Unable to start Computer: Virus'

dbrisendine · 2015-07-24T08:22:40.000Z

We will try very hard to save / fix this

Caution: This Fixlist is only for the user / system combination! Use on other systems may cause unrepairable damage!!

Download the attached Fixlist.txt file to the USB drive that has FRST64.exe on it (the Boot drive / disk). Both FRST64.exe and the Fixlist.txt files need to be on the same location / directory.

Plug the USB drive into the corrupted system and run FRST64.exe like you did to make the scan log ONLY this time click on Fix instead of scan. FRST will create a log (Fixlog.txt) on your USB drive. When the fix is finished, remove the USB drive and reboot the system.

Attach the Fixlog.txt file to a post here and let me know if your system boots now; it may be into Safe Mode but we will work from there.

system · 2015-07-24T08:55:47.000Z

After rebooting th screen shows Starting Windows but nothing happens (so far at least (some 10 mins)

Fix result of Farbar Recovery Scan Tool (x64) Version:20-07-2015
Ran by SYSTEM at 2015-07-24 10:51:56 Run:1
Running from h:
Boot Mode: Recovery

fixlist content:

Start
HKLM-x32.…\Run: =>
HKLM.…\RunOnce: [*Restore] => C:\windows\system32\rstrui.exe [296960 2015-05-25] (Microsoft Corporation)
C:\Windows\SysWOW64\lsass.exe
S3 catchme; ??\C:\ComboFix\catchme.sys
C:\ComboFix\catchme.sys
end

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ => value removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\*Restore => value removed successfully
C:\Windows\SysWOW64\lsass.exe => moved successfully.
catchme => Service removed successfully
“C:\ComboFix\catchme.sys” => File/Folder not found.

==== End of Fixlog 10:51:56 ====

system · 2015-07-24T09:02:04.000Z

Nothing happened so I restarted again in Safe Mode. As before the list of drivers stops at exactly the same place (last driver laoded: ambakdrv.sys)

It may move on, but in the past took an hour or two. I will wait.

system · 2015-07-24T09:54:11.000Z

as befoe, after a coupl of hours or so I end up with a black screen without any iDesktop icons. All I can see is “Safe Mode” in all 4 corners and the ability to use the mousepad.

What should I do now?

I’m starting to think that this may be due to a corrupt driver, but if so, which one?

Is ir t possibleto see the Device Manager in DOS? If so, what doI have to add to X:\windows\systen32> ?

dbrisendine · 2015-07-25T03:15:26.000Z

Can you access any Safe Modes?

If not, retry the following on the Advanced Boot Options menu:

Last Known Good Configuration (try this first)
Repair Your Computer

system · 2015-07-25T06:06:41.000Z

Hi

I’ve tried all that in the past and nothng worked. The besr I managed was to get the Task Manager from the black screen in Safe Mode, But yesterdat it would not open.

Can I try Device Manager from Dos to see if there is a hardware problem?

dbrisendine · 2015-07-25T08:01:55.000Z

We deleted one of the files that was being misused by the system services so one of the two repairs I asked for may now have a chance of working.

If not go back to Advanced Boot Options > Repair Your Computer > Recovery Options Screen > Command Prompt

Run a Disk Check w/ Repair option by typing in CHKDSK /R and then pressing Enter. Reboot the system when prompted to allow the check to take place.

After that has run, return to Advanced Boot Options > Repair Your Computer > Recovery Options Screen > Command Prompt and type in SFC /SCANNOW and press Enter. When that is finished, reboot the system.

system · 2015-07-25T11:26:24.000Z

Problems

I ran last known config and got nowhere.
Si, I ran Repair your Computer and got as far as the Recovery Options Screen

However when I enter CHKDSK /R in the Dos panel I get

Cannot lock current drive
Windowas cannot run disk checking on this volume because it is write protected

Then I tries SFC /SCANNOW

and got

beginning system scan. This process will take some time.

Thre is a system repair pending which requires reboot to complete. Restart Windows and run sfc again.

Well if I do I will be back here in the same place…

Maybe I am not entering the right text after

X:\windows\system32>CHKDSK /R

What shall I do now?

LATER

I changed directory to c:\ and got somewher

Chkdsk cannot run because the volume is in use by another process. Chkdsk may run if this volume is dismounted first. AL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
Would you like to force a dismoun on this voume (y/n)?

I pressed yes and the results include

0 large file records processed
0 bad file records processed
0 EA records processed
0 reparse records processed
334 index entries processed
0 unindexed files scanned
0 unindexed files recovered
256 file SDs/SIDs processed
40 data files processed
1160512 USN bytes processed
240 files processed (stage 4 of 5)
19035 free cluster processed

Free space verification is complete
Windows has chacked the file system and found no problems

102399 total disk space
22352 in 47 files
28 in 41 indexes
0 in bad sectors
3875 in use by the system
2048 occupies by the log file
76144 available on disk

4096 bytes in each allocation unit
255599 total allocation units on disk
19036 allocation units available on disk

failed to transfer logged messages to the vent log with status 50

AND LATER:

I used bcdedit | find “osdevice” which returned drive E: as the location of Windows

Now I was able to rum chkdsk which returned believable numbers, e.g. 524287999 kb total disk space

0 kb in bad sectors

I ran it again with the /f with the same results

I restarted but with nothing new happening

dbrisendine · 2015-07-26T03:47:27.000Z

Let us see if we can fix the locked repair status issue:

Follow these steps:

a. Open Windows Recovery Environment.

b. Select “Command Prompt”.

