Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer will not start


  • This topic is locked This topic is locked
55 replies to this topic

#1 Clay the Turtle

Clay the Turtle

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:08:22 AM

Posted 27 August 2010 - 04:20 PM

Hello everyone.

I've been my household's resident PC fix-it guy for ages. I've dealt with more sinister virus outbreaks than I care to count, but in the past I've always been able to fix it. But when I can't get a PC to start in any fashion, I'm genuinely flummoxed what to do.

After uninstalling Norton the other day in order to install Kaspersky, I had an infestation of malware. It prevented any exes from running. I managed to get Combofix to run by renaming it. It indicated root kit activity and cleared up a lot of things. After that, I managed to run Anti-Malware and get Kaspersky to install and run its own scan. I thought I had deleted most of the Trojans except one Kaspersky said it could not remove and recommended ignoring for now. Unfortunately I did not make a note of it's name. It was late, so I just went on with what little business I had left to do and turned the PC off. (It is a VAIO AR notebook).

Upon my next boot, Windows informed me it had a problem starting up and gave me its usual run of choices. Starting normally results in a hang with all the previous text remaining on the screen. Choosing "last configuration that worked" results in a black screen. Safe mode of any kind hangs at Isapnp.sys.

I had recovery console installed because of Combofix, but attempting to go there results only in a loading screen followed by a blue screen saying windows stopped loading to protect my system from damage. It says I should check for a infection - such sage advice! - and finishes with this code: STOP: 0x0000007B (0xF78D2524,0xC0000034,0x00000000,0x00000000)

I'm becoming increasingly concerned that nothing can be done. I have no XP install disc and Sony has not been cooperative in giving me one. All of my important files are on this computer and it is invaluable to me. Ironically I bought a backup drive with Kaspersky but had to deal with this infection first.

Thanks in advance to anyone who might can help. It means the world to me. I am currently writing this from an iPad, but I do have access to other PCs if need be.

BC AdBot (Login to Remove)

 


#2 Doug K.

Doug K.

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:22 AM

Posted 27 August 2010 - 08:10 PM

Hi Clay. I am working on a similar issue, though I've gotten past the boot up issue. What I discovered from some Googling is that either a virus or malware had dropped some empty, zero byte files in the /windows/system32/drivers folder. I booted up using my Dell Windows repair disk to a command prompt, cd to the folder, and looked for any .sys files that had zero bytes. Deleted them, then the computer booted. Unfortunately, before I found the solution, I had run the Dell Windows repair, which rolled me back to pre-SP1 days. Internet programs were all broken so I couldn't reload from Windows Update. Had to manually download SPs and install from CD. System still isn't right, will be working on it more this weekend.

I know you said you don't have a Sony repair disk. There are a number of programs out there that can at least get you a command prompt. One I tried, if I recall correctly, is pebuilder. Google it for download and instructions. I used it to gain access to a system my brother-in-law had hosed up. Good luck!



#3 hamluis

hamluis

    Moderator


  • Moderator
  • 55,753 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:08:22 AM

Posted 27 August 2010 - 09:11 PM

I will ask someone from the BC Malware staff to have a look...they are more knowledgeable about situations such as this.

Be patient, some one will try to help smile.gif.

Louis

EDIT: Request already made by DC3.

Edited by hamluis, 27 August 2010 - 09:15 PM.


#4 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,114 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:04:22 PM

Posted 28 August 2010 - 05:32 AM

Hello, please let me know if you have an XP CD and what service pack you have installed.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#5 Clay the Turtle

Clay the Turtle
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:08:22 AM

Posted 28 August 2010 - 01:38 PM

Doug: Thanks for taking the time to share your experiences. I'm going to wait for a few more replies before I take any action. This certainly sounds like a reasonable solution though, and I'm going to look into the command prompt program you mentioned.

hamluis: Thanks for bringing attention to this. I really appreciate it.

Elise: As I said in my post, Sony doesn't supply an XP install disc. Basically what they do instead is include a recovery partition that, were my computer able to start, I could use to completely set the PC back to factory. Even if I could have done this, however, I'd rather avoid it since it involves removing all personal data off the computer.

I'm 95% certain I have Service Pack 3 installed. I manage a lot of computers and sometimes it's difficult to keep them straight. The PC in question once had a virus that prevented Security Center from working properly, making it unable to receive service pack updates. But I'm nearly certain I resolved this a few months ago and installed all the latest Service Packs and updates. I do know with 100% certainty that it has Service Pack 2.

Edit: I will have access to a Dell XP install disc by Tuesday. I'm not sure if this will work or not since it is a Sony notebook, but I wanted to let you know.

Edited by Clay the Turtle, 28 August 2010 - 01:40 PM.


#6 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,114 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:04:22 PM

Posted 28 August 2010 - 02:02 PM

While Dougs solution is not bad, I am fairly sure this is a case of a patched driver, not a 0 byte driver.

We can investigate this in different ways; the easiest one involves an XP CD, but since you don't have one at hand, lets first try something else.

