[Resolved] Odd blue screen i've never seen before when trying to b

[external image: Posted Image]

I was getting help from oldman960, and didnt completely follow through due to various reasons (sorry oldman, i did appreciate the help!) my fathers laptop just started showing this screen when he turns it on. I tried booting in safe mode, and returning to an earlier time using system recovery, that didnt work. when i get to the login screen, only my login which i havent used in years, and administrator is there, with a password that no one knows or uses, not my dad's login. Thanks for looking and any help.

Hi coryjames80,

This may be a job for the tech department, but let me have a look.

Give me a chance to check out that error. In the meantime try to access the Recovery Console. Don't do anything else, I just want to see if that option is available to us to do any repairs we may be able to do from there.

Start the computer, you should be presented with an option to either start Windows ort he Microsoft Recovery Console. Use the arrow keys to select the Recovery console, press enter.

- You should now see a list of installations and the prompt "Which Windows Installation would you like to log on to?"
Select the appropriate number for the Windows installation that you want to repair. If you only have one, press 1 and press enter
-If you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER.

You should now have a C:\windows> prompt

Let me know if you can get this far.

yes, I am currently at the C:\windows> prompt.

Hi coryjames80, Good, at least the Recovery Console is accessable. There are different ways of going about this. I'm going to consult with the Tech and which in their opinion is the best. You can shut the computer down with the off button on the computer. Be back as soon as possible.

Hi coryjames80,

We'll try this first.

Go back into the recovery console, at the c:\Windows prompt type these line hitting enter after each:

cd "ERDNT\Hiv-backup"
batch erdnt.con

Note: *in the first line there is a space after cd
*in the second line there is a space after batch

The cursor will move down one line if the command was succesfull or finished. When the second command has finshed type exit at the next prompt and hit enter.

Windows should start loading. Let us know if you can get into windows now.

Okay! that got me into windows normally. One thing my father told me was that some tech guy a while ago told him that there is a bad part of the hard drive we havent gotten to yet. It may have gotten there now? I dont know, but my dad wants me to look into getting a new one from dell for him.

Hi coryjames80,

One thing my father told me was that some tech guy a while ago told him that there is a bad part of the hard drive we havent gotten to yet. It may have gotten there now? I dont know, but my dad wants me to look into getting a new one from dell for him.

Good. What you experienced is a common symptom of a failing hard drive. It could also have been one of those things. Given that this hard drive has already been diagnosed with bad sectors, I would tend to go with the former as the problem.

The backup you used was placed there during the cleaning we were doing. Since it was made while the computer was infected there is a good chance some of the infection was restored. You now have some decisions/choices to make.

We can clean this machine again and you can replace the hard drive in the near future and use some software to move your personal data to the new drive.

You can leave it as is and backup any important documents, pictures and personal data to another storage source and reinstall windows on the new drive. You can then restore your personal items.

Since this is a Dell, it should have came with some Recovery Disks. If you have the disks, you will be able to set the new hard drive to the same condition it was when the laptop was new.

If it is a failing hard drive, there is no guarantee that the method we used will work again if the need arises. We could use Check Disk to see how bad the hard drive is. Windows should flag the bad sector as sectors not to be used. Depending on how large the hard drive is and what is found may make this process last several hours.

Regarless of your choice, I would suggest anything important be backed up. Should the hard drive fail you may not be able to recover anything.

Let us know how you wish to proceed.

I ran a few tests from holding Fn and turning on the system, one express test, and one custom on just the hard drive. It came out with two errors, both saying two different blocks with an uncorrectable data error. I was doing an online chat with a dell representative, and he seemed unphased by them, saying one (which came from the hard drive test) was on the motherboard. What is the test you say may take hours? Is that the one that would prove a faulty hard drive? We are still under warranty and are trying to get it just replaced.

Hi coryjames80,

I was thinking of Windows built in Check Disk. It will scan for data errors and bad sectors. If you have all ready used Check Disk, a log will have been created in Event Viewer.

To retrieve the log

Click the Start > Run . Copy and paste eventvwr.msc /s into the run box and click ok

When Event Viewer opens,

• click on Application
  
• scroll down to Winlogon and double-click on it.
• Click the copy button (looks like two pieces of paper)
• Open a new notepad by clicking the start button > Run
• In the run box type notepad and hit enter
• Right click in the notepad and select paste.

Save the notepad to a convenient location and post it in your next reply.

If you have not used Check Disk yet you can do so by

• Click your Start button, double click My Computer
• Right click on local disk(c:)
• Click properties
• Click on the Tools tab
• In the Error Checking section click Check now
• Check both boxes and click start
• Follow the prompts from there

When it's finished the log can be retrieved as outlined above.

This looks like a small hard drive, about 34GB. It is also starting to get fairly full.

Alright, i ran the check just to be sure, and here is the log:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 1/22/2010
Time: 2:53:54 PM
User: N/A
Computer: DADCOMPUTER
Description:
Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 1670 unused index entries from index $SII of file 0x9.
Cleaning up 1670 unused index entries from index $SDH of file 0x9.
Cleaning up 1670 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)…
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)…
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Windows has made corrections to the file system.

35334967 KB total disk space.
26946736 KB in 85793 files.
30580 KB in 10918 indexes.
4 KB in bad sectors.
182039 KB in use by the system.
65536 KB occupied by the log file.
8175608 KB available on disk.

4096 bytes in each allocation unit.
8833741 total allocation units on disk.
2043902 allocation units available on disk.

Internal Info:
60 b4 01 00 d2 79 01 00 c2 0b 02 00 00 00 00 00 `….y……….
04 02 00 00 02 00 00 00 38 0b 00 00 00 00 00 00 ……..8…….
30 d8 1c 04 00 00 00 00 c0 e9 9c 5b 00 00 00 00 0……….[….
80 48 72 17 00 00 00 00 b0 12 95 ab 04 00 00 00 .Hr………….
50 87 0e d2 00 00 00 00 80 d6 9c fc 05 00 00 00 P……………
99 9e 36 00 00 00 00 00 98 38 07 00 21 4f 01 00 ..6……8..!O..
00 00 00 00 00 c0 b2 6c 06 00 00 00 a6 2a 00 00 …….l…..*..

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Hi coryjames80,

Check Disk didn't find very much in the way of bad sectors. Our Tech department has more tools in the way of diagnostics. Let's make sure this computer is still clean and then I suggest you post over there after we are done. I'll give you a link.

This hard drive is pretty small and approaching being full with 25% free space. Windows Defragmenter need 15% free space to run.

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

• Click the Update tab
• Click Check for Updates
• If an update is found, it will download and install the latest version.
• The program will close to update and reopen.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with the MBAM log.

Thanks

Hi You still with us?

Yes, my apologies. I'll do those last instructions when I get the laptop from my father

I'm trying to get back to working on it today, and i got the blue screen, and when I'm trying to do the first steps you gave me, It now asks for the admin password, one which neither of us knows and I cant figure out yet. And its not just blank… Any ways to get around?

Hi coryjames80,

Not sure why there would be a password this. If you are able to burn an iso to a cd so we can make a boot cd, we might be able to get into the computer another way.

Let me know.