Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows XP freeze after welcome screen


  • This topic is locked This topic is locked
34 replies to this topic

#1 snowfall1040

snowfall1040

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:07:50 PM

Posted 13 October 2011 - 02:01 PM

IBM Thinkpad R52 is old, but was working fine. Now when I turn it on it loads windows and gets stuck on the windows welcome screen where I normally would press ctrl alt del and then enter my password (same problem in safe mode). The ctrl alt del key does nothing, the mouse just sits there about in the middle of the screen. Days prior to this windows problem, this machine had multiple malware problems including Open Cloud,6DSS92c31Apgjk.exe, Data restore and would not be surprised if my daughters machine had others. Following instructions for removal from the internet I must have obviously removed something important from windows that is causing the computer to hang at sign in. At this point, do you have any ideas of what I might try to regain use of windows? Or, alternately how do I back up the data on the hard drive as maybe it is time to get a new system anyway. This laptop runs XP pro. Thanks for any ideas you may offer. Your website has been very helpful in the past, should've gone to it first with the malware.

BC AdBot (Login to Remove)

 


#2 LouisR47

LouisR47

  • Members
  • 174 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Riverside, California
  • Local time:07:50 PM

Posted 14 October 2011 - 12:27 PM

If you have the Windows XP operating system disk you can boot to the disk and from recovery console do a check disk.
Or upon booting from your Windows operating disk choose to repair your install.

for recovery console select the first repair option. once you have come to the recovery console type chkdsk /r

for repair of operating system continue past the first repair option and choose the second repair option to do a repair install which will not delete your data.

if that doesn't work then you will ethier have to back up that data or wait until you get your new computer and transfer your data from your old hard drive to new computer.

#3 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:10:50 AM

Posted 15 October 2011 - 01:45 AM

I would tend to think that the current problem may well be malware-related from what you have posted, and if you wish I can ask that an experienced member of the Malware Removal Team respond to your topic and help you get the computer operational again. Let us know if you wish to do try that approach.

Running chkdsk /r may help. Performing a repair install may help. However, if the problem is caused by malware, then neither is likely to have any effect ... and I would tend to suggest that you leave those options for a later time.

Since you asked about backing up files from the non-working computer, I will post instructions for doing just that, and it would be a good idea to go ahead with it anyway, on the off-chance that the computer cannot be made to run Windows normally again.

If your computer is not able to boot into Windows or simply not able to access the internet, you can use a LIVE Linux operating system run from a bootable CD or flashdrive instead of Windows, to access the internet, to access files on the HDD(s) and do other tasks.

:step1: Using a working computer:
  • If you wish to use a LIVE CD ...
  • Download the Linux version of your choice (usually an .ISO image file).
  • There are many options to use for a LIVE CD. I suggest that you try one of the following:
  • Puppy Linux (download file size 128 MB)
  • Ubuntu (download file size almost 700 MB)
[*]Burn the .ISO image to CD: If you do not already have a suitable burning program for writing .ISO images to disc ...
  • Download and install ImgBurn.
  • Ensure that you UN-check the box agreeing to install the Ask toolbar during the installation.
  • Place a new (blank) CD disc in the drive tray.
  • Choose Write image file to disc.
    • Under Source, click on the Browse button: Navigate to and select the .ISO file that you wish to burn.
    • Place a check-mark in the box beside Verify.
  • Click Posted Image
[*]When the CD has been burned and verified as successful, it will be bootable.
[/list][*]OR ... if you wish to use a LIVE flashdrive ...
  • Go to UNetbootin - Homepage and Downloads and at the top of the page, click on Download (for Windows) to download the application.
  • Follow the instructions further down the page under the heading Installation & Screenshots.
  • Run the application to download and install the Linux version of choice to your flashdrive.
  • I suggest that you try one of the following:
  • Puppy Linux (download file size 128 MB)
  • Ubuntu (download file size almost 700 MB).
[/list][/list]
:step2: Boot the problematic machine from the LIVE CD or flashdrive.
  • (You may have to configure the Boot Menu or BIOS Setup Menu to boot first from the optical/CD drive or the flashdrive, which ever you are using.)
  • Choose to run the Linux operating system from the CD or flashdrive without making any changes to your computer.
    Do NOT install Linux on your hard drive.
  • When the Linux operating system loads ...
  • You will be able to navigate to all the files on your HDD.
  • You can backup your files by copying them to a flashdrive or an external hard drive.
  • Before using the internet (if you choose to use Puppy, for example) you may have to:
  • Configure/set up the internet connection
  • Download a favourite browser
    (With Ubuntu the foregoing should not be necessary.)
[/list]You may find one of the following guides useful:
Recover files from Windows XP hard disk using Puppy Linux

Recover files from Windows Vista hard disk using Puppy Linux

Recover files from Windows 7 hard disk using Puppy Linux

The easiest way to copy files/folders in Puppy is to drag-and-drop from one window to another. To do this open a window showing what you want to copy. Open another window showing the location that you wish to copy to .... and move the windows so that you can conveniently see both at the same time. Now, simply drag the items you wish to copy from one window into the other. Simple.

