Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

From Trojan Horse To Loops Setup Is Restarting Screen


  • Please log in to reply
8 replies to this topic

#1 Deprived

Deprived

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:35 AM

Posted 26 July 2010 - 02:36 AM

I will post what I wrote at a terrible forum where I didn't get any replies from. Hopefully you can help.\

My computer was infected by a trojan horse. My AVG antivirus caught it, but it still infected my computer. I didn't know what to do, so I deleted some files... which I thought were a part of the trojan horse. Anyways I tried doing system restore, but it wouldn't work. So I shut off my computer and tried booting it in safe mode. But it stopped at the loading driver isapnp.sys. I then tried going to recovery console by booting from a disc, but I don't know what to do. I'm stuck at the sorry for your inconvenience your computer shut down screen. It gives me the options to boot from safe mode, boot normally, or last best working settings. I trried it all but, I got no where. In recovery console I tried fix mbr and fixboot, but none them work.

Please, i'm desperately in need of help. i've been working on this for about 3 hours now. I have no other ideas. Please, help :thumbsup:

I'm taking risks, and I don't know what i'm doing. I think I messed up my comptuer and just lost all my files. Did the repair install **** up my computer?? I went to recovery console and deleted all drivers with 0 kb it starts up but it's attempting to reinstall my computer.


Ok i've come close to the problem. Now this is where i'm at. I repair installed my computer. I shut down during the setup because I thought it was reinstalling my computer. Then I tried going back to it, but it's stuck in a loop. It keeps restarting itself... It says Setup is restarting. Should I try fixmbr in recovery console? I tried repair reinstalling it again...

If anyone is following my problem, please... I sincerely request your intelligence in this matter. I've been working on this for about 5 hours now. I haven't even fixed the main root of the problem, which is my hard drive being infected by a trojan horse. But I will get to that when i fix this loop. Thanks again :flowers:

BC AdBot (Login to Remove)

 


#2 abauw

abauw

  • Members
  • 951 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Kebun Kelapa
  • Local time:10:35 PM

Posted 26 July 2010 - 04:45 AM

first I want to tell that I dont advise you about removal of the trojan you told...just wanted help on stoping isapnp.sys

Start Recovery console (boot with XP setup CD).
go to c:\windows\system32\drivers
type
"expand d:\i386\isapnp.sy_" (without quotes)
"expand d:\i386\pciide.sy_" (without quotes)

if you stops on isapnp.sys its doesnt mean that file has stopped...maybe after that file thas has stop (on loading process)...so lets copy file after it (pciide.sys)

go to c:\windows\system32\drivers
type
"dir" (without out)
check if there any 0 length on it...if you found it...just delete it...

:guitar: Take me to a place where time is frozen
You don't have to close your eyes to dream :busy:
You can find escape inside this moment :smash:
And I will follow  :whistle:


#3 Deprived

Deprived
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:35 AM

Posted 26 July 2010 - 05:16 AM

THANKS for your response, but I resolved the isapns problem. I'm stuck in the looping setup is restarting.

#4 abauw

abauw

  • Members
  • 951 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Kebun Kelapa
  • Local time:10:35 PM

Posted 26 July 2010 - 05:56 AM

what looping setup???
is it winxp repair setup???
in which process of setup is it???

:guitar: Take me to a place where time is frozen
You don't have to close your eyes to dream :busy:
You can find escape inside this moment :smash:
And I will follow  :whistle:


#5 hamluis

hamluis

    Moderator


  • Moderator
  • 55,723 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:35 AM

Posted 26 July 2010 - 08:06 AM

Clean install.

You have evidence of an infected system...and who can say how that has interacted with your efforts.

Repair installs are no cure for malware problems, only clean installs ensure the integrity of a system that has malware problems compounded by O/S problems, IMO.

<<I will post what I wrote at a terrible forum where I didn't get any replies from. Hopefully you can help.\>>

There are many reasons why readers/viewers/members...may not respond to a thread initiated by someone. Rather than go into all those...I suggest that you be grateful that no one gave you bad advice for problems which they did not understand or have experience with...rather than assume that every computer situation which arises...has some sort of pill which can be taken to overcome it.

<<I didn't know what to do, so I deleted some files...>>

The appropriate thing to do would have been to seek more expert assistance...by posting in an appropriate forum which deals with known malware issues. My guess is that you crippled your system by your approach, but that's only a guess.

If you brought your system to my doorstep, based on what you have posted thus far...I would just do a clean install to clear the system and give it a good base for dealing with future problems.

I will ask one of our Malware Team personnel to take a look at this thread and see if anything useful can be done now.

Louis

#6 Deprived

Deprived
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:35 AM

Posted 26 July 2010 - 11:10 AM

Thank you, also it's a repair install os setup. I fixed the issue of not being able to boot into my computer. But before I did this I repair installed my computer, and I thought it was reinstalling it and deleting all my files so I shut off my computer. Which probably corrupted the setup, hence the loop. So this is my new plan. I'm going to turn my unused Hard drive, that I used as a slave with my infected hard drive, to write a new OS on. After I install a fresh OS on this new hard drive, I will plug in my old infected hard drive as a slave and take off my needed files, then after i've got what I need i'm going to wipe the infected one. Will this work? will this cure the trojan horse?

Thanks for replies everyone :thumbsup:

#7 hamluis

hamluis

    Moderator


  • Moderator
  • 55,723 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:35 AM

Posted 26 July 2010 - 11:19 AM

Well...from my perspective...you are making a dangerous set of assumptions which many make.

a. That you only have 1 type of malware item to deal with.

b. That within that category...you have identified what is a problem.

c. That simple removal of same will provide resolution to your current malware problems.

I cannot advise you on how to deal with malware...that's what the BC Am I Infected forum is for and this is the XP forum.

Best advice I could suggest would be to initiate a thread in the AII forum, following the administrative rules/suggestions there.

I will move this thread to the AII forum.

Louis

#8 Deprived

Deprived
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:35 AM

Posted 26 July 2010 - 11:49 AM

But, I don't think the issue lies within the trojan horse that I have. It's the problem that I shut off during setup.

#9 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,070 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:06:35 PM

Posted 03 August 2010 - 02:47 PM

Hi Deprived, your plan to slave your infected drive is not bad, as long as you keep in mind you should only copy files that are known safe (before copying, you can scan them with an online scanner like ESET or Kaspersky).

This goes for all backed up data: one infected file can reinfect a complete computer.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users