Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Black Screen & no safe mode...after cleaning a virus & getting Windows updates


  • Please log in to reply
16 replies to this topic

#1 jimpo

jimpo

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 13 September 2012 - 09:56 PM

Howdy.

A couple days ago I got the ultradefraggerfraud (as Symantec calls it) on my old old Dell Inspiron Latitude D620 running XP Professional. I successfully got rid of it (as far as I can tell all was working properly) by using AntiMalwareBytes in safe mode followed by Ccleaner. Everything was running normally afterward.

When I went to bed and shut down the computer, it automatically installed updates from Microsoft. The next morning, when I turned on the computer which had been working fine before, I got the black screen and blinking cursor. I cannot get into safe mode at all. Nothing happens when I hit f8 or f1 after turning on. All I get is the black screen and a loud beep whenever I hit any keys.

I can get into Setup, but I don't know what to do there (if anything).

Rather than just give up and reinstall Windows XP, I thought I'd try to see if anyone here can help. Since the laptop was working fine before Windows Updates, it makes me think that perhaps there's a simple way (or at least some way) to fix this. I really don't want to have to reinstall from scratch if I can help it. I'm convinced the Windows updates had something to do with this.

Can anyone help me?

Thanks.

BC AdBot (Login to Remove)

 


#2 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:12:09 PM

Posted 14 September 2012 - 09:23 PM

I can get into Setup, but I don't know what to do there (if anything).


Do you mean the recovery console?

Did you try running chkdsk /r ?

#3 jimpo

jimpo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 15 September 2012 - 09:10 PM

Thanks narenxp!

I can get into Setup by hitting f12 and once there I can get into the recovery console, which I do with my Windows XP disc installed. But once there I haven't a clue what to do because, well, that's the limit of my computer knowledge in this area.

Thank you for your suggestion to run chkdsk /r. I had not tried that -- since I had no idea what it was in the first place! I researched it upon your recommendation, and I'm running it now. It's slow! Hopefully it will do something.

Thanks for taking the time to suggest something to me. I really appreciate the help.

Edited by jimpo, 15 September 2012 - 09:11 PM.


#4 jimpo

jimpo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 16 September 2012 - 12:00 AM

Well, I ran chkdsk /r.

After it ran, it said it found and fixed some errors, but sadly the computer acts the same.

Black screen.

Help!

#5 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:03:09 AM

Posted 16 September 2012 - 12:07 AM

Re: blank black screen with blinking cursor
It sounds as though the MBR (MasterBootRecord) is infected &/or damaged, so let's take a look at it.

Please try the following: You will need a USB drive/flashdrive and a new blank writable CD.

:step1: Please do the following on a working computer:
  • Download GETxPUD.exe to the Desktop.
  • Run GETxPUD.exe
    A new folder will appear on the desktop.
  • Open the GETxPUD folder and click on get&burn.bat
  • The program will download xpud_0.9.2.iso, and when finished will open BurnCDCC ready to burn the image.
    Please be patient: This could take awhile - download file size 63MB.
  • Click on Start and follow the prompts to burn the image to a CD.
You will use this CD to boot the ailing computer from.


:step2: Boot the ailing computer with the xPUD CD.
  • (You may have to configure the Boot Menu or BIOS Setup Menu to boot first from the optical/CD/DVD drive.)
    A Welcome to xPUD screen will appear.
  • Click on File.
  • Expand the mnt icon on the left (click on the little arrow beside the icon).
    • sda1, sda2 etc. ...usually correspond to your HDD partitions
    • sdb1, sdc1 is likely to correspond to a USB flashdrive, external USB hard drive etc.
  • Click on the folder that represents your USB drive (sdb1 ?).
  • Click Tool on the top menu, and choose Open Terminal.
  • Type the following at the hash prompt:

    dd if=/dev/sda of=mbr.bin bs=512 count=1

    • Note: Leave a space between the following:
      • dd ... the executable application used to create the backup
      • if=/dev/sda ... the device the backup is created from (the hard drive when only one HDD exists)
      • of=mbr.bin ... the backup file to create - note the lack of a path - it will be created in the directory currently open in the Terminal
      • bs=512 ... the number of bytes in the backup
      • count=1 ... says to backup just 1 sector
        It is extremely important that the if and of statements are correctly entered.
  • Press the <ENTER> key.
    After it has finished a file will be located on your USB drive named mbr.bin.
  • Go to Home > Power Off > Turn Off and remove the flashdrive as the system shuts down.