Edited by AustrAlien, 15 October 2011 - 01:46 AM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#4 snowfall1040

snowfall1040
  • Topic Starter

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:07:50 PM

Posted 15 October 2011 - 08:14 PM

Attached File  TDSSKiller.2.6.4.0_04.10.2011_20.46.30_log.txt   58.42KB   6 downloads

Thanks tremendously for the information on Puppy Linux!! Your instructions were great. Using that I have safely backed up all important data from this system. I would be greatful if you passed this windows not start problem along to a Malware removal team in case they could offer any help to get the old system to start back into Windows. I am attaching a file from TDSSKiller which I ran when following directions for removal of open cloud. Let me know if you or the malware team have any ideas.

In the meantime should I also try running the checkdisk? The CD's that I have for the IBM Thinkpad say product recovery CD on them, and there is 10 of them in the set. Is this the right product to use? I also have a Reinstallation CD for Windows XP service pack 3 ( a single CD), which is the operating system on this laptop but this particular CD is from a different computer, which is a Dell Desktop. Thanks again for any help you can offer!

#5 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:10:50 AM

Posted 16 October 2011 - 01:44 AM

Please sit tight and be patient.

I have requested that an experienced helper who specialises in malware-related un-bootable computers respond to your topic.

Thank you.

Hold off on running chkdsk for the time being: Wait for a response from the Malware Removal Team.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#6 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,205 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:03:50 AM

Posted 16 October 2011 - 03:54 AM

You allowed TDSSkiller to delete your input controller service and driver, which, in layman's terms means that Windows can't load keyboard and mouse.

We need to look for a replacement file as well as a system restore point to use to restore the service.

Try this please. You will need a USB drive.

Download GETxPUD.exe to the desktop of your clean computer
  • Run GETxPUD.exe
  • A new folder will appear on the desktop.
  • Open the GETxPUD folder and click on the get&burn.bat
  • The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
  • Click on Start and follow the prompts to burn the image to a CD.
  • Next download driver.sh and rst.sh and save them to your USB drive
  • Remove the USB & CD and insert it in the sick computer
  • Boot the Sick computer with the CD you just burned
  • The computer must be set to boot from the CD
  • Gently tap F12 and choose to boot from the CD
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Confirm that you see driver.sh and rst.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh -f
  • Type i8042prt.sys
  • Press Enter
  • After it has finished a report will be located on your USB drive named filefind.txt
  • Next, click Tools > Open Terminal again (if you closed the terminal), type bash rst.sh and press enter.
  • When finished, it will create a log called enum.log on your USB drive.
  • Remove the USB drive and insert it back in your working computer and navigate to filefind.txt and enum.log and post them for my review.

Edited by elise025, 16 October 2011 - 03:55 AM.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#7 snowfall1040

snowfall1040
  • Topic Starter

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:07:50 PM

Posted 16 October 2011 - 02:04 PM

Filefind and Enum attached, Thanks!

Attached Files



#8 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,205 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:03:50 AM

Posted 16 October 2011 - 02:42 PM

Please navigate to /mnt/sda1/WINDOWS/ServicePackFiles/i386/i8042prt.sys, and right click on this file, select Copy.

Now navigate to /mnt/sda1/WINDOWS/system32/drivers, right click in an empty space in this folder and select Paste.

Next, navigate to your USB drive, and make sure you see rst.sh. Click Tools > Open Terminal.

Type bash rst.sh -r and press enter.

Type 629 and press enter.

After the restore, restart your computer and let me know if your mouse and keyboard work now.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#9 snowfall1040

snowfall1040
  • Topic Starter

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:07:50 PM

Posted 16 October 2011 - 04:39 PM

No luck. The windows screen loads as it did before, when I hit ctrl alt del, an hourglass comes up really briefly then goes away. Nothing happens. Eventually the screen turns black (where before it would just start to scroll windows across the screen like it does it power save mode). Thanks for any more ideas you can suggest, and for the easy to follow directions!

#10 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,205 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:03:50 AM

Posted 17 October 2011 - 01:53 AM

Did all steps in my last post go as predicted?

Please restart your computer and tap F8. When the advanced boot options menu opens, choose Last Known Good Configuration and see if that works.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#11 snowfall1040

snowfall1040
  • Topic Starter

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:07:50 PM

Posted 17 October 2011 - 11:15 AM

Yes, it seemed as though each step was going ok. Should I repeat that process again? No luck with the Last Known Good Config, same symptoms. Thanks again,

#12 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,205 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:03:50 AM

Posted 17 October 2011 - 11:31 AM

Can you verify the following file exists: /mnt/sda1/windows/system32/drivers/i8042prt.sys

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#13 snowfall1040

snowfall1040
  • Topic Starter

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:07:50 PM

Posted 17 October 2011 - 01:34 PM

Yes, it appears in that directory.

#14 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,205 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:03:50 AM

Posted 17 October 2011 - 01:46 PM

On the welcome screen, does your mouse pointer move if you move the mouse?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#15 snowfall1040

snowfall1040
  • Topic Starter

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Local time:07:50 PM

Posted 17 October 2011 - 02:38 PM

No, mouse is stuck near middle of screen.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users