Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

boot disk/safe mode


  • Please log in to reply
28 replies to this topic

#1 SJFP

SJFP

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 05 June 2010 - 12:23 PM

I was unable to get into safe mode via normal method. Used msconfig and still blocked. Now trying from boot disk (created from this site) the c drive has disappeared. External drive was initially identified as c drive. I have now removed external drive and c does not exist. I have tried the rest of the alphabet but it is not there. Help appreciated.
Initial problem was virus causing slow computer and random internet access. I ran Sophos, Kaspersky virus removal tool , Malwarebytes anti-malware and McAfee all came up clean, but problem not solved.

BC AdBot (Login to Remove)

 


#2 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:01:22 PM

Posted 05 June 2010 - 01:17 PM

You can enter safe mode via hitting F8 just after the BIOS POST Codes where it displays the RAM, Drives, and what not. Just before the Windows is loading splash screen.

Just before this:
Posted Image

#3 SJFP

SJFP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 06 June 2010 - 09:12 AM

Thanks for this, but that was the first method I tried which was blocked. Message: windows has been shut down to prevent damage to your computer. I am in a safe mode cycle which does not work and the boot disk does not work either. Computer is unusable and I am borrowing another computer to post this.

#4 coxchris

coxchris

  • Members
  • 1,151 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Atwater
  • Local time:06:22 AM

Posted 06 June 2010 - 09:55 AM

Could BIOS recognized your hard-drive. Run a BIOS Hard drive diagnostic if your bios has one?

AA in Computer Networking Technology

BS in Information Technology 

Comptia A+, Project+, L+

Renewable:  N+,S+

CIW Web Design Specialist, JavaScript Specialist,  Database Design Specialist 

LPIC-1, SUSE 


#5 hamluis

hamluis

    Moderator


  • Moderator
  • 56,298 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:08:22 AM

Posted 06 June 2010 - 09:58 AM

Generally...if a tool (Recovery Console, boot disk, etc.) does not recognize the existence of a partition/drive, the next thing I would do is attempt to run the appropriate hard drive manufacturer's diagnostic long test...on the questionable drive.

If by "safe mode cycle" you mean that the systems boots into safe mode continuously...let us know. If the system boots into safe mode, it clearly recognizes the partition/drive.

Louis

#6 SJFP

SJFP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 06 June 2010 - 10:53 AM

Thanks again. Yes the system boots into safe mode continuously, hence using boot floppy. C drive was there until system went into safe mode cycle and accessing from floppy. Intention was to rename boot.ini as recommended on safe mode/boot up page. The boot disk was created on an older computer running Windows 98 although the Windows XP version from Bleeping Computer was down loaded and run. The reason I did this was because I had difficulty creating a boot disk on the problem computer. I note that when it boots up it says Windows 98 starting, although Windiws XP referenced in text.
Drive C still there on BIOS page - SATA drive.

#7 hamluis

hamluis

    Moderator


  • Moderator
  • 56,298 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:08:22 AM

Posted 06 June 2010 - 11:18 AM

I guess that I'd like to know...just why you were trying to access safe mode...

<<Initial problem was virus causing slow computer and random internet access.>>

What is "random internet access"? Does that mean that you could not connect to the Web? Or you could connect but not visit any sites? Or what?

As for your reboot loop...that's commonly a symptom of certain malware problems, which are exacerbated when users attempt to invoke safe mode.

I will ask one of our Malware Team personnel to take a look at your situation and attempt to assist you.

From this point on...please take all suggestions/instructions from BC Staff personnel, please.

Louis

#8 marktreg

marktreg

  • Members
  • 403 posts
  • OFFLINE
  •  
  • Local time:01:22 PM

Posted 06 June 2010 - 11:21 AM

If your HD is SATA, some boot disks will not be able to recognise it. You make need to make a BartPE disk and add SATA drivers in order to recognise the disk.

http://www.nu2.nu/pebuilder/

http://www.terabyteunlimited.com/howto/Ima...%20Windows.html

See the Note in Section 8 of the second link about SATA drivers.

#9 SJFP

SJFP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 06 June 2010 - 11:37 AM

I was trying to get into safe mode to run virus scans/clean ups, as although scans I have indicated earlier generally came up clean, computer continued to run slow and there was a lot of internet activity when explorer was not running (noted by activity on router from that computer) and advertising pages were sometimes opened at random by explorer. Further runs of virus scanners sometimes indicated viruses reoccuring but being cleaned each time, indicating that virus was still on computer.

#10 marktreg

marktreg

  • Members
  • 403 posts
  • OFFLINE
  •  
  • Local time:01:22 PM

Posted 06 June 2010 - 12:13 PM

If you think you are still infected, I recommend that you re-post in the 'Am I infected? What do I do?' section. They are able to give you malware removal help in there.

