blue screen, bug screensaver virus

[rorybreaker]

hello all,

i posted this morning concerning my laptop. well, i downloaded the updated MBAM and ran it. it found over 450 infected files and i deleted them. some said that the computer needed to be rebooted, so i clicked yes, the comp rebooted, and now i have absolutely nothing. i've tried safe mode, last successful config, anything, and all i get is the compaq background, can't even control-alt-delete. did whatever i had delete the OS as well?

i would post the successful HJT log if there was anything on the comp.

thanks!

[1972vet]

...now i have absolutely nothing. i've tried safe mode, last successful config, anything, and all i get is the compaq background, can't even control-alt-delete. did whatever i had delete the OS as well?

Your description is vague. When you say that you "tried safe mode" please tell us what that means to you. The way some folks describe their situation may mean something entirely different to us..in other words, were you actually able to enter safe mode but you found that nothing works while you are in safe mode? What happens when you select "Last Known Good Configuration that Worked"?

You did say that all you get is the compaq background but that doesn't describe the background you SHOULD get while in safe mode or even at the "Advanced" menu listing.

When you boot to safe mode the system will take quite a bit longer to present a stable desktop. Did you wait long enough? Were you presented with any questions on your screen?

You asked if you had deleted the OS as well along with the malicious software that mbam found...that's sort of a loaded question but the short answer would be NO. Windows cannot be deleted while you are using windows on the mounted drive. However, it IS possible to delete an operating system if you have more than one operating system installed (this would require more than one partition).

Please post back with a bit more detail.

[rorybreaker]

thanks for responding...

i have just a desktop. no icons and no way that i can open any programs. this includes control alt delete, windows button, anything. when you reboot, after it went to the plain compaq background, i hit f8 and tried safe mode, safe mode with networking, last successful config, and boot windows normally. safe mode would just boot up to a black screen that would say safe mode, with no icons on the desktop and no way to open any programs. i let each run for over an hour. i only have windows, no other OS. hope that helps...

[1972vet]

Do you have your Windows XP Installation CD Handy?

[rorybreaker]

Do you have your Windows XP Installation CD Handy?

i'll go dig it out...

[rorybreaker]

i have:

operating system cd windows xp home sp2

application and driver recovery dvd

[1972vet]

OK, before we decide which way to proceed, tell us when your system boots up, do you even get a start button? If so, does the start menu open at all or does the computer just not respond to anything you type?

...and if not, describe the steps the system goes through when you try to boot up. Does the Welcome screen appear? I understand you said their are no icons, but does your desktop appear normal otherwise?...I mean, is there the familiar color scheme, task bar, start button, etc.

[rorybreaker]

the regular windows screen pops up and if i hit f8, it goes to the black screen where you can choose how to start up. the first time i tried, it went to this screen automatically, it said something along the lines of "the computer could not boot up successfully" and then i had to choose safe mode or go back to last successful config.

no start button, color scheme or task bar, just a plain compaq background, the cursor arrow is there and it does move

[1972vet]

Make sure that there are NO Floppy Disks, CD's, or External Drives connected to the computer.

• Insert the Windows XP Bootable CD into the computer.
  
• When prompted to press any key to boot from the CD, press Any key.
  
• Once in the Windows XP Setup Menu press the "R" key to repair Windows.
  
• Log into your Windows installation by pressing the "1" key and pressing enter.
  
• You will then be prompted for your Administrator Password, enter that password (if none assigned, just press enter)
  
• Copy the below two files to the root directory of the primary hard disk. In my below example we are copying these files from the CD-ROM drive letter "D". Since we haven't yet seen a log from you that shows us your drive letter, this letter may be different on your computer.
  

copy d:\i386\ntldr c:\

copy d:\i386\ntdetect.com c:\

Once the two files are both copied over Successfully you may then restart your computer...windows should start normally. If Windows starts up normally for you, post the mbam log from your earlier run. Thanks!

[rorybreaker]

good morning,

i was able to successfully copy both files.

i then turned the computer off (was there a command to shut it down?)

i booted it back up with the cd out and i am back to the same blank compaq screen

[1972vet]

OK, you said earlier that when you tried safe mode that you got to a black screen that said "safe mode" but there were no icons...which actually, is typical so based on your own description, your safe mode option is still valid.

Let's boot back to safe mode, log on as "Administrator", wait long enough and your safe mode desktop should appear.

Once it stabalizes (remember, safe mode takes it's time so be patient), open the mbam utility and click the "Logs" tab. Select the log with the most current date and open it. When the log opens, click File from the menu at the top, then select "Save As" and save it to your desktop. Don't bother changing the name of the file...it should already be named and highlighted for you by default.

Next, click Start-->Control Panel-->System-->Advanced Tab-->Startup and Recovery Settings

...Click the Edit button at the top of the Startup and Recovery window.

