blue screen, no way to get into windows aswrvrt.sys

Viruses and worms
1

Hello,

I don’t know what I did… no idea realy. Wanted to start up my comp and windows xp keeps shutting down and rebooting… in every mode I tried nothing worked. It stops loading at: Windows/system32//drivers/aswrvrt.sys
STOP:0X000000ED(0X8A9A5718,0X00000006,0X00000000,0X00000000)

I downloaded from another computer the otlpen.exe and burned it on cd. Also Farbar recovery scan tool and saved it on a flash drive.

Put the whole thing in action (like it was written in "Logs to assist in cleaning malware ")

I got the FRST.text, but I have no idea what to do with it…

emmm, help? please :-[

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-05-2015
Ran by SYSTEM on REATOGO on 03-06-2015 14:47:38
Running from F:
Platform: WIN_XP (X86) OS Language: English (United States)
Boot Mode: Recovery
ATTENTION: Could not load system hive.
Attention: System hive is missing.

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

ATTENTION: Software hive is missing.

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

==================== Known DLLs (Whitelisted) ============

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\winlogon.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\svchost.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\services.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\User32.dll IS MISSING <==== ATTENTION!.
C:\Windows\System32\userinit.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\rpcss.dll IS MISSING <==== ATTENTION!.
C:\Windows\System32\Drivers\volsnap.sys IS MISSING <==== ATTENTION!.

==================== Restore Points (XP) =====================

==================== Memory info ===========================

Percentage of memory in use: 11%
Total physical RAM: 1919.17 MB
Available physical RAM: 1704.32 MB
Total Pagefile: 1750.56 MB
Available Pagefile: 1683.88 MB
Total Virtual: 2047.88 MB
Available Virtual: 2000.98 MB

==================== Drives ================================

Drive b: (RAMDisk) (Fixed) (Total:0.06 GB) (Free:0.06 GB) NTFS
Drive d: () (Fixed) (Total:183.07 GB) (Free:34.58 GB) NTFS
Drive f: () (Removable) (Total:0.98 GB) (Free:0.98 GB) FAT
Drive x: (ReatogoPE) (CDROM) (Total:0.43 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 232.9 GB) (Disk ID: A8D32665)
Partition 1: (Active) - (Size=49.8 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=183.1 GB) - (Type=OF Extended)

========================================================
Disk: 2 (Size: 1000 MB) (Disk ID: 91F72D24)
Partition 1: (Active) - (Size=1000 MB) - (Type=06)

==================== End of log ==========================

2

hey please also attach the addiotion log from the frst scan. a malware expert will help you out from there, when one is onnlien lter today.

3

Hi from the Reatogo desktop select command prompt
In the black box type the following

chkdsk c: /r

Once it has completed then try a normal boot

4

is this it?
Its the same thing that I copy/paste above…

no idea :-\

5

You need to run that command from the command prompt… Did you do that ?

6

It’s been running for an hour now… It was kinda funny trying to write in command prompt (keybord all messed up in reatogo… key k was writing as a two, : was fin-, and : still don’t know what it was, so I copypasted it from the line above :smiley:

Is it normal for that many file record segments to be unreadable… It’s been an hour and it’s at 25579 and everyone of them is marked as unreadable :frowning:

How long does this usually take?

7

What that means is that you have a severe problem with your hard drive. It may be advisable to back up what you can from the Reatogo desktop

8

hey agian d.ghost please follow the instruction from essexbox he will help you out :slight_smile:

9

Hey :slight_smile:

I left the command prompt running until now. For the last hour it’s stuck on 43 percent completed. The 43 is underlined and 4 is blinking. The line before says:“correcting a minor error in file 21528”
What do you think, any hope left?

On desktop in rufus appeared a WindowBlinds4 (a promo for a program to update to full version of object desktop for only $49.95…) Is that the reason I got stuck at 43%?

As recommended I used handy recovery program on rufuss desktop but haven’t tried saving it yet because I don’t have the storage to do so at the moment.

I’ve also encountered another problem. The computer I downloaded all the necessary programs for this venture- it started acting up. It keeps getting popups ads by PrinceMinns and creativecdh.com. All the tabs open in firefox keep loading and the Google insignia has been replaced by loose some weight ads.
Any idea what that is about? Drives me grrrrr :wink:

10

Rufus is adfree … Well my copy was where did you get it from ?

Looks like the computer that you downloaded it to has some adware

On that computer

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.

https://dl.dropboxusercontent.com/u/73555776/frst.JPG

[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please attach both logs generated.