Computer won't even boot.

JustJen · November 30, 2015

Hello I think I a virus got to my MBR and now it won't boot. I can not run any of your scans because my computer won't boot. System refresh won't work neither will restore. I have went into the command prompt and tried to have it repair the MBR with no success. Just wondering if they is any thing else if can try. It is Windows 8.1 on a dell inspiron tower.

Thanks.

TwinHeadedEagle · November 30, 2015

Hello,

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

Before we start please read and note the following:

We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
Note that we may live in totally different time zones, what may cause some delays between answers.
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

Please download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.
Restart your computer and tap F8 to bring up the Advanced Menu, then click Repair your computer
Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.
In the Choose Recovery Tool menu select Command Prompt.
You will see a big black window with a blinking cursor (command prompt).
Access the notepad and identify your USB drive
In the Command Prompt please type in:
```
notepad
```
and press Enter.
When the notepad opens, go to File menu.
Select Open.
Go to Computer and search there for your USB drive letter.
Note down the letter and close the notepad.
Scan with Farbar Recovery Scan Tool
Once back in the command prompt window, please do the following:
Type in e:\frst64.exe and press Enter.
You need to replace e with the letter of your USB drive taken from notepad!
FRST will start to run. Give him a minute or so to load itself.
Click Yes to Disclaimer.
In the main console, please click Scan and wait.
When finished it will produce a logfile named FRST.txt in the root of your pendrive and display it. Close that logfile.
Transfer it to your clean machine and include it in your next reply.

JustJen · December 1, 2015

Thank you so much for helping. I have the log you requested.

Jen

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:30-11-2015
Ran by SYSTEM on MININT-9DHE3BI (30-11-2015 20:23:48)
Running from D:\
Platform: WIN_81 (X64) Language: English (United States)
Boot Mode: Recovery
ATTENTION: Could not load system hive.
The operation completed successfully.

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Winlogon: [userinit]
HKLM-x32\...\Winlogon: [userinit] [X]
HKLM\...\Winlogon: [shell] [0 ] () <=== ATTENTION
HKLM-x32\...\Winlogon: [shell] [0 ] () <=== ATTENTION
HKLM\...\InprocServer32: [Default-wbemess] ATTENTION! ====> ZeroAccess?
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess?
HKLM\...26dfa299cadb\InprocServer32: [Authentication UI Logon UI] <==== ATTENTION

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-30 20:23 - 2015-11-30 20:23 - 00000000 ____D C:\FRST
2015-11-22 13:12 - 2015-11-29 22:23 - 00000000 _____ C:\Recovery.txt
2015-11-20 07:21 - 2015-11-20 07:21 - 00000000 ____D C:\Windows\SMINST
2015-11-20 07:19 - 2015-11-20 07:19 - 00000000 ____D C:\System Recovery

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-20 07:25 - 2015-05-05 09:08 - 00000000 ____D C:\Program Files (x86)\Dell Backup and Recovery
2015-11-20 07:25 - 2013-08-22 07:36 - 00000000 ___RD C:\Windows\DesktopTileResources
2015-11-20 07:25 - 2013-08-22 07:36 - 00000000 ____D C:\Windows\FileManager
2015-11-20 07:25 - 2013-08-22 07:36 - 00000000 ____D C:\Windows\Cursors
2015-11-20 07:25 - 2013-08-22 07:36 - 00000000 ____D C:\Windows\Camera
2015-11-20 07:25 - 2013-08-22 07:36 - 00000000 ____D C:\Windows\addins
2015-11-20 07:25 - 2013-08-22 07:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2015-11-20 07:25 - 2013-08-22 07:36 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2015-11-20 07:25 - 2013-08-22 07:36 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2015-11-20 07:25 - 2013-08-22 07:36 - 00000000 ____D C:\Program Files (x86)\Windows Multimedia Platform
2015-11-20 07:25 - 2013-08-22 07:36 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2015-11-20 07:25 - 2013-08-22 05:36 - 00000000 ____D C:\WINDOWS
2015-11-20 07:23 - 2014-11-20 20:20 - 00000000 ____D C:\Program Files\Windows Journal
2015-11-20 07:23 - 2013-08-22 07:36 - 00000000 ____D C:\Program Files\Windows Portable Devices
2015-11-20 07:23 - 2013-08-22 07:36 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2015-11-20 07:23 - 2013-08-22 07:36 - 00000000 ____D C:\Program Files\Windows Multimedia Platform
2015-11-20 07:23 - 2013-08-22 07:36 - 00000000 ____D C:\Program Files\Windows Defender
2015-11-20 07:23 - 2013-08-22 07:36 - 00000000 ____D C:\Program Files\Common Files\System
2015-11-20 07:23 - 2013-08-22 07:36 - 00000000 ____D C:\Program Files\Common Files\Services
2015-11-20 07:21 - 2015-05-05 11:14 - 00000000 ____D C:\DELL
2015-11-20 07:21 - 2015-05-05 08:50 - 00000000 ____D C:\Intel

