Unable to start Computer: Virus'

system · 2015-07-23T05:18:17.000Z

Is it not possible to start FRST directly from cmd.exe, without involving Notepad?

dbrisendine · 2015-07-23T05:37:00.000Z

Quick answer - Yes, you can run FRST without opening Notepad IF you know what the drive letter is that holds FRST.

Long answer - the reason we use Notepad first to search for the drive letter that hold FRST is that some people do not realize that using a USB drive to boot into a Recovery Enviroment adds 2 or 3 virtual drives into the process. The Notepad is only used to find the drive letter. You close Notepad and enter the direct run command into the command window using the drive letter that was discovered in Notepad.

system · 2015-07-24T06:09:49.000Z

Good! So, how do I launch FRST from the DOS window?

system · 2015-07-24T06:37:08.000Z

as I mentioned earlier the DOS window appears with

X:\windows\system32>

and the FRST is in H:\ ??? ("Repair disc Windows 7 64 bit (H:))

So, what do I write in DOS? H:\frst.exe ?

dbrisendine · 2015-07-24T06:49:01.000Z

H:\FRST64.exe

press ENTER

system · 2015-07-24T07:19:43.000Z

Nothingis ever easy!

When I enter h:\ to change directories it tells me taht “H” is not recognized as an internal or external command, operan«ble programme or batch file.

So now what?

system · 2015-07-24T07:23:06.000Z

UPDATE

I entered X:>h:\FRST64.exe and the farbar Recovery Scan Tools box appeared but so far it is setting up itself to read Local Disc.

So, Panic is over. Let´s see what happens

system · 2015-07-24T07:45:13.000Z

Hi, here it goes

Give me the good news; tell me it can be fixed…

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-07-2015
Ran by SYSTEM on MININT-01U2NS4 on 24-07-2015 09:32:55
Running from h:
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM.…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-24] (Realtek Semiconductor)
HKLM.…\Run: [BTMTrayAgent] => rundll32.exe “C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll”,TrayApp
HKLM.…\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2588968 2010-11-12] (ELAN Microelectronics Corp.)
HKLM.…\Run: [IntelTBRunOnce] => wscript.exe //b //nologo “C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs”
HKLM.…\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-29] (Microsoft Corporation)
HKLM-x32.…\Run: =>
HKLM-x32.…\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-18] (Adobe Systems Incorporated)
HKLM.…\RunOnce: [*Restore] => C:\windows\system32\rstrui.exe [296960 2015-05-25] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\qimi.…\Run: [POP Peeper] => C:\Program Files (x86)\POP Peeper\POPPeeper.exe [1613824 2011-11-16] (Mortal Universe)
HKU\qimi.…\RunOnce: [FlashPlayerUpdate] => C:\windows\system32\Macromed\Flash\FlashUtil64_17_0_0_188_ActiveX.exe [623792 2015-06-04] (Adobe Systems Incorporated)
AppInit_DLLs: C:\windows\system32\nvinitx.dll => C:\windows\system32\nvinitx.dll [247144 2012-10-25] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\windows\SysWOW64\nvinit.dll => C:\windows\SysWOW64\nvinit.dll [202600 2012-10-25] (NVIDIA Corporation)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2012-07-11] (SUPERAntiSpyware.com)
S2 AffinegyService; C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe [571288 2010-09-14] (Affinegy, Inc.)
S2 Apache2.2; C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe [20549 2012-01-28] (Apache Software Foundation)
S2 Backupper Service; C:\Program Files (x86)\AOMEI Backupper\ABService.exe [29912 2013-08-26] (AOMEI Tech Co., Ltd.)
S2 EFS; C:\Windows\SysWOW64\lsass.exe [0 2013-09-27] () <==== ATTENTION (zero byte File/Folder)
S3 KeyIso; C:\Windows\SysWOW64\lsass.exe [0 2013-09-27] () <==== ATTENTION (zero byte File/Folder)
S2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202296 2012-04-25] (Kaspersky Lab ZAO)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-13] (Malwarebytes Corporation)
S2 McAfee SiteAdvisor Service; c:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe [155368 2015-02-12] (McAfee, Inc.)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-29] (Microsoft Corporation)
S2 MySQL56; C:\ProgramData\MySQL\MySQL Server 5.6\my.ini [14242 2013-03-24] ()
S3 Netlogon; C:\Windows\SysWOW64\lsass.exe [0 2013-09-27] () <==== ATTENTION (zero byte File/Folder)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-29] (Microsoft Corporation)
S3 ProtectedStorage; C:\Windows\SysWOW64\lsass.exe [0 2013-09-27] () <==== ATTENTION (zero byte File/Folder)
S2 ReflectService.exe; C:\Program Files\Macrium\Reflect\ReflectService.exe [1142768 2014-01-24] (Paramount Software UK Ltd)
S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-11-30] ()
S2 SamSs; C:\Windows\SysWOW64\lsass.exe [0 2013-09-27] () <==== ATTENTION (zero byte File/Folder)
S2 SurfEasyVPN; C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe [3272048 2015-01-16] ()
S3 VaultSvc; C:\Windows\SysWOW64\lsass.exe [0 2013-09-27] () <==== ATTENTION (zero byte File/Folder)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 ambakdrv; C:\Windows\System32\ambakdrv.sys [30648 2013-05-07] ()
S2 ammntdrv; C:\windows\system32\ammntdrv.sys [151480 2013-05-07] ()
S2 amwrtdrv; C:\windows\system32\amwrtdrv.sys [17848 2013-02-06] ()
S5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-04-13] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-04-13] (Malwarebytes Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
S3 OXSDIDRV_x64; C:\Windows\System32\DRIVERS\OXSDIDRV_x64.sys [51760 2009-09-28] ()
S3 OXUDIDRV; C:\windows\system32\Drivers\OXUDIDRV_X64.sys [31280 2010-05-24] ()
S3 PSMounterEx; C:\windows\system32\drivers\psmounterex.sys [76408 2013-08-01] (Paramount Software UK Ltd)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-12-05] (Windows (R) 2003 DDK 3790 provider)
S1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 tapse01; C:\Windows\System32\DRIVERS\tapse01.sys [39048 2015-01-16] (The OpenVPN Project)
S3 catchme; ??\C:\ComboFix\catchme.sys