Edited by marktreg, 06 June 2010 - 12:15 PM.


#11 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:09:22 AM

Posted 06 June 2010 - 12:39 PM

The boot disk you created in a Windows 98 machine is a FAT 32 File System. If wont read NT File System, thus the drives will be missing. Do you have an XP installation CD you can use to boot to the Recovery Console?

Here is a process to create an alternate Recovery Console Boot disk:

Please download ARCDC from Artellos.com.
  • Double click ARCDC.exe
  • Follow the dialog until you see 6 options. Please pick: Windows Professional or Home ,SP2 & SP3, whichever applieas
  • You will be prompted with a Terms of Use by Microsoft, please accept.
  • You will see a few dos screens flash by, this is normal.
  • Next you will be able to choose to add extra files. Select the Default Files.
  • The last window will allow you to burn the disk using BurnCDCC
Your ISO is located on your desktop.

Boot the computer with that CD.

If prompted, select any options required to boot from the CD. You will be prompted with the following options:

A. To setup Windows XP, press Enter.
B. To repair Windows XP installation using recovery console, press R.

Choose the option, "To repair the Windows XP installation using recovery console", press R. If an Administrator Password have been established, you will be prompted to type it in. If no Administrator Password exists, just press ENTER.

You will be presented with the following:

Microsoft Windows® Recovery Console
The Recovery Console provides system repair and recovery functionality.
Type EXIT to quit the Recovery Console and restart the computer.

1: C:\WINDOWS

Which Windows Installation would you like to log onto
(To cancel, press ENTER)?


Press the number assigned to the installation you need access to on your keyboard and hit Enter.

In this case and if only the above is displayed is 1.

At the command prompt, type the following command and press Enter:

Attrib -s -h -r C:\Boot.ini
Del C:\Boot.ini
bootcfg /rebuild

  • When you receive a message that is similar to the following message, press Y:

    Total Identified Windows Installs: 1
    [1] C:\Windows
    Add installation to boot list? (Yes/No/All)

  • You receive a message that is similar to the following message:

    Enter Load Identifier

  • This is the name of the operating system. When you receive this message, type the name of your operating system, and then press ENTER. This is either Microsoft Windows XP Professional or Microsoft Windows XP Home Edition.
  • You receive a message that is similar to the following:

    Enter OS Load options

  • When you receive this message, type /fastdetect, and then press ENTER.
Once this process is completed, type EXIT and press ENTER to restart your computer.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#12 SJFP

SJFP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 06 June 2010 - 01:39 PM

Thanks for the help. I now have a working computer again but safe mode is still blocked out. Any suggestions for accessing safe mode? Or is there some other route I should be following?

#13 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:09:22 AM

Posted 06 June 2010 - 04:21 PM

Lets scan:

Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • OTL should now start. Change the following settings
    • Change Drivers to All
    • Change Standard Registry to All
    • Under File Scans, change File age to 30
  • Under the Custom Scan box paste this in

    netsvcs
    set /c
    %SYSTEMDRIVE%\*.*
    safebootminimal
    safebootnetwork
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    /md5stop
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt (first run only). These are saved in the same location as OTL.
    • Please post the contents of these files in your next reply.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#14 SJFP

SJFP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:02:22 PM

Posted 06 June 2010 - 05:08 PM

Thanks but there is a problem running the scan, it hangs on "Scanning driver : WudfRd..."

I have tried rerunning and also after restarting computer, but it still hangs at the same point. Windows task manager shows programme not responding.

On starting computer there are now two versions of Windows XP and on going into windows the System Config Utility pops up with selective startup highlighted. Can I now change this to normal startup?

#15 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:09:22 AM

Posted 06 June 2010 - 05:41 PM

On starting computer there are now two versions of Windows XP and on going into windows the System Config Utility pops up with selective startup highlighted. Can I now change this to normal startup?


Two versions of XP? Change to Normal Startup.

See if you can download these to your infected computer. If not then download through your clean one and transfer and then follow the instructions.

Please download OTH.scr to your desktop

Note: If you are using Firefox right-click and use "Save link As". Otherwise, on some systems, FF attempts to open the file as a script and you will just see a bunch of gibberish.

Please download OTL to your Desktop
Please download the attached [attachment=59996:Scan.txt] to your destop

Double click the OTH file and select Kill All Processes, your desktop will go blank
Posted Image
Then select Start OTL
OTL will now run
  • double-click on the Custom Scans box and a message box will popup asking if you want to load a custom scan from a file
    Select Scan.txt that you downloaded
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Copy and paste the contents back here.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users