1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive Multiple Infections; Cannot boot- Critical Stop 0X0000007B

Discussion in 'Malware and Virus Removal Archive' started by kspaulding, 2009/07/26.

Page 1 of 2
  1. 2009/07/26
    kspaulding Lifetime Subscription

    kspaulding Well-Known Member Thread Starter

    Joined:
    2005/08/07
    Messages:
    77
    Likes Received:
    0
    [Inactive] Multiple Infections; Cannot boot- Critical Stop 0X0000007B

    I was working on a friend's PC attempting to clean multiple infections. She just recently obtained broadband service and was not running a firewall and either no AV & malware protection software or very outdated AV definitions resulting in them having been circumvented by infections.

    Her desktop PC is a Dell (don't have the model info etc at moment as I'm not at her house currently; will post later as needed) running with only 512 RAM. I had loaded AVG (free edition) scanned and cleaned some multiple infections but registry appears to have been reloading them on re-boots. I installed & updated Spyware Blaster and it seems to run fine. I installed and attempted to run Spybot S&D, Malwarebytes & SuperantiSpyware but the existing infections prevent access to the exe files to run them. I was unsure of the correct files to search for and rename in an attempt to get around that problem and run those programs. I was attempting to boot into Safe Mode and see if I could access them but I get a Blue screen with the following Critical Stop error:
    Stop 0X0000007B (0XF8C8F528, 0XC0000034, 0X00000000, 0X00000000)

    Blue screen message indicate virus detected and will not allow computer to boot. Not certain how to proceed. Assistance would be appreciated.
     
    kspaulding,
    #1
  2. 2009/07/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Are you saying, you can't boot in any mode right now?
     
    broni,
    #2


  3. to hide this advert.

  4. 2009/07/26
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Guess so .....
     
    PeteC,
    #3
  5. 2009/07/26
    kspaulding Lifetime Subscription

    kspaulding Well-Known Member Thread Starter

    Joined:
    2005/08/07
    Messages:
    77
    Likes Received:
    0
    That is correct. I cannot boot in normal or any of the Safe Modes. I get the same Stop error message about virus being detected and needing to run a check for viruses.

    I have a spare PC of mine that I'm updating Windows on (been sitting a while). It has Windows 2K-Pro and I thought if needed I could slave the HD from her PC on my old one to run AV software etc. I forgot to state that her PC was running XP-SP2.

    Looking for best and safest path forward and hoping not to have to format the HD, reload OS and lose all her data. She doesn't have an OS disk as the PC was a hand-me-down to her. I don't have any XP disks as I run 2K-Pro.

    I appreciate any help or suggestions.
     
    kspaulding,
    #4
  6. 2009/07/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Avira AntiVir Rescue System

    Using another working computer...
    1. Download the Avira AntiVir Rescue System: http://www.free-av.com/en/tools/12/avira_antivir_rescue_system.html
    2. Place a blank CD in your burner and double-click on the downloaded file.
    3. The program will automatically burn the CD for you.
    4. Place the burned CD into the affected computer and start the computer with the CD in the CD tray.
    5. On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.
    6. Click on the Configuration button.

    - Select Scan all files
    - Select Try to repair infected files and Rename files, if they cannot be removed
    - Select Scan for dialers
    - Select Scan for joke programs (Jokes)
    - Select Scan for games
    - Select Scan for spyware (SPR)

    7. Click on Virus scanner
    8. Click on Start scanner at the bottom of the screen.

    9. Let Avira finish it's scan and then remove any threats found and then exit out of the scanner.
    10. Take the CD out of the CD/DVD tray and then restart the computer.

    If needed see this Tutorial for the Avira Rescue CD: http://forum.avira.com/wbb/index.php?page=Thread&threadID=82163
     
    broni,
    #5
  7. 2009/07/26
    kspaulding Lifetime Subscription

    kspaulding Well-Known Member Thread Starter

    Joined:
    2005/08/07
    Messages:
    77
    Likes Received:
    0
    Thanks, I'll do this at first opportunity and let you know the results. Thanks so much for replying.
     
    kspaulding,
    #6
  8. 2009/07/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Ok...
     
    broni,
    #7
  9. 2009/07/26
    kspaulding Lifetime Subscription

    kspaulding Well-Known Member Thread Starter

    Joined:
    2005/08/07
    Messages:
    77
    Likes Received:
    0
    Thanks, I'll run this as soon as I can and let you know the results. Thank you for your time and the assistance!
     
