BSOD? Thought I had Total PC Defender beat

[duga]

I believe I have Total PC Defender 2010

Was able to overcome Malwarebytes install problems with the help of this forum and reclaim my computer, or so I thought.

I also ran a full updated MCafee scan, a full updated MWB's scan and a full updated Super Anti Spyware scan. All scans quarenteened various items.

Everything seemed to be working so I decided to do a google search for this forum on the infected machine through Firefox and BAM, Defender started up again.

I turned the computer off and now if I restart in normal or safe mode, I get a blue screen and it say's;

Stop c000021a, (fatal system Error)

The session Manager terminated With status of oxc000026c (ox00000000 ox00000000)

The system has been shut down

What does this mean?

What to do next?

[Elise]

Hello, and welcome to Malwarebytes forum!

Can you please tell me at what point this BSOD occurs?

Did you try the Last Known Good Configuration?

[duga]

You bet. I turn it on, the blue Dell pops up for a second like normal, then the Windows XP for a few more seconds and then the bsod shows up. I have only tried it twice in regular and safe mode each with the same results.

Last known config? Noticed PCD about 10 days ago. Had the computer functioning well about 2 days ago before the trap was resprung.

One other note, I think their may be additional info on the safe mode blue screen that I didn't post above.

[duga]

Sorry, reread your questions and no, I didn't try LKGC

[Elise]

OK this file is big Print these instruction out so that you know what you are doing

Two programs to download

First

ISOBurner this will allow you to burn OTLPE ISO to a cd and make it bootable. Just install the program, from there on in it is fairly automatic. Instructions

Second

• Download OTLPE.iso and burn to a CD using ISO Burner. NOTE: This file is 292Mb in size so it may take some time to download.
  
• When downloaded double click and this will then open ISOBurner to burn the file to CD
  
• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
  
• Your system should now display a REATOGO-X-PE desktop.
  
• Double-click on the OTLPE icon.
  
• When asked "Do you wish to load the remote registry", select Yes
  
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
  
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
  
• OTL should now start. Change the following settings
  • Change Drivers to Use Safelist
    

  [*]Press Run Scan to start the scan.

  [*]When finished, the file will be saved in drive C:\OTL.txt

  [*]Copy this file to your USB drive if you do not have internet connection on this system

  [*]Please post the contents of the OTL.txt file in your reply.

[duga]

Couple of quick questions;

I havn't tried the "Last Known Good Configuration" yet, should I?

With the next step you proposed above, is the goal to get my computer back to where it was? Or reformat somehow?

Thanks

[Elise]

First question: yes, you can try it, but tbh, I don't expect it to work (however, it never hurts to try, who knows )

Second question: the goal is to get your computer up and running again.

If I think a reformat is the only option in a case, I'll always explain why; the steps I gave you in my last post will allow you to create a log that will help me determine what is wrong with your computer and hopefully fixing it

[duga]

I'm stuck

got to the REATOGO Desktop and when I double click on the black and yellow OTLPE icon a box comes up that say "Browse for folder" It gives me different choices in MY Computer

[Elise]

got to the REATOGO Desktop and when I double click on the black and yellow OTLPE icon a box comes up that say "Browse for folder" It gives me different choices in MY Computer

In My Computer, please expand c:\ and locate the Windows folder. This should start OTLPE.

[duga]

I don't see C

I see Ramdisk B

ReatogoPE X

Control Panel

and Shared Docs

[Elise]

On the Reatogo desktop, please open My Computer and see if you see your C drive listed there.

[duga]

Not there, just the stuff I listed above

[duga]

Did I miss something in the "boot from CD" setup?

[Elise]

No, you did fine, however, it appears there might be some problem with your harddisk.

You're going to need a program called TestDisk. It's a free and open source disk recovery program.

Step 1: Download the TestDisk executable here: Download and save it to a flash drive.

Step 2: On the Reatogo desktop, extract the downloaded zip file using your favorite archive extractor.

Step 3: Double-click on the testdisk_win.exe file (found in the win folder of the extracted archive)

Step 4: You will now be at a scary looking text-based command window:

Press Enter here to create a new log file.

Step 5: TestDisk will now detect all local hard drives, and present them in a list like this:

You have indicated that there is only one hard drive attached to your computer, with two partitions. So, use the arrow (up and down) keys to highlight the disk called /dev/sda.

Note: If /dev/sda isn't listed or you have more than one hard drive, STOP and post back here.

With /dev/sda selected, press Enter

Step 6: Now we need to specify the type of partitions that are on your disk. Select Intel (even if you have an AMD processor).

Press Enter.

Step 7: Select Analyse and press Enter.

Quit TestDisk by pressing Q. Post me the testdisk log please (it can be found in the win folder).

[duga]

Stuck on step 2

How do I find the flash drive?

[Elise]

Just like on your windows desktop B)

Use My Computer.

The Reatogo desktop is build in such a way that it resembles windows quite nicely. Most basic functions will work the same.

[duga]

Thats what I did, but I don't see the removable storage

[Elise]

Well, this could mean something is wrong with the OTLPE disk.

Do you still have the downloaded .iso file? If so, please check the filesize: this should be as in the quote below

Bytes - 290,236,416

MB - 276.7

Also, can you please try to boot from the CD on a known clean and normal functioning computer and see if it sees the C drive there.

[duga]

Looked at the disc on my laptop and it has 276mgs listed above

[duga]

Can I just run the disc on the laptop without changing things on it?

[Elise]

Yes, this CD just loads in RAM, it does not change a thing, unless you access the C drive and change things there (i.e. if you delete a file on your c drive when booted on Reatogo, it will stick). It doesn't change a thing on your installed system when you boot from it.

[duga]

Now my noobness is really gonna show

I loaded the disk, a reatogo menu comes up, and I don't see how to make it run. Am I trying to get the reatogo desktop to appear?

[Elise]

Yes, go as far as the Reatogo desktop, click on My computer and see if your harddisk is recognized.

[duga]

Still stuck

I don't know how to bring up the reatogo desktop

When I go to My Computer, I see the CD and it's 276 MB's, but when I click on it, it brings up that menu with no way to get to that desktop

[Elise]

O sorry, I misunderstood.

You need to boot your laptop from the CD. This means, restart and boot from the CD instead of the Harddisk (just as you did on the BSOD-ing computer).