Computer got ownd..

[87x]

Ok.. I was told my sister had a virus, and i was invited over to her house for dinner, and to fix her computer... She doesn't really know a lot about computers, and I know how to run it through dos, and can trouble shoot most problems, so she figured i could help her out...

So I get there and eat, and then make my way to the computer...
Its turned off so I turn it on... It loads and goes to the "select User" screen, I select owner (which is there default), and it says loading settings.. There Background flashes on the screen for a split second and then its back at the "select User" screen saying logging off/saving settings.... I ponder it for a second, select shut down computer.. and turn it back on...

This time I hit f8 during startup and Try to go with safe mode.. Go through everything.. select Owner as my user.. and same thing.. logs on thien back off.. before any of the desktop icons can appear, without any alert messages... just logs off..

So I try for safe mode again.. this time i select Safe mode with command prompt.. Same thing happens.. logs off.. So now im confused.. and notice that im not dealing with the average virus...

So I go back to the f8 screen and select an option called debugging.. (only because it sounded promising), then when it asked which system to load , (windows xp home or windows system restore) i selected restore... screen went black and a little dos thing came up asking which i wanted to restore..

1[C:blah]
2[C:blahblah]
3[C:windows]

I selected option three.. and it asked for administrator password.. they didn't have one so i just hit enter.. I sent me to a dos prompt without loading windows..

It said type help for a list of commands, so I did.. I messed around with a few of them.. trying to see what they did, (ex. "bootcfg /?", when i typed that it gives you the definition of what that does..), I found format, and asked if i could reformat her computer..She said ok, because it didn't work anyway...

I did this

"C:/Format C: /FS:NTFS"

now, what that says is format drive C with NTFS... which basically I was guessing on, It had FAT and FAT32 as other options.. but i decided to guess with the NTFS..

Now, it asked if I was sure and I said yes.. the next line that came up on the command prompt was blank, so i knew the computer was doing something.. then it came back up with C:/... So i thought it was done.. but i was thinking that the format only took like 5 seconds.. so i knew it couldn't of reformatted that fast.. so i typed

C:/dir

to get a list of all directories.. and sure enough.. it hadn't done anything...

So now im at the stand still of safe mode not working.. and reformattiong not working.. She can't find her Windows XP home disk.. and Im all out of options.. Can somone tell me what needs to be done, and what is wrong with her computer..

Shes running an HP pavilion a200n desktop... with windows XP home on it.. any help will be appreciate.. any "clear your cache" remarks will be deleted.. and any stupid comments will be deleted.. so think before you post.. thanks in advance..


hm©

[SotN]

EDIT: Take a look at this page. http://securityresponse.symantec.com...tw.trojan.html

If you're lucky and that's your virus, then all you need to do is find that script in %Windir%\Start Menu\Programs\Startup adn you'll be golden.

Boot from an XP CD. That'll prevent nastyness when you format your OS into nothing. It'll also help prevnt the virus from starting up. And do it from the "recovery console". (OMG DOS LOL)

I can think of a few things wrong with that. I'm thinking she is using FAT32. The name of the file system refers to the one the hard drive is using now. Did she upgrade from Windows9x?

Second, the drive letter might have gotten reassigned. That happens rarely. Type map in the console to make sure that's the right partition.

Third, it might protect C:\ because the format program is running from there. I havent ever formatted without booting from a CD, so I dont know if it behaves that way. Windoze.

When do do format correctly, FORMAT will still be running. You'll be prompted to type exit.

[87x]

Thanks SotN, for your input on the situation..

I remember that virus when I got home from her house, I called her and told her thats what it might have been.. if thats the case, then I can just go into DOS (like I did before), and delete that script so I can access the computer from windows again.. But the question is.. if windows isn't open, can I go through DOS, and delete something that can't be accessed??.. And I remember hearing something about holding down the shift key while starting up bypasses all startup scripts from running.. Is that true??

The only problem is that, the virus you are talking about shuts down the computer... the one she has, just logs whatever user you try to use off.. The two virus's do essentially the same thing by locking the user out of the computer.. just they would have different scripts, and will make me have to search around for it..

Now, she can't find her XP cd, so I was trying to get ways to fix this problem without having the CD..

It doesn't seem like she has some major virus on her hands, just something that causes the logging off.. if that is the case, then I will come back here and tell everyone, and I appreciate your help.. If thats not the case, and we have to reinstall windows, thanks anyway for the suggestions..

And, C:\ is the right drive.. I made sure of that..


*EDIT*
Curtosey of www.techtv.com

Continual crashing
If your co-worker needs to constantly reboot his computer because of crashing applications, why not give him a helping hand with a shortcut that will restart his computer in his Startup folder? Here's how in Windows XP.

1. Right-click the Start menu.
2. Select Explore Users.
3. Navigate to Programs > Startup.
4. Right-click the file windows and select New > Shortcut.
5. When the window pops up asking for the location, enter "%windir%system32shutdown.exe -r -t 00."

This shortcut causes the system to execute the Windows shutdown process. And since it's in the Startup folder, it'll be one of the first things Windows executes when starting up. It's a fun startup/shutdown loop that will drive the bastard crazy. If it happens to you, the antidote is to hold down the Shift key when Windows starts up. That will tell Windows not to run what's in the Startup folder. Then just go back into the Startup folder and delete the shortcut.

This can be found on there pranks page at http://www.techtv.com/unscrewed/ihat...633552,00.html
*EDIT*


hm©

[SotN]

I remember that virus when I got home from her house, I called her and told her thats what it might have been.. if thats the case, then I can just go into DOS (like I did before), and delete that script so I can access the computer from windows again.. But the question is.. if windows isn't open, can I go through DOS, and delete something that can't be accessed??.. And I remember hearing something about holding down the shift key while starting up bypasses all startup scripts from running.. Is that true??

Running the computer in DOS should allow you to delete the script (if that's what it is) without any problem. You'll know what the script is because it'll be a file with a wierd ending in the StartUp folder.

If the file is Read-Only for some reason, just type attrib -r <filename.xxx>. Then delete it.

[Varia]

So...the prank thing was the problem? Or just a reference to the shift key?

[87x]

deleted your post prodicalink (sp?) because it was irrelevant and stupid..

now varia.. the prank was just the reference to where H had found out about the prank and how to solve it..