Virus / crash / xp won't restore / new hard drive?

[jbrinn]

I'm a new user in desperate need of help!
I have a Dell Deminsion 2350 with windows XP.
I recently upgraded to DSL 6.0 along with adding my ISP's security suite.
I have no trouble deleting spyware, adware etc... yet my 6.0 runs at dial up speed!
I do have one virus "trojan/win32.ata" that I delete every day but it keeps coming back.
That is what I told my ISP tech when I called to complain about paying so much for a service that was doing nothing to stop this virus
Here's what they did and what I'm left with....

turned off "automatic restore" in my computer properties
ran a test in safe mode, 6.0 worked perfectly there.
Did full virus/ spyware scan in safe mode.
Scan automatically deleted any problems it found....
No idea what it deleted ...scan results uses flash player...flash will not run in safe mode.
Logged out of safe mode, turned computer off. Turned it back on to log into regular XP.
Computer turned off on its own and a blue screen: fatal system error C000021a appeared.
Tech went back to safe mode, got fatal error screen there too
Used operating system restore disk win XP: could not restore / repair.
tried to install XP as new, said could not copy about 200 files off disc, at the end of install it gave error: windows could not start because the following file is missing or corrupt: <windows root>\system 32\hal.dll Please reinstall. It's been used once before so I'm pretty sure it's not corupt, and it's not dirty or scratched. at this point, isp tech abandoned me saying call Dell!
Well thanks for crashing my computer you idiot, a slow coputer is better than none at all! UGH!

Dell tested my drives: results were:
IDE Drive Diagnostics: Primary IDE WDC-WD600BB-75CAAO Drive 0:Pass; Drive 1: No IDE device;
Secondary IDE CDROM drive 2: Diagnostics not supported; Drive 3 HL-DT-STGCE-8400B Diagnostics not supported.
F10 boot to utility Partition...quick test came back with Driver Error....
F10 ran advanced on-board IDE controller test: IDE hard disk passed; IDE CDROM & CDRW both failed.
At this point dell tech told me my options were: pay them for new xp disc, and see if that works...maybe it's just a corrupted disc. they thought it was more likely that I need a new hard drive...plus I would have to buy a backup hard drive to save the stuff on my C drive. Plus the geek squad to install if I can't figure it out on my own!

So my ISP says it's a software problem. Dell says it's a hardware problem. Now I'm confused!
I fail to see why I could not just load a brand new XP to my unpartitioned space. I'd have to figure out how to move 1600 MB from my partitioned c drive to my unpartitioned space, but I still don't see why it could not be done. Dell told me if loaded a new XP it would erase my current c drive, so I would stilll have to buy a backup harddrive. I have no idea if either of these tech's are telling me the correct thing. Does any one have any ideas what my next step should be?

Thanks in advance
Jo

[Freaktech]

All you need to do is download a linux live cd and boot to it. Use the CD to get you information off the C: drive and either burn it to disk or by a external drive and copy it to it. Then download gparted cd and reformat the whole drive. Then do a fresh install of XP.

[jbrinn]

Sweet! Thanks for the info...
I'll give it a try and let you know what happens....
may be a few days, gotta find a computer to download from first!

[jbrinn]

Sorry!
Didn't work!
When I tried to boot to the "linux live" it gave me:
Windows could not start because of a computer disk hardware configuration problem. Could not read from the selected boot disk. Check boot path and disk hardware.
Any ideas?

[caperjack]

Sorry!
Didn't work!
When I tried to boot to the "linux live" it gave me:
Windows could not start because of a computer disk hardware configuration problem. Could not read from the selected boot disk. Check boot path and disk hardware.
Any ideas?

you need to set the computer to boot to the cdrom in the bios/setup when you first turn the computer ,when booting to a live linux cd you should not get a Windows could not start error ,as you are not trying to start Windows .
Also what live cd did you use

[jbrinn]

Hi,
Thanks for the help!
It saying "windows" on my error screen did not make sense to me either? It's the same response I get no matter what disk I have in.. I 've tried my xp disk, linux, registry cleaner Mcafee ...all the same!
I've turned on the computer and hit F2. I think that's the bios/setup your refering to ..if I'm wrong let me know. Anyway, I've gone out to that screen three times now and every time my boot menu has reset itself to 1st boot device: floppy, 2nd: hard disk, 3rd: cdrom, 4th: lan. I've changed it to cdrom 1st boot device and f10 to save, then Y to save! What am I doing wrong.
I got the linux cd from linux-live.org
Right now I'm trying the xp repair with my neighbors xp disk...praying that it works!
I've found some threads that mention other solutions ..like deleting the corrupted hal.dll the first issue I had...what do you think?

