Question

Locked

system restore disabled

By tonybellini ·
My Daughters P.C. has developed a major problem. There are no system restore points available and XP will not boot beyond wallpaper on desktop. Safe mode works but last successful boot and all other startup modes do not.Appears to be caused by virus but can't get anywhere with it - Help !!!

This conversation is currently closed to new comments.

2 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

run the scanner in safe mode

by CG IT In reply to system restore disabled

if you can boot to safe mode run the scanner in safe mode [better way to run it anyways] If you know the virus name, get a removal tool and run that in safe mode.

Leave restore off until your sure the virus is off the machine. The n turn it on and create a restore point.

Collapse -

msconfig _if you red it read it again...

by operator1 In reply to system restore disabled

hi,i wrote you about /noguiboot option but it wont help because it only disables bitmaps during boot process.
When you are this way "half" booted with only
wallpaper on try to press ctrl+alt+del and see if you can get Task manager running.If you can on the applications tab click "new task"and type "explorer.exe".maybe that brings GUI up.If not go to safe mode.
While you are in the safe mode run regedit
and go to this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and on the right side see what is written under "shell" value
Should be "Explorer.exe".if it isnt change the value.
you can check this value also:
Hkey_Local_Machine\System\CurrentControlSet\Control\ and on the right side check SystemStartOptions.On a normal system should be only /Fastdetect.
For boot options you can check here:
http://www.microsoft.com/technet/sysinternals/information/bootini.mspx
and maybe it would be good idea to copy explorer.exe from clean same version system and paste it to your system.
if you can access system restore but theres no restore points that can mean that it has been disabled in near past and then enabled again.or something running under system account has deleted them.Maybe better
cause if it is a virus it would be in the restore points as well.
bye

Back to Malware Forum
2 total posts (Page 1 of 1)  

Related Discussions

Related Forums