# Windows 7 & Virus



## RoadDaddy (Mar 10, 2010)

Please help, my grandson's pictures are in jeopardy...:-(

My Son tells me that they got an indication that there was a virus on their laptop.

HP Pavilion dv6000. Currently it attempts to boot but only comes to the point where Windows should start, I get a black screen with the mouse pointer. I have tried to do a "restore to a known good configuration" but that has failed to solve the problem. 

I have worked with your virus experts before and have been successful. I need some help creating a CD with anti-virus that I can create on MY PC and attempt to recover the Windows 7 laptop. I can't get the Windows 7 laptop to boot and get on the network so my options are limited. MY PC is an XP system.

I don't have any Windows 7 CD's, recovery CD, etc.

I have PC skills that span decades, so I will be able to work effectively with you. I am motivated to get this issue solved as my grandson's infant pictures are on the infected Windows 7 laptop. 

Once this issue is resolved I will make a donation as always... 

Please consider helping me resolve this virus infection.


----------



## RoadDaddy (Mar 10, 2010)

Wanted to add additional information about the symptom.
1. Upon re-boot I get the "splash" screen then a blank/black display with the cursor.
2. I can get to a DOS command prompt, looking around for some tools that might be loaded on the laptop that might help solve the problem.


----------



## RoadDaddy (Mar 10, 2010)

3. Same start symptoms in "safe" mode


----------



## RoadDaddy (Mar 10, 2010)

JSntgRvr - are you willing to work with me on this...? We have had success before...? I just created a Windows 7 Recovery disk and am going to see if I can get Windows up so we can proceed with the virus detection and repair...


----------



## RoadDaddy (Mar 10, 2010)

ok, I have been working on this ALL day and I think I found the root cause, BUT I don't know how to fix it.

1. I created an Ultimate Boot CD 4 Windows
2. SuperAntiSpyware reports "no Windows installations found"
3. AVPersonal found a minor "Webpage.Gen" infection
4. Looks like this is a Vista machine....
5. After searching the Web I found out that

HKEY_local machine/software/microsoft/WindowsNT/Currentversion/winlogon/shell SHOULD have a value of "explorer.exe" 

BUT has "cmd.exe /k start cmd.exe"

I edit this bad value back to "explorer.exe" attempt a re-boot and the bad value for Shell is still there...please help me remove this


----------



## RoadDaddy (Mar 10, 2010)

More information for the expert that will help me:

Seems that this is a common issue/complaint with users, also called the "Black Screen of Death". I have identified the "SHELL" value that keeps getting changed to "CMD.EXE /K START CMD.EXE.

I don't know how to remove this problem from the registry.


----------



## kevinf80 (Mar 21, 2006)

Hiya RoadDaddy,

That fault sounds like the userinit value may also be wrong :-

Navigate to this key as you`ve done before *HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon* Select the Winlogin folder,

From the right hand pane amend *Shell* value to *Explorer.exe*
amend *Userinit* value to *C:\WINDOWS\system32\userinit.exe,* ** Note** the comma at the end of *userinit.exe,* very important...

Kevin


----------



## RoadDaddy (Mar 10, 2010)

Hi Kevin:

I followed you suggestion:

1. Shell value WAS "cmd.exe /k start cmd.exe" - the BAD value that I changed to "explorer.exe". I even closed and opened again REGEDIT to verify that Shell value did in fact = "explorer.exe"
2. I confirmed userinit.exe was the value and the comma was there. I even deleted and re-entered a comma.

Is there any "registery" tool that I can run from the command prompt...? As you know Windows will not load... :-(


----------



## kevinf80 (Mar 21, 2006)

Hiya RoadDaddy,

Go *Here* and scroll down to option two for instructions how to create a "System Repair Disc"

That disc will allow you to access all of the System Recovery Options.....

Kevin


----------



## RoadDaddy (Mar 10, 2010)

Hey Kevin:

I really appreciate your assistance...! I did create a Windows 7 recovery disk but it didn't offer any more options or success than selecting "Startup Repair" after hold F8 on Windows boot. 

So I think I have tried the Windows 7 recovery disk, it was not able to identify and resolve the issue...


----------



## kevinf80 (Mar 21, 2006)

Hiya RoadDaddy

Boot up normally and you get to the black screen, select the following keys together *Ctrl - Shift - Escape* does that bring up Taskmanager? if so do the following:

Select > File > New task (run) > type *explorer.exe* in the open box > OK. Does the Desktop populate?

Kevin


----------



## RoadDaddy (Mar 10, 2010)

Hi Kevin, unfortunately, the system is unresponsive. I am not able to to complete your instructions...:-(


----------



## kevinf80 (Mar 21, 2006)

OK Buddy, I`m out of ideas unless you have an installation DVD.


