BSOD on Startup, Possible Virus

[nitrusoxide]

Hello,

First post here, but I've found many answers on this site. Sorry in advance for any vague information, I'm dealing with my neighbor's PC that I'm not too familiar with.

He asked me to come over to deal with a virus/malware issue. It was the Security Suite malware, the one that scares you into thinking you have a virus and blocks a lot of things on your PC. I copied MBAM on a flash drive and installed it on his PC in safe mode, and removed everything. I also installed a copy of Avira anti-virus free software, and updated it to the latest version. In addition, there were a few items in his startup tab in msconfig that looked like nasties, so I disabled them as well.

After all that, the computer needed to restart, so I did that and it kept restarting itself. It flashes a blue screen error for literally a split second, then restarts. I'm not sure what to do at this point, as I can't boot into safe mode, last known good config, command prompt, anything. They all just result in a BSOD.

On top of that, I don't think he has an XP CD. He's got a Gateway desktop, and he has two recovery CDs that came with the computer. Both ask me if I want to do a full recovery/reinstall of Windows (destructive) or a repair reinstall after copying stuff to a backup directory. I haven't tried either yet. Is there anything I can do before trying to reinstall Windows?

Thanks!

[PhilliePhan]

In addition, there were a few items in his startup tab in msconfig that looked like nasties, so I disabled them as well.

I'm guessing you used msconfig to boot to safe mode as opposed to tapping F8 on boot? Did you do that?

-- What happens when you tap F8 on boot?
-- What about tapping F12?

-- I guess a better question would be: Are you still able to access the Recovery Disks? And, more specifically, the Recovery Console?

Let us know.

PP :)

[gerbil]

Uh-oh.... okay, in that advanced options screen near the foot is an option to stop auto-restart on error. Enable that, try to start in Normal mode, give the full details of that next blue screen.

[TurcoLoco]

I bet your neighbor will not be asking you to come over ever again! =)

[nitrusoxide]

I went over last night and disabled the restart on system failure so I could copy down the blue screen error:

STOP: c000021a {Fatal System Error}
Windows Logon Process system process terminated unexpectedly with status of 0xc0000005 (0x00000 0x00000)

Might have missed a zero or two but that's the general error.

@PhilliePhan, I didn't have a chance to do anything else in msconfig except uncheck a few startup items. After I did that it prompted me to restart and the boot loop started.

@stevebucknor1, not sure if that is sarcasm or not but if it is sorry to have offended you so much that you had to reply like that.

[PhilliePhan]

@PhilliePhan, I didn't have a chance to do anything else in msconfig except uncheck a few startup items. After I did that it prompted me to restart and the boot loop started.

So you didn't use msconfig to force Safe Mode?

What about my other questions?

-- Are you able to tap F8 on boot and then choose the "Last Known Good Configuration" option? If you can do that, do it and we'll work from there.

PP:)

Download UBCD4Win from www.ubcd4win.com and follow the instructions on how to create a bootable disc, then burn the ISO file. It will boot into a preinstallation environment and you can backup the data from there

[nitrusoxide]

PhilliePhan, nope I didn't use MSCONFIG to force safe mode. Every option that comes up when I hit F8 during startup resulted in a blue screen error, including the last known good configuration.

I think he is going to take the PC to a repair shop to see what they can do. Not sure if I can, but we can consider this thread closed.

[PhilliePhan]

Not sure if I can, but we can consider this thread closed.

Are you able to copy his important data to external drive?

In your first post, you said you could run the recovery CDs - If you can do that, there should be no reason to take it to the shop just yet.
That's why there was a bit of confusion on my end - figured you had a bit more functionality.....

Cheers :)
PP

[nitrusoxide]

Nope, I can't even get to a command prompt. The recovery CDs had two options: one to copy all the files to C:\backup and reinstall Windows, and another option to wipe everything and reinstall Windows. I hoped the CD would at least give me the option to get to a recovery console, but no luck :)

I could do option 1, but it said I'd have to reinstall all his applications, and he wanted to see if a repair shop could fix it without that happening. Oh well, I did as much as I could as a friendly neighbor.

Thanks for your help!

[PhilliePhan]

Oh well, I did as much as I could as a friendly neighbor.

Thanks for your help!

Yeah - it's good of you to try :)

Hopefully the shop can get him sorted without losing important data.

I was going to say that, if you can boot the recovery disks, you should also be able to boot a Linux live CD and use that to copy all of his important info to an external drive.
It is VERY easy...... Providing you have an external drive. A shop might charge and arm and two legs to do that.

The CD is FREE and easy to create and I can talk you through it. Something to consider if you don't want to give up just yet or you want to take a stab at backing up the data before putting the compy in the shop.

Cheers :)
PP