takberapapandai
Member
Acer veriton m661 Core 2 Duo - Vista Business 32bit OEM, 3 years
Start PC just only my Rising antivirus logo, mouse cursor and a couple of minutes the Vista screen saver played.
I had hooked to the next PC or/and used AV live CD to scan for virus.
System believed had been infected by malware/virus. Scan by Rising, Kaspersky and malwarebytes and spybots.
F8 (safe mode) - all the same. No Ctrl+Alt+Del function to access the explorer.exe.
What I had done based on my googling guide;
1. Run Vista Recovery CD.
run regedit/Regedt32 to check ;
a. Check the "ObjectName" value
On the File menu, select Load Hive.
HKEY_LOCAL_MACHINE\MySYSTEM\Select and find the “Current” value in the Right hand side. Current value is 2
But the available entry under
Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X is ControlSet001.
There is no ControlSet002.
ControlSet002 missing.
Checked for the "ObjectName" value
Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs
Value Name of "ObjectName" is still "NT AUTHORITY\NetworkService"
b. Checking the "Shell" and "Userinit" String Value
go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell= cmd.exe /k start cmd.exe
Userinit= X:\windows\system32\userint.exe,
I had changed the shell value for so many time but after reboot, there is no change.
Some sort the registry file is not save or write protect or lock by something.
I also had checked the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN
there is no entry - empty.
2. RUN BARTPE Live CD
a. Check the "ObjectName" value
Value Name of "ObjectName" is "LocalSystem" not "NT AUTHORITY\NetworkService"
ControlSet002 missing.
b. Checking the "Shell" and "Userinit" String Value
Shell= Explorer.exe
Userinit= X:\system32\userint.exe,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN (empty).
Edit and save but no change. Still black screen and registry still with the same value.
_________________________________________________
I had run your BSOD Dump & System File Collection app. But can't run the a System Health Report - START | type perfmon /report
because Im using the Vista Recovery Cd command prompt.
But managed to found an old "perfmon.msc" file in the C:\windows\system32 folder.
I zipped in one file.
Chkdsk /f or sfc /scannow failed - An unspecified error occurred.
Help me please before I format the hd.
Tq.
Start PC just only my Rising antivirus logo, mouse cursor and a couple of minutes the Vista screen saver played.
I had hooked to the next PC or/and used AV live CD to scan for virus.
System believed had been infected by malware/virus. Scan by Rising, Kaspersky and malwarebytes and spybots.
F8 (safe mode) - all the same. No Ctrl+Alt+Del function to access the explorer.exe.
What I had done based on my googling guide;
1. Run Vista Recovery CD.
run regedit/Regedt32 to check ;
a. Check the "ObjectName" value
On the File menu, select Load Hive.
HKEY_LOCAL_MACHINE\MySYSTEM\Select and find the “Current” value in the Right hand side. Current value is 2
But the available entry under
Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X is ControlSet001.
There is no ControlSet002.
ControlSet002 missing.
Checked for the "ObjectName" value
Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs
Value Name of "ObjectName" is still "NT AUTHORITY\NetworkService"
b. Checking the "Shell" and "Userinit" String Value
go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell= cmd.exe /k start cmd.exe
Userinit= X:\windows\system32\userint.exe,
I had changed the shell value for so many time but after reboot, there is no change.
Some sort the registry file is not save or write protect or lock by something.
I also had checked the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN
there is no entry - empty.
2. RUN BARTPE Live CD
a. Check the "ObjectName" value
Value Name of "ObjectName" is "LocalSystem" not "NT AUTHORITY\NetworkService"
ControlSet002 missing.
b. Checking the "Shell" and "Userinit" String Value
Shell= Explorer.exe
Userinit= X:\system32\userint.exe,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN (empty).
Edit and save but no change. Still black screen and registry still with the same value.
_________________________________________________
I had run your BSOD Dump & System File Collection app. But can't run the a System Health Report - START | type perfmon /report
because Im using the Vista Recovery Cd command prompt.
But managed to found an old "perfmon.msc" file in the C:\windows\system32 folder.
I zipped in one file.
Chkdsk /f or sfc /scannow failed - An unspecified error occurred.
Help me please before I format the hd.
Tq.
My Computer
System One
-
- Manufacturer/Model
- Acer Veriton M661
- CPU
- Intel Pentium Core 2 DUO
- Motherboard
- Acer
- Memory
- 4GB
- Graphics card(s)
- Intel
- Sound Card
- Intel
- Monitor(s) Displays
- Acer