:step3: On the working computer:
  • Insert the USB drive, and navigate to the file mbr.bin
  • Zip-up the mbr.bin file:
    • Right-click on the file and choose Send to .. > Compressed (zipped) Folder.
      A zipped folder will appear in the same location as the mbr.bin file.
  • Please attach the zipped file to your next reply.
    This will allow the MasterBootRecord of your hard drive to be checked to see whether or not it is infected &/or damaged.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#6 jimpo

jimpo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 16 September 2012 - 07:44 PM

Hi AustrAlien! Thanks so much for responding to my plea for help!

I did everything you said. My mbr.zip file is attached.

I look forward to hearing what you think about it. Thanks again!

Attached Files

  • Attached File  mbr.zip   112bytes   3 downloads


#7 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:03:09 AM

Posted 16 September 2012 - 07:57 PM

Something went wrong and the mbr.bin file does not contain the MBR (0 bytes size).

Please try again, ensuring that you enter the command exactly as given.

Edited by AustrAlien, 16 September 2012 - 08:00 PM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#8 jimpo

jimpo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 16 September 2012 - 08:54 PM

Hi AustrAlien.

I don't know what went wrong. (I have no idea of most of what we're doing, to be honest, but) I did follow the directions exactly and typed the command exactly.

After I hit enter, as with last time, the next lines appear:

1+0 records in
1+0 records out

Then the regular command line again. I just did it a third time and got the same 1kb size file (attached, for what it's worth).

I don't know what I'm doing wrong.

When I expand mnt I see:

sda1 which contains a Dell folder and lots of files
sda2 which contains many folders including docs & set, i386, program files, and many files
sda3 which is empty
sdb1 which is apparently empty but shows 16.4kb size
sdc1 which is my usb drive with my files on it


Do you have any other suggestions? Thanks!

Attached Files

  • Attached File  mbr.zip   522bytes   6 downloads

Edited by jimpo, 16 September 2012 - 08:55 PM.


#9 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:03:09 AM

Posted 16 September 2012 - 09:33 PM

You got it right that time! :thumbup2:

MBR Analyzer v1.1.0

File : C:\Documents and Settings\GEOFF\Desktop\jimpo_BC\mbr.bin

--------------------------------------------------------------

--OFFSET--  0-1-2-3-4-5-6-7-8-9-A-B-C-D-E-F-  0123456789ABCDEF

0x00000000  33C08ED0BC007CFB5007501FFCBE1B7C  3.м.|P.P..|
0x00000010  BF1B065057B9E501F3A4CBBDBE07B104  ..PW.˽..
0x00000020  386E007C09751383C510E2F4CD188BF5  8n.|.u.....
0x00000030  83C610497419382C74F6A0B507B4078B  ..It.8,t....
0x00000040  F0AC3C0074FCBB0700B40ECD10EBF288  <.t.....
0x00000050  4E10E84600732AFE4610807E040B740B  N.F.s*F..~..t.
0x00000060  807E040C7405A0B60775D28046020683  .~..t...u.F...
0x00000070  46080683560A00E821007305A0B607EB  F...V..!.s...
0x00000080  BC813EFE7D55AA740B807E100074C8A0  .>}Ut..~..t.
0x00000090  B707EBA98BFC1E578BF5CBBF05008A56  ...W.˿...V
0x000000A0  00B408CD1372238AC1243F988ADE8AFC  ...r#.$?...
0x000000B0  43F7E38BD186D6B106D2EE42F7E23956  C..ֱ.B9V
0x000000C0  0A77237205394608731CB80102BB007C  .w#r.9F.s....|
0x000000D0  8B4E028B5600CD1373514F744E32E48A  .N..V..sQOtN2.
0x000000E0  5600CD13EBE48A560060BBAA55B441CD  V...V.`UA
0x000000F0  13723681FB55AA7530F6C101742B6160  .r6.Uu0.t+a`
0x00000100  6A006A00FF760AFF76086A0068007C6A  j.j..v..v.j.h.|j
0x00000110  016A10B4428BF4CD136161730E4F740B  .j.B..aas.Ot.
0x00000120  32E48A5600CD13EBD661F9C3496E7661  2.V..aInva
0x00000130  6C696420706172746974696F6E207461  lid partition ta
0x00000140  626C65004572726F72206C6F6164696E  ble.Error loadin
0x00000150  67206F7065726174696E672073797374  g operating syst
0x00000160  656D004D697373696E67206F70657261  em.Missing opera
0x00000170  74696E672073797374656D0000000000  ting system.....
0x00000180  00000000000000000000000000000000  ................
0x00000190  00000000000000000000000000000000  ................
0x000001A0  00000000000000000000000000000000  ................
0x000001B0  00000000002C44631623AB4100000001  .....,Dc.#A....
0x000001C0  0100DEFE3F073F000000C9F501000000  ..?.?.......
0x000001D0  010807FEFFFF08F60100F8AF4E0980FE  ........N..
0x000001E0  FFFF17FEFFFF00A65009A05200000000  ......P..R....
0x000001F0  000000000000000000000000000055AA  ..............U

