Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Boot won't complete from any source i.e. live cd's and o's disks


  • This topic is locked This topic is locked
8 replies to this topic

#1 jrmarto

jrmarto

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:10 PM

Posted 20 October 2011 - 06:10 AM

Don't know whether to just give up. Trying to work on an older HP Pavilion computer which is clearly badly virus infected but I can't get it to boot from any bootable source whatsoever. Have tried Windows disks, multiple off-line virus cleaning CD's (KAV 10, MSE Live, etc), and a couple of flavors of Knoppix. The system has 2 optical drives but one is clearly broken, so I only have access to one. What happens when I try to boot from the hard drive is that I get the "windows didn't load correctly" screen with the countdown and then it reboots. If I try to boot from a bootable cd the system begins the boot process appropriate for that cd, gets between 15 and 45 seconds into it, and then spontaneously reboots with no error message. If I attempt to boot from the HP recovery partition the system exhibits the same behavior, 15 seconds into it and then reboot.

I have taken the hard drive out and put it into an enclosure and scanned it for viruses offline with KAV and with MSE - both found multiple infections they cleaned. I also ran manufacturer diagnostics on the drive and it passed. I put the drive back in the system and no change. I have a USB CD drive I attempted to boot from, but it exhibited the same problem - cd's began to boot then restarted.

Apart from being unable to boot from any source the system shows no obvious hardware problems - it doesn't make any funny sounds, no funky flashing lights, doesn't shut itself off, seems to display properly. I can get into the BIOS and stay there as long as I want or make any changes I want. It sees all devices attached and at least attempts to boot from them.

Any ideas?

never mind, duh - bad RAM. Both sticks. Swapped out, can get to disks now.

Edited by jrmarto, 20 October 2011 - 07:22 AM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,381 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:07:10 PM

Posted 20 October 2011 - 07:56 AM

Thanks for providing us your self-resolution...happy computing :).

Louis

#3 jrmarto

jrmarto
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:10 PM

Posted 20 October 2011 - 09:52 AM

Bah, spoke too soon. Worked once to get to recovery console, now back to partially booting from CD and then crashing into the loop again. Anybody with any suggestions?

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,381 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:07:10 PM

Posted 20 October 2011 - 11:51 AM

If the system is infected...it's hard for me to do anything other than generalize.

You clearly have at least two options:

a. I can report the system as "unbootable" and one of the BC malware personnel will try to assist you with pertinent info.

b. You can invoke the system restore-to-factory-defaults option.

These options would apply...assuming that it is not a hardware problem of some type.

Since you have already tried the restore options and various boot options...I would be inclined to suspect a hardware issue. Such are not easy to pin down, since the only hardware items which can readily be tested are the RAM and the hard drive. There is no motherboard test that I am aware of (other than switching out), no PSU test I would conduct (other than switching out) and no CPU test (other than switching out).

The fact that you swapped RAM modules and achieved one successful boot...doesn't really tell me much (my knowledge is limited) but I would replace the CMOS battery on the system anyway...since it also is one of the components which can produce various glitches in any system when it begins to weaken or die.

I will place this on the BC list of unbootble computers and let one of our malware personnel see what they think :).

Louis

#5 jrmarto

jrmarto
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:10 PM

Posted 20 October 2011 - 12:17 PM

Thanks for your detailed response. No need to put it on the list of unbootables as it's clearly some sort of hardware issue. I have since been able to boot to Windows twice - once it failed at the log in screen, once I made it all the way to a desktop and poked around a bit.

I didn't have the correct memory to swap out - the system uses PC 3200 and all I had was a stick of 256 MB 2700 that I threw in there for a lark - once it booted up I ordered some PC 3200 which is on its way. Obviously the system isn't going to work well with 256 MB of too slow memory so I wasn't planning to go too deeply into potential malware removal prior to getting the new RAM.

I like your idea of the CMOS battery, although I've torn the system apart and it doesn't give me any warnings about date and time being reset. I think I'll wait till the new RAM gets here, see if that works, if it does, great, if not I will try changing the battery. If none of that leads to a stable system I'll just declare it a nebulous undiagnosable hardware failure and chalk it up to experience.

Thanks again!

#6 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,815 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:09:10 PM

Posted 20 October 2011 - 01:59 PM

Hi, :welcome:

Lets give it a try.

We will need to view the system status from an external environment. You will need a USB drive and a CD to burn. There will be several steps to follow.

Download GETxPUD.exe to the desktop of your clean computer
  • Run GETxPUD.exe
  • A new folder will appear on the desktop.
  • Open the GETxPUD folder and click on the get&burn.bat
  • The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
  • Click on Start and follow the prompts to burn the image to a CD.
  • Next download driver.sh to your USB drive
  • Also Download Query.exe to the USB drive. In your working computer, navigate to the USB drive and click on the Query.exe. A folder and a file, query.sh, will be extracted.
  • Remove the USB & CD and insert them in the sick computer
  • Boot the Sick computer with the CD you just burned
  • The computer must be set to boot from the CD
  • In some computers you need to tap F12 and choose to boot from the CD, in others is the Esc key. Please consult your computer's documentation.
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh
  • Press Enter
  • After it has finished a report will be located on your USB drive named report.txt
  • Then type bash driver.sh -af
  • Press Enter
  • You will be prompted to input a filename.
  • Type the following:

    Winlogon.exe

  • Press Enter
  • If successful, the script will search for this file.
  • After it has completed the search enter the next file to be searched
  • Type the following:

    volsnap.sys

  • Press Enter
  • If successful, the script will search for this file.
  • After it has completed the search enter the next file to be searched
  • Type the following:

    explorer.exe

  • Press Enter
  • After it has completed the search enter the next file to be searched
  • Type the following:

    Userinit.exe

  • Press Enter
  • After the search is completed type Exit and press Enter.
  • After it has finished a report will be located in the USB drive as filefind.txt
  • While still in the Open Terminal, type bash query.sh
  • Press Enter
  • After it has finished a report will be located in the USB drive as RegReport.txt
  • Then type dd if=/dev/sda of=mbr.bin bs=512 count=1


    Leave a space among the following Statements:

    dd is the executable application used to create the backup
    if=/dev/sda is the device the backup is created from - the hard drive when only one HDD exists
    of=mbr.bin is the backup file to create - note the lack of a path - it will be created in the directory currently open in the Terminal
    bs=512 is the number of bytes in the backup
    count=1 says to backup just 1 sector


    It is extremely important that the if and of statements are correctly entered.

  • Press Enter
  • After it has finished a report will be located in the USB drive as mbr.bin
  • Plug the USB back into the clean computer, zip the mbr.bin, and except for the mbr.bin zipped file, post the contents of the report.txt, filefind.txt and RegReport.txt in your next reply. The mbr.bin zipped file must be attached to your reply.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,530 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:10 PM

Posted 20 October 2011 - 02:24 PM

Hello, just letting you know I moved this topic to Here in the Virus, Trojan, Spyware, and Malware Removal Logs forum where it will stay.

Please remember to click the Watch Topic button at the top right and select Immediate Notification so you do not miss any replies now that you were moved.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 jrmarto

jrmarto
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:09:10 PM

Posted 21 October 2011 - 07:38 AM

Thanks so much for the help but I am all set - I found the right RAM and the system started up again and seems to be fine. Please close this case, thanks!

#9 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,815 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:09:10 PM

Posted 21 October 2011 - 10:54 AM

Thanks for the feedback.

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users