS - Address F748E0BF base at F7487000, Datestamp 3b7d855c



Then I shut the computer off. Did I make the recovery disk correctly? Anything else I can do? Thanks for your help.

Jeff

#6 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:31 AM

Posted 15 January 2010 - 08:25 AM

I was afraid of that. You haven't stated, but I'm assuming you are running Windows XP fully updated with SP3. Let me know if that's incorrect.

Assuming that, you will need to borrow a Windows XP setup disc, or request one from Dell. Dell will send you one.
Then follow the instructions here to create a XP slipstream disc that we can use.
http://www.bleepingcomputer.com/tutorials/slipstreaming-windows-xp-to-create-bootable-cd/


Let me know when you have this disc and we'll take it from there.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#7 cumulonimbus

cumulonimbus
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 15 January 2010 - 11:28 AM

Sam,

I do have a Reinstallation CD that came with the computer that I use here at work (also a Dell). It's labeled: "Reinstallation CD, Microsoft Windows XP Home Edition, Including Service Pack 1a". Will this work?

Also, will the process we are going through erase the files on my computer? If it has to be, it has to be, but It'd be nice to preserve them. I backed up my important stuff, but not everything. Thank you.

Jeff

#8 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:31 AM

Posted 16 January 2010 - 09:11 AM

Yes, that disc should work. In fact, try using it to access the recovery console just like you did before.

To run the Recovery Console from the Windows XP startup disks or the Windows XP CD-ROM, follow these steps:

1. Insert the Windows XP startup disk into the floppy disk drive, or insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer.
Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted.
2. When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
3. If you have a dual-boot or multiple-boot computer, select the installation that you must access from the Recovery Console.
4. When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER.

If you can get this far without seeing the same error you did before, type in this command at the prompt.

fixmbr


Once it completes type exit to reboot back into normal mode.


All of the steps we are taking now will not result in the loss of any of your files or data. We'll try everything we can to avoid that.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#9 cumulonimbus

cumulonimbus
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 17 January 2010 - 03:01 PM

Sam,

I booted to the Windows Installation CD, got to Windows Setup, but when I pressed R, nothing happened. I also pressed F3 to quit setup, but nothing. When I restarted my computer and went to press F12 for setup to try again, the computer kept taking me to the "how do I want to start Windows" prompt, ignoring my keyboard commands. Nothing was recognized, so I changed batteries in my wireless keyboard, restarted, and the keyboard worked fine until I got to the window to press "R" for the repair console. What I think is happening is that somewhere along the Installing Windows Setup, my keyboard is getting knocked out, because I can only get it to work again if I remove and replace the batteries and start over. Everytime I get to Windows Setup, my wireless keyboard has stopped being recognized. Any ideas? Thank you for your continuing help.

Jeff

#10 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:31 AM

Posted 18 January 2010 - 09:48 AM

Windows setup isn't recognizing the wireless keyboard. Do you have an old keyboard that you can plug in and use for this step? You can take any keyboard from another computer and use it.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#11 cumulonimbus

cumulonimbus
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 18 January 2010 - 03:52 PM

Figuring that was the problem, I tried to connect a keyboard from a very old computer here at home, but discovered my XP does not have the proper port. Do they all connect through USB now? (that's how my XP's wireless connects) Either way, I'll have to wait until I get to work on Tuesday and check the keyboard there on the computer that runs Vista. Hopefully...Thank you for your patience.

Jeff

#12 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:31 AM

Posted 18 January 2010 - 06:43 PM

Most of the newer keyboards will connect through a usb port. You can also get an adapter that will work if you don't have an available usb port.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#13 cumulonimbus

cumulonimbus
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 18 January 2010 - 10:06 PM

Sam,

I hooked up my keyboard with a USB connection (from a newer computer) and it behaved identically to my wireless one. It worked up to the point where Windows Setup asked if I wanted to press R for the recovery console. Then I was helpless.

Do you think it's perhaps not an issue with the keyboard, but that the computer is freezing up at that point? Anyway, I still can get no farther than that. Thank you.

Jeff

#14 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:31 AM

Posted 19 January 2010 - 07:32 AM

You need to use a keyboard with a ps/2 connection. It should be a purple connection.
http://www.computerhope.com/issues/ch000449.htm
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#15 cumulonimbus

cumulonimbus
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:11:31 AM

Posted 19 January 2010 - 11:26 AM

Sam,

My computer does not have a PS-2 port. It has only USB for keyboard and mouse. Do I follow the instructions for entering CMOS/BIOS in the link you posted and enabling legacy USB support?

Jeff




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users