Compaq Presario r3000 safe mode boot loop

Hello all, I am new to this forum and in desperate need of some help. I have been everywhere and spent good money trying to find a solution to this problem but have had zero success. Here is the problem. Recently I got a rootkit infection that then allowed a hacker to upload virut and heur to my computer. As soon as this was said at every single OTHER forum on the planet they just send you a form reply to topic that says I am no good and that I have to reformat my computer… BUT WAIT! There is more to the story. Because these two viruses destroy the registry entries that control safe boot mode capability if you make the unfortunate mistake of trying to run any of the virut cleaning utilities from any of the antivirus companies by using msconfig to force the computer to boot in safe mode from boot.ini your computer will be locked in a safe boot mode failure loop. It will start with the compaq screen with some options to enter into setup or boot from lan or press escape to change boot order. Then it will go to the screen that gives you options like safe boot mode, safe boot mode with prompt, boot from last known good configuration, etc. ANY option just gets subjugated to the msconfig setting and puts you right back there because the registry and possible the boot.ini is totally corrupted. This is a gift computer from my sister and so I dont know the system admin password to enter the phoenix bios setup utility. Don't know how to recover this because again the OS is not booting even if I had software (and more spent money in vain) that would help me recover or change that. Many disks sales companies say that all you have to do is insert their disk and it will autorun when you put it in an boot any computer no matter what well I defy you to tell me that THIS computer will boot. IT will not. So folks I am really needing someone who knows these laptops well and can help me find a way to get this computer up and running again OUT of this hell loop of failed safemode. Please? Benjamin

Hi and welcome to the WTT forums

We do not offer malware removal advice on this subforum…if you need specific malware removal advice, then you should go here:
http://forums.whatthetech.com/HijackThis_L…emoval_f27.html
and a trained and trusted malware removal specialist will offer you direction on how to proceed.

Having said that there is a general opinion amongst malware removal experts that the best solution to virut infection is a format and reinstall of your operating system rather than even attempting to clean in any other way. This is also my own view, providing your machine is infected with virut as you have been told.

Having said that you will need to boot the machine somehow to get anything done with it at all, (if at all possible…….)
Here are some thoughts for your consideration…however I appreciate its completely your call as to how you wish to procced.

1 the first step is to try to boot from the Microsoft Windows Installation disc or any other boot disc, Ubuntu or Puppy Linux are both excellent, but if your machine will not boot from CD/DVD then the next step is to go into the BIOS,

It will start with the compaq screen with some options to enter into setup or boot from lan or press escape to change boot order.

If you can get into set up as above then do so …the objective is to set the boot priority to boot first from CD/DVD and only from Hardrive as second priority…you MUST save changes before exiting……….. now see if you can boot from CD

If not have a look on the Compaq sreen to see if there is an option to reinstall or restore……….you could try this, but note this will destroy all your data, files, essays, photos, music everything……( hopefully including all the malware):

2 immediately after you try to start the machine……there will be an onscreen menu to guide you, if you cannot access this then try (in turn) pressing the del key and see if this works if not restart then try Esc, if still no joy, restart then try F2 (remember you will need to restart between each attempt……….

3 If your sister has set a BIOS password to prevent unauthorised access to the BIOS you will need to ask her to supply you with the password or ask her to remove it

4 if you cannot for any reason do this then your options are limited.
however a further step for your consideration is to remove the hard drive from the laptop ( take all personal safety precaustion, ensure machine is switched off and power drained, remove mains power lead, remove battery and taking all ESD (antistatic precautions) place the hard drive either in an external hard drive (USB) caddy or just use an external laptop hard drive to USB wire, this will enable you hopefully to access the drive on another machine, so you can reformat it and copy across to it suitable operating system/installation files. This is complex work and should only be attempted by a competent person.
NOTE This machine should be running a VM or a Live Distrbution of Linux or a Windows system that is running entirely within memory with all hard drives disconnected or a blank easily reformatted drive installed….as you must avoid cross contamination at all costs so be very very careful how you do this, if you are at all uncertain of the exact procedures on any of this, then you would be well advised to take the machine into your local competent computer technician and have her/him do the work for you.