    kspaulding,
    #8
  10. 2009/07/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're welcome :)
     
    broni,
    #9
  11. 2009/07/26
    kspaulding Lifetime Subscription

    kspaulding Well-Known Member Thread Starter

    Joined:
    2005/08/07
    Messages:
    77
    Likes Received:
    0
    Broni, I have a small problem and hope you have a solution. I created the bootable Rescue CD as instructed and it loaded (had to use the F-12 & select the CD Rom) but I think because of the previous settings on the PC when the menu screen appears I can only see about the top 2/3rds of the page. I cannpt make adjustments to move the page, cannot scroll or tab down the page to select the "English" language. So I said what the heck, just run it in german (made the selections based on the line selections in the english language tutorial). Thought I was being pretty smart. Trouble is when I changed to the CONFIGURATIONS tab to make the selections change, then switched back to the scanner page, I could not get to the "Start Scanner" button which unfortunately is along the bottom of the page.

    On first load it starts scanning automatically so I don't need the "Start" button but it is scanning for the Malware protocol only. The try repair etc. is not selected. Should I let that run? Have a work around to let me get to the "Start Scanner" buton? or maybe a different tool to try?

    Sorry for the extra trouble.

    Kevin
     
    kspaulding,
    #10
  12. 2009/07/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Try to press Enter. That will work, if "Start scanner" button is already selected.
    If it's not, use Tab button to move between selections.
    I hope, I make sense.
     
    broni,
    #11
  13. 2009/07/26
    kspaulding Lifetime Subscription

    kspaulding Well-Known Member Thread Starter

    Joined:
    2005/08/07
    Messages:
    77
    Likes Received:
    0
    It makes sense, but I already tried those. I cannot tab around the page and hitting the Enter key does nothing as well. Ialso tried scrolling and the Page Down keys with no success. I even tried selecting the Advanced Users boot selections that have a number of VGA settings offered but could not see the entire page.
     
    kspaulding,
    #12
  14. 2009/07/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Let's see, if we can fix boot issue...

    If you have Windows CD...(if you don't have Windows CD, scroll down)

    1. Insert your Windows XP CD into your CD and assure that your CD-ROM drive is capable of booting the CD.
    2. Once you have booted from CD, do NOT select the option that states: Press F2 to initiate the Automated System Recovery (ASR) tool.
    You’re going to proceed until you see the following screen, at which point you will press the “R” key to enter the recovery console:

    [​IMG]

    3. After you have selected the appropriate option from step two, you will be prompted to select a valid Windows installation (typically number “1″).
    Select the installation number, and hit Enter.
    If there is an administrator password for the administrator account, enter it and hit Enter (if asked for the password, and you don't know it, you're out of luck).
    You will be greeted with this screen, which indicates a recovery console at the ready:

    [​IMG]

    4. There are eight commands you must enter in sequence to repair your problem..
    NOTE. Make sure, you press Enter after each command. Make sure, all commands are exact, including "spaces ".
    These commands are as follows:

    CD..
    ATTRIB -H C:\boot.ini
    ATTRIB -S C:\boot.ini
    ATTRIB -R C:\boot.ini
    del boot.ini
    BOOTCFG /Rebuild

    Note about the above command.
    BOOTCFG /REBUILD command which searches for pre-existing installations of Windows XP and rebuilds sundry essential components of the Windows operating system, recompiles the BOOT.INI file and corrects a litany of common Windows errors.
    It is very important that you do one or both of the following two things:
    A.) Every Windows XP owner must use /FASTDETECT as OS Load Option when the rebuild process is finalizing.
    B.) If you are the owner of a CPU featuring Intel’s XD or AMD’s NX buffer overflow protection, you must also use /NOEXECUTE=OPTIN as an OS Load Option.
    For the Enter Load Identifier portion of this command, you should enter the name of the operating system you have installed.
    If, for example, you are using Windows XP Home, you could type Microsoft Windows XP Home Edition for the identifier (it's not crucial, however what the name is, as long, as it's meaningful).
    Here is your computer screen:

    [​IMG]

    5. Following command verifies the integrity of the hard drive containing the Windows XP installation. While this step is not an essential function in our process, it’s still good to be sure that the drive is physically capable of running windows, in that it contains no bad sectors or other corruptions that might be the culprit:

    CHKDSK /R

    6. This last command writes a new boot sector to the hard drive and cleans up all the loose ends we created by rebuilding the BOOT.INI file and the system files. When the Windows Recovery Console asks you if you are Sure you want to write a new bootsector to the partition C: ? just hit “Y”, then Enter to confirm your decision:

    FIXBOOT

    7. It’s time to reboot your PC by typing
    EXIT
    and pressing Enter.

    With any luck, your PC will boot successfully into Windows XP as if your various DLL, Hive, EXE and NTLDR errors never existed.



