Unable to do system restore - is this a virus? 4

[DCSage]

Hello.

My cousin is having a big problem with his computer. Earlier he kept getting pop-ups. So, he did a system scan with McAfee- full scan and short scan. McAfee asked if he wanted to shut down and he did so.

He received a message that said no disk space. He was able to restore his system at that time to Friday. But now all of his windows desktop icons are distorted and the task bar have disappeared. He can't run the system restore and he he gets the following message:

can't restore to earlier check points. No restore points.

When he reboots his system, are still distorted and the system just shuts itself off.

Is this a worm? What can he do? Nothing is backed up and all of his work is on the drive.

Please advise.

Thanks so much.

 

[goombawaho]

1. Put the drive in another computer as a slave drive and copy the data off.
OR
Boot from a bootable CD, such as Bart PE, and have another hard drive (external) or USB Flash drive attached before you boot the machine and then copy the data off.

2. While the drive is a slave drive, you could run MalwareByte's Anti-Malware or other anti-virus scan on it to see if it can repair the malware.

3. If that doesn't fix the problems and get it booting up normally, then a repair install may be needed once things are clean.

 

[DCSage]

where would I get Bart PE? Is this something I need to order? Or is the bootable cd something he shoudl have?

 

[kjv1611]

http://www.nu2.nu/pebuilder/

 

[kjv1611]

How:

http://www.bjorn3d.com/read.php?cID=1112

Also, alternative:

http://www.ubcd4win.com/

Or:

http://www.ultimatebootcd.com

 

[glenmac]

kjv1611 I'm going to give you a star cause you pointed me in the right direction to fix a problem I had. My old puter couldn't find an old HD I had (I have it set up to change removable HDs). "no drive present" I booted with Bart PE and low and behold there was my drive!I was able to retrieve mt data, so a Star for you.

Glen

http://lantzvillecomputers.com

 

[DCSage]

Hello.

Thank you very much. I am going to try this now and report back.

 

[DCSage]

I made a cd of the BARTPE and went to my cousin house to implement the suggestions.

the following happened:
1) system started and I couldn't select f11 or any of the f keys.

2) The system immediate went to the windows xp startup screen and froze.

My cousin had another system (dell) but after plugging everything in, it won't communicate with the monitor.

What are my options now? the first system is the main system that my cousin needs, while we were hoping he could still get on and do his work.

please advise.

As for the Bart, after inserting the cd, since I couldn't get past the xp screen, how else could i have run the executable?

thank you so much for your suggestions.

 

[goombawaho]

Hey - BartPE was my idea, so KJB is a star-stealer (joking). Google search would have set you free though on how to find it.

You are very confused as to using the BartPE from your description of what you have done.

First, you should verify that the BART CD will boot in a known good machine. That will verify the CD.

Next (and actually for the above as well) you have to have the BIOS set to boot to CD as the first option. Now, some PCs (Dell for instance) have the option to hit F12 upon startup and then you get a choice of which device to boot to. In that case, you don't have to go into the BIOS to change the default boot device to CD-ROM.

On other computers, you have to do just that to get the PC to boot from the CD. Go into BIOS (F1, F2, DEL - depends on the PC) and find the boot order. Change it to CD-ROM first. SAVE and exit.

If this is getting too complicated for you, it might be time to call a professional. Seems like you have mounting problems and problems you need to resolve before you can fix the main problem!! So sorry for you.

 

[goombawaho]

By the way - BART PE is NOT an executable. You don't launch it, you boot from it and it does it's thing. It is a mini operating system that boots into a Windows XP like environment.

It may take a good 5 minutes to boot up, so don't rush it.

 

[kjv1611]

If you can't get the basic Bart PE disk to run w/o error, then your problem may well be hardware related. I'd highly suggest trying the UltimateBootCD, and running some scans from it - Memory first and foremost, as the hard drive is not likely to be the culprit with your symptoms. Nonetheless, it also wouldn't hurt to try and boot ANY CD without the hard drive connected. If the computer is running, unplug the data and power cables from the hard drive, and attempt to boot from the Bart PE disk, and see whether or not you have the same issues. If the issues go away, then it sounds like a physical problem with the hard drive. If problems are still there, then it's something to do with your other components:

1. RAM/Memory definitely a possibility
2. Motherboard can't be ruled out. If you open the case, just in case, take a look, and see if you see any bulging or leaking capacitors, which could mean the motherboard/mainboard will fail altogether very soon.

How to tell if the capacitors are leaking/bulging, and what does that mean:

http://www.capacitorlab.com/visible-failures/

 

[goombawaho]

^^^^ Agreed with StarStealer (I mean KJV1611) that you should use that UltimateBootCD to test the memory and hard drive before trying to boot from the BART PE CD. Normally I suggest that first for systems that are behaving "strangely".

You really can't get anything to work if there is a physical hardware problem with RAM, hard drive or motherboard. Those two tests will prove that the hardware layer is okay.

 

[DCSage]

thank you all so much! My cousin (despite my warnings to back up everything before), has not backed up anything and is most concerned about his file.

I will keep you posted.

 

[kjv1611]

Hmm, if he is mostly concerned about his files, then based on what we're seeing, this may be the best course of action for now:

1. Unplug/disconnect his hard drive from his system.
2. Tote/carry it to your home
3. Connect the hard drive to your system as a slave or via an IDE/SATA to USB adapter or whatever you might have.
4. Back-up any important data - assuming you can see any of it.
5. Take back the hard drive, and continue with your testing, etc...

At least that way, his data will be safe. Of course, this will take more of both your time, but if his data is important, I'm sure it'll be worth it to him. Whether or not it's worth it to you depends upon, well, you.

;p

And I can't help it - for goomb's sake:

 

[goombawaho]

I'm not emoticon literate. Looks like pacman playing with darth vader.

I see that pacman has left on his victory tour leaving darth vader alone to ponder his navel.

 

[kjv1611]

[ROFL2]

Um, either you didn't get it, or you're just playing dumb. Honestly, it wasn't a deep thought, just a joke.

Here's a hint: They don't have a Star Destroyer emoticon, but the others are as close as I could get.

http://starwars.wikia.com/wiki/Star_Destroyer

 

[DCSage]

Thank you!! We are still working on this, but I am sure it will pan out.

 

[goombawaho]

Wow - I got two stars!!! Thanks. I only deserved one, but I'll take it. KJV1611 should have had two though.

 

[kjv1611]

I guess the 2nd one for me was for the Star Wars joke.


Regardless, glad you're um still working on this, DCSage?

Well, keep with it, and let us know how it turns out for sure. There's nothing worse than an open-ended ending.. wait, does that even make sense? Well, it's the end of the work day for me today, so that's my excuse and I'm a stickin' to it!