Member Avatar for rastafarian

Hi i hope you could help me with this humongous problem i'm having. It started after i downloaded some application. my antivrus (mcafee 9.0) shutdown and through a process viewer i could see it kept trying to get back on(since it was using up all of CPU) but it couldn't.
task manager couldn't be accessed , it said it has been disabled my admin.
system restore was disabled! i tried restoring to "best known config" through the F8 option while booting, no luck. And then all of a sudden it boots to the login part and once i login my wallpaper loads and nothing else happens- no icons, no task bar, no response to ctrl+alt+del. only mouse pointer(which moves normally).
The WORST part: tried using safe mode and every time it finishes loading files my system restarts. tried all 3 safe mode options in fact tried all F8 options.

Now i loaded a new windows in a separate windows folder so that my old windows files are not affected (With the hope that sometime i could possibly go back to using that). i ran a virus scan(mcafee) through this and quarantined all detected viruses. However, my original windows still shows the same problem- no desktop, no safe mode etc. i have several important files which i cant lose so formatting is NOT an option. Reinstalling windows is also NOT an option mainly because Ive reinstalled windows twice in the last 4 months and i don't want to give into the virus this time. And yes, once its fixed i am switching to a new OS. Windows is a nightmare.

  • 2 Contributors
  • 2 Replies
  • 198 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by jholland1964

Dani AI

Generated

This looks like a classic deep infection: an active component (often a kernel-mode rootkit or a tampered autostart entry) that prevents interactive shell and Safe Mode, and also flips protections like Task Manager and System Restore off. Immediate priorities are preservation and offline cleaning rather than trying more repairs from the infected install.

First step: image and back up user data before attempting fixes. Create a sector image or copy important documents from the drive using a known-clean boot environment (Linux live USB or WinPE on a USB stick). Do not execute programs from the compromised partition; treat those files as potentially infected and scan them later on a different, clean machine.

Second step: run offline scanners and rootkit checks from trusted rescue media (bootable AV or WinPE with up-to-date tools). Quarantine or remove anything found, then run filesystem and system-file repairs from recovery: for example, from WinRE/WinPE run

sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows
chkdsk C: /f /r

These repairs sometimes restore missing system files but will not remove all rootkits.

Third step: if behavior persists, inspect the offline registry (load the hives from WinPE) and confirm Winlogon entries are valid. Under
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
expect:

Shell = explorer.exe
Userinit = C:\Windows\system32\userinit.exe,

Also check HKCU/HKLM Policies keys (look for DisableTaskMgr or similar flags) and clear them if present. Only edit the registry from an offline environment and only if comfortable doing so.

As suggested, a repair install can replace damaged system files without wiping data, but it will not reliably remove sophisticated rootkits. If offline cleaning plus repair install fails, the safest route is a full reinstall after imaging and validating backups. For irreplaceable data, consider professional recovery. After recovery, apply full patching, install reputable AV, and scan all restored files on a clean machine before returning them to the repaired system.

Recommended Answers

All 2 Replies

Member Avatar for rastafarian

Would not getting a reply mean this problem has been solved before or would it mean i should give up?

Member Avatar for jholland1964

I honestly think none of us know what to tell you here. Since you cannot get into Windows it seems you cannot run the programs needed. It sounds to me, I could be wrong, that key windows files have been damaged by whatever it was you downloaded or the attempted clean up. I cannot say for certain. Your only option may be a reformat.
Have you tried a repair of the affected Windows? The repair may keep the files you wish to keep but correct the damaged os files.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.