5 Hard drives are now very cheap to buy and easy to fit, so you could consider fitting a new one, installing your operating system and applications…but to do this you will still need to get your machine to boot from CD. or other removable device………..or get operating system and install files installed on it as set out above.

6 Finally once you have a virut infection you must consider all your files as potentially compromised………..and this includes all your back ups……
in particulay files with any suffix like,
.exe .scr .htm .html .xml .zip .pif .com .rar
as they could all be infected and will simply re-infect your system again.

If you are sure that you have virut then it is very bad news indeed.
Post back if you need further information
Regards
paws

Hey Paws,

Thanks so much. I have progessed much since this post that I think it best to inform you of where I am and then we can go from there. First of all the tidal wave of brick walls that I was hitting in order to access the bios (my only option and hope) was ended only when I exploded the machine and found the battery, peeled off the connection which was soldered in and then let it sit for 30 minutes so the CMOS capacitor died. I then taped teh connection back on the battery using surgical tape tightly wound thrice and then reassembled the notebook.

Result? Password gone! From what I understand I am the ONLY person alive who has achieved this result on a Compaq Presario r3000. So pat on the back to me.

Follwoing this success I then accessed the BIOS and changed the boot preference to allow CD ROM to be the first option. I then placed the operating system disk into the CD ROM drive and it asked me if I wanted to boot from CD and that I should push any key to continue. I did so. It then asked if I wanted to repair,reformat or cancel and run windows without reformat or repair. As I mentioned above, I am caught in a boot in safe mode failure loop. What that means is that The virut virus or heur virus (I have both) destroyed the registry entries that allow booting in safe mode. However before I was aware of that fact I had set it to autoboot in safe mode (something that everyone should think twice about doing as standard proceedure in a virus infection). This resulted in a loop between the Compaq r3000 startup screen and the boot options screen in the system dos. The only option out is to the bios, boot from LAN or to change boot order using the boot menu.

So my problem is dual. I solved the first issue but I am unable to solve the second issue of the safe mode boot failure loop caused by this horrible virus. Those who make these things to hurt others may God have mercy on their souls.

I do have information on this disk that is not of the ilk of your file extension expose. I have family images, source files for flash, flash files and my outlook express identity files and favorites files.

So if you can find a way to help me first get access to the msconfig by bypassing the windows OS or using it as a slave in a way that does not involve expensive and complicated setups with a removed notebook hard drive that would be great. Second I need to extract information from the disk, the images and such I mentioned in a safe way.

What would be helpful is an explaination of how to get Ubuntu on a disk as an image (I have image burn - imgburn), and then a step by step (for complete idiots like me) roadmap on how to work with ubuntu to first access the msconfig to shut off this loop and then get the files I want off the disk. I also have Spotmau Windows Recovery FILES (downloaded) and if that would help please help me understand how to get that into an image or something usable in the drive of the compromised notebook.

I think I have a pretty comprehensive suite of computer repair software now and with your excellent advice I may be able to actually help a few people on this end who get this horrible virus (maybe we'll see). One thing I will do is refer them HERE!

Thank you for your consideration in this matter.

Benjamin De Mers
CEO I Am Marketing and Media Services
http://www.iammarketingmedia.com
[removed]

Hi Benjamin,
Well done on getting your machine to boot from CD…this is good news……

I do have information on this disk that is not of the ilk of your file extension expose. I have family images, source files for flash, flash files and my outlook express identity files and favorites files.

Please be aware that any files on your machine, if it has virut may be considered as potentially or actually compromised….. If you use files only from your back up that you have kept safe on removable media, and that were created well before your machine became infected, you should be reasonably OK.

