Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Can't Boot Up Xp Pc


  • Please log in to reply
14 replies to this topic

#1 Sunset Breakfast

Sunset Breakfast

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:44 AM

Posted 23 November 2006 - 05:58 PM

This is a problem with a friend of mine's XP system.

Her teenage son (who has been duly frowned at, and won't ever be allowed to forget about this!) has been on Freeserials.com, looking for a 'free' keycode for some Adobe software he downloaded (naughty naughty!). When he went to susequently install the software, the system crashed immediately after install (I suspect he got something he didn't bargain on from Freeserials - serves him right really, but its his Mum's computer so I'm trying to fix it for her).

Problem is, it is now impossible to boot up the computer. When I try to boot up, the Norton GoBack she has on her system takes over, but of the four options available, 'GoBack', 'Disable GoBack' & 'Enable AutoBack' all result in a frozen screen, which can only be removed by a 'hard' power-down. I haven't tried the fourth option because this requires the use of the ReBoot disk, and I was afraid that this might destroy all the data on her hard drive.

I did manage to get through to the DOS screen and try to boot in Safe Mode, but it just got part-way into booting then restarted form scratch, resulting in the Norton GoBack screen again.

I also tried to boot to Last Known Good Configuration, but that got so far then tried to run ScanDisk, which immediately sent it back into rebooting from scratch again, resulting in the Norton GoBack screen again.

I don't know what to try next - I'm out of options now!

Anyone got any ideas?

The computer I'm trying to fix is across town from mine (I'm using mine to access the internet), so if there is more info I need to provide to get assistance, please state what's needed then bear with me as it takes time to get there, find out what's needed, then get back here, and I can only get into that house at certain times of day when the occupants are home.
The gremlins were framed; a human did it...

BC AdBot (Login to Remove)

 


#2 Enthusiast

Enthusiast

  • Members
  • 5,898 posts
  • OFFLINE
  •  
  • Location:Florida, USA
  • Local time:04:44 AM

Posted 23 November 2006 - 08:05 PM

Norton's “Go Back” is a utility similar to Windows System Restore which comes with Windows XP but unlike the Windows utility, unless the owner created a Go back point recently or set Go Back to do so automatically at specific intervals using it will ensure data loss - period, at least to the point in time (if any) a go back image was created).

Windows System Restore will not automatically cause data loss to occur, however, if it contained viruses, etc, whatever malicious code your teenage miscreant downloaded when he attempted to steal the Adobe program possibly may have already done so.

If you want to be sure that data loss is minimized you need to remove the hard drive from the non-functioning computer and install it on another computer as a slave drive. If you accomplish this and the hard drive is operable, you will be able to backup any data from the now non-functioning drive to either the hard drive in the computer you are using for this purpose, cds or any other suitable media. (You can use XP's backup utility to accomplish this once the drive is installed as a slave drive and becomes accessible to the rescue computer.) Make sure you set the jumper properly on the hard drive from the malfunctioning computer to slave or secondary drive when installing it as the slave.

At that point, you can remove the slave drive, reset the jumper to "Master" or "Primary", reinstall the drive as the master drive in the original computer and can either wipe the drive, format it and do a fresh install of Windows (if you have the Windows XP bootable installation cd for this specific computer and its 25 digit Windows Key - highly recommended as that will remove any malware including boot sector viruses that may exist on the drive)

Or

If you only have a manufacturer's Recovery CD, after reinstalling the hard drive to the original computer, you can boot from the Recovery CD to restore the computer back to the software condition it had when new.

All Windows Updates performed since the computer was new will have to be re-downloaded and re-installed in either of the cases above.

If you use a Manufacturer's Recovery CD all software added that did not originally come packaged with the computer when it was new will have to be reinstalled. (The computer may also have come with an installation cd for additional software and another cd for proprietal drivers)

If you perform a fresh installation of Windows after wiping the drive and formatting it you will loose the original extra programs that came bundled with the computer (although most of the time they are junk anyway). The choice of format for Windows XP is NTFS, not Fat32 although you may be given the choice.

In both cases you will need to download and have available all drivers that the computer needs to function properly - IE, updated video drivers, chipset drivers, sound card drivers, etc.

Again - If the computer owner made and saved an image with Go Back, recent or not, using it now to restore the system image (to Go Back - hence the name "Go Back") may prevent the necessity of doing some or all the above, but it must be available (originally created and findable now) for you to be able to use it, and it may or may not eliminate the malware existing on the hard drive depending what it is).

There is one other option that MAY be available, which if it is, will save you an enormous amount of work: - Windows System Restore

First, let’s see if you can use the Windows System Restore utility to revert the system state of that computer to an operable state.