----------



## RoadDaddy (Mar 10, 2010)

Thanks for your efforts so far Kevin, my Son purchased the laptop used and did not get any CD's.

It seems like there is some Malicious program/virus that keeps modifying the registry...


----------



## kevinf80 (Mar 21, 2006)

Avira does a very good rescue CD, you want the info..


----------



## RoadDaddy (Mar 10, 2010)

Yes, thank you...! That sounds encouraging...


----------



## kevinf80 (Mar 21, 2006)

If you can nail the infection with this tool you may then be able to reset the reg settings successfully....

I recommend Avira in your situation. The process is very simple and easy to follow. One stipulation that must be followed. The CD must be created on a known clean PC, from the same PC print off the instruction, they really are very easy to follow. All you need is a blank writable CD, everything else is included in the tutorial. Obviously the PC must have a burner.
All instructions are available here *Avira Rescue System* Read through the instructions a couple of times to familiarize yourself with them, create the CD and print off the instruction. It will be to your advantage to have the instructions available during the process.

Kevin


----------



## RoadDaddy (Mar 10, 2010)

Great Kevin, Thanks so much...! Watching the pre-game, but I will get on this and let you know how it turns out...


----------



## kevinf80 (Mar 21, 2006)

Yep. let me know how you get on...


----------



## RoadDaddy (Mar 10, 2010)

Hi Kevin, just wanted you to know that I created the Avira Rescue CD and executed it on the infected laptop.

1. FIRST PASS = Found 13 viruses that were cleaned/deleted.
2. SECOND PASS = NO viruses, just a few warnings about files, early end of file stuff.
3. I can't figure out how to get the logs just yet but I will keep trying.
4. Shell Value STILL GETS CHANGED TO "CMD.EXE /K START CMD.EXE" after I manually edit the value back to "explorer.exe"

This seems to be commonly reported to many forums, any ideas Kevin...?


----------



## RoadDaddy (Mar 10, 2010)

Status:

1. Boot, F8, Repair System, Command Prompt, Regedit, change Shell to "explorer.exe"
2. Shut down
3. Boot, F8, Repair System, Command Prompt, Regedit, Shell has been changed by the malicious program to to "CMD.EXE /K START CMD.EXE"

Please help me get rid of the virus that is causing this...Cookiegal you interested...?


----------



## kevinf80 (Mar 21, 2006)

Hiya RoadDaddy,

Change the reg settings as you`ve done before, Next,

Lets try rebuilding the bcd completely

Enter the recovery environment as you did before > choose the command prompt

at the command prompt type the following commands > press enter after each command:

&#8226;	bcdedit /export C:\BCD_Backup (enter)
&#8226;	c: (enter) 
&#8226;	cd boot (enter)
&#8226;	attrib bcd -s -h -r (enter)
&#8226;	ren c:\boot\bcd bcd.old (enter)
&#8226;	bootrec /RebuildBcd (enter)
Type exit, enter then reboot,see if that helps....

Kevin


----------



## RoadDaddy (Mar 10, 2010)

Hi Kevin, thanks so much for your suggestion, I will attempt this when I get home from work tonight...


----------



## kevinf80 (Mar 21, 2006)

Let me know if it helps.....


----------



## RoadDaddy (Mar 10, 2010)

Hi Kevin:

Thanks for your continued interest and support. Unfortunately. I entered your commands and they indicated "success", but I still have the same symptoms. So, I am going to purchase a Windows 7 CD set. Question for you, is there options for recovery with those CD's, or am I looking at a format and re-load...? 

I am concerned because I have read threads from persons that have had this SAME problem and after a format and re-load, they had the SAME problem... :-(

Your thoughts...? Can we do more with the Windows 7 disks...?


----------



## kevinf80 (Mar 21, 2006)

Hiya RoadDaddy,

Boot to the command prompt as you`ve done previously and try the following command, Press enter after the command, remove the rescue CD then try to boot after each command :-


 *bootsect /nt60 C:\* (to type if your operating system is installed in C: Of course you can change C: with the word of the partition where your OS is installed)
 *bootsect /nt60 SYS* (to use if the first command doesnt work)
 *bootsect /nt60* ALL (to use if the above commands do not work)
 Once done, eject the disc and restart your computer for the change to take effect.

If this does not work is it possible for you to slave the HD from the infected PC to your XP system, not in a caddie but from the motherboard?

