Infected system, boots to black screen after POST

I was handed this computer after a user tried to clean multiple infections with Symantec. The computer shows the manufacturer's logo, and I can access the boot menu (and the whole BIOS), but when selecting the hard drive - or letting the computer boot straight from the hard drive without selecting it - the computer shows only a black screen.

I have tried recovery console: fixboot, fixmbr, chkdsk /p /r
I then tried to to a repair install.

Same results.

The drive can be mounted and accessed. There are no indicators of physical failure that I can tell. But it won't advance past the black screen.

I have tried this computer on 2 different sets of monitors, and the hard drive in 2 towers. (A spare hard drive I had booted all the way through to Windows using the same SATA cables that this hard drive is connected to.) And the only result I can get is the black screen.

Are there any tools I can use to help bring the disk through boot and into Windows? If I could just do that, then I could clean the malware. I'm hoping someone has some advice about getting there.

 

If you're convinced it's malware (I'm not) then ask on the correct forum, but have you actually tested the drive with the manufacturers utilities?

Disk Diagnostic Software ....

ExcelStore

Hitachi/IBM

Samsung

Seagate, Maxtor, Quantum

Western Digital

Fujitsu

 

Did you place the XP setup CD in the drive bay and attempt to boot? Did it give the option screen to Press Any Key To Boot From CD? If so, did you press a key and if so what was the next screen message? If you didn't get an option to Press Any Key, did you then change the boot sequence in the bios to allow for the CD drive to be checked first, before the hard drive? Then did you attempt once more to boot to the CD? If it succeeded, did you follow through all the screen prompts, ignoring the first R offered and continuing on as if doing a full install, as you must do to perform a Repair Install. Then did it detect the existing system and ask if you woulld like to repair it? That's how a Repair Install is done. Tell us how you did your attempt and what messages you got.

Help will come much faster if you supply full details.

 

To: WILDFIRE
The computer is infected with a number of malware. I'm not blaming the malware as the reason it won't boot, though. While the issue booting happened after the attempted malware cleanup, I'm aware that correlation =/= causation. I was just trying to list all the factors that I know are present.

I will download the hdd manufacturer's utils and run a test.


To: SURFERDUDE
I changed the boot priority in the BIOS to boot first from the CD-ROM.

Putting in my windows install disc, I pressed 'r' at the first option to run Windows Recovery console, as detailed above, with fixes to the master boot record, as well as a check disk scan. The computer failed to boot past the black screen after that, still.

Instead of pressing 'r', the next time I booted from the CD, I selected "enter" and "f8" to get the prompt to perform a repair installation of Windows XP. The blue loading screen displayed that it was deleting a number of files and then the yellow copy bar ran until the computer rebooted. I did not 'press any key' as instructed, so I could see if the hard drive booted after the repair install.

It did not.

 

That's what I needed. As you probably already suspect, this may be an equipment failure, either a bad HD or mobo IDE channel or cable. That doesn't mean it couldn't still be some malware that can lead us astray. They have been known to change the drive designation so as to hide it. You could check that with the free tool ptedit32.exe or ptedit.exe from Symantec. I'd try to get the data off it and wipe it clean, reformat using the long method and if all seems good, do a clean install.

You could fool around with it connected in another system and try to clean the malware from it but I suspect you'll spend more time than it's worth.

 

I'll have to look for a link for pfedit and ptedit32 since my old one has failed me. BRB

OK, I think these will do:

Ptedit32 for use in a Windows environment.

PTedit for use in the 16-bit environment.

You would run whichever tool was appropriate and check the TYPE listed for the HD in question. It should be type 07 for a normal NTFS system.

It would seem that since the install CD found the drive that it would be visible and healthy though??? We may be back to equipment failure after all.

 

The SeaTools DOS utility reported no hardware errors with the hard drive. I ran both the long and short tests.

What is ptedit? It didn't come with a readme on how to use it. Is it bootable, or do I need to mount the hard drive onto another system and target the mounted hard drive?


EDIT: I'm confused. How do I use PTEDIT, now that you've posted the right links? I can't get into the windows environment yet to run it.

 

You can supposedly place ptedit.exe on a bootable floppy created by Xp and it will run when you execute it from a command line from that disk.

Else, you can run ptedit32.exe directly from a windows environment, it's a free standing tool that needs no install. It will detect all drives connected so browse to the correct one and see how it compares to the norm. I have always used it from within Windows but the other way should work. Never tried it.