c. Type this command and hit enter.

dism.exe /image:C:\ /cleanup-image /revertpendingactions

d. Reboot the system (see if the system will now start in Safe Mode and is responsive; if not return to Recovery Environment Command Prompt)

e. Run the System File Check but notice the correct commands based on what boot environment the system is in:
1) Safe Mode - enter a Command Prompt window and type in SFC /SCANNOW
2) Recovery Environment Command Prompt - type this command and press enter.
SFC /SCANNOW /OFFBOOTDIR=C:\ /OFFWINDIR=C:\Windows

system · 2015-07-26T06:35:51.000Z

Hi

Good morning: we seem to be on opposite sides of thr world…

Well, yesterday I tried Safe Mode with Command Prompt and after a long time thr safe Mode Desktop appeared (black without icons) and later the Dos window came up. I tried sfc /scannow. It seemed to accept it inasfar as the hyphen changed lines and stayed there. This moring some 12 hours later it was still the same. So, I’m going to reststartand try it again in order to folow your instaructions.

If it does not work and I have to go back to the Recovery Panel what do I do to the drive letter? It comes up as X:\ but I now found that Windows is (was) in E:\ What is the exact command I place after the letter?

LATER

Ok, I got back to the DOS windows through Safe Mode option.

I entered the line you gave me after c:\windows\system32>

Nothing is happening so far. Should I have entered the line immediately after c:\ instead?

Also, I guessed the empty spaces in the line you gave me as I had to type it in letter by letter.

OK, it did not accept the first directory, and stated that DISM log file can be found at C:\windows\logs\DISM\dism.log

Now I tried the command directly from drive c:|> but got the same resukt: Error: 87 with the lien that " DISM doesn’t recognize the command line option "c:"

I tried to launch SFC from the command prompt C:\ and this time I got the message:

"Windows Resource Protection could not start the repair service!

At least the command prompt seems to be working

And now… SFC seems to be working. Ok verification 100% compete but

“Windows resource Protection found corrupt files but was unable to fix some of them”

So, what now?

dbrisendine · 2015-07-26T07:48:36.000Z

This line

SFC /SCANNOW /OFFBOOTDIR=C:\ /OFFWINDIR=C:\Windows

should have been entered in the Recovery Environment > Command Prompt (Start computer > tap F8 > select Repair Your Computer > Recovery Environment > Command Prompt). Do not enter it in Safe Mode as it will not work there.

You are correct in the spaces; there should be a space before every / . And we are on almost opposite sides of the planet (I’m in BC, Canada) but I will try and keep up.

EDIT:
Did you mean this command (in Safe Mode) dism.exe /image:C:\ /cleanup-image /revertpendingactions
or
this one SFC /SCANNOW /OFFBOOTDIR=C:\ /OFFWINDIR=C:\Windows ?

Now SFC is working? Yeah; let’s see what happens there.

system · 2015-07-26T08:03:46.000Z

Hi

See above!

Did you mean this command (in Safe Mode) dism.exe /image:C:\ /cleanup-image /revertpendingactions

I am in safe Mode. What should I enter at the command prompt?

I tried this again and got:

The /image option that is specified points to a running Windows installation. To service the running operating system use the /Online option. For more information refer to the help by running Dism.exe /Online /?.

dbrisendine · 2015-07-26T08:14:46.000Z

In the Command Prompt type the following and press enter. (You may be able to also copy the text and paste it in the Command Prompt box with your mouse.)

findstr /c:“[SR]” %windir%\logs\cbs\cbs.log >sfcdetails.txt

This will search for SFC entries in the CBS log and copy those entries to the sfcdetails.txt file. Attach that file to a post for my review.

system · 2015-07-26T08:29:21.000Z

Ok, Here it goes

LATER

I managed to open Device Manager through Dos and it looks good: no problems

dbrisendine · 2015-07-26T08:37:18.000Z

You attached a file; is that the complete file?

dbrisendine · 2015-07-26T08:46:42.000Z

I will research how to repair what the SFC could not and get back to you asap. I must sleep now; sorry. :-\

system · 2015-07-26T08:48:43.000Z

Happy SFC dreams…

If that helps I have just found how to open control panel via dos prompt, and I have access to Administrtive Tools

System logs shows repeating 2001 errors (Microsoft Antimalware) and Error 9 (iaStor) and 10010 (DistributedCom)

system · 2015-07-27T07:28:20.000Z

A few things happened. I am now able to start the computer in Safe Mode with Command prompt. Ver slow but it gets there after an hour or two.

I also managed to give commands for Devise Manager and Control Panel.

I don’t know what I did, playing around, but at one stage all my Desktop icons appeared and even the bottom line where the Start button is. With the Start button I could among other things open Explorer and the Run box.

Un fortunately I cannot replicate it past the Control Panel. Is there a dos command to refresh the Desktop?

system · 2015-07-27T15:35:51.000Z

Hi

I’m losing hope and tried to get into the Recovery option through F4, which I believe reformats the disk and places the OS back into the disk.

I get the message “A disk read error ocurred. Press Ctrl-Alt_Del to restart”

Could this indicate a disk failure and that I need to buy a new one?

dbrisendine · 2015-07-27T20:59:22.000Z

DOS command to refresh / load the desktop would be C:\Windows\explorer.exe .

However you have beat me to the punch, so to speak. I was researching for a way to see about testing the hard drive since it seems that it is working so slowly (RW head servo can do that) but the disk error during the format pretty much nails it to a failing hard drive.

If you try that again and it gives you the same error then it is the drive. Sorry.

Announcements