    If you don't have Windows CD...
    Download Windows Recovery Console: http://www.thecomputerparamedic.com/files/rc.iso
    Download, and install free Imgburn: http://www.imgburn.com/index.php?act=download
    Using Imgburn, burn rc.iso to a CD.
    Boot to the CD...let it finish loading.
    When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
    Then, follow instructions from Step #3 above.
     
    broni,
    #13
  15. 2009/07/26
    kspaulding Lifetime Subscription

    kspaulding Well-Known Member Thread Starter

    Joined:
    2005/08/07
    Messages:
    77
    Likes Received:
    0
    Broni, I successfuly created the disc and loaded it to the point of the image that you linked as an example oe ready for the 8 commands. However when I enter "CD.." it states this command is not recognized. It will not change to the root drive of C:

    Should I go straight to the first ATTRIB entry @ c:\windows> ?
     
    kspaulding,
    #14
  16. 2009/07/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    No, because, it'd work with first 3 commands, but not with the others (we'd have to adjust them).
    Try
    cd<space>..
     
    broni,
    #15
  17. 2009/07/26
    kspaulding Lifetime Subscription

    kspaulding Well-Known Member Thread Starter

    Joined:
    2005/08/07
    Messages:
    77
    Likes Received:
    0
    Okay, the space helped... Now for the next issue.
    During BOOTCFG /REBUILD, "Error: Failed to successfully scan disks for Windows installations. This error may be caused by a corrupt file system, which would prevent Bootcfg from successfully scanning. Use chkdsk to detect any disk errors."

    I am running CHKDSK now, if successful do I just do the BOOTCFG /REBUILD again or the entire sequence of commands? If not successful I believe I know what that means...

    Thanks again for all your time, patience and help!!
     
    kspaulding,
    #16
  18. 2009/07/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    If chkdsk finds, and fix some errors, and you ran successfully:
    ATTRIB -H C:\boot.ini
    ATTRIB -S C:\boot.ini
    ATTRIB -R C:\boot.ini
    del boot.ini
    then you go only with BOOTCFG /REBUILD
     
    broni,
    #17
  19. 2009/07/27
    kspaulding Lifetime Subscription

    kspaulding Well-Known Member Thread Starter

    Joined:
    2005/08/07
    Messages:
    77
    Likes Received:
    0
    Well, maye the end of the road here. I've run CHKDSK 3 times once with the/P extension to check the volume as well. I saw no reported errors. The last chkdsk report was
    "CHDDSK has finished checking the volume.
    117154012 kilobytes total space.
    85064072 kilobytes are available.

    4096 bytes in each allocation unit.
    29288503 total allocation units on disk.
    21266018 allocation units available on disk. "

    After each chkdsk i re-ran the BOOTCFG /REBUILD command and still receive the same error message as before about Failed to soccessfully scan disks for Windows installations. This error may be caused by a corrupt file system, which would prevent Bootcfg from successfully scanning. Use chkdsk to detect any errors.

    Next step formatting the HD & reload of OS (which I don't have)? or do you have any more magic tricks up your sleeve?

    Thanks again for your time. I enjoy trying to learn a little....
     
    kspaulding,
    #18
  20. 2009/07/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Run hard drive diagnostics: http://www.tacktech.com/display.cfm?ttid=287
    Make sure, you select tool, which is appropriate for the brand of your hard drive.
    Depending on the program, it'll create bootable floppy, or bootable CD.
    If downloaded file is of .iso type, use ImgBurn: http://www.imgburn.com/ to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.

    NOTE. If your hard drive is made by Toshiba, unfortunately, you're out of luck, because Toshiba doesn't provide any diagnostic tool.
     
    broni,
    #19
  21. 2009/07/27
    kspaulding Lifetime Subscription

    kspaulding Well-Known Member Thread Starter

    Joined:
    2005/08/07
    Messages:
    77
    Likes Received:
    0
    Okay, thanks. It is a Seagate drive. I have that diagnostic test running now (long test version that checks every sector).

    When I closed the recovery console I had to reboot to be able to eject the CD. When I did it showed an error message saying Windows could not boot because a file was missing in the Windows Root directory. I don't recall the exact file name but it was something like ...system32.hall.dll maybe? Anyway I'll try to reallocate any bad sectors that might be found on the disk and then try to reboot into Windows? Is that the correct next step? I don't want to assume or get ahead of what you instruct.
     
    kspaulding,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...