Copying across files from a Virut infected machine (that may also be carrying other infections that can infect not only the files with suffixes .exe .scr .htm .html .xml .zip .pif .com .rar, but many other file types as well….is a definite high risk…and should be considered most carefully before proceding.
My advice would be to sacrifice all such files created after your machine became infected and use instead only files from a previous back up that you have confidence in.However its your call,(as always) and if you want to copy stuff across here's how:

1 First I recommend you get one or two cheap flash drives (USB memory sticks) that you can use to store your files that you want to copy off your computer.
2 Next download either Linux Puppy that is only about 100MB from here:
http://www.puppylinux.org/
or Linux Ubuntu ( which is considerably larger than Puppy) from here:
http://www.ubuntu.com/GetUbuntu/download
this will be an .iso file that you must burn as an "image" (otherwise it wont work!) As you already have ImgBurn this makes it easy.
3 When you have burnt the CD, boot from it
Your computer should ask "Boot from CD?…press any key to boot from CD, so boot from CD
NOTE you do not want safe mode or any flavour of Windows or MSCONFIG or any of the other things you mentioned …….just boot from CD……
4 Linux will load and probably ask you a few questions…….the important one is that (particularly on Ubuntu) you want the Linux to load as a live distro to run solely in memory and not repeat not to affect your existing drive…please read this again as you do not want to install it in any other way…… ie you must not let it load onto your hard drive Puppy is a lot more forgiving in this respect!
5 Once the Linux had loaded it will usually automatically mount your hard drive so you can access your files………please use extreme caution when doing this and only copy across to your USB Flash memory stick the data files you need………
6 Remember that if you copy across your Outlook Express data store with all your emails you will also be copying across any accompanying infections……..
( I realise I am beginning to labour the point…….Sorry! but I do not want you to be under any misapprehension on the risks you will be running!)
7 The linux interface is a GUI so you should have little difficulty in finding your way around……. The GUI is similar to that of Windows and you should have little difficulty in finding the stuff you need …Your hard drive will probably be called SDA1 or HDA 0 or 1
Good luck….

8 Once you are satisfied that you have everything safely copied that you need……you can close down, remove the Linux disc and restart your machine this time with the Windows XP installation disc in the CD drive
9 Once again boot from CD and this time its your intention to destroy your existing partitions, (along with all your infections) repartition, format and reinstall a fresh copy of Windows This will destroy all data on your hard drive…….. all files so make sure you understand what is to happen before you commit yourself (EVERYTHING ON YOUR MACHINE WILL BE WIPED) if you have a separate Manufacturer's RESTORE DISC then its best to use this as it will provide you with the facility to do a destructive restore (and that is the one you want)
10 to sum up forget anything about safe mode or MSCONFIG

how to work with ubuntu to first access the msconfig to shut off this loop and then get the files I want off the disk

The procedures that I have outlined mean that you do not work with Linux UBuntu or PUPPY to access MSCONFIG and the safe mode loop will not occur….. you just use the LInux to copy off any files that you need (see previous warnings!) then use either the manufacture's Restore Disc or the Microsoft Windows Installation disc to destroy the partitions, recreate them, format and reinstall….
Let us know how you get on
Regards
paws

Paws,

Again THANKS! You are awesome! BUt then again you ARE a SUPER user, lol.

The warnings are great. Even the warnings about warnings even. Its ok. I personally think this is a great thread for others to read too. Concise without belaboring the point.

Here's what I plan on doing once I have puppy up and running…

I am going to upload everything I need onto a seagate go drive that I have and then I am going to wipe it clean and then I am going to try and use those files to see if anything happens to the machine. If after 48 hours or so nothing happens to the machine I will assume that the files are clean.

The way virut works, by the way, is that it propogates only stuff it inserts into the file extensions that you mentioned in such a way that the file is unrecoverable and has to be deleted instead of healed by any antivirus software trying to do so. I have become somewhat of an expert on Virut and Heur as you can imagine with four months on my hands researching these two nasties.

Most experts agree that data files cannot contain executables. Most experts agree that such executables can be attached to such files. Most experts agree that data files can be manipulated by viruses. What this means is that if you are going to rescue information from a compromised drive, you should do forensics on the files to make sure there is nothing attached to them.

I will keep you posted on this and let you know how things went. Thanks for your advice and help.

Benjamin De Mers
CEO I Am Marketing and Media Services
http://www.iammarketingmedia.com