Installed avast, now computer won't boot

I have a compaq presario sr2037x with microsoft xp media center edition. It worked fine for over 2 years and then about a week ago started getting the incessant pop-ups (it came with the 60 day trial of norton antivirus but I never renewed the subscription). So I installed avast and ran the scan thing, and it picked up 70 infected files. I didn’t/don’t know what I’m doing, so I deleted them all, even when it asked “are you sure?” I jotted down a few examples just in case something bad happened:

C:\WINDOWS\karna.dat
C:\WINDOWS\system32\brastk
C:\WINDOWS\system32\dllcache\beep.sys
C:\WINDOWS\system32\drivers\beep.sys

Now of course something bad has happened. The computer turns on and comes to the blue Welcome screen with Compaq_Administator as the user (before I did any of this it always went straight to the desktop). I click on it and it says “Loading your settings,” flashes to the desktop wallpaper and then plays the little piano sound and says “Logging off” and then “Saving your personal settings.” There is no way to get past the welcome screen. What did I do and how can I fix it? Is there any way to recover the infected files that I deleted?

Meanwhile I also installed avast on my laptop and it works just fine.

Thanks!

Hi…

If you own a legal copy of your OS (a Microsoft Windows XP CD, I don’t think a restore CD will work in this case,) you can perform a repair install with the instructions listed here, please read the entire page…

http://www.michaelstevenstech.com/XPrepairinstall.htm

If you only have the restore CD’s, then this option here may be helpful…

http://h10025.www1.hp.com/ewfrf/wc/document?lc=en&dlc=en&cc=us&docname=c00007689

Choose the “standard recovery” when asked. Although this option claims to leave your data in place, in both cases, be prepared for the possibility that files and programs may be lost.

If for some reason you don’t have any restore CD’s, then there may be a restore partition (with a different drive letter) located on your hard drive. You can verify this by clicking on “My Computer” and seeing if there is a second, smaller partition listed as possibly as “D Drive” and having the title include the word “Recovery.” If so, then that partition and the recovery options can be accessed by tapping a certain key during POST (before you see the Windows XP splash screen on bootup.) This key may be F10 (as I have seen with older Compaq’s) but your system may be different. If this is not the key for your system, please see your computer’s documentation for this information or call Compaq at 1-800-652-6672. Please be aware that the recovery options available through this method may be a bit different than what I’ve listed here. :slight_smile:

Hope this helps. :slight_smile:

May God Bless you!

Hi all,

I am having the same problem where my computer will not let me log in after a scan & reboot.
Please let me know how you go with the suggestions by Ardvark as I think I will need to follow this process with my XP PRO CD.

Cheers & Good Luck. ;D

Before you go charging down that path. I think it is too early to say you have the same problem as there really is no information to confirm that. Especially since the original posters problem seems related to having deleted numerous files.

So are you saying you also deleted a bunch of files ?

If not there are other reasons this might occur most commonly a clash with another AV.

Have (or did) you another AV installed in this system, if so what was it and how did you get rid of it ?

I was using Clamwin, although this program does not run resident, it only fires up when using a mail
program such as Outlook or the like. So I’m not entirely convinced that there is a clash there.

The Avast boot scan did delete some files, although I’m also confident that the files were not Windows files
and were created by the Spyware/Adware I was trying to get rid of (XP POLICE in this case).

If I can get logged in, then I am sure I can get things going properly again, but it attempts to log in, then goes
back to the Choose User screen. It is probably also important to note that;

  1. I do not have the option to log in as Administrator.
  2. I also cannot log in to Safe Mode, same problem occurs.

Hence, I think I will need to run with XP PRO CD option.

However, any other ideas will be much appreciated!

Whilst clamwin is supposed to be on-demand (I’ve never used it) I find it strange that it fires up when you use an email program that would have to have some sort of service and hook to be able to do that, but is unlikely to cause an issue at boot.

Deletion isn’t really a good first option (you have none left), ‘first do no harm’ don’t delete, send virus to the chest and investigate.

I don’t know if a repair install would resolve the inability to log on as an administrator of boot into safe mode as I don’t thing the repair install does any registry integrity checks or repairs.