[jbrinn]

Neighbors restore did not work either. From the restore screen I typed in system 32>bootcfg /list. It said "there are currently no boot entries available to display". Should I ask it to: redirect /useBiosSettings?

[caperjack]

if the bios doesn't save changes i thinks it usually cause by dead bios battery ,its on the motherboard

[jbrinn]

I had went ahead and tried the bootcfg redirect /usebiossettings. Now it holds my changes on F2. I also tried bootcfg /scan...states failed to scan disks for windows installation, may be caused by corrupt file system. use chkdsk to detect errors. Chkdsk /p ......says the volume appears to contain 1 or more unrecoverable problems. 58556924 Klbyts disk space 45453944 Klbts available. How am I supposed to fix the problems it detcts if it won't tell me where the problems are located? Do you think I should just give up and write off my C drive as lost? I could have fixed this weeks ago, but I wanted to do anything I could to save my information. I do not have a computer to slave my c drive to so I'm lost!

[caperjack]

do a chkdsk /p /f

[jbrinn]

do a chkdsk /p /f

I'm performing the chkdsk /p/f now,....while I'm waiting I'll tell you what I've discovered over the past few days of bumping around several tech sites including Microsoft.

Apparently! I'm stuck in some kind of never ending Loop of Microsoft Hell! I say this because, Every day I power up and I get the same error: "windows couldn't start, because file is missing or corrupt. <Windows Root>\System32\hal.dll. After that I reboot to my winxp recovery disk f8 screen. I go in under "R" to get to the Dos screen. There is only ever one windows installation choice to select: 1. c:\Windows. From there I've tried every suggestion I could find....

"c:\windows>CD System32...finds this directory but when I put in the next command of "CD hal.dll"... it says no file found! Well that pretty much tells me it's missing not corrupt. I've looked everywhere for a copy of hal.dll that I can download to CDRW and boot it into my windows...but no luck! I don't even know if or how that could be done?

While I was looking for a replacement hal.dll I found several other thread suggestions for the above error message...tried them all with no luck. One suggestion was missing or damaged boot.ini.... I put in command prompt, bootcfg /List.. System tells me "no boot entries to display" I've tried next step at least 5 times...bootcfg /rebuild...system says "Error: Failed to successfully scan disks for windows installations. This error may be caused by a corrupt file system which would prevent bootcfg from scanning. Use chkdsk to detect any disk errors. Note: this operation must complete successfully in order for the add /use or rebuild commands to be used. Out of curriousity I've tried Add and default on bootcfg as well but get this same error response.

I've run chkdsk so many times now it's ridiculous. The first time it said "one or more bad sectors were recovered or repaired" The next time it said I had unrecoverable damage to one or more files or something to that effect. Now everytime I try it I get "chkdsk is checking the volume.....is performing additional checking or recovery... repeated twice more...then chkdsk has finished checking the volume....58556924 total kilobytes of space....454539444 kilobytes of available space...no errors reported...but still bootcfg /rebuild gives me the same response to run chkdsk. By the way the chkdsk /p/f just finished and again I got a "no errors found"..tried bootcfg /rebuild again but still says run a chkdsk.

I found a thread on Microsoft site ...it's old but it was the same exact issue of looping. It suggests to go to "http://www.michaelstevenstech.com/xprepairinstall.htm" and follow steps, I haven't tried it yet because the first thing it suggests is to back up important data. I do not have a back up hard drive. It would seem to be simpler to copy the files I want off the C: DIR list onto a CD...but I'm not sure how to type out that command in DOS? or if that would even work.

My Boot.ini & NTLDR & NTDETECT.Com files, can only be accessed from the C:\> prompt........if I try it from C:\Windows> it says no such file exsist. I didn't know if that was the way it's supposed to be or not? Maybe i need to copy it from C: to C:Windows?
Boot.ini says:
[boot loader]
timeout = 1
default =multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition"/fastdetect/NoExecute=OptIn .................................
I'm wondering if noexecute=optin belongs there? I've tried to edit my boot.ini to see if it could be removed and possibly fix my issues, but "edit" is not on my command list. The only instructions I could find to edit boot.ini were from the start menu which I can't get to....ugh!
I also wondered why it was set to partition 2? I originally had only unpartitioned space 32MB and a partition 1 where everything was installed. The AT&T tech that crashed my comp had me create a 2nd partition off my unpartitioned space to see if we could add a whole 2nd copy of Windows but I did not have enough MB to hold a new copy there. I believe it said I need 1500MB? I've since Deleted the part (2)since there were no files there anyway, and I've done a "fixboot" but my boot.ini still says part (2)??? Any idea why? The only other thing I could think of to do would be to see if I could create a partition2 using the copious amounts of space I have on the part (1) and load a 2nd copy of XP to that, but I do not know if it would fix the problem or be worth my time?

