[DeathDomokun]

I was sent here by rorschach, I was doing scans for their forum and I got 1 called the doctor, it came with a registry cleaner. I used that and then ran a scan rogeam from there. After that I rebooted my pc and it won't boot. I have tried safe mode but it gets stuck at mup.sys, it says it will now load SPTD.sys but it never loads and stays like that. I am running xp sp2 and don't have any xp discs. What can I do? Please help, I have no computers to use, I'm writing this on my iPod touch. Can I recover my files if I do need to do something drastic? Thankyou in advance. All help is greatly appreciated.

[Extremeboy]

Hello and welcome to 247Fixes.

I'm Extremeboy, and I will try to help you with your current problem.

Recovering/backing up your data files is possible (if they are not damaged in anyway or removed, which in most cases should be fine) so, let me know if that is your first priority and we'll get to that ASAP.

Before we continue however, a few questions I would like to ask you.

1)

Quote

I was sent here by rorschach, I was doing scans for their forum and I got 1 called the doctor, it came with a registry cleaner.

Which forum were you sent here from? Please link me the topic that you were previously being helped so I can see what has occurred so far.
What "scans" is this referring to?
What do you exactly mean by "it came with a registry cleaner?

2)

Quote

[...]it says it will now load SPTD.sys but it never loads and stays like that.

Where do you get the message that says "now load SPTD.sys" and it never loads?

3)

Quote

[...]and don't have any xp discs. What can I do? Please help, I have no computers to use,

Having no other computers to use may be a difficult thing to proceed with as we need tools to do certain diagnosis or backup your files etc... In worst case scenario, you may need to get a XP Disk and re-install and then backup your data information. For now, just answer my questions and let me know if you have any computers that are accessible.

With Regards,
Extremeboy

[DeathDomokun]

1)
I was sent here by rorschach from SpyWare BeWare
My previous topic http://forums.maddok...58&#entry112858

The scans i ran were the comedian.exe, that came with/installed a registry program
I also ran that.
The other scan i ran was the TFC.exe scan, after that ran it rebooted my system
After that my xp wouldn't run
the links to info about these programs are here
http://forums.maddok...?showtopic=9590

2)
it says it had loaded Mup.sys [a windows driver] and then down the bottom of my screen it says it will now load SPTD.sys, press esc to cancel but it never loads and stays like that.
This happens in the safe mode boot log, when it says what it is opening

3)
I am on my mums computer right now but i cant tell her my computer isnt working or she will crack the sh!ts with me


Thanks for all this (:

[Extremeboy]

Hello.

I'm very busy today, so we'll probably get some "work" done tomorrow.

Just a few quick things.

Are you capable of getting past the BIOS? I believe so, since you said you were able to boot into Safe Mode. Does this computer have the Recovery Console installed?

There could be various reasons that might have caused this and fix it however, we need to see the current condition.

Mup.sys is one of the drivers that Safe Mode requires to load so if service/driver is causing it, you can't boot in.

Let's first get your data files or any other files backed up here. You will need a CD and a CDBurner Software on your Mom's computer. You will also need some sort of removable drive such as a USB/flash-drive.

---
Hello.

The steps below will take a while so please be patient. The download package is also very big so it may take a while to finish. You will need a flash-drive or external hard-drive. If you have a lot of data on your drive then a external hard-drive may be more reasonable. Depending on how big your flash-drive it is you can use that as well.

To begin we will need a CD (at least 700MB) and a removable drive.

Word of Advice: You may wish to read over the instructions FIRST and if you do have any problems or questions that you do not understand or are unclear of, let me know. Otherwise follow the instructions below.

Run the following tool on your clean machine with the external/flash-drive you are going to use.

Download and Run FlashDisinfector

• Please download Flash_Disinfector.exe by sUBs and save it to your desktop (You're Clean machine)
  
• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
  Please plug in your external hard-drive that you are going to use to backup your data in the infected machine afterwards to be on the safe side.
  
• Wait until it has finished scanning and then exit the program.
  
• Reboot your computer when done.

Note: Flash_Disinfector will create a hidden file named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder. It will help protect your drives from future infection.

Using Knoppix to Backup Files/Folders

Allow me to stress that, before we begin this, ask if you have doubts about any step before proceeding.

Download and Burn Knoppix to a Disk

We will be using Knoppix, a bootable disk. From it, we can access your harddrive and do any repairs/backing up datas.

Download Knoppix 5.1.1 to your desktop.

• From a working computer download and install IMGBurn.
  
• Open IMGBurn via the newly created icon on your desktop, or by pointing to Start->All Programs->ImgBurn->ImgBurn
  
• Push the large "Write image file to disk" button.
  
• Right under "Source" and next to "Please select a file" push the http://billy-oneal.com/BleepingComputer/ScreenShots/imgburnbrowse.png button.
  
• Browse to and select the Knoppix image file on your desktop.

Place a blank CD-R into your clean system's CD Burner, and press the large button that looks like a page going into a CD in the bottom left of IMGBurn.

Visual instructions on burning ISO images can be found over here

Note: The CD has to be at least 700MB as the ISO file image is 689MB in size.

---

Run Knoppix and Backup Important Files/Folders

• Now place this CD into the non-bootable system. Configure the system to boot from CD.
  You can usually do this by pressing F10, F11, or F12 (try all of them if unsure) to bring up configuration options, and select CDRom as your boot device.
  