How to restore Safe Boot.
The malware may have deleted the SafeBoot registry keys.
Here are some options to restore them:

http://didierstevens.wordpress.com/2006/06/26/restoring-safeboot/
http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/
Also see http://forum.avast.com/index.php?topic=26554.msg216924#msg216924

Thanks David, I’ll look into it all when I get home & see if I can;

  1. Get Safe Mode up & going…then
  2. Ensure the Malware is completely removed…then
  3. Convince my wife she is never allowed on the PC ever again without supervision!!! :wink:

Thanks for your time, I’ve printed everything I need… for now.

It wouldn.t hurt to use the Norton Removal Tool if you didn.t use it to uninstall Norton. Norton leaves bit and pieces behind. http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039

You’re welcome, good luck, that’s me for the night, almost 1:45am here.

I could be having a similar problem (it also doesn’t help that I originally posted to the Server Edition forum):

"I had a couple of viruses that wouldn’t go away; I currently use Windows Live OneCare for virus protection, but it is apparently not getting the job done. I downloaded the latest free home edition of Avast (4.x), scheduled a boot sector scan and restarted the computer. It found two trojans; in both cases I selected the option to move the viruses to the chest.

When the scan completed, it pulled up the background picture for my desktop and stopped there. I can ctrl-alt-delete my way to task manager and restart the computer, but I’ve tried a couple of times and my desktop, launch bars, Windows menu, etc., are not coming up - just the background picture. (I’m typing in on another computer, obviously).

Any thoughts or ideas? Thanks!"

Should I try to uninstall Avast?

Hi…

By any chance, do you remember the names of these trojans and the files they infected?

Also, will your system boot successfully into safe mode?

May God Bless you! :slight_smile:

Yes - They are both Win32:Fabot [trj] viruses - one was originally at C:\Program Files\Microsoft Common and the other was originally at C:\System Volume Information_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP135

I cannot seem to re-start in safe mode (suggestions on how to do so?). It’s the weirdest thing - it’s as though the computer isn’t booting - like it’s hanging on just the background picture of my desktop - but if I ctrl-alt-delete and pull up task manager, I can open files and even some applications. It’s my desktop I can’t get to. I managed to get to the Windows System restore application through File - New Task - function in Task Manager, and selected a couple of restore points, but no luck there (as a side note, this has never been a successful resolution on any computer problem I’ve ever had - I don’t know why I try that).

Based on discussions above, I wonder if the system hanging is due to having Avast and MS Live OneCare running simultaneously… ? I have tried to remove Avast, but I don’t know how to do this if I can’t get into Control Panel.

Thoughts?

Thank you.

Hi…

I apologize, for some reason, this escaped my attention from your first post. I think I need to hang it up for the night. ;D

Yes, this may very well be your problem. Two AV’s running simultaneously is never a good idea because they can conflict with each other. First, what happens when you try bring up safe mode and are you able to access Onecare to disable the realtime scanner long enough to get the system booted and avast uninstalled?

I don’t think the trojan removal is preventing your OS from booting based upon the locations you provided.

Best Regards…

Well, I got into Add & Remove Programs through MSCONFIG and removed Avast. This didn’t solve my problem - I’m still only booting up as far as the background screen of my desktop (it’s a lovely picture of my son on Halloween, but I’d like to see my whole desktop)…

I’m fresh out of ideas…

Hi…

The only thing I can suggest at this point is along the lines of my original post to agirlfromunc above. What is “make and model” is your computer exactly and do you own a legal copy of your OS (Windows XP?) or have a restore CD(s) that goes with your system?

If not, does your hard drive have a restore partition?

Best Regards…

I tried to;

  1. Boot normally, no luck
  2. Reboot into safe mode, no luck
  3. Repair using my original (and legal copy) of XP PRO, no luck.

Ended up doing a format & clean install, luckily I am in a position of having everything that I need (not necessarily everything I want)
backed up on CD & DVD.

Sorry I wasn’t able to find a good resolution for others who are having similar issues.

Good luck to you, and thankyou to everyone for your help & suggestions