See if you can boot the computer to "Safe Mode with Command Prompt"

To invoke the Windows System Restore tool at a command prompt you do the following:

1.Restart your computer, and then press F8 during the initial startup to start your computer in Safe Mode with a command prompt.

2.Log on to your computer with an administrator account or with an account that has administrator credentials.

3.Type the following command at a command prompt, and then press ENTER:

%systemroot%\system32\restore\rstrui.exe

4.Follow the instructions that appear on the screen to restore your computer to an earlier state.

Windows System Restore is not supposed to affect any data, so unless the loss of data would be more than can be endured, you can attempt using System Restore without removing the hard drive and saving its data as described above, but being as it may that data is not supposed to be affected, data loss can occur for any reason, and sometimes for what seems like no reason at all so I will issue the following caveat:
Although I have personally used System Restore numerous times without the loss of any data, the only way that no data loss is guaranteed is to physically back it up using media other than the original drive on which the data resides.

If Windows System Restore is successful, you need to immediately begin a regimen for discovery removal of viruses and other malware from the hard drive.

Let us know and we will help direct you through that process.

#3 Sunset Breakfast

Sunset Breakfast
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:44 AM

Posted 25 November 2006 - 04:03 PM

Thanks Enthusiast,

I tried to boot the computer to "Safe Mode with Command Prompt", and no dice. Brought the drive home and my PC won't even recognise it. I had my local hardware chap in to see if he could get it to cheer up, and still no luck, so he believes the drive to be beyond repair. He even had a fiddle in BIOS to see what was happenning, and it wasn't recognising it properly there either.

But he did tell me there is software available known generically as 'hard-disk rescue utilities', which might enable me to rescue the owner's personal files and folders, with a view to restoring them to her new drive, when she gets one.

Any ideas what software I might need for this, or if there are any other options available?

I have also posted this problem on the BC Forum topic http://www.bleepingcomputer.com/forums/ind...c=73235&hl=

Edited by Sunset Breakfast, 25 November 2006 - 04:37 PM.

The gremlins were framed; a human did it...

#4 Siggyman

Siggyman

  • Members
  • 134 posts
  • OFFLINE
  •  
  • Local time:04:44 AM

Posted 25 November 2006 - 10:12 PM

Looks like you may have been infected with a virus but no worries this can be fixed but we need to no what kind of virus it is so first I would sugjest running Ad-Aware and if no dice then it may be a virus

Looks like you may have been infected with a virus but no worries this can be fixed but we need to no what kind of virus it is so first I would sugjest running Ad-Aware and if no dice then it may be a virus, such as a trojan
Posted Image

#5 Sunset Breakfast

Sunset Breakfast
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:44 AM

Posted 26 November 2006 - 05:15 AM

Thanks Acklan and Siggyman,

I repositioned the 'guest' drive on the Primary Slave IDE cable position, with the Jumper in the Slave position, (in place of my 'resident' Slave drive), and BIOS actually recognised it properly, whereas it hadn't done in either position on the Secondary IDE cable. Sadly, however, My Computer still failed to find the 'guest' drive.

Nevertheless, I scanned all local hard disks with my Virus Scanner (Avira AntiVir PE Classic) to see what would happen, with the result that there was no infection detected on my 'resident' Primary Master drive, but it failed to notice or interrogate the 'guest' Slave drive.

Continuing my optimism, I performed a full system scan with AdAware SE, but with the same result (apart from finding and removing a TAC 3 Tracking Cookie from @real-dot-com in my 'resident' Primary Master drive).

Because My Computer and both scans failed to notice the 'guest' Slave drive, I did not continue to perform further scans (Spybot S&D, AVG Anti-Spyware and McAfee Stinger 2.6.0), because it seemed unlikely they would find the 'guest' drive.

Two questions pop to mind:

1) I normally have 'resident' Master and Slave hard-drives connected on the Primary IDE cable, and two CD/DVD drives (one reader, one re-writer) on the Secondary IDE cable, all of which have been working just fine. Does the fact that BIOS recognised the 'guest' drive properly on the Primary Slave position, but not on the Secondary cable in either position, indicate that I have a problem with my Secondary IDE cable?

2) Is there anything else I can do to the 'guest' drive to try to recover the drive, or at least the personal files from it? N.B. I'll need to be able to have both 'resident' hard drives connected at the same time as the 'guest' drive to back-up files from it, because I have Windows installed on my 'resident' Primary Master drive, but the only place I have any space for backing-up the files from the 'guest' drive to is on my 'resident' Slave drive.
The gremlins were framed; a human did it...