Now, please tread very carefully here...that file is your boot.ini and is a critical file that your bios looks at before windows loads. In a blank area of the boot.ini notepad, please Right-Click and select Select All...then right-click again and select Copy. Now, please close the boot.ini notepad and open a blank notepad. Right-click in the blank notepad and select Paste. Now save THAT notepad to your desktop. Save it as bootini.txt

Upload both of those files back here on your next reply. Thanks!

[rorybreaker]

i booted into safe mode, but i can't run anything. all i have is a black screen that says safe mode in each corner of the screen. i've tried using control-alt-delete and the windows button to bring up a menu or a way to access any programs. i also did not get the ability to log in, it went straight to safe mode. its been sitting here 20 minutes and still nothing. am i missing something?

[1972vet]

To repair your installation of Windows without loosing any files that you've already created, please do the following:

Insert your Windows XP Setup CD, and restart your computer.

• When the Press any key to boot from CD message is displayed on your
  screen, press a key to start your computer from the Windows XP CD.
  
• Press ENTER when you see the message To setup Windows XP now, and
  then press ENTER displayed on the Welcome to Setup screen.
  
• Do not choose the option to press R to use the Recovery Console.
  
• In the Windows XP Licensing Agreement, press F8 to agree to the
  license agreement.
  
• Make sure that your current installation of Windows XP is selected
  in the box, and then press R to repair Windows XP.
  
• Follow the instructions on the screen to complete Setup.
  

When completed, your system should boot normally. The installed applications and files you had before should still be present. There will more than likely still be some malware present as we have not wiped the disk. Please post the mbam log from your last run. Thanks!

[rorybreaker]

i followed the instructions.. after all that it said to boot up press any key, i did and now i have a black screen and a cursor, no way to bring up anything. at this point, i'm not worried about files, as i've transfered over most of everything as it was getting bad, i would just like to have my laptop back, and working. any ideas?

by the way, thank you again for your help. i really do appreciate it.

[1972vet]

The instruction to "press any key" is at the very beginning of the reinstall process when you press a key to boot from the cd. After that, windows is installed when you go through the prompts and instruct the menu option to install windows on the partition that already has windows installed...since that is what you've done, then the absolute only reason for the message you received would have been from having any of the following conditions present when you started the computer.:

a CD or DVD in your D:\ drive

a floppy disk in your A:\ drive

Remove the media and reboot. Post back the results.

[rorybreaker]

still nothing.. its on that blue install screen for awhile, and it says i needs to reboot. i took the cd out and it booted up to a black sceen/nothing

[1972vet]

It seems you need to repair the master boot record...we'll have to boot back to the Recovery Console:

To run the Recovery Console from the Windows XP startup disks or the Windows XP CD-ROM, follow these steps:

• Insert the Windows XP startup disk into the floppy disk drive, or insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer.
  

Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted.

• When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
  
• If you have a dual-boot or multiple-boot computer, select the installation that you must access from the Recovery Console.
  
• When you are prompted, type the "Administrator password". If the administrator password is blank, just press ENTER.
  
• At the command prompt, FIXBOOT and press Enter.
  
• To exit the Recovery Console and restart the computer, type exit at the command prompt, and then press ENTER.
  

Post back your results. Thanks!

[rorybreaker]

followed those instructions.

when it rebooted, went back to same black screen w/ cursor. nothing.

what next?

thanks for your patience.

[1972vet]

Having copied over these files:

copy d:\i386\ntldr c:\

copy d:\i386\ntdetect.com c:\

...and, having repaired the master boot record, the results you allege are impossible, unless you have more than one partition. You DID say you have only one partition, did you not?

[rorybreaker]

if by partition you mean drive, then yes, i only have 1 hard drive on the computer :C drive

[1972vet]

Partition examples:

C:\ (which is where your windows operating system is usually located)

D:\ (which is where your recovery files may be if you have such a feature)

E:\ (which may be your CD-Rom drive

F"\ (which is where you store your files that you want to keep safe...you would have had to create such a partition)

If your setup is only:

A:\ (Floppy disk drive)

C:\ (windows drive)

D:\ (CD-ROM drive)

...then, you're right, you have only one partition. If you're Compaq has a system recovery feature (not the same as system restore) then you have more than one partition.

[rorybreaker]

how would i know if i had a system recovery feature? i checked the book and can't find any evidence that i have that feature, though that would make sense as to why it's not working then, right?

pardon my ignorance.

[1972vet]

What is the model number?

[rorybreaker]

What is the model number?

comaq presario laptop r3000

[1972vet]

Both have the system recovery feature but I now doubt the boot issue relates to a partition mismatch on the boot.ini data file that the bios looks for on boot up...your problems however seem to relate to other hardware...battery, or perhaps RAM:

Boot problems relating to Compaq Presario R3000 (Intel) Notebook PC

Boot problems relating to Compaq Presario R3000 (AMD) Notebook PC

You didn't indicate which, so I looked up both.