What to do, so viruses wouldn't come back

[Route44]

Freeman14, you may want to do a google seach on boot sector virus and removal. As for its removal or other infections I strongly recommend the next step of going to the Virus & Malware removal forums here. There or guys there that really know their stuff and can be a big help.

If you go there and post make sure you read all three stickies by Julio at the top of the forum. You could make the subject something like "Possible Boot Sector Virus?" and then tell them of your issues, the infections, and the steps you took in the attempt to fix it.


I just can't help believe that you are still infected in some manner but I wouldn't dare try to give you an answer when others here are much more knowleageable in this area. Perhaps we missed something hardware wise but I think you did a lot of good diagnostic work.

 

[mflynn]

Hello Guys many times I need a little help when it keeps going and going and hope for a little help.

So if you don't mind let me join in.

Print this so you will have it when computer is in recovery console.

WARNING: You said you had nothing to loose. So if there is a bad sector or the right boot sector Virus it will trash the drive.

1. disconnect all external devices usb, sata printers and Flash drives.

2. leave the Second/Slave disconnected

3. boot with Windows XP install cd, choose Recovery Console

4. Recovery console should boot to C:\WINDOWS>

5. type chkdsk /r hit Enter key

6. Wait quite a while perhaps and hour or more.

7. after chkdsk exits

8. type the following 5 commands hit enter at the end of each line. The D: should be your CD drive letter if you have disconnected the Slave as directed if not type in the correct drive letter.

FIXMBR C:
FIXBOOT C:
COPY D:\I386\NTLDR C:\
COPY D:\I386|NTDETECT.COM C:\
BOOTCFG /rebuild

When finished type
exit Enter key

Try not to boot to normal mode the first time. Go to Safe mode and if it does boot this time just do a normal Retarrt.

Mike

 

[Freeman14]

Hey, mflynn.

Thank you for your responce, but a problem occured while doing the process you told me to do.

I have done everything succesfully till I wrote "COPY D:\I386\NTLDR C:\" or the other one.

I get a message: "Access is Denied"

Any ideas what it might be?

 

[mflynn]

In Recovery Console
first type

attrib -h-s-r \NTLDR
Hit enter key

then type the copy command again.

Mike

 

[Freeman14]

In Recovery Console
first type

attrib -h-s-r \NTLDR
Hit enter key

then type the copy command again.

Mike

I still get the same Access is Denied.

 

[mflynn]

Did you get an error from the attrib command or did it just return to the prompt.

And if error did you put the slash \ before ntldr

Mike

 

[Freeman14]

Did you get an error from the attrib command or did it just return to the prompt.

And if error did you put the slash \ before ntldr

Mike

It returned to the prompt.

I tYpped exactly like you wrote "attrib -h-s-r \NTLDR"

 

[mflynn]

Ok skip that one and go to next line.

First type
attrib -h-s-r \NTDETECT.COM

the the copy command

if it fails just continue to next command

Mike

 

[Freeman14]

Ok skip that one and go to next line.

First type
attrib -h-s-r \NTDETECT.COM

the the copy command

if it fails just continue to next command

Mike

I changed both attributes, didn't work, so I continued to write BOOTCFG, then something about a boot list prompted to choose (Yes/No/All). I chose All...Then came something about a Load identifier and later about OS. I wrote random stuff in it....Rebooted. Tried to go to safe mode,but got the error...

Anything else I might try?

 

[mflynn]

Boot to the Windows Advanced boot menu (location of Safe Mode).

First try Enable VGA Mode

no joy

Then Last known...

no joy

Go into Bios find Plug and Play setting and reverse it
Find Reset Configuration
If you are using an onboard Video controller then Lower Onboard Video memory
If you have a USB Legacy setting turn it off
If you have Video or Bios Caching turn them off
If you have an Optimal Bios setting lower it to Safe defaults.

If one if the items does fix it then you will need to reenable them 1 at a time until you hit the bad one. Don't be surprised if it does boot that you can then enable them all without returning the problem.

Mike

 

[Freeman14]

No joy on Last known or VGA mode.