#6 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:05:44 AM

Posted 26 November 2006 - 04:33 PM

Free recovery software: http://www.pcinspector.de
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#7 Sunset Breakfast

Sunset Breakfast
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:44 AM

Posted 27 November 2006 - 12:27 AM

Thanks usasma,

I tried file recovery using 'PC Inspector File Recovery' from the URL you gave, but could get nothing useful off the drive. I followed all the instructions in the Help file, but it is quite possible I am being dense. Have you any useful hints on how to get useful results?
The gremlins were framed; a human did it...

#8 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:05:44 AM

Posted 27 November 2006 - 09:34 AM

Sometimes the file names get messed up - so you'll have to look through the files to see if they contain anything that you need. Otherwise, just recover everything and that way you'll have a copy if you ever need it.

Here's the program that I use. It's just as powerful as the free version - but a bit more understandable. It has a free tool to let you know what it can recover (but you'll have to pay $80 to actually use it). Sometimes you can use the results of the free tool to correlate with the PCInspector info and find files that way.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#9 Sunset Breakfast

Sunset Breakfast
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:44 AM

Posted 27 November 2006 - 11:15 AM

erm... where's the program you use (the $80 one)?
The gremlins were framed; a human did it...

#10 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:05:44 AM

Posted 28 November 2006 - 08:23 AM

Sorry! That's what I get for posting when I'm tired!

GetDataBack from http://www.runtime.org/ It comes in 2 versions - 1 for NTFS volumes and one for FAT32 volumes. You should only need one - but they did have a package deal last time that I was there ($120 for both).
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#11 Sunset Breakfast

Sunset Breakfast
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:44 AM

Posted 04 December 2006 - 02:22 AM

I have managed, after much effort and time spent, to recover a significant proportion of the personal files on the drive, including a completely irreplaceable Family Photo Album, which has cheered up the owner of the system somewhat!

The drive has now been replaced with a new item from Seagate, and the old one declared 'dead' by the owner, who decided that it was the best way to proceed. All I have to do now is a complete fresh installation of the Windows XP O/S, and all the other programs she uses (Ho hum; no rest for the Fool-Who-Doesn't-Say-'NO'-Quickly!) :thumbsup:

MANY thanks to all of you who have provided advice and assistance. I couldn't have done anything useful without you!
The gremlins were framed; a human did it...

#12 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:05:44 AM

Posted 04 December 2006 - 06:13 AM

FWIW - I just found out that BestBuy has a data recovery service that's reasonably priced. About $250 for simple recoveries, $525 for more complicated, and $1599 for the clean-room disassembly. They even have a program that'll tell you which option is appropriate.

Edited by usasma, 04 December 2006 - 06:15 AM.

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#13 sageinblue

sageinblue

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:44 AM

Posted 06 December 2006 - 07:44 PM

Hello everyone.
I'm sorry I didn't stumble across this thread sooner, maybe I could have saved Sunset Breakfast some money.

Norton Ghost modifies partitions such that you CANNOT mount them as a slave drive. A GoBack slave drive will simply never show up under Windows. Those errors Sunset was having are NORMAL. He does not have viruses, nor is his hard drive likely dying.

If you have the GoBack slave drive hooked up and you want to be sure it's not really bad, you can do the following: Under Win XP, go into Control Panel -> Administrative Tools -> Computer Management -> Storage -> Disk Management. You should see a list of all the drives in your system, there will be at least one hard drive labeled C:, some cd rom drives, etc. Now, look in the list on the top half of the right side. You might see a hard drive icon with no letter next to it. That's your GoBack drive. This means windows sees a hard drive, but can't understand any of the data on it. Information stored within the Master Boot Record tells Windows how many partitions are on the drive, what sizes they are, etc. GoBack scrambles the MBR when you install it, and so Windows can't understand it. That's why you don't get a drive letter or letters. If you don't see a drive icon with no letter next to it, that means windows can't see the hard disk itself, and you may have a drive problem (check the BIOS and jumper settings.)

I work for a computer repair shop, and am currently trying to back up a customer's drive with GoBack on it. I am trying to develop a retrieval procedure that works, i'll post back here tomorrow if I learn anything. I intend to charge this customer around $400 for my trouble. I wish I could charge him $1000.

#14 sageinblue

sageinblue

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:44 AM

Posted 11 December 2006 - 03:14 PM

I've documented a pretty exhaustive solution here:

http://www.bleepingcomputer.com/forums/t/74951/how-to-get-around-norton-goback/

Hope this helps!

#15 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:05:44 AM

Posted 12 December 2006 - 12:06 AM

Wow! I sure could've used that today at work! Thanks for the hard work!
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users