[AizA]

Hello and thank you for reviewing this post.

I obtained a machine infested with the 'standard' viruses .. fake alerts, and others. I ran some cursory scans and determined that there was a rootkit. Not too uncommon. I ran ATF cleaner first, then turned off System Restore ... then I went to work with Combofix first. (I have performed this procedure or close to it several dozens of times)

Just after to CF, I now get the above-noted error either through safe or normal mode.

I pullede the hard drive, and plugged in into a different machine using IDE to USB Roswell adapter. I ran the disk checking utilities and it came up with no errors. Then I scanned it with MWB, and nothing found (although I have done this with others and it 'found' nothing when attached in this manner even though they were full of stuff).

I then inserted operating syswtem disk, did a chkdsk /r, which found and fixed some errors. Then upon reboot, same blue screen.

Then I did a fixmbr and fixboot and another chkdsk /r and rebooted.

Same blue screen.

I am beginning to think that something was removed or altered during the CF run that affected this.

Whether it caused it, or was caused by something else, I am seeking guidance and advice. Sure I can reformat it, but I would like to avoid having to go there.

Thank you in advance for your time and assistance.

Don in Tucson
The Virus Slayer

[Mumbodog]

Did you try the bootcfg /rebuild command?

.

[AizA]

No, I did not. Run this from command prompt just as it is written by you? I will try this .. but in the mean time, so I can learn, what is the function of this command and are there any ancillary commands using it that I should know?
Thank you! I will report back as to my success with it ..... oh .... this does not risk any data, does it?

Have a wonderful evening.

Don in Tucson

[Mumbodog]

It rebuilds the boot ini file

/Add
Scans the disk for all Windows installations and allows you to add any new ones to the Boot.ini file.
/Scan
Scans the disk for all Windows installations.
/List
Lists each entry in the Boot.ini file.
/Default
Sets the default operating system as the main boot entry.
/Rebuild
Completely re-creates the Boot.ini file. The user must confirm each step.

this does not risk any data, does it?

no
.

[Mumbodog]

When you did the fixmbr, fixboot did you specify the drive in the command?

fixmbr C:

fixboot C:

.

[AizA]

(First off, I like your box quote. Tea Partier here.)

Anyway ... to your 2nd question .. no, I merely did fixboot <enter> or fixmbr <enter>

So your command rebuilds the boot.ini file .. too cool. Will do right away .. unless you suggest I do the fixmbr and fix boot again, the right way.

To verify .. it would look like this:

fixmbr C: <enter> and fixboot c: <enter> given C is my OS drive, right?

Thank you.

[Mumbodog]

fixmbr C: <enter> and fixboot c: <enter> given C is my OS drive, right?

Actually I got it wrong, see #6 and 7 at this link
http://articles.techrepublic.com.com...1-6031733.html


fixboot C: <enter>

fixmbr \Device\HardDisk0 <enter> not sure if there is a space between fixmbr and \

evidently fixmbr needs a hardware path, not a drive letter, Disk0 would be the first partition on the hard drive Disk1 would be second, and so on, so you would need to know what partition the OS resides on.

Yes I would try these commands, see if it will boot.

.

[Mumbodog]

Looks like of you do not specify a device name, a new master boot record will be written to the boot device, which is the drive on which your primary system is loaded.

http://www.microsoft.com/resources/d....mspx?mfr=true

also, Using the fixboot command without any parameters will write a new partition boot sector to the system partition you are logged on to.

http://www.microsoft.com/resources/d....mspx?mfr=true

so I guess it does not matter if you use the switches or not.

.

[AizA]

Tried 'em all ... no change in blue screen. So I finally formatted a new drive for the system.

If you had any other ideas, I'd still be interested, but will not be able to try them. But I would be interested in knowing ....

Thank you.

Should I mark this solved, even though it is not?

Don in Tucson
The Virus Slayer

[Mumbodog]

Should I mark this solved, even though it is not?

Well actually you did solve your problem, you just did not find the cause, so yes mark it solved.

.