topic Re: Power Eraser vs rogue a/v. in Other Norton Products

Power Eraser vs rogue a/v.

harcut — Wed, 02 May 2012 03:59:31 GMT

Picked up a rogue a/v. virus detected by Norton Internet Security which it could not solve. Ran Power Eraser as suggested by the website. Reboot after running the program was stopped with these references: 0x0000008e, 0xc0000005, 0x820361a7,

0x9dc4091c, and oxoooooooo. Can boot up in safe mode, however and safe with networking (including wireless internet). All files seem to be there and programs working (at least the ones I tried).

Does anyone know wht all this means? Did Power Eraser remove some system files...and if so, can I replace them? Or is this some other problem caused dirctly by the virus?

Thanks,

Harry

Re: Power Eraser vs rogue a/v.

Quads — Wed, 02 May 2012 04:03:51 GMT

Start NPE go into history and have it undo what it did.

How many times do I have to tell people NOT to use NPE and other tools!!!

Quads

Re: Power Eraser vs rogue a/v.

harcut — Wed, 02 May 2012 04:09:38 GMT

Unfortunately just got on the site, so never saw your recommendations.

Tried to start NPE again and got following:

Error while enumerating operating system.

Error Code: 0x80045007,0

Re: Power Eraser vs rogue a/v.

Quads — Wed, 02 May 2012 04:12:50 GMT

What does it say on the NPE site??

Quads

Re: Power Eraser vs rogue a/v.

harcut — Wed, 02 May 2012 04:29:07 GMT

No info Re: Error messages at all on the site. Wrote support. Holding my breath.

Re: Power Eraser vs rogue a/v.

Quads — Wed, 02 May 2012 04:38:09 GMT

It says about the accressive nature of the tool on the download site, I have just checked.

When you boot your machine, press F8 to list the startup options, exactly as you would if you were trying to enter
Select "Disable Automatic Restart on System Failure", as shown here:
When your system BSODs, write down the STOP error code, as well as any written out error message back here. The STOP error will always appear, but the message may not. You are looking for this:

Please include this information in your reply.

Quads

Re: Power Eraser vs rogue a/v.

harcut — Wed, 02 May 2012 05:51:30 GMT

No error message other than the STOP: 0x0000008e (0xc0000005, 0x820741a7, 0xaded091c, 0x00000000)

Re: Power Eraser vs rogue a/v.

Quads — Wed, 02 May 2012 05:54:09 GMT

Are you 32 bit or 64 bit Windows??

Quads

Re: Power Eraser vs rogue a/v.

harcut — Wed, 02 May 2012 06:02:50 GMT

Re: Power Eraser vs rogue a/v.

Quads — Wed, 02 May 2012 06:06:31 GMT

Reboot your computer and tap the F10 key until Edit Boot Menu appears

Is something like this listed,

[ /DETECTHAL /MININT /REDIRECT RDIMAGEOFFSET=8192 RDIMAGELENGTH=3161088 R
DPATH=multi (0)rdisk(0)partition(1)\sources\boot.wim]

Quads

Re: Power Eraser vs rogue a/v.

harcut — Wed, 02 May 2012 06:26:52 GMT

Partitions 3

Hard disk eb1710f3

[-no execute=optout / minint ]

Re: Power Eraser vs rogue a/v.

Quads — Wed, 02 May 2012 06:40:05 GMT

is it XP??

Quads

Re: Power Eraser vs rogue a/v.

harcut — Wed, 02 May 2012 06:45:41 GMT

Vista Home Premium,

Re: Power Eraser vs rogue a/v.

Quads — Wed, 02 May 2012 06:52:11 GMT

What does the path state, for instance "Path: \Windows\System32\winload.exe"

Quads

Re: Power Eraser vs rogue a/v.

harcut — Wed, 02 May 2012 07:08:44 GMT

Sorry, VT, I must have missed something (other than using NPE being a bad idea)...you are looking for the path for what file location?

Re: Power Eraser vs rogue a/v.

Quads — Wed, 02 May 2012 07:17:19 GMT

This should have also listed a path for winload.exe

Partitions 3

Hard disk eb1710f3

[-no execute=optout / minint ]

And this piece should have a section removed

[-no execute=optout / minint ]

So would look like

[-no execute=optout ]

Quads

Re: Power Eraser vs rogue a/v.

harcut — Wed, 02 May 2012 07:47:54 GMT

Yes, went bck and path is: Path:\windows\system32\winlod.exe

The other is just s I had stated, except without the left hnd bracket: [-no execute=optout / minint

Re: Power Eraser vs rogue a/v.

harcut — Wed, 02 May 2012 07:50:23 GMT

I meant...without the right hand bracket.

Re: Power Eraser vs rogue a/v.

Quads — Wed, 02 May 2012 08:00:30 GMT

one step is to remove the / minint in red

[-no execute=optout / minint and add the left bracket slowly with arrow keys and back space

So would look like

[-no execute=optout ]

may have to alter the BCD entries to get Normal Mode fully

Quads

Re: Power Eraser vs rogue a/v.

harcut — Wed, 02 May 2012 18:59:17 GMT

I removed the minint and the system booted normally. Everything fine until I re-started, then boot stopped again as before. Checked and minint was back in the string. Removed it again and the same thing happened. Did notice, however, that the right hand bracket is still there...two rows down and off in the right hand mrgin where I cannot get the curser to go to remove it. Any ideas?

Thanks,

Harry