Hi guys,
I'm working on a family member's XP Pro desktop. When trying to boot, it kept coming up with the "windows failed to start" page where you can pick safe mode, last settings that worked, start windows normally, etc. But no matter which one you pick, the computer just restarts and does the same thing over again.
The first thing I tried was a "chkdsk /r" command in the recovery console from a windows CD I have. It actually said that it found and fixed errors on the disk. But this did not fix the problem I was having with the failure to boot. So next thing I tried was to try a repair install (***See the P.S. note at the bottom of post). This seemed to working, but midway through the installation process, an error pops up saying that it cannot find a certain file (some type of .bat file if I remember correctly; I'm at work right now so I can say for sure). Here's the interesting thing though. When I click "OK" or whatever to get out of this box, there's a big warning that comes up on the screen saying something about System Warning: Dear user, your computer is infected blah blah blah. It looks like your typical virus message telling you to take action. So it's as if whatever virus/issue is causing the boot up problem maybe preventing the repair install from completing successfully. I've tried the repair installation a few times since, and I get the same cannot find "xxxxxx.bat" file followed by the above warning message. Of course, now when I try to boot up windows normally (i.e. without the installation CD in), it asks me to put in the disk to finish the install, so I'm kind of stuck now.
The only other thing I tried was to boot using an Ubuntu CD (not actually installing Ubuntu though, because I believe that gets rid of Windows and all the files/documents on the hard drive, right?). I was going to boot using Ubuntu, and then grab as many of his files as I can so that I could do a clean install of Windows. But Ubuntu failed to run. It pops up with a message saying something like: "Killed. Kernel Panic. Out of Sync. Out of Memory and no killable processes" or something to that effect.
You guys have any ideas, short of completely wiping the hard drive and starting from scratch? Needless to say, I'd rather not have to do that! He only has a 20GB hard drive, so I doubt he has many programs on it. I just don't want him to lose all of his files/data/documents. So if I DO end up having to do a clean install, I at least want to be able to grab his stuff off of the hard drive first, if at all possible.
***P.S. he did not give me an installation/recovery CD with the computer. So I've been using my own discs. The first time I ran chkdsk, it was actually using an XP HOME edition from an old desktop that I used to have. Now, I'm not sure whether the recovery console is version and/or computer dependent or not, so I may have done more harm than good by running the XP Home recovery console on an XP Pro computer. After that, though I found an old XP Professional installation disc that I had years ago and I ran the recovery & chkdsk command using that CD. Also, I used this XP Pro CD to try the repair installation. Again, this CD, all though it is at least XP Pro, was not intended for use with this particular PC, so that may or may not have to do with the installation failing, but the aformentioned virus/warning page that appears after the installation failure makes me think it has more to do with what trash is on the hard drive than what CD I was using.
Also, please move this to the malware forum if that is more appropriate.
THANKS!
My suggestion is retrieve the data first if that is important, messing around with repairs and issues such as this can run the risk of losing it all, so get the data before doing anything else, at least worst case you can start from scratch without any loss, and it would be a pretty fast thing given the small size involved.
Not sure on the Linux version you used, I assume it can do the same as Puppy Linux ?
But I would boot to Puppy Linux, it loads in the ram so the drive is untouched, and as you surmised it means windows files do not get in the way, and any infections shouldn't get in the way, then mount the drive and save any files to save to a thumb drive or similar.
Points to consider BEFORE starting are as follows, insert the thumb drive on your clean system and get and run Flash Disinfector, this will block any auto run files\infections from accessing your PC, obviously transferring files from an infected system carries risk, but I have done it many times without issue, using this tool to block auto run, updating ALL protection on the clean PC before starting, then do NOT access the drive when you plug it into your PC, instead open your "My Computer" and right click on the drive and in turn select to scan via all the protection options you have available, this way if there is something lurking you should get it before anything goes wrong, repeat the scan with each transfer before accessing the files (assuming it takes more than 1 transfer to get it all).
Next I would get protection that is Bootable, the UBCD has a few scans to check for infections, I would boot to that, then run each scan one after the other, a-squared has an Emergency USB Stick, the hope is if there is an infection this will remove it, or at least enough to allow access back to the drive for you to scan further and get it running right again, I often add the drive as a slave to my own system and scan the same way as I describe with the thumb drive, again it carries risk, infections always do, but I have yet to have an issue using the method described here, but ultimately once you prove the drive to be clear of infection then that is one less thing to get in the way.
I also suggest a scan of the drive, it's size suggests it is quite old, as such I wonder if it may be at the start of beginning to fail, the UBCD again has all the hardware makers utility's on, so scan with the drive makers utility and run and extended scan, it may well be a case of a failing drive, yet another reason to retrieve the data before doing more if it is essential, hopefully something here will help, good luck.
Thanks for the suggestions!
I've got a few of questions:
*I'm unfamiliar with Puppy Linux. Do I just burn it to a CD like I did Ubuntu, and boot it that way? Or do you put in on a flash drive or what?
*Also, the flash disinfector thing. Are you saying that I download it (on my working computer, of course) and put it on a thumb stick and run it on that messed up computer? If so, how can I run something like that when the computer will not even boot? Or will the computer try to run what's on the flash drive instead of the hard drive, similar to when you boot from a CD? Or did you mean to run this AFTER I reinstall Windows and get it running correctly?
