PDA

View Full Version : Can't boot past isapnp.sys



nofam
21-12-2009, 09:46 AM
Hi All,

Removed w32.downadup plus a few other nasties from a PC (XP Pro) using trojan remover in safe mode, and now the PC in question won't boot past isapnp.sys in safe mode, and just freezes on a black screen if I boot normally.

Any ideas? :thumbs:

Speedy Gonzales
21-12-2009, 09:51 AM
Try this (http://support.microsoft.com/kb/315311)

nofam
21-12-2009, 10:30 AM
Thanks Speedy - tried that, and it's replaced the file from the install CD, but I still get the same issue on boot. :illogical

Speedy Gonzales
21-12-2009, 10:53 AM
Remove the hdd put it in a working system then do a full scan with an AV program

wainuitech
21-12-2009, 02:40 PM
Try booting from the XP CD, load up the recovery console, type in chkdsk /r

See if it repairs the system files - Have a PC here was completely unbootable - even the drive wouldn't show, ran chkdsk and whalla, bootable drive.

Other wise a repair install my also fix it.

Blam
21-12-2009, 03:51 PM
Try booting from the XP CD, load up the recovery console, type in chkdsk /r

See if it repairs the system files - Have a PC here was completely unbootable - even the drive wouldn't show, ran chkdsk and whalla, bootable drive.

Other wise a repair install my also fix it.

Yea-possible its a file system error.

If that fails then a repair install would be the next option.

KSODs are the worst to troubleshoot:x

Sadbuttrue
22-12-2009, 11:56 AM
I'm having the exact same issue.

I did not notice any trojan/viruses on my computer.

Yesterday it okay, today it goes blank screen and safemode haults at isapnp.sys

My first speculation was there was a windows update that installed in the background that has caused it to be non-bootable.

Seems like the timing of your incident and mine may not be a co-incidence?

Let me know if you found a solution.. :stare:

nofam
22-12-2009, 12:15 PM
Hi Sadbuttrue,

I ended up doing a full rebuild; I found evidence of a Virut infection, which is pretty much the kiss of death for a Windows install, as it writes itself to every .exe on the system partition.

Try booting into the recovery console and rename/replace isapnp.sys from the install CD as Speedy says in his post.

The most practical option is to remove the drive and slave it to another clean system, and run a full scan with NOD32. Good luck!!

Blam
22-12-2009, 02:50 PM
I would do a repair install. Chances are, its infected more than just that system file...

Do it after you do a full virus scan

wainuitech
22-12-2009, 06:31 PM
If as nofam said its variant of the Virut infection - you will be a lot better off doing a complete reinstall of windows / programs the lot.

That virus, if it gets in is basically impossible to remove, as it does affect every exe and scr file on your PC. As soon as you remove it, another takes its place, even on a repair install.

Sadbuttrue
23-12-2009, 07:58 PM
Okay, this went from bad to tragic.

I have a WD passport elite, so I used it's USB interface to connect the "blank startup" HD to my working office laptop. Then thought the better of it and decided to do a full backup of my work laptop to the WD 500gig drive before moving files. About 30 minutes into the backup an odd popup in firefox that downloaded a file from some fake address "skyzkehter.com/aasdfa..." and WD Passport essentials Backup software crashes. Since it was automatically downloaded I believe it to be a .jpg or something.. not an exe. I only had a second to look before the freeze.

Anyways, had to restart due to crash and voila!

"No Operating System Found"

Now it has gotten serious. The work laptop has very sensitive data and the last backup I have done is Sep. Imagine losing all your data during a backup process?! I wasn't backing up any system files, just my documents, etc.

So I had to dig out an out PC and get it up and running.. now to use it to fix 2 non-bootable SATA hard drives!

My all important question:

How do I go about getting the files from the 2 other non-bootable hard drives backed up? Or at least my utmost important ones.. like outlook .pst file.

I have one healthy computer and presumably one healthy 500G WD drive along with usb interface.

The problem remains I had not run or moved any of the files from the original 'virus'd' hard drive to the work laptop, but it seemed to get infected just by matter of plugging it in..

Unless the 2 startup failures are somehow un-related?!

Please HELP!@

On this system I am running Mcaffee Security Suite with an expired license (the computer hasnt been started in a year).. On the work laptop I had Norton Antivirus network version with upto date virus definitions.

Do I need to purchase a new scanning software? This is my last working computer.. I can't mess it up this time..

Speedy Gonzales
23-12-2009, 08:05 PM
Connect them to a working system, Then copy whatever to it. I would get rid of norton and mcafee. Theyre both hopeless. Install something better, like NOD32, Avast, or MSSE. Whatever that thing was that downloaded, its probably malware or a removable drive worm/trojan or something. Scan those hdds with something better, (after you connect them to a working system), before you copy from them. I would take it offline while you copy the files across (from the stuffed hdds to the new one). Or boot into safe mode / networking, then get something like trojan remover first update it, scan. Then select all options under utilities. Then scan those hdds, once you connect them