Member Avatar for BryanA917

I thankful to have found this site through Google (number 4 I think on "WinXP no mouse no keyboard" search).

In starting with a second question, I'll ask what moderator I could e-mail a HijackThis log to that must contain nearly 300 items? I'm new at a computer repair shop and recently discovered HJT and MWShredder (?) and StartUp List, etc. My new-green color led me to try these on a laptop today too...

A Compaq Evo came in. It's got WinXP and the owner hits Ctrl+Alt+Delete before putting in his name and password onto just one of many Networks ID's.

His laptop was running slower than you can imagine. Norton and Symantec and McAfee all reported no viruses. It took forever, but I installed HJT, et al in a folder on his desktop via a CD-ROM and ran HJT. I'm too new at this and got giddy.

No pro looked at that list and I rebooted after a significant "Fix." The computer ran great like a P4 should. I was happy. I rebooted several times to ensure things were well. All was well until I tried to unzip another anti-spy soft.

Things got slow again. I realized that I had about 60 seconds every reboot before a freeze. I beat the clock and beat the clock and deleted backups from HJT thinking they were replacing themselves. On another 60 second round I finally found the Processes (?) and found that mcshield was ramping up within 60 seconds to steal 99% of the CPU. I lowered its Priority to Low from highest.

That triggered System 'something' to 99% (like hibernate, but not that word-it's at the bottom of the list literally). After 60 seconds more, I was free to work the computer normally although 99% was still designated to the bottom process. I got giddy again.

(Sorry this is so wordy). I sought out MSCONFIG and unchecked quite a bit of Start Up items. Then I saw Services (?) and unchecked things that weren't Microsoft or MCI (our victim is an MCI employee). The Compaq was singing right along again. No delays, no warnings, no nothing. I also tore out BISADS from the history.

Then the reboot. It's all wrong, man.

It's a quick boot. I only got to hit F10 and toy with those things. Once it gets to the C+A+Delete screen, no input is registered at all. Because he signs on to a Network, I am thinking that there is no chance for me to get to use F8; no chance to run in Safe Mode.

Thank you for reading my short novel - will a start up disk make a difference? I hate to say this, but reformatting is 100% not an option. And before I go HJT crazy again on a waiting PC, I would really like to have someone look at the scary long report (seriously about 300 items) from that other computer with similar problems and thensome running 98.

If you tell me to post the other HJT, that's what I'll do - I just wouldn't presume to take up so much space on the Forum.

If you guys can save my roasted buns at my new job, then please consider telling me how to become a sponsor and expect my number of posts to increase! Fair is fair and I'm already grateful to have found so many computer-smart people who use their super-human powers for the sake of good. Thank you sincerely.

  • 3 Contributors
  • 2 Replies
  • 133 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by Catweazle

Dani AI

Generated

A quick recap and recovery plan based on the symptoms described by and the replies from and : disabling startup items or services can remove the drivers or service support that Windows needs to accept keyboard/mouse input at the logon screen. The least-destructive recovery steps should be tried first (F8 -> Last Known Good or Safe Mode) before moving on to offline registry restores or a repair install. As suggested, involve @tallcool1 or the Security forum for a careful review of the HijackThis log; include exactly which Services/MSCONFIG entries were unchecked and any HJT backups that still exist.

Immediate actions (non-destructive)

  • Reboot and press F8 repeatedly during POST to reach Advanced Boot Options. Select "Last Known Good Configuration (advanced)" first. This restores service/driver startup values to the last successful logon.
  • If LKG fails, use "Safe Mode" or "Safe Mode with Command Prompt" from the same menu. From Safe Mode undo the service/startup changes (re-enable items that were unchecked) and run System Restore to a point before the changes if available.

Offline registry option (when Safe Mode/LKG are inaccessible)
Boot the XP CD, press R for Recovery Console, select the Windows installation, authenticate with the Administrator password, then run (example sequence):

cd \windows\system32\config
ren DEFAULT DEFAULT.old
ren SAM SAM.old
ren SECURITY SECURITY.old
ren SOFTWARE SOFTWARE.old
ren SYSTEM SYSTEM.old
copy \windows\repair\DEFAULT
copy \windows\repair\SAM
copy \windows\repair\SECURITY
copy \windows\repair\SOFTWARE
copy \windows\repair\SYSTEM
exit

Caution: copying the repair hives restores an earlier registry state (may remove later-installed drivers/apps). Back up the renamed files so they can be restored if needed.

If offline hive restore is not acceptable or fails, an in-place "Repair Install" from the XP CD will replace core system files without formatting and often fixes damaged drivers/services while preserving user data.

When posting the HJT log in the Security forum (as advised), include the full log, a clear list of every Service/MSCONFIG change made, timestamps when problems began, and whether the built-in HJT backups are still present. That context makes diagnosis much faster and avoids unnecessary reformatting.

Recommended Answers

All 2 Replies

Member Avatar for Slade

Talk to the moderator tallcool1, he is very knowledgable where spyware is concerned.

Member Avatar for Catweazle

Post your 'Hijackthis' logs and concerns in the new "Security' Forum area please.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.