*Yeah, I thought about using the bad drive as a slave too to try and save things from the drive. So how exactly does that work? 'Cause I've got an old XP (it may even be 2000 it's so old) hard drive laying around. It's an old like 20GB hard drive (maybe less) that I kept from doing a friends upgrade years ago, so I wouldn't even care if it got messed up somehow. Now if I were to open up the problematic PC and install this hard drive to the master, and move the corrupted one to the slave slot, would Windows automatically know to boot from the master (i.e. the good drive that I have sitting around)? Also, of course they were both configured as the C: drive on their respective computers, so would Windows automatically reassign one of the drives to another letter?
Thanks in advanced!
Yes, you burn it to disk, then boot to the disk, the hard drives are not touched, it runs in the ram, you can save the "install" to a thumb drive, so rather than booting to a disk, you can (once burnt to disk) load it to a thumb drive (like you do burning it to disk), then in future you can just use the thumb drive, this is an advantage if going out and needing such tools, it's simply easier to carry, apart from that there is no difference between the disk or thumb drive, everything works just the same, only bit to note is when closing down, it asks about saving the session. something like that, I've only used it twice so don't claim to understand fully, but as a person unfamiliar with Linux I did find it easy to use, and with common sense managed to do what I needed, albeit some head scratching at times lol.
The Disinfector is run on the clean system, and the thumb drive must be inserted when it is run, what it does is add a hidden file that blocks auto run, which is what most (AFAIK) infections rely on to spread in such instances, once done thats it, unless you format the thumb drive, simply deleting\cut & pasting wont touch this file, not unless you have hidden files set to shown, but once run, the only time you need to run it again is if you format it, once done thats it until next format.
It blocks the infected system passing on any surprises when first inserted, the fact the infected system does not have the file doesn't matter, not at this stage, the aim is to protect what is known to be clean from picking up any nasties, which is what this does, and if a transfered file is infected then by scanning via right click means it isn't activated, at least this is my experience with such things anyway, then once an infected system is clean then it can't hurt to run the Disinfector on that system as well to minimise future risk.
Before I had the experience I have now, I always added the drive as a slave, still do at times, depends on the time I have available, sometimes adding it as a slave is the fastest result, and when the data to be saved is a lot then I go straight to adding it as a slave for pure speed, but ALWAYS remember infections can spread, so always make sure you're system is fully updated first, and any data you have is backed up, I use a 1TB slave which has all my files to save, and I disconnect this when adding an infected drive to be safe, then once I know all is well I add it back again.
But adding it as a slave is no different than when building a system, just set the jumper (on ide drives that is) to slave and add it in.
The fact you have an old drive opens up an even safer option, although this may not always allow backing up all the data required if it is too small to take what is on the infected drive, but you can totally bypass you're own drives with this, do a fresh install to the old spare drive (never thought of that one before this lol), install and fully update it to be safe, add all the protection and fully update that and once it is fully done, shut down and add the infected drive as a slave, as you say worst case it doesn't matter if anything goes wrong as you have removed you're drives from the equation.
Or in the case you have proposed Yes, add you're old drive as master to the infected system, disconnect the existing master during this and do a CMOS reset before adding it, and remember ide drives the master must be on the end connector, and the slave on the middle one, but fully install the old drive before adding the problem drive back in, this completely removes your own system from the equation, but all the warning and guides still apply, more so with memory resident infections.
One major point in going this route thought, although if things go wrong and the drive gets infected etc, and a low level format (a proper one) can remove those issues, there are infections out that are really nasty, and they can hide in the system memory (memory resident infections), so even though you think the format has cleaned out the problem, a memory resident one can come back as soon as you're reinstalled, so using the paranoid belt and braces approach in these matters, it's worth the peace of mind to do a CMOS reset BEFORE adding your own drives back, if so pull the mains lead, remove the CMOS battery, then move the jumper to the clear position, leave it like this for a minute or so for max safety, it means messing about with the bios settings, but it's as safe as you can get trying to do these kinds of things, hope this helps.
Interesting findings today. With the old hard drive that I had sitting around installed as the master drive, I'm getting the same Windows failed to start and rebooting issue that I had with the original hard drive (regardless of whether the original drive is installed as a slave or disconnected altogether. So it's as if the problem resides somewhere else; maybe some settings are incorrect or some hardware conflict or something. Any ideas?
P.S. keeanu: you may in fact be right. The first thing I thought when I came across he CD was: "hmmm…I don't remember ever having a Windows XP Professional system." I think every computer I have/have had is/were XP Home. So who knows where a Professional CD came from! I'm definitely not messin' with that CD anymore. Problem is, it failed mid repair, so I'm afraid that now whenever I try to boot that installation of Windows, it will try to resume the install instead of just running normally (assuming I can get passed to whole reboot issue)
That is certainly confusing, my first question has to be did the install to the new master go without issue ? did it install without error ? I am wondering if the optical drive may be dirty and causing read issues.
Are you happy with entering the bios settings ? if so check the boot order, and if there is a system health section see what temperature's are reporting.
Do you have a psu tester ? might be worth checking this is as it should be.
I assume this is a pretty old system, can't hurt to change the CMOS battery, I've seen some funkiness going on when these are on the way out, they can cause all sorts of mayhem, if you do change this pull the mains, and remove the problem drive (disconnect anyway), pop the battery then move the jumper to the clear position, then leave it like this while you go to get the new battery, it's OTT but it should definitely remove anything lurking about, and although a CMOS reset should only take a matter of seconds, I have come across rare situations where I have had to use much longer periods to resolve certain things.
There is of course sod's law, and this states as much as you should be able to use the spare drive, this law states that because you want too it will be failing as well lol, so to that end try scanning the drive for errors with the makers utility's, lets see if the drive is faulty before wasting lots of time chasing ghosts, it could be as simple as that, see if this shows anything.