Kevin


----------



## RoadDaddy (Mar 10, 2010)

Hi Kevin,* bootsect /nt60 SYS* was accepted by the system but did NOT resolve the problem... :-(

My XP system is almost (10) years old so I will check to see if the harddisk in the HP DV6000 is IDE...?

I am going to purchase Windows 7, do we have any recovery options with those CD's*...?
*


----------



## kevinf80 (Mar 21, 2006)

Yes you can run system repair, I`m not 100% sure that a new Windows 7 Installation Disc will be compatible with an already installed system.
If you can slave the HD to your XP system there is a program available that will wipe and re-write the Master Boot Record (MBR) on the W7 HD.
You mention buying the new W7 disc, what is the downside of a fresh install, might be the best option


----------



## RoadDaddy (Mar 10, 2010)

Hey Kevin, well I guess I have to figure a way to get my grandson's infant pictures off, AND I am concerned about other's that have done the same thing and still have the Black Screen of Death AFTER a format and re-load.

Your thoughts...?


----------



## RoadDaddy (Mar 10, 2010)

I have learned that this is a Windows 7 Ultimate system, but I would be purchasing Windows 7 Home Premium and attempting the System 
Repair with those CD's


----------



## kevinf80 (Mar 21, 2006)

You will not be able to do a repair with a different version of Windows 7. Also I cant see how the issue would return if the HD drive was formatted before the new system was installed.

To recover data you will have to use a linux based system, it is quite straightforward. Go *Here* for the full instructions on how to use Ubuntu

Try the following two commands from the command prompt, see if they help...

type this at the prompt chkdsk /r and tap <Enter>.* 
Note the space between the "k" and the "/".* it will take quite a bit of time, particularly if your boot partition is large.* What the /r flag does is force chkdsk to run an expanded version of chkdsk that has 5 tests.* The last two will check the drive for file/folder/free space errors and also fix related MFT errors if there are any.

At the command prompt type sfc /scannow > then enter. Let it run its course. Type exit when its finished. Re-boot, any good??


----------



## RoadDaddy (Mar 10, 2010)

Hi Kevin:

I ran chkdks /r and received the following upon completion:

1. Correcting errors in the master file tables MFT BITMAP attributes.
2. Correcting errors in the volume bitmap
3. zeroK in bad sectors

sfc /scannow produced the following error:

1. There is a system repair pending which requires reboot to complete. Restart Windows and run sfc again.
2. I did restart but sfc /scannow produced the same error.

I did notice that after I ran bootsect /nt60 SYS that the Windows 7 recovery disk actually made an attempt at Startup Repair, it ran and seemed to be doing something but in the end indicated that it was not able to perform the repair automatically. (this was the FIRST time that it seemed that the Startup Repair actually did something...?


----------



## kevinf80 (Mar 21, 2006)

Can you re-run the Avira rescue disc, then try the following straight after :-

Boot to the command prompt as you`ve done previously and try the following command, Press enter after the command, remove the rescue CD then try to boot after each command :-


 bootsect /nt60 C:\ (to type if your operating system is installed in C: Of course you can change C: with the word of the partition where your OS is installed)
 bootsect /nt60 SYS (to use if the first command doesn't work)
 bootsect /nt60 ALL (to use if the above commands do not work)
 Once done, eject the disc and restart your computer. Any good?

Did you try to recover the pictures with Ubuntu


----------



## RoadDaddy (Mar 10, 2010)

Hi Kevin, executing your last instructions now:

*Quick Recap*

There is a malicious virus program that keeps changing

HKEY_local machine/software/microsoft/WindowsNT/Currentversion/winlogon/shell SHOULD have a value of "explorer.exe"

BUT has "cmd.exe /k start cmd.exe"

I edit this bad value back to "explorer.exe" attempt a re-boot and the bad value for Shell is still there

Because of this, I can only get to the command prompt with various rescue disks. It seems to me that if there was a way to execute Hijackthis from the command prompt, we could easily identify the offending registry entries and programs and manually get rid of them.

What do you think Kevin...?


----------



## kevinf80 (Mar 21, 2006)

I`m not aware that it is possible to run HJT that way. Have you thought about contacting Microsoft for a replacement DVD? does the PC have the License key certificate label on the case?


----------



## RoadDaddy (Mar 10, 2010)

Hi Kevin, yes, I am going to purchase a copy of Windows 7 so I can format and reload. Today I am running the Ultimate Boot CD for Windows, various virus scanners and they tell me I will be able to run HJT from the command line, but I have not got that far yet...  Scanners are running and a malware trace was found in the registry...

Thanks for hanging in there with me Kevin...