Download http://unetbootin.sourceforge.net/unetboot...dows-latest.exe to the desktop of your clean computer
  • Insert your USB drive
  • Press Start > My Computer > right click your USB drive > choose Format > Quick format
  • Double click the unetbootin-xpud-windows-387.exe that you just downloaded
  • Press Run then OK
  • It will install a little bootable OS on your USB
  • After it has completed do not choose to reboot the clean computer simply close the installer
  • Next download http://noahdfear.net/downloads/driver.sh to your USB
  • Remove the USB and insert it in the sick computer
  • Boot the Sick computer
  • Press F12 and choose to boot from the USB
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh
  • Press Enter
  • After it has finished a report will be located on your USB drive named report.txt
  • Remove the USB drive and insert back in your working computer and navigate to report.txt
Copy and paste the report.txt for my review

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#7 Clay the Turtle

Clay the Turtle
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:08:22 AM

Posted 28 August 2010 - 06:28 PM

Thanks so much for your help so far, Elise. Unfortunately I seem to have hit a snag. I formatted and installed/added files to the USB drive as you requested. However hitting F12 on the sick computer accomplishes nothing. I tried to google the issue, and got into my BIOS (PhoenixBIOS) by hitting F2. Under Advanced, there's an option for "External Drive Boot" that is disabled. I enabled it, but can undo this easily if this was the wrong course of action. Right below Network Boot is also disabled, but i left it alone. There is also a tab for boot order: 1) internal optical drive 2) floppy drive (Which has an (*) next to it, even though I have no such drive 3) internal hard disk drive 4) network.

Further googling led me to try the F10, F11, and Esc keys at startup. F11 does nothing, but F10 actually brings up Sony's factory restore. Again this is not a desired option since my files are still on the PC. Esc does what I think you wanted to happen with F12. It brings up a boot select, but only the hard drive is given as an option. It gives me an option to enter setup, but that just brings me to the BIOS setup as if I pressed F2.

Sorry I could not get you the diagnostic log. I haven't owned a desktop PC in over a decade, and I'm really rusty on messing with BIOS and boot orders and such. Thanks again for all your help, and I hope to hear from you soon.

Edited by Clay the Turtle, 28 August 2010 - 06:32 PM.


#8 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,114 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:04:22 PM

Posted 29 August 2010 - 04:05 AM

QUOTE
Under Advanced, there's an option for "External Drive Boot"

If you enable this, and your usb drive is plugged in, do you not get an extra option in the boot priority?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#9 Clay the Turtle

Clay the Turtle
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:08:22 AM

Posted 29 August 2010 - 07:19 AM

Not that I can see. It still only has the 4 items in the boot list. It lets me rearrange them, but I see no way to add a new one. It's possible I'm missing something, but I thoroughly explored all screens to the best of my ability. Thanks again.

#10 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,114 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:04:22 PM

Posted 29 August 2010 - 07:47 AM

In that case, lets create the xpud cd.

Please download xPUD for bootable CD: http://noahdfear.net/downloads/GETxPUD.exe
Save this file and run it. It will extract to a folder named GETxPUD in the same location. Open the folder and run get&burn.bat which will download version 0.9.2 iso. Once the download is complete, it will start a burning application that has all correct settings. Proceed and now try booting from that CD.

The other instructions once xPUD starts booting, remain unchanged.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#11 Clay the Turtle

Clay the Turtle
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:08:22 AM

Posted 29 August 2010 - 02:09 PM

Well that seemed to work! I got xPud to run and performed the rest of the instructions. Unfortunately, the only contents of report.txt is this:

QUOTE
Driver report for


I can explore the USB HDD fine via the mount folder. (It turned out to be sdc) However, sda1 and 2 appear to be blank. I don't know if this is the issue with the report or not.

Hopefully we can get somewhere eventually! Thank you once again.

#12 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,114 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:04:22 PM

Posted 29 August 2010 - 02:55 PM

Please see if you can right click on your sda1 and 2 drive and select "mount". If that works, try to execute the command once again.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#13 Clay the Turtle

Clay the Turtle
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:08:22 AM

Posted 29 August 2010 - 03:39 PM

Unfortunately, when I right click these drives, there is no option to mount. If I right click the USB HDD, there is no mount/unmount option there either. I looked through all the top menus and saw nothing. I wish one thing about my PC were straightforward!

I did notice it claims both sda1 and sda2 are only 1000-ish megabytes. My internal hard drive should be 100 GB, minus 500MB or so for the Sony Recovery Partition. Not sure if this is relevant.

#14 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,114 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:04:22 PM

Posted 30 August 2010 - 01:26 AM

Click Tool > Open Terminal.

Type mount /dev/sda1 /mnt/sda1 and press enter. Let me know if this command mounted your sda1 drive.

If so, mount sda2 the same way (replace the 1 in the command with a 2).

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#15 Luckily

Luckily

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:22 AM

Posted 30 August 2010 - 05:22 AM

To my own experience, you can try restore your computer's registry to a previous state or try to start your computer by using the Last Known Good Configuration feature. This helped me successfully log in the system after an incomplete Adobe uninstall process. Wish it help you, too!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users