Member Avatar for nitrusoxide

Hello,

First post here, but I've found many answers on this site. Sorry in advance for any vague information, I'm dealing with my neighbor's PC that I'm not too familiar with.

He asked me to come over to deal with a virus/malware issue. It was the Security Suite malware, the one that scares you into thinking you have a virus and blocks a lot of things on your PC. I copied MBAM on a flash drive and installed it on his PC in safe mode, and removed everything. I also installed a copy of Avira anti-virus free software, and updated it to the latest version. In addition, there were a few items in his startup tab in msconfig that looked like nasties, so I disabled them as well.

After all that, the computer needed to restart, so I did that and it kept restarting itself. It flashes a blue screen error for literally a split second, then restarts. I'm not sure what to do at this point, as I can't boot into safe mode, last known good config, command prompt, anything. They all just result in a BSOD.

On top of that, I don't think he has an XP CD. He's got a Gateway desktop, and he has two recovery CDs that came with the computer. Both ask me if I want to do a full recovery/reinstall of Windows (destructive) or a repair reinstall after copying stuff to a backup directory. I haven't tried either yet. Is there anything I can do before trying to reinstall Windows?

Thanks!

  • 5 Contributors
  • 10 Replies
  • 257 Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by PhilliePhan

Dani AI

Generated

Quick triage and what to try before a destructive reinstall.

Start by preserving user data — that’s the priority. Several replies in this thread pointed toward an offline rescue/backup first and that approach is correct: a blue‑screen at the early logon stage means a critical user‑mode process (Winlogon or CSRSS) failed, so repairs that touch system files can be risky without a copy of the users’ folders and registry hives. The Microsoft troubleshooting guidance for STOP 0xC000021A explains the common causes and why an offline approach is recommended. (learn.microsoft.com)

Use a bootable pre‑OS environment to copy files (user profiles, Documents, Desktop, mail stores, favorites, and hidden files like NTUSER.DAT). Mount NTFS read‑only when possible and copy to an external drive. If the disk is showing read errors or is noisy, make a sector‑level image first and work from the image instead of the original drive; GNU ddrescue is the standard tool for that kind of rescued imaging. For file‑level copies and mounting guidance, Ubuntu’s live environment documentation is a good practical reference. (help.ubuntu.com)

If you want to attempt non‑destructive repairs, use the Windows Recovery/console or a WinPE-based environment to check and repair the filesystem and boot records. Typical Recovery Console commands to try (from the installation/recovery environment) are: 

chkdsk /r
fixboot
fixmbr
bootcfg /rebuild

Run those only after the data is backed up; the Recovery Console docs list exact usage and caveats (Administrator password, access limits). (learn.microsoft.com)

If offline scans and recovery‑console repairs don’t restore bootability, consider an in‑place (repair) install before a full wipe — it replaces core system files but can preserve applications in many XP scenarios. Image the drive first, and run an up‑to‑date offline AV/rescue scan on the image or from rescue media before restoring any user data. If imaging/repairs are outside comfort level, hand the disk (or image) to a data‑recovery/repair pro rather than doing a destructive reinstall. (support.microsoft.com)

Notes tied to the thread: ’s suggestion to stop auto‑restart made the error readable; ’s emphasis on backing up first is the right priority; pointed toward a bootable recovery approach — follow those steps in that order (backup → offline scan/image → non‑destructive repair → repair install) to avoid unnecessary data loss.

Recommended Answers

All 10 Replies

Member Avatar for PhilliePhan

In addition, there were a few items in his startup tab in msconfig that looked like nasties, so I disabled them as well.

I'm guessing you used msconfig to boot to safe mode as opposed to tapping F8 on boot? Did you do that?

-- What happens when you tap F8 on boot?
-- What about tapping F12?

-- I guess a better question would be: Are you still able to access the Recovery Disks? And, more specifically, the Recovery Console?

Let us know.

PP :)

Edited by PhilliePhan because: Brain Cramp
Member Avatar for gerbil

Uh-oh.... okay, in that advanced options screen near the foot is an option to stop auto-restart on error. Enable that, try to start in Normal mode, give the full details of that next blue screen.

Member Avatar for TurcoLoco

I bet your neighbor will not be asking you to come over ever again! =)

Member Avatar for nitrusoxide

I went over last night and disabled the restart on system failure so I could copy down the blue screen error:

STOP: c000021a {Fatal System Error}
Windows Logon Process system process terminated unexpectedly with status of 0xc0000005 (0x00000 0x00000)

Might have missed a zero or two but that's the general error.

, I didn't have a chance to do anything else in msconfig except uncheck a few startup items. After I did that it prompted me to restart and the boot loop started.

, not sure if that is sarcasm or not but if it is sorry to have offended you so much that you had to reply like that.

Member Avatar for PhilliePhan

@PhilliePhan, I didn't have a chance to do anything else in msconfig except uncheck a few startup items. After I did that it prompted me to restart and the boot loop started.

So you didn't use msconfig to force Safe Mode?

What about my other questions?

-- Are you able to tap F8 on boot and then choose the "Last Known Good Configuration" option? If you can do that, do it and we'll work from there.

PP:)

Member Avatar for Member #697672

Download UBCD4Win from www.ubcd4win.com and follow the instructions on how to create a bootable disc, then burn the ISO file. It will boot into a preinstallation environment and you can backup the data from there

Member Avatar for nitrusoxide

PhilliePhan, nope I didn't use MSCONFIG to force safe mode. Every option that comes up when I hit F8 during startup resulted in a blue screen error, including the last known good configuration.

I think he is going to take the PC to a repair shop to see what they can do. Not sure if I can, but we can consider this thread closed.

Member Avatar for PhilliePhan

Not sure if I can, but we can consider this thread closed.

Are you able to copy his important data to external drive?

In your first post, you said you could run the recovery CDs - If you can do that, there should be no reason to take it to the shop just yet.
That's why there was a bit of confusion on my end - figured you had a bit more functionality.....

Cheers :)
PP

Member Avatar for nitrusoxide

Nope, I can't even get to a command prompt. The recovery CDs had two options: one to copy all the files to C:\backup and reinstall Windows, and another option to wipe everything and reinstall Windows. I hoped the CD would at least give me the option to get to a recovery console, but no luck :)

I could do option 1, but it said I'd have to reinstall all his applications, and he wanted to see if a repair shop could fix it without that happening. Oh well, I did as much as I could as a friendly neighbor.

Thanks for your help!

Member Avatar for PhilliePhan

Oh well, I did as much as I could as a friendly neighbor.

Thanks for your help!

Yeah - it's good of you to try :)

Hopefully the shop can get him sorted without losing important data.

I was going to say that, if you can boot the recovery disks, you should also be able to boot a Linux live CD and use that to copy all of his important info to an external drive.
It is VERY easy...... Providing you have an external drive. A shop might charge and arm and two legs to do that.

The CD is FREE and easy to create and I can talk you through it. Something to consider if you don't want to give up just yet or you want to take a stab at backing up the data before putting the compy in the shop.

Cheers :)
PP

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.