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-24 09:32 - 2015-07-24 09:32 - 00000000 ____D C:\FRST
2015-07-03 09:26 - 2015-07-03 09:30 - 00000000 ____D C:.Trash-999
2015-06-27 00:37 - 2015-06-27 00:37 - 00000000 ____D C:\Users\qimi\Desktop\Tokyo
2015-06-27 00:36 - 2015-06-27 00:36 - 00011698 _____ C:\Users\qimi\Desktop\Tokyo.zip
2015-06-26 02:48 - 2015-06-26 02:48 - 00035709 _____ C:\Users\qimi\AppData\Local\recently-used.xbel
2015-06-25 04:40 - 2015-06-25 05:35 - 00000474 _____ C:\Users\qimi\Desktop\A-lvels.txt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-03 22:23 - 2015-04-04 04:00 - 00000000 ___SD C:\Windows\System32\GWX
2015-07-03 22:23 - 2014-03-10 04:35 - 00000000 ____D C:\users\Reserve
2015-07-03 22:23 - 2013-05-16 01:46 - 00000000 ____D C:\Users\qimi\AppData\Roaming\Notepad++
2015-07-03 22:23 - 2012-04-13 18:04 - 00000000 ____D C:\Users\qimi\AppData\Roaming\POP Peeper
2015-07-03 22:23 - 2012-04-13 16:53 - 00000000 ____D C:\users\qimi
2015-07-03 22:22 - 2014-09-28 00:23 - 00000000 ____D C:\Lumix
2015-07-03 22:22 - 2013-05-09 02:47 - 00000000 ____D C:\Program Files (x86)\Opera
2015-07-03 22:22 - 2011-09-05 16:49 - 00000000 ____D C:\ProgramData\WinClon
2015-07-03 22:22 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration
2015-06-24 21:03 - 2011-09-06 08:19 - 01173941 _____ C:\Windows\WindowsUpdate.log
2015-06-24 21:00 - 2013-04-25 08:28 - 00001008 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-24 21:00 - 2013-04-25 08:28 - 00001004 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-24 20:45 - 2014-12-10 23:03 - 00003914 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{DCDE9FBE-C0F3-4E5C-8FDD-486E85AF8C79}
2015-06-24 20:43 - 2015-06-02 12:20 - 00000652 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-251638132-866889896-205452805-1001.job
2015-06-24 20:43 - 2014-05-22 05:01 - 00000556 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-251638132-866889896-205452805-1001.job
2015-06-24 20:43 - 2013-06-15 00:11 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

Some files in TEMP:

C:\Users\qimi\AppData\Local\Temp\SkypeSetup.exe

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points =========================

==================== Memory info ===========================

Percentage of memory in use: 12%
Total physical RAM: 6056.19 MB
Available physical RAM: 5319.74 MB
Total Virtual: 6054.39 MB
Available Virtual: 5320.39 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:500 GB) (Free:284.27 GB) NTFS
Drive d: () (Fixed) (Total:408.01 GB) (Free:260.81 GB) NTFS
Drive h: (Repair disc Windows 7 64-bit) (Removable) (Total:7.23 GB) (Free:7 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: A9ACFE6D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=500 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=408 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=23.4 GB) - (Type=27)