 

PT Results (I plugged the non-booting drive into my operating computer via SATA to USB tonnection - it also had 2 lines of data where my personal hard drive only had 1)

Drive 1 (76316 MB) 8728 cyl, 255 heads, 63 sectors per track
Partition Table at sector 0 (cyl 0, head 0, sector 1)
Type: 07 | Boot: 80 | Cyl: 0 | Head: 1 | Sector: 1 | Cyl: 1023 | Head: 254 | Sector: 63 | Before: 63 | Sectors: 15628057

Drive 2 (76293 MB) 9726 cyl, 255 heads, 63 sectors per track
Partition Table at sector 0 (cyl 0, head 0, sector 1)
Type: DE | Boot: 00 | Cyl: 0 | Head: 1 | Sector: 1 | Cyl: 5 | Head: 254 | Sector: 63 | Before: 63 | Sectors: 96327
Type: 07 | Boot: 80 | Cyl: 6 | Head: 0 | Sector: 1 | Cyl: 1023 | Head: 254 | Sector: 63 | Before: 96390 | Sectors: 156135735

 

That DE type partition would seem to be a Dell hidden creation that will allow you to press a certain key at start-up and possibly run a system restore. The other partition looks fine and since you report running a diagnostic on it and getting a clean report, I think we must look elsewhere than the drive for the failure.

I'd not go much further if there is data to save and since you have it connected and presumably readable, it would be a good time to do the backup.

Then I'd see if pressing some key at start-up gave me any options that might help. I'm holding off on saying the board has failed until we try a clean install and it fails.

 

I can offer you a boot floppy or CD creator that will allow you to make a Quick Boot CD or floppy and use it to boot the system for a test. It will substitute for the HD MBR and boot code as well as the 3 boot files XP needs so that we can see if that's where the problem lies.

Get which ever one you need HERE. Direction are there also but ask if you need more.

 

Props to SURFERDUDE!

Here's the messages I get from your quickbooter iso.

Physical Disk 1(rdisk0) Boot Partition 1
Physical Disk 1(rdisk0) Boot Partition 2
Physical Disk 2 (rdisk1) Boot Partition 1
Physical Disk 2 (rdisk1) Boot Partition 2
Physical Disk 3 (rdisk2) Boot Partition 1
Physical Disk 3 (rdisk2) Boot Partition 2

Booting from the first option, I got the following message:
"Windows could not start because the following file is missing or corrupt:
<Windows Root>\system32\hal.dll
Please reinstall a copy of the above file. "

Booting from the second option took me to a black screen.

That leaves a couple of questions:
- hal.dll should have been replaced with the repair installation, correct?
- How do I replace hal.dll since the repair installation did not?
- Maybe I don't understand it... But how do I have 3 *physical* disks when I have only one hard drive? And 6 boot partitions?

 

Try all of the options. Since you only have one drive connected, one of the first two selections should have worked if bootloader was the problem. The disk is make so that it can be used in many types of system configurations. If it won't boot from ANY of the selections, your problem is more serious than a missing bootloader file and will probably require wiping the drive and doing a clean install.

 

Results 3-6:

"Windows could not start because of a computer disk hardware configuration problem.
Could not need from the selected boot disk. Check boot path and disk hardware.
Please check the Windows documentation about hardware disk configuration and your hardware reference manuals for additional information. "

 

I work in a pc repair shop and I have run into the black screen on many occasions.

Every time I have been able to boot into the system using miniPE and using the registry restore tools, went back a few days and got it back into windows.

This has resolved the black screen error for me about 90% of the time but Im weary of this working for you since you already ran a windows repair. The restore points might not be there anymore.

 

I wish I'd remembered miniPE... I have a copy of Hiren's Boot CD back at home, that I was using on a friend's computer. Along with my copy of UBCD. So many good tools... And I never remember them when I need them.

Here's hoping Surfer has something to make up for my memory shortfall.

 

Well, if you're up to doing command line licks, you could download the Vista boot iso and make the boot cd with it. It will allow you to perform command line work on an NTFS system, giving access to all system files. I generally use a bartPE for that but you may not be able to build one if you don't have all the resources where you're at now.

You can get the Vista iso HERE or if that link fails, Google for it.

I never see an offer for a BartPE iso so I suppose that's a violation of MS copyright.

 

What kind of time are we looking at to build and run a bartPE? I have the access and the blank CD-RWs to make what I need.

At this point, is getting it running going to take less time and effort than rebuilding it?

If you think so, then let's go ahead with the bartPE, and command line this thing back to life. I'm game if you are.

 

You'll need a XP setup CD and the software from HERE. It doesn't take long to build. Full instructions are on that link site. When finished that disk will give you regular copy/paste access as if you were in a windows environment. Beats command mode for sure.

All that is not to dismiss the fact that sometimes it's easier to wipe and do a clean install.

 

I'm getting a Windows install CD now, and going to build the PE shortly.

Question... I have an upgrade version of XP Pro (requires a 2k disc when installing on a zero'd drive, but not when re-formatting with Windows already on a drive). That should work, right? Or does it have to be a full version, from scratch?