I then found "Plug And Play O/S" in Advanced in Bios. It was set to No, I set it to Yes.

Lowered Onboard Video Memory to 1 MB, it was set to 8MB.
Turned USB legacy off.

There was no Video or Bios catching.

Didn't find anything like "Optimal bios settings"

I still get the BSOD. Damnit.

 

[mflynn]

Can you boot from CD and do a repair install?

Mike

 

[Freeman14]

Can you boot from CD and do a repair install?

Mike

Yea. I have two Windows XP Professional CDs. One is an original SP1 and the second one is mixed with updates, SP3 etc.etc.

Which one is more recommended?

 

[mflynn]

The SP3 and leave all the settings we changed!

Also first another name for the Video and BIOS cacheing is Video shadowing Bios Shadowing check for those in BIOS first.

I know you have formatted a couple of times but the changes to the BIOs may change things.

Are you familiar with a Repair/Overly install?

Boot from CD decline the first (R) repair with Recovery console and proceed to the point setup finds an existing windows installation and offers to repair it (R). That is the one!

Mike

 

[Freeman14]

The SP3 and leave all the settings we changed!

Also first another name for the Video and BIOS cacheing is Video shadowing Bios Shadowing check for those in BIOS first.

I know you have formatted a couple of times but the changes to the BIOs may change things.

Are you familiar with a Repair/Overly install?

Boot from CD decline the first (R) repair with Recovery console and proceed to the point setup finds an existing windows installation and offers to repair it (R). That is the one!

Mike

I didn't find Cacheing or Shadowing, but ill change the settings.

I know how to "Repair" the windows, when I do so, should I try to boot up? If it succeeds there may be a chance that it'll come back..


Earlier I re-installed the windows, worked for a day, then came back with another BSOD.

 

[mflynn]

OK yes lets boot up after repair install!

Mike

 

[Freeman14]

Apparently the SP3 CD can only Install Windows, not repair....

Should I repair with SP1 or re-install with SP3?

 

[mflynn]

What was on it before? Has it ever been SP3?

Mike

 

[Freeman14]

What was on it before? Has it ever been SP3?

Mike

The last time I re-installed it was a CD which cannot boot, so I started it from My Computer. I think it was SP3 tho', not sure if it was with the updates.

 

[mflynn]

Can't Boot?

Well if this SP3 boots then use it!

Mike

 

[Freeman14]

Can't Boot?

Well if this SP3 boots then use it!

Mike

It can't boot because I downloaded it and it was splitted in archives .part01 etc. and Hjsplit can't join them. That's why it can't boot.

So Ill have to repair with SP1 then, we can do it just to test if it works.

Do it?

 

[davidm71]

Something similar

I just recently recovered from a virus/worm infection and after I had it cleaned out with norton av 2009, there was still corruption and damage on the system files. So I had no choice but to restore a backup. That even was not virus free but not so bad. So sometimes you have to start over fresh... or almost fresh in my case.

Also I read you could try this to check the integrity of your dll libraries with microsoft XP CD:
type : 'sfc /scannow' in a command window. But too me it sounds like some serious corruption going on...

good luck.

 

[mflynn]

In thinking about your issue!

Is the Downloaded XP extracted any where on this computer now?

I have a feeling it may be infected.

Stay away from it for now anyways!

And I forgot to mention to format with this install. But if not don't restart to do it!

Mike

 

[Freeman14]

In thinking about your issue!

Is the Downloaded XP extracted any where on this computer now?

I have a feeling it may be infected.

Stay away from it for now anyways!

And I forgot to mention to format with this install. But if not don't restart to do it!

Mike

It all started on a normal legal Windows SP1 version. First it started that my computer started restarting by itself, shutting down and restarting...Then I tried re-installing...The BSODs started attacking, following with restarts...The BSODs seemed different after every install. I tried scanning around, but BSODs kept popping up while scans...For no reason at all...

I am now repairing my PC with the legal version of SP1.

 

[Freeman14]

I now repaired my Windows. Ill plug my slave harddrive in.

Can I install SP2 now? I need it to try to check if it holds off without BSODs