========================================================
Disk: 1 (Size: 7.2 GB) (Disk ID: 03D6679C)
Partition 1: (Active) - (Size=7.2 GB) - (Type=07 NTFS)

LastRegBack: 2015-06-24 04:20

==================== End of log ============================

dbrisendine · 2015-07-24T08:22:40.000Z

We will try very hard to save / fix this

Caution: This Fixlist is only for the user / system combination! Use on other systems may cause unrepairable damage!!

Download the attached Fixlist.txt file to the USB drive that has FRST64.exe on it (the Boot drive / disk). Both FRST64.exe and the Fixlist.txt files need to be on the same location / directory.

Plug the USB drive into the corrupted system and run FRST64.exe like you did to make the scan log ONLY this time click on Fix instead of scan. FRST will create a log (Fixlog.txt) on your USB drive. When the fix is finished, remove the USB drive and reboot the system.

Attach the Fixlog.txt file to a post here and let me know if your system boots now; it may be into Safe Mode but we will work from there.

system · 2015-07-24T08:55:47.000Z

After rebooting th screen shows Starting Windows but nothing happens (so far at least (some 10 mins)

Fix result of Farbar Recovery Scan Tool (x64) Version:20-07-2015
Ran by SYSTEM at 2015-07-24 10:51:56 Run:1
Running from h:
Boot Mode: Recovery

fixlist content:

Start
HKLM-x32.…\Run: =>
HKLM.…\RunOnce: [*Restore] => C:\windows\system32\rstrui.exe [296960 2015-05-25] (Microsoft Corporation)
C:\Windows\SysWOW64\lsass.exe
S3 catchme; ??\C:\ComboFix\catchme.sys
C:\ComboFix\catchme.sys
end

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ => value removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\*Restore => value removed successfully
C:\Windows\SysWOW64\lsass.exe => moved successfully.
catchme => Service removed successfully
“C:\ComboFix\catchme.sys” => File/Folder not found.

==== End of Fixlog 10:51:56 ====

system · 2015-07-24T09:02:04.000Z

Nothing happened so I restarted again in Safe Mode. As before the list of drivers stops at exactly the same place (last driver laoded: ambakdrv.sys)

It may move on, but in the past took an hour or two. I will wait.

system · 2015-07-24T09:54:11.000Z

as befoe, after a coupl of hours or so I end up with a black screen without any iDesktop icons. All I can see is “Safe Mode” in all 4 corners and the ability to use the mousepad.

What should I do now?

I’m starting to think that this may be due to a corrupt driver, but if so, which one?

Is ir t possibleto see the Device Manager in DOS? If so, what doI have to add to X:\windows\systen32> ?

dbrisendine · 2015-07-25T03:15:26.000Z

Can you access any Safe Modes?

If not, retry the following on the Advanced Boot Options menu:

Last Known Good Configuration (try this first)
Repair Your Computer

system · 2015-07-25T06:06:41.000Z

Hi

I’ve tried all that in the past and nothng worked. The besr I managed was to get the Task Manager from the black screen in Safe Mode, But yesterdat it would not open.

Can I try Device Manager from Dos to see if there is a hardware problem?

dbrisendine · 2015-07-25T08:01:55.000Z

We deleted one of the files that was being misused by the system services so one of the two repairs I asked for may now have a chance of working.

If not go back to Advanced Boot Options > Repair Your Computer > Recovery Options Screen > Command Prompt

Run a Disk Check w/ Repair option by typing in CHKDSK /R and then pressing Enter. Reboot the system when prompted to allow the check to take place.

After that has run, return to Advanced Boot Options > Repair Your Computer > Recovery Options Screen > Command Prompt and type in SFC /SCANNOW and press Enter. When that is finished, reboot the system.

system · 2015-07-25T11:26:24.000Z

Problems

I ran last known config and got nowhere.
Si, I ran Repair your Computer and got as far as the Recovery Options Screen

However when I enter CHKDSK /R in the Dos panel I get

Cannot lock current drive
Windowas cannot run disk checking on this volume because it is write protected

Then I tries SFC /SCANNOW

and got

beginning system scan. This process will take some time.

Thre is a system repair pending which requires reboot to complete. Restart Windows and run sfc again.

Well if I do I will be back here in the same place…

Maybe I am not entering the right text after

X:\windows\system32>CHKDSK /R

What shall I do now?