---------------------------[ MBR ]----------------------------

MBR_CODE        : XP MBR Code
MD5             : E8BD3AF046AD8F4F0FC977E67812CC1D
SHA1            : 467DDF5B08DF50402F42F54A0E580E77E2AC0238
PARTITIONS      : 3
DISK_SIGNATURE  : 1623AB41
SIGNATURE_ID    : AA55h

-----------------------[ PARTITION 1 ]------------------------

BOOTABLE        : NO
PARTITION_TYPE  : 0xDE ( Dell Utility )
PARTITION_SIZE  : 62.50 Mo
STARTING_SECTOR : 63
ENDING_SECTOR   : 128520
TOTAL_SECTORS   : 128457

-----------------------[ PARTITION 2 ]------------------------

BOOTABLE        : NO
PARTITION_TYPE  : 0x07 ( NTFS / HPFS)
PARTITION_SIZE  : 74.46 Go
STARTING_SECTOR : 128520
ENDING_SECTOR   : 156280320
TOTAL_SECTORS   : 156151800

-----------------------[ PARTITION 3 ]------------------------

BOOTABLE        : YES
PARTITION_TYPE  : 0x17 ( Hidden HPFS/NTFS )
PARTITION_SIZE  : 10.00 Mo
STARTING_SECTOR : 156280320
ENDING_SECTOR   : 156301472
TOTAL_SECTORS   : 21152

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#10 jimpo

jimpo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 16 September 2012 - 09:45 PM

Wow! I wasn't expecting that. The file size was still so small. I'm glad I attached it anyway. :)

I hope it'll tell you something useful. I really appreciate your help!

Edited by jimpo, 16 September 2012 - 09:45 PM.


#11 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:03:09 AM

Posted 16 September 2012 - 09:59 PM

There are 3 partitions on the laptop's hard drive:
  • sda1 corresponds to the first partition on the hard drive >>> DELL utility/diagnostics (62.50 MB)
  • sda2 corresponds to the main partition on which you have the Windows system installed (74.46 GB)
  • sda3 (10.00 MB)
It is interesting that you report sda3 being empty!
It is this empty, very small, third partition that is currently set as the bootable partition, and the reason that you see only a blank black screen with blinking cursor when you attempt to boot the computer normally.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#12 jimpo

jimpo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 16 September 2012 - 10:11 PM

Wow! That gives me hope that you might be able to suggest a way to get this resolved.

I wonder why that third partition is there. I have only the faintest idea what this all means, and I know I didn't make that third partition -- wouldn't know how to if I wanted to! I wonder did the virus that I had and cleaned with Antimalwarebytes make it, or did the Ccleaner I ran make it, or is that Microsoft update (which was the last thing I did before it restarted to the black screen) the culprit?

Either way, I hope this suggests to you a way for me to get my computer back! And if it might be the result of something evil done via malware to my computer, how to get rid of it.

Thanks so much for the help you've been giving me.

Edited by jimpo, 16 September 2012 - 10:14 PM.


#13 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:03:09 AM

Posted 16 September 2012 - 10:25 PM

It is likely that malware was responsible for creating the third partition and setting it as bootable, and that attempting to remove the malware has resulted in the system becoming unbootable.

Please sit tight and be patient for now:
  • I have requested that an experienced helper who specialises in malware-related un-bootable computers respond to your topic.
  • A suitably experienced helper will respond when they are available.

Edited by AustrAlien, 16 September 2012 - 10:32 PM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#14 jimpo

jimpo
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 16 September 2012 - 10:31 PM

Tight is how I will sit. (In fact it's cocktail time...now that I think of it.) I'll wait to hear from whomever comes next to help.

You, AustrAlien, are a total prince, and I sincerely thank you again for all of your help.

Best wishes. :)

#15 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,836 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:01:09 PM

Posted 16 September 2012 - 11:25 PM

Lets change the boot process to partition 2 as it seems logical based on the scans you have have perform.

Boot once again with the xPUD CD.
Press File
Expand mnt
sda1,2...usually corresponds to your HDD
sdb1 is likely your USB
Click on the folder that represents your System drive (sda1 ?)
Press Tool at the top
Choose Open Terminal
Type the following:

parted /dev/sda set 2 boot on

Leave a space between the following arguments:

parted
/dev/sda
set
2
boot
on


After it has finished Boot in Normal Mode and let me know the outcome.

Edited by Orange Blossom, 16 September 2012 - 11:56 PM.
Moved to log forum. ~ OB

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users