This is quite challenging, I know what is wrong, but can't fix it. That bad virus that keeps changing the "Shell" value referenced in this thread to "CMD.EXE /K START CMD.EXE" instead of the correct value of "explorer.exe"


----------



## RoadDaddy (Mar 10, 2010)

hey Kevin, SUPERAntiSpyware detected a registry virus:

SOFTWARE\MICROSOFT\WINDOWS NT\CURRENT VERSION\WINLOGON\

This is all that is reported.

I remove the virus and scan again and it still shows up...I used the latest virus definitions...

The good news is that SUPERAntiSpyware AT LEAST detected the virus, just can't successfully remove it...?

Nasty, nasty... :-(


----------



## kevinf80 (Mar 21, 2006)

Can you navigate to the follow key and see what is listed against it :-

*HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs*


----------



## RoadDaddy (Mar 10, 2010)

Kevin, nothing, blank...? Is that normal/expected...?


----------



## kevinf80 (Mar 21, 2006)

Hiya RoadDaddy,

Yes blank entry is OK, I was hoping there would be entry. It must be something that loads right at boot that is replacing explorer.exe entry.

Try this, boot to command prompt as before. Type the following commands at the prompt, tap enter after each:

Type *bootrec /fixmbr* and then press enter.

Type *bootrec /fixboot* and then press enter.

Type *bootrec /rebuildbcd* and then press enter.

Type exit, remove CD and re-boot, any good???

Kevin.


----------



## RoadDaddy (Mar 10, 2010)

Hi Kevin, I executed your instructions, all completed successfully, BUT I still have the BlackSOD... :-( I always try to execute (CNTL+SHIFT+ESC) and (CNTL+ALT+DEL) at every BlackSOD, just in case the things we do might cause a change and allow me to move forward....

Again, thanks for helping me out. It seems if I could just figure out a way to get a HJT log and post it, it would be relatively easy to remove this BAD BABY...


----------



## kevinf80 (Mar 21, 2006)

Hiya RoadDaddy,

I feel the only way you`ll get this to boot is by using a compatible OS DVD and doing a system repair from the disc. Regarding HJT, I cannot see how you can run it when windows isn`t loaded?

Kevin..


----------



## RoadDaddy (Mar 10, 2010)

Hey Kevin, sorry I read your other message first...  Ok, guess it's time to buy a new set of Windows 7 Ultimate CDs...


----------



## kevinf80 (Mar 21, 2006)

Sounds like a plan....


----------



## RoadDaddy (Mar 10, 2010)

Hi Kevin, it's me...

Well I have a Windows 7 Ultimate DVD. I attempted to do a Startup Repair and didn't have any better luck than I had with the Windows 7 Recovery CD. It was not able to repair and it looked like it didn't find any problems. 

Do you have any other suggestions or options that I could execute with the Windows 7 software DVD...?


----------



## Cookiegal (Aug 27, 2003)

Thread reopened as requested.


----------



## kevinf80 (Mar 21, 2006)

Hiya RoadDaddy,

I haven`t gone right through the thread, as I recall when you amended this Key *HKEY_local machine/software/microsoft/WindowsNT/Currentversion/winlogon/shell* to the correct value it reverted on re-boot.

Can you check the following two keys and check in the right pane and see if anything unusual is listed against either:

*HKCU\Software\Microsoft\Windows\CurrentVersion\Run*

*HKLM\Software\Microsoft\Windows\CurrentVersion\Run*

Kevin


----------



## RoadDaddy (Mar 10, 2010)

FINAL POST

Well, after a long and determined battle, I was not able to resolve this issue as documented in this thread. I was able to use the free operating system "Ubuntu", to copy off my grandsons baby pictures to a USB disk drive...  That process was very easy to accomplish. I finally did a format and re-load of the HP DV6000. Her are some of my final observations, hoping that someone else out there in cyberspace can benefit...

1. Create a repair disk, or TWO
2. Create an Ubuntu operating system disk, know how to use it
3. Create a Ultimate Boot CD for Windows (UBCD4W) disk, know how to use it
4. Backup your valuables to a USB disk on a regular basis, simple copy is better than nothing
5. Be ready to format and re-load, know how to do this
6. Use Avast, free virus & spyware software, I've paid more for less, Avast is the best...(my humble opinion)
7. Don't waist to much time, cut your losses and format and re-load, you and your PC will be better for it...
8. If you use this forum, show your appreciation and make a donation

Thanks to Kevin and Cookiegal for all your support...!


----------



## kevinf80 (Mar 21, 2006)

Hiya RoadDaddy,

Sometimes you`ve just got to bit the bullet and do an R & R, at least you managed to save your important stuff. I like your observations, very apt.

Take care,

Kevin


----------