LATER

I changed directory to c:\ and got somewher

Chkdsk cannot run because the volume is in use by another process. Chkdsk may run if this volume is dismounted first. AL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
Would you like to force a dismoun on this voume (y/n)?

I pressed yes and the results include

0 large file records processed
0 bad file records processed
0 EA records processed
0 reparse records processed
334 index entries processed
0 unindexed files scanned
0 unindexed files recovered
256 file SDs/SIDs processed
40 data files processed
1160512 USN bytes processed
240 files processed (stage 4 of 5)
19035 free cluster processed

Free space verification is complete
Windows has chacked the file system and found no problems

102399 total disk space
22352 in 47 files
28 in 41 indexes
0 in bad sectors
3875 in use by the system
2048 occupies by the log file
76144 available on disk

4096 bytes in each allocation unit
255599 total allocation units on disk
19036 allocation units available on disk

failed to transfer logged messages to the vent log with status 50

AND LATER:

I used bcdedit | find “osdevice” which returned drive E: as the location of Windows

Now I was able to rum chkdsk which returned believable numbers, e.g. 524287999 kb total disk space

0 kb in bad sectors

I ran it again with the /f with the same results

I restarted but with nothing new happening

dbrisendine · 2015-07-26T03:47:27.000Z

Let us see if we can fix the locked repair status issue:

Follow these steps:

a. Open Windows Recovery Environment.

b. Select “Command Prompt”.

c. Type this command and hit enter.

dism.exe /image:C:\ /cleanup-image /revertpendingactions

d. Reboot the system (see if the system will now start in Safe Mode and is responsive; if not return to Recovery Environment Command Prompt)

e. Run the System File Check but notice the correct commands based on what boot environment the system is in:
1) Safe Mode - enter a Command Prompt window and type in SFC /SCANNOW
2) Recovery Environment Command Prompt - type this command and press enter.
SFC /SCANNOW /OFFBOOTDIR=C:\ /OFFWINDIR=C:\Windows

system · 2015-07-26T06:35:51.000Z

Hi

Good morning: we seem to be on opposite sides of thr world…

Well, yesterday I tried Safe Mode with Command Prompt and after a long time thr safe Mode Desktop appeared (black without icons) and later the Dos window came up. I tried sfc /scannow. It seemed to accept it inasfar as the hyphen changed lines and stayed there. This moring some 12 hours later it was still the same. So, I’m going to reststartand try it again in order to folow your instaructions.

If it does not work and I have to go back to the Recovery Panel what do I do to the drive letter? It comes up as X:\ but I now found that Windows is (was) in E:\ What is the exact command I place after the letter?

LATER

Ok, I got back to the DOS windows through Safe Mode option.

I entered the line you gave me after c:\windows\system32>

Nothing is happening so far. Should I have entered the line immediately after c:\ instead?

Also, I guessed the empty spaces in the line you gave me as I had to type it in letter by letter.

OK, it did not accept the first directory, and stated that DISM log file can be found at C:\windows\logs\DISM\dism.log

Now I tried the command directly from drive c:|> but got the same resukt: Error: 87 with the lien that " DISM doesn’t recognize the command line option "c:"

I tried to launch SFC from the command prompt C:\ and this time I got the message:

"Windows Resource Protection could not start the repair service!

At least the command prompt seems to be working

And now… SFC seems to be working. Ok verification 100% compete but

“Windows resource Protection found corrupt files but was unable to fix some of them”

So, what now?

dbrisendine · 2015-07-26T07:48:36.000Z

This line

SFC /SCANNOW /OFFBOOTDIR=C:\ /OFFWINDIR=C:\Windows

should have been entered in the Recovery Environment > Command Prompt (Start computer > tap F8 > select Repair Your Computer > Recovery Environment > Command Prompt). Do not enter it in Safe Mode as it will not work there.

You are correct in the spaces; there should be a space before every / . And we are on almost opposite sides of the planet (I’m in BC, Canada) but I will try and keep up.

EDIT:
Did you mean this command (in Safe Mode) dism.exe /image:C:\ /cleanup-image /revertpendingactions
or
this one SFC /SCANNOW /OFFBOOTDIR=C:\ /OFFWINDIR=C:\Windows ?

Now SFC is working? Yeah; let’s see what happens there.

system · 2015-07-26T08:03:46.000Z

Hi

See above!

Did you mean this command (in Safe Mode) dism.exe /image:C:\ /cleanup-image /revertpendingactions

I am in safe Mode. What should I enter at the command prompt?

I tried this again and got:

The /image option that is specified points to a running Windows installation. To service the running operating system use the /Online option. For more information refer to the help by running Dism.exe /Online /?.

Announcements