Startup Recovery loop virus - Win 7

[foxhound187]

Hi there,

 

I've tried the solution outlined on this website with no success.

 

http://www.makeuseof.com/tag/fix-windows-7-infinite-reboot-loop/

 

So I've run FRST64.exe and here is a copy of my log, the computer is not mine it's my brothers so I don't know what startup

data is malware and what are things he has installed.  What software do you run to analyses the log file in order to get a fixlist ?

surely you don't write them by hand ?

 

Thanks for your help in advance.

Foxhound

FRST.txt

[MrCharlie]

Welcome to the forum.

Please run listparts the same way you ran FRST:

Please download Listparts64

Run the tool, click Scan and post the log (Result.txt) it makes

----------------------

Did you also restore the registry as outlined in that link??

MrC

[foxhound187]

Yes I restored the registry as outlined in that link, no success.

 

Here is the log for ListParts

 

 

Result.txt

[MrCharlie]

Can you get to a command prompt??

If so run the system file checker as outlined here:

http://pcsupport.about.com/od/toolsofthetrade/ht/sfc-scannow.htm

Let me know......MrC

[foxhound187]

ok I can guarentee the windows installation is on the E:\ drive, I've checked countless times.

 

First when I try  sfc /scannow on it's own I get,

 

"There is a system repair pending which requires reboot to complete"  , everytime I reboot I get the startup repair loop virus that is causing my issue. 

 

So Then if I try to specify the following , sfc / scannow /offbootdir=e:\ /offwindir=e:\windows I get,

 

"The offline image has a different platform architecture than the running system"

 

how can that be ???

[foxhound187]

Ok I was booting from the Win7 Install CD, when I tried from the startup repair loop the sfc / scannow /offbootdir=e:\ /offwindir=e:\windows , was able to run and I got the following,

 

"Windows Resource Protection found corrupt files but was unable to fix some of them"  

 

it gave me a path to a log file in c:\windows\logs\cbs\cbs.log , here it is.

CBS.log

[MrCharlie]

Run FRST as before, enter these in the Search box..exactly like this: (there's a semicolon ; between the file names)

 

SHELL32.dll;ndis.sys;TsUsbGD.sys;usbuhci.sys 

 

Now click on the Search Files button

 

Post the log it creates.

 

MrC

[foxhound187]

Done, please see the attached log.

Search.txt

[MrCharlie]

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if the computer boots normally now.

Let me know....MrC

[foxhound187]

Ok, it seems to get further now, I get to the "starting windows splash screen" for a few seconds then I get a BSOD, but the computer restarts before I can see what the BSOD error is.

 

Furthermore I then tried to boot into safe mode, it loaded all files until it hit \windows\system32\drivers\CLASSPNP.sys, then it stopped and crashed.

[MrCharlie]

OK, run another scan with FRST and post the new log......MrC

[foxhound187]

ok, here is the new log from the FRST64.exe scan.

 

Thanks

FRST.txt

[MrCharlie]

OK, let me look it over.

Did you ever get the error code for the BSOD?

You will have to disable automatic restart on system failure. This is an option that will appear on many computers (but not all) when pressing the F8 key.

MrC

[foxhound187]

ok did that and got the BSOD error.
 

c000021a {Fatal System Error}

[MrCharlie]

Do another search for.....

 

 CLASSPNP.sys

 

as you did before:

https://forums.malwarebytes.org/index.php?showtopic=141619&p=787043

 

MrC

[foxhound187]

ok, here is the log from that search.

 

Thanks

Search.txt

[MrCharlie]

The file looks OK, try the SFC again:

1. Boot into Windows Recovery Mode

2. Open command prompt

3. Type:

sfc /SCANNOW /OFFBOOTDIR=C:\ /OFFWINDIR=C:\Windows

There's a bunch of solutions at the link below you can read through:

http://social.technet.microsoft.com/Forums/windows/en-US/566cdd43-ce91-4e64-93e0-8d09d8fc1ea0/windows-7-fails-to-go-into-safe-mode-stuck-at-classpnpsys?forum=w7itprogeneral

Let me know...MrC

[foxhound187]

The file looks OK, try the SFC again:

1. Boot into Windows Recovery Mode

2. Open command prompt

3. Type:

sfc /SCANNOW /OFFBOOTDIR=C:\ /OFFWINDIR=C:\Windows

There's a bunch of solutions at the link below you can read through:

http://social.technet.microsoft.com/Forums/windows/en-US/566cdd43-ce91-4e64-93e0-8d09d8fc1ea0/windows-7-fails-to-go-into-safe-mode-stuck-at-classpnpsys?forum=w7itprogeneral

Let me know...MrC

 

 

Ok I will investigsate solutions to the CLASSPNP.sys file, so far I've simply been providing you with logs with litting feedback from you on what you think the issue is.  I'm a web developer by trade, so you can talk shop with me it won't go over my head, I would like your opinion on what you think is going on here ?

 

Do you think that some malware has corrupted various system files preventing them from being loaded by the OS ?  That's the impression I'm getting, but I'm a web developer not a malware expert, hence your opinion is greatly appreciated.

[MrCharlie]

I don't think it was malware, I would try the SFC again and then read the threads on the BIOS, that seems to be a possible solution.

We can make a rescue disk to run on the system to check for malware and check the "start-up" system.

MrC

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!