• Some machines will automatically attempt boot from the CD if one is inserted, if that is the case do not worry about it.
  
• Knoppix will now begin loading onto your computer. This process may take up to one minute.
  Please do not touch or use the machine while Knoppix loads itself

• When you see this screen,
  http://billy-oneal.com/BleepingComputer/ScreenShots/knoppixboot.png
  
• Press enter on your keyboard, and wait for Knoppix to boot.
  
• Knoppix will now being to setup, this may take a while (sometimes up to 5 minutes). Please be patient while it loads itself.

• Then soon you should see the Knoppix desktop appear after a while.
  
• On Knoppix' desktop, you should see an icon for your hard disk (Looks like http://billy-oneal.com/BleepingComputer/ScreenShots/knoppixhdd.png.)
  
  
• Right click the drive, and select "Change Read\Write Mode". Press "Yes" at the prompt.
  
• Now plug in your external hard-drive/removable drive in that you ran flash-drive disinfector above.
  
• Soon it will recognize the drive and a flash-drive icon will appear on the desktop.
  
• Then click the hard disk icon on your desktop and copy and paste anything over to your external hard-drive that you may need.

Let me stress you not to backup any executables but only pictures, files, documents, music etc... Anything else including a .zip archive folder, do not backup.

---

Confirming Files/Folders are Functioning and Shut-Down Knoppix

• Once the files are done copying and backed up, take out your external hard-drive from the slot.
  
• To make sure they are all working and functioning properly meaning they are not corrupted you should test it on one of your clean machines.

• Now press the large K button in the lower left corner of the screen, and select Log Out...
  
• Then press "Turn off computer".
  
• It will now being to unload itself and tell you to take out the CD from the slot. Take it out and select Ok.
  
• You're computer will now reboot itself.

Tell me how it goes and if the backup went okay. Any questions or problems feel free to ask.

We'll continue from there afterwards.

With Regards,
Extremeboy

[DeathDomokun]

instead of imgburn can i use nero?
i greatly appreciate your help, i know rl happens so if you cant reply thats okay too

[DeathDomokun]

Ignore that i will just download that
Once i have backed up my documents what do i do next?
Please help asap
Thanks in advance, i greatly appreciate your attitude and help

[Extremeboy]

Hello.

Just a quick reply before I head off. I'll be back in the afternoon.

Let me know once you have successfully backed up your files and data and then we'll proceed from there.

With regards,
Extremeboy

[DeathDomokun]

I have backed up everything important, I can download my other stuff again. I'm ready to fix my computer now

[DeathDomokun]

I have backed up everything important, I can download my other stuff again. I'm ready to fix my computer now

[Extremeboy]

Hello.

Glad you got it all backed up. Now that we have your files and important data backed up, we are free to do more diagnosing and fixing here.

I would like you to answer my questions first please... I need to know if you have the Recovery Console installed or not:

Quote

Just a few quick things.

Are you capable of getting past the BIOS? I believe so, since you said you were able to boot into Safe Mode. Does this computer have the Recovery Console installed?

There could be various reasons that might have caused this and fix it however, we need to see the current condition.

Mup.sys is one of the drivers that Safe Mode requires to load so if service/driver is causing it, you can't boot in.

Try booting into the Last Known Good Configuration and describe to me what happens: http://support.microsoft.com/kb/307852

Let me know.

With Regards,
Extremeboy

[DeathDomokun]

It loads up to the xp loading bar and then goes black and blank. I can not boot my computer at all. Went to debugging mode and I thought it was working coz it went to the screen where all the users would be but none showed up and instead it said something along the lines
Of can't scan/debug because c: is a RAW drive or something like that.

[Extremeboy]

Hello.

Okay. Thanks for the explanation but my initial question was do you have the Recovery Console installed? By the fact you are not responding to it I believe you may not know what it is or don't have it installed. IN this case, please burn a copy of RC.ISO to a CD and run chkdsk.

Download and Create Recovery Console Disk

• Please download the RC.iso image file to your working computer's desktop.
  
• Now Burn the image onto a CD. If you do not have CD burning software, you can use ImgBurn Software.
  
• Take the CD out from your working computer and shut-down your infected computer if it's not already shut down.

*****

• Now Place the recovery console CD into the drive of the infected machine.
  
• Turn on your computer and boot into the Recovery Console
  
• Type in the number of the Windows installation you want to repair (1) and then press Enter.
  This is usually 1: C:\Windows, unless you are using dual-booting or something else
  
• Type in the Administrator password and press Enter if you have set one.
  leave blank if you are unsure what it is or if you do not have one
  
• You will now be in the Recovery Console, please follow the instructions below on fixing your machine.

*****

• Type the following without the word "code":
  

  chkdsk C:\ /p /r

  followed by Enter on your keyboard.
  
• Type the following without the word "code":
  

  disable mup

  followed by Enter on your keyboard.
  Now type the following without the word "code":
  

  exit

  followed by Enter to Exit the Recovery Console.
  Your computer will now reboot, take out the CD afterwards and boot your computer back either to Normal Mode/Safe Mode.

Let me know what happens and give a description in your next reply please. We'll continue on wards afterward.

With Regards,
Extremeboy

[DeathDomokun]

I did what you said and it all worked but it didn't help,I still can't boot at all...

[Extremeboy]

Yes, I know but I would like you to explain the problem now that you receive at boot up.

Let me know.

[Extremeboy]

How's everything coming along? Do you still need help?

~Extremeboy