Viruses Removed but no Boot

[DonP]

After thoroughly cleaning a drive that was badly infected by multiple viruses, I am trying to test it before sending it back the person whose drive it is. I know there are issues in booting a drive in another system but I thought it would at least boot up without high-res video and without other hardware and/or in Safe Mode but it doesn't.

It goes to a screen saying that XP was not successful in booting up due to recent software or hardware changes. It gives options to start in Safe Mode or start normally but does nothing and just hangs no matter the choice.

In-place upgrade doesn't work either and crashes with a blue screen each time. I suspect that the viruses have damaged something. Is there a way to repair its boot files or the MBR with it connected as a second drive in another system?

Don

http://www.pc-homepage.com/

http://www.personalzone.net/

Experienced in HTML, Perl, PHP, VBScript, PWS, IIS and Apache and MS-Access, MS-SQL, MySQL databases

 

[linney]

Have you disconnected the regular drive?

Try these while the good drive is out of the way.

How to install and use the Recovery Console in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;307654&FR=1&PA=1&SD=HSCH

Have a look at the FixMbr, FixBoot and BootCfg and ChkDsk /r commands.

266745 - Error Message When You Run fixmbr Command

http://support.microsoft.com/default.aspx?scid=kb;en-us;266745&FR=1&PA=1&SD=HSCH

A Discussion About the Bootcfg Command and Its Uses

http://support.microsoft.com/support/kb/articles/q291/9/80.asp

HOW TO: Create a Boot Disk for an NTFS or FAT Partition in Windows XP(Q305595)

http://support.microsoft.com/support/kb/articles/q305/5/95.asp

How to Use System Files to Create a Boot Disk to Guard Against Being Unable to Start Windows XP (Q314079)

http://support.microsoft.com/support/kb/articles/q314/0/79.asp

 

[DonP]

Thanks! I tried some of the ideas but as I do not have a system with a diskette drive, I was not able to create a boot diskette. This might be a good time to create a boot CD-ROM, though.

The only way I can get to the drive right now is by connecting it externally via a USB chassis so I can do whatever needs to be done that way as long as it CAN be done that way. I cannot boot to it at all but yes, no other drives were connected when I tried to boot. I'll see what I can do about creating a boot CD-ROM.

Don

http://www.pc-homepage.com/

http://www.personalzone.net/

Experienced in HTML, Perl, PHP, VBScript, PWS, IIS and Apache and MS-Access, MS-SQL, MySQL databases

 

[iamnotageek]

A drive that has xp installed will only boot in another system if that system is a clone of the first. It might also boot if the new system is using the same disk controller, but you are still likely to get blue screens due to further driver vs hardware discrepancies.

Sounds like you already did a repair reinstall, which would ordinarily reapply the HAL and straighten this out, but even if it were successful, the customer would have to do the same when he gets it back, for the same reasons. You might be money and time ahead to have him ship his tower to you.

Nowadays, viruses typically don't live in the boot sector/MBR. What is the stop code you are getting on the blue screen? How exactly did you clean the hard drive of viruses?

 

[DonP]

Thanks, that's what I suspected. The computer is in central Oregon and I am in California but I'll be going up there shortly and might have to work on it then (it's my sister's computer who has little income for shipping the tower). I couldn't run the repair reinstall because I couldn't boot to it so everything should boot up just fine for her. I think it will.

One more related question, I discovered last night that she had the notedad.exe trojan which my virus detector didn't find. Although I physically removed it along with the related files, is there some way to open the driver's registry to remove the entries it created even though I can't boot to the drive? In other words, can it be opened in, say, Notepad or some other application for editing?

Thanks again.

Don

http://www.pc-homepage.com/

http://www.personalzone.net/

Experienced in HTML, Perl, PHP, VBScript, PWS, IIS and Apache and MS-Access, MS-SQL, MySQL databases

 

[mscallisto]

I found this Tek-Tips FAQ, don't know if it works or not but it looks interesting

http://www.tek-tips.com/faqs.cfm?fid=6646

 

[linney]

This will introduce you to BartPE, a freeware XP that runs from CD. It has the ability to run Virus Scans and Registry Editors via Plugins and contained programs.

Cannot logon to winxp...losing lots of valuable documents
thread779-975236

You have to load the faulty Registry Hives and edit them while in BartPE, or any other Windows Operating System.

As an Administrator highlight one of the two following Keys, it will only be available for these Keys.

HKEY_LOCAL_MACHINE
HKEY_USERS

These two articles in the RegEdit Help are a good explanation of the process.

To load a hive into the registry
To unload a hive from the registry