topic Re: Cannot boot computer after running Norton Power Eraser in Norton 360

Cannot boot computer after running Norton Power Eraser

jcrnell16 — Mon, 30 Jan 2012 00:34:03 GMT

Here's my story, hope someone out there can help me fix this on my own! I have a Dell Inspiron 570, AMD Athlon II X4-630 processor, Windows 7 64 bit...purchased May 2011. I came with 3 free years of McAfee, theres my mistake! Firewall kept shutting itself down so I have a virus. Couldn't fix it, bought Norton 360. Ran a scan, found tracking cookies. Still had the virus. Could not access Google, kept getting messages stating I was out of memory at line 35, etc, walked past my computer and caught it sending emails to a bank. Ugh! So I ran Power Eraser and now I can't boot my computer. It found 2 bad files, I think I remember one being backdoor.bot. Tried safe mode, system repair, Dell Data Safe, restore from a previous point, nothing works. This was yesterday, now today that previous restore point doesn't even show up on the list. Ans I do not have a Windows disc, it came pre-installed on my computer. What should I do? I ran a Farbar recovery scan as suggested on another web forum. Here is the log: Scan result of Farbar Recovery Scan Tool Version: 28-01-2012 Ran by SYSTEM at 2012-01-28 15:06:58 Running from F:\ Windows 7 Home Premium (X64) OS Language: English(US) The current controlset is ControlSet001 ========================== Registry (Whitelisted) ============= HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [8321568 2009-11-09] (Realtek Semiconductor) HKLM\...\Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup [207350 2011-01-25] () HKLM-x32\...\Run: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-07-14] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-02-27] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-25] (Dell, Inc.) HKLM-x32\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1484856 2010-09-30] (McAfee, Inc.) HKLM-x32\...\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [439568 2010-05-10] (Microsoft Corporation) HKLM-x32\...\Run: [] [x] HKLM-x32\...\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [240112 2010-11-25] (Sonic Solutions) HKLM-x32\...\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [514544 2010-11-17] () HKLM\...\RunOnce: [EDocs] C:\Program Files\Dell Inc\Dell Edoc Viewer\EDocs.exe /s [1499648 2010-04-28] (Dell Inc.) HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [296960 2009-07-13] (Microsoft Corporation) Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X] ==================== Services (Whitelisted) ====== 2 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [355440 2010-03-10] (McAfee, Inc.) 2 mcmscsvc; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [355440 2010-03-10] (McAfee, Inc.) 2 McNaiAnn; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [355440 2010-03-10] (McAfee, Inc.) 2 McNASvc; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [355440 2010-03-10] (McAfee, Inc.) 3 McODS; "C:\Program Files\mcafee\VirusScan\mcods.exe" [509416 2010-10-07] (McAfee, Inc.) 2 McOobeSv; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [355440 2010-03-10] (McAfee, Inc.) 2 McProxy; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [355440 2010-03-10] (McAfee, Inc.) 2 McShield; "C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe" [200056 2010-10-13] (McAfee, Inc.) 2 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" [245352 2010-10-13] (McAfee, Inc.) 2 mfevtp; "C:\Windows\system32\mfevtps.exe" [149032 2010-10-13] (McAfee, Inc.) 2 MSK80Service; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [355440 2010-03-10] (McAfee, Inc.) 2 NOBU; "C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe" SERVICE [2823000 2010-08-25] (Dell, Inc.) 3 RoxMediaDB12OEM; "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe" [1116656 2010-11-25] (Sonic Solutions) 2 RoxWatch12; "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe" [219632 2010-11-25] (Sonic Solutions) 3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [x] ========================== Drivers (Whitelisted) ============= 3 cfwids; C:\Windows\System32\drivers\cfwids.sys [62800 2010-10-13] (McAfee, Inc.) 3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [121248 2010-10-13] (McAfee, Inc.) 3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [190136 2010-10-13] (McAfee, Inc.) 3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [441328 2010-10-13] (McAfee, Inc.) 0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [529128 2010-10-13] (McAfee, Inc.) 1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [75032 2010-10-13] (McAfee, Inc.) 3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [94864 2010-10-13] (McAfee, Inc.) 0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [283360 2010-10-13] (McAfee, Inc.) ========================== NetSvcs (Whitelisted) =========== ============ One Month Created Files and Folders ============== 2012-01-28 16:09 - 2012-01-28 16:09 - 0000452 ____A C:\Users\Public\Desktop\Emergency Backup.lnk 2012-01-28 16:09 - 2012-01-28 16:09 - 0000452 ____A C:\Users\All Users\Desktop\Emergency Backup.lnk 2012-01-28 16:02 - 2012-01-28 16:02 - 0000000 ____D C:\Emergency 2012-01-28 15:42 - 2012-01-28 15:42 - 0000000 ____D C:\Windows\SMINST 2012-01-28 15:06 - 2012-01-28 15:07 - 0000000 ____D C:\FRST ============ 3 Months Modified Files and Folders ============= 2012-01-28 16:09 - 2012-01-28 16:09 - 0000452 ____A C:\Users\Public\Desktop\Emergency Backup.lnk 2012-01-28 16:09 - 2012-01-28 16:09 - 0000452 ____A C:\Users\All Users\Desktop\Emergency Backup.lnk 2012-01-28 16:02 - 2012-01-28 16:02 - 0000000 ____D C:\Emergency 2012-01-28 16:02 - 2011-05-09 09:21 - 0000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup 2012-01-28 15:42 - 2012-01-28 15:42 - 0000000 ____D C:\Windows\SMINST 2012-01-28 15:07 - 2012-01-28 15:06 - 0000000 ____D C:\FRST ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ========================= Memory info ====================== Percentage of memory in use: 10% Total physical RAM: 5886.98 MB Available physical RAM: 5265.19 MB Total Pagefile: 5885.13 MB Available Pagefile: 5248.88 MB Total Virtual: 8192 MB Available Virtual: 8191.89 MB ======================= Partitions ========================= 1 Drive c: (OS) (Fixed) (Total:917.66 GB) (Free:889.97 GB) NTFS 4 Drive f: () (Removable) (Total:3.73 GB) (Free:3.68 GB) FAT32 7 Drive i: (RECOVERY) (Fixed) (Total:13.81 GB) (Free:5.51 GB) NTFS ==>[System with boot components (obtained from reading drive)] 9 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- Disk 0 Online 931 GB 0 B Disk 1 Online 3819 MB 0 B Disk 2 No Media 0 B 0 B Disk 3 No Media 0 B 0 B Disk 4 No Media 0 B 0 B Disk 5 No Media 0 B 0 B Partitions of Disk 0: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 OEM 39 MB 31 KB Partition 2 Primary 13 GB 40 MB Partition 3 Primary 917 GB 13 GB Disk: 0 Partition 1 Type : DE Hidden: Yes Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 8 FAT Partition 39 MB Healthy Hidden Disk: 0 Partition 2 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 1 I RECOVERY NTFS Partition 13 GB Healthy Disk: 0 Partition 3 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 2 C OS NTFS Partition 917 GB Healthy Partitions of Disk 1: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 3818 MB 16 KB Disk: 1 Partition 1 Type : 0B Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 3 F FAT32 Removable 3818 MB Healthy ========================================================== TDL4: custom:26000022 ========================================================== Last Boot: 2011-05-09 11:04 ======================= End Of Log ==========================