==================== Known DLLs (Whitelisted) =========================

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe IS MISSING <==== ATTENTION
C:\Windows\System32\wininit.exe IS MISSING <==== ATTENTION
C:\Windows\explorer.exe
[2014-11-20 21:14] - [2014-11-20 21:14] - 2501368 ____A (Microsoft Corporation) 85D47EB257B06094F052E0C8AEFA3BEE

C:\Windows\SysWOW64\explorer.exe IS MISSING <==== ATTENTION
C:\Windows\System32\svchost.exe IS MISSING <==== ATTENTION
C:\Windows\SysWOW64\svchost.exe IS MISSING <==== ATTENTION
C:\Windows\System32\services.exe IS MISSING <==== ATTENTION
C:\Windows\System32\User32.dll IS MISSING <==== ATTENTION
C:\Windows\SysWOW64\User32.dll IS MISSING <==== ATTENTION
C:\Windows\System32\userinit.exe IS MISSING <==== ATTENTION
C:\Windows\SysWOW64\userinit.exe IS MISSING <==== ATTENTION
C:\Windows\System32\rpcss.dll IS MISSING <==== ATTENTION
C:\Windows\System32\dnsapi.dll IS MISSING <==== ATTENTION
C:\Windows\SysWOW64\dnsapi.dll IS MISSING <==== ATTENTION
C:\Windows\System32\Drivers\volsnap.sys IS MISSING <==== ATTENTION
C:\Windows\System32\codeintegrity\Bootcat.cache IS MISSING <==== ATTENTION
C:\Windows\System32\winsrv.dll IS MISSING <==== ATTENTION

==================== EXE Association (Whitelisted) =============

HKLM\...\.exe: => <===== ATTENTION
HKLM\...\exefile\DefaultIcon: <===== ATTENTION
HKLM\...\exefile\open\command: <===== ATTENTION

==================== Restore Points =========================

==================== Memory info ===========================

Percentage of memory in use: 7%
Total physical RAM: 8108.93 MB
Available physical RAM: 7491.77 MB
Total Virtual: 8108.93 MB
Available Virtual: 7517.03 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:919.71 GB) (Free:908.03 GB) NTFS
Drive d: (Lexar) (Removable) (Total:14.9 GB) (Free:14.9 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.5 GB) (Free:0.5 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 0A73DD9C)

Partition: GPT.

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 14.9 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=14.9 GB) - (Type=0C)

==================== End of FRST.txt ============================

TwinHeadedEagle · December 1, 2015

This doesn't look good.

When entering recovery environment, open CMD again and type this command:

chkdsk C: /R

JustJen · December 2, 2015

It is still scanning. How do I get the results to you?

Thanks,

Jen

JustJen · December 2, 2015

It finished. How do I get the log to you?

TwinHeadedEagle · December 2, 2015

I don't need the results. Can you now run FRST scan again and attach fresh report?

JustJen · December 3, 2015

Hi. Here is the second scan. Thanks again.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:30-11-2015
Ran by SYSTEM on MININT-0OVKUAQ (02-12-2015 19:05:50)
Running from d:\
Platform: WIN_81 (X64) Language: English (United States)
Boot Mode: Recovery
ATTENTION: Could not load system hive.
The operation completed successfully.