I also tried another fix it method.... from recovery console prompt:
"expand E:\i386\ntoskrnl.ex_ C:\Windows\System32\ntoskrnl.exe"
the e drivve is my cdrom drive ...response was: "unable to create file ntoskrnl.exe 0 files expanded"

If I try to use the Enable or Disable commands I get an error: "The system Registry does not appear to have an active ControlSetKey. The system registry may be damaged. If system isn't starting correctly try restarting with last known good configuration (this has not worked from day one). Or repair the instalation of Windows using the setup programs repair and recovery options. (this was also tried on day one, but it took me right back to "win sys32 hal.dll" error screen) I guess I could try repair and recovery again to see if it will work now? I also have a "Registry Cleaner program" on CD...would it hurt to see if I can boot that?

Ive also done command "fixmbr" I figured what the heck, it cant possibly get any worse...but still I get stuck in the same loop!! I guess as a last resort I could completely wipe this computer and reinstall every program from scratch. I would only lose the last 6 months of photos and some financial docs that could be "painfully" recreated. LOL! My husband said if I can't fix it myself by the end of the week (I've had 3 weeks now)then he's going to take it to a repair shop (which we really cant afford!)
Sorry for the overload of questions, I've been racking my brain for days on how I can save my info ... :icon_rolleyes: If you think any of my above ideas will work please let me know.
Thanks!!!
Jo

[jbrinn]

Ok ...update time....and I have new questions???? I don't know what this virus was programed to do exactly, but whoever created it needs to be horse-whipped!!! As soon as I fix one problem I find another...sooo frustrating! Hopefully this might help someone else out! I found a website "www.dll-files.com/dllindex/dll-files.shtml?hal" that finally got my XP restarted, without losing any of my C drive. Praise the Lord!!! It gave me two XP's, but now I at least had access to down load my pics, docs, mov & music out of my C drive to hard disk. Whew First Crisis averted!

Now I have a choice... I could continue using the new XP, copy over anything I need from old XP, and then delete the old XP. If I do that then I could be bringing over the same damaged files, with no idea if the virus is gone or still attached to something! Or I could just shred the whole C drive and reload XP to start anew....WITH SOME BETTER VIRUS PROTECTION...LOL! I'm leaning towards shreeding, any suggestions? specific software to use? etc....

My brother in law says he has a WinXP prof disc that comes with a shreder. However, I read that shreeding or re-formating doesn't always get rid of everything. I want to make sure I never see this Trojan again! This article, suggests to run a shreder/re-writter over top all info several times to ensure a complete wipe? www.pcworld.com/article/id,110338-page,1-c,storage/artcle.html. Also, I'm not sure if I want to keep XP professional as my OS, I have no idea what the difference is between it and XP home edition?

In the meantime, on this new 2nd XP, I can't connect to the internet. I know I'm hooked up correctly because my work computer runs off the same DSL, modem & hard wired router and it works in all 4 router ports! My Device Manager says everything works fine except my "Ethernet Controller". When I go to "Internet Connections" all I get is an empty screen. I should have a LAN connection and as I understand it that should just automatically load up when I connect the DSL line. So I'm not sure if the Ethernet controller is my only problem? I also have no assurances that a wipe and reinstall of a new XP will solve this issue. Either way I'd like to have a backup Ethernet Driver on disk in case this happens again. Any idea where I can download one? my modem is a
Motorola/Netopia 2241N-VGX ADSL . Or would it just be easier to get a different modem? I've already called AT&T/ISP who gave me this modem, and they only have USB drivers, Weird? Converting to USB is not an option for me............

Thanks for any help or advice you can give.

[Kewlkat]

The error "missing hal.dll" is bcoz of boot.ini file. A change in the file can also cause it. Try Xp restore "bootcfg\Rebuild". You might need to enter the admin password.
If that dos not work try to connect ur hdd to another comp. backup ur data and format everything and start again. But that might coz the virus to jump to the other comp also..