Re: Cannot boot computer after running Norton Power Eraser

Quads — Mon, 30 Jan 2012 01:25:24 GMT

Stay with the removal forum

You don't have Norton installed but McAfee,

On quick look, it looks like you have MaxSS, (SST.*) and /or TDL4

Quads

Re: Cannot boot computer after running Norton Power Eraser

jcrnell16 — Mon, 30 Jan 2012 03:26:56 GMT

So what are you telling me to do? I removed McAfee. Norton successfully installed, used it for scans.

Re: Cannot boot computer after running Norton Power Eraser

Quads — Mon, 30 Jan 2012 04:14:05 GMT

I am saying for you to stay with the Malware removal forum http://www.bleepingcomputer.com/forums/topic440444.html

They are strict like me, and don't like 2 groups working on a machine at one time, I can tell you it gets confusing and frustrating. They are able to do what I do and script etc. to be able to clean a system with advanced tools,even when a PC doesn't boot Windows.

The tool used requires scripts to know what to do. It's designed that way.

looks like you have a custom BCD entry that belongs to TDSS (include mods coming out)

In BCD lookup it would look like.

EMS Settings
------------
identifier {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9}
custom:26000022 Yes

But they havn't asked for the BCD log yet to double check

Quads

Re: Cannot boot computer after running Norton Power Eraser

Quads — Mon, 30 Jan 2012 21:37:27 GMT

You have been given the fix scripted to fix the BCD entry and MBR. http://www.bleepingcomputer.com/forums/topic440444.html

cmd: bootrec /FixMbr
TDL4: custom:26000022

Quads

Re: Cannot boot computer after running Norton Power Eraser

siddharth_laksh — Wed, 01 Feb 2012 04:52:54 GMT

jcrnell16,

When you bought N360, you also get the ability to build a bootable recovery disk, that lets you scan all your windows partitions. Do you have that disk? If not, please try to create that disk on a different PC. You will be able to boot using the CD and then be able to run a traditional scan using Norton 360 and also scan using Norton Power Eraser. You may also be able to undo the changes you made by your previous run of Norton Power Eraser.

http://us.norton.com/products/tutorials/tutorials.jsp?pvid=nis2011&tutid=recovery_tool.

Let me know if that was useful.

Re: Cannot boot computer after running Norton Power Eraser

Shrinivasp — Wed, 01 Feb 2012 09:11:39 GMT

Hi jcrnell16,

Just in case you are not able to see the Norton Bootable Recovery Tool Tutorial getting launched after clicking on mentioned link then, remove the "." dot from end of the link

click on this link.

http://us.norton.com/products/tutorials/tutorials.jsp?pvid=nis2011&tutid=recovery_tool

Re: Cannot boot computer after running Norton Power Eraser

Quads — Wed, 01 Feb 2012 11:36:47 GMT

The users system is now bootable after using the script.

Quads

Re: Cannot boot computer after running Norton Power Eraser

visualstat — Wed, 08 Feb 2012 02:59:32 GMT

I ran the Norton Power Eraser today because Norton was telling me to manually remove a Trojan virus. When it went to restart my computer I was not longer able to boot my computer which is a Dell Vostro 220 with windows 7. I was able to run the norton recovery tool that I was able to create on another machine. It scanned the entire machine with no viruses found. There was nothing for me to select "undo".

Any ideas on what I should do now?

Re: Cannot boot computer after running Norton Power Eraser

Quads — Thu, 09 Feb 2012 02:25:00 GMT

What did it ask to remove manually?? (actual dection name)

What makes the well known Rootkit /Bootkit families is that they are continually changing, and also if you remove them wrongly, it's bye bye for loading Windows

Quads

Re: Cannot boot computer after running Norton Power Eraser

visualstat — Thu, 09 Feb 2012 03:53:32 GMT

I saw 3 items which I should have paid very close attention to. one item was cdrom .. but the other two I am not sure of.

so, i guess you are telling me that I my only option is to reinstall windows 7?

Re: Cannot boot computer after running Norton Power Eraser

shannons — Sun, 04 Mar 2012 03:09:06 GMT

Moved to own thread for better exposure.