Can't boot into safe or normal mode, keyboard doesn't function during boot

[GeorgeT]

If I could get to a normal boot, I could run the usual suite of anti-malware software. But I can't get there. And when booting, my keyboard is blocked (it works fine mechanically) so I can't change the boot approach or launch Kaspersky.

Attached is the FRST.TXT file. At least I could run that.

What should I do next?

 

[kuttus]

Hi and welcome to the malwaretips.com forums!

I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:

• I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine!
• The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Refrain from running self fixes as this will hinder the malware removal process.
• It may prove beneficial if you print of the following instructions or save them to notepad as I post them.

Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.


Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.
<hr />

Do you try any other Keyboard?

 

[GeorgeT]

I don't have an extra keyboard available at home. I can borrow one from work today, if you think that would make a difference.

The weird thing is the keyboard lights up, but the PC doesn't recognize the input. But Windows Repair initiates during the boot process and I then exit out of it, the keyboard and mouse then work. I'm able to get to the command prompt and run FRST, for example.

And the keyboard only became disabled after I attempted to boot into safe mode.

So it's not the physical keyboard, it's something else.

So do you want me to get another keyboard still? If so, I won't be able to respond till tonight. And if another keyboard makes a difference, what should I do next?

Or is there something I can try right now?

 

[kuttus]

You are using a weird keyboard right? Wireless Keyboard may not work in Safe mode......

Try another Keyboard if possible.......

 

[GeorgeT]

No, I'm using a normal Dell USB multimedia keyboard - not wireless.

And again, it doesn't boot completely into safe mode -- the system hangs mid-process.

 

[kuttus]

Can you please try to run a scan with Farbar Recovery Scan Tool. You will need a USB (Flash) pendrive.

For x32 (x86) bit systems download Farbar Recovery Scan Tooland save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Click on Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the flash drive. Please copy and paste it to your reply.

 

[GeorgeT]

I already did that. It's attached to my first post!

Let me know if you need me to repost it.

 

[kuttus]

All those files in the log seems good only..... Do you try a system restore on the computer?

 

[GeorgeT]

I'm not sure how to do a system restore, given I can't boot into safe or normal mode. And I'm not sure if I can (all the windows restore points were deleted). I don't believe there is a partition with a restore section on it. How would I check or do that?

 

[kuttus]

<h3>STEP 1 : System Restore from Recovery Console.</h3>
<ol><li>Remove all floppy disks, CDs, and DVDs from your computer, and then <>restart your computer</>.</li>
<li><>Press and hold the F8 key as your computer restarts</>.Please keep in mind that you need to press the F8 key <>before the Windows start-up logo appears</>.
<em>Note</em>: With some computers, if you press and hold a key as the computer is booting you will get a stuck key message. If this occurs, instead of pressing and holding the "F8 key", <>tap the "F8 key" continuously</> until you get the Advanced Boot Options screen.</li>
<li>On the Advanced Boot Options screen, use the arrow keys to <>highlight Repair Your Computer</> , and then <>press ENTER</>.
<img title="Safe Mode with Networking screen" src="http://www.diy-computer-repair.com/image-files/repair-dual-boot-2.jpg" alt="[Image: Safemode.jpg]" width="539" height="292" border="0" /></li>
<li>Select your keyboard language preferences and click on Next. </li>
<li>Select your user name and type in the password, and then click on OK. </li>
<li>Select the option “System Restore and press enter. </li>
<li>Now Select one Restore Point and restart your computer to a date where your computer was working fine.. </li>

</ol>
<hr />

 

[GeorgeT]

OK - here's what I've done and the results:
- Ran CHKDSK again -- it found more disk errors that it corrected
- Ran CHKDSK again -- no errors
- Swapped to a different keyboard -- now the keyboard works all the time
- Ran Kaspersky Rescue Disk -- no issues found
- At this point, I'm still not able to boot into safe or normal mode
- Ran System Restore from backup on external drive
- NOW, able to boot in safe mode
- Ran Malwarebytes (full scan) -- found no issues
- Able to boot into Normal mode

However, system still appears to unstable. Froze on Windows Update for example requiring a hard boot.

I'm thinking that I have a hard drive that's dying, not a malware issue.

Do you agree? Or is there some other scan software that I should try?

 

[kuttus]

GeorgeT please take a back up of all of your important files on your hard drive ASAP... If it is something related to your hard drive we can prevent losing data...

STEP 1: Download and Run Windows Repair (all in one)

Download Windows Repair (all in one)

• Install the program then run it.
• Go to step 2 and allow it to run Disc check by clicking Do It
• Go to step 3 and allow it to run SFC
• Go to start repairs tab select advanced mode and click start.
•  Check the box next to "Restart/Shutdown system when finished" and ensure the following is checked along with the default checks
  1. Reset File Permissions
  2. Register System Files
  3. Repair WMI
  4. Remove Policies Set By Infections
  5. Remove Temp Files
•   Then click Start.
  

 

[GeorgeT]

Thanks, Kuttus for your help. I've resolved the issue.

I continued to have issues loading/running Windows, so I was unable to install a new program and run it. I replaced the hard drive with a new one, restored a system image from a month ago, and then attached the old drive as a slave to the new one. I was then able to transfer new & updated files since the backup to the new hard drive from the old one.

I then ran Western Digital's Drive Diagnostics on the old drive. It determined the drive was definitely defective and needed to be replaced. Thankfully, it was functional enough to get files off of it.

I also confirmed through scans that there wasn't any malware on the system.

Thanks again!

 

[kuttus]

Okay... So GeorgeT how's it working after the restore?

 

[GeorgeT]

It's working fine with the new hard drive.

 

[kuttus]

Okay........


Now that your PC is clean, I recommend you to create a new System Restore point then purge the old ones after.

For XP
How to create a Restore Point in XP
Delete all restore points except the most recent one

For Vista
Create a restore point
Delete all but the most recent restore point

For Windows 7
Create a restore point
Delete all but the most recent restore point - Click the Delete all but the most recent restore point link

---

Keep your system updated

• Keeping your programs (especially Adobe and Java products) updated is essential. Update Checker will notify you if any of your programs require an update.
• Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office product bugs and vulnerabilities.
• Please ensure you update your system regularly and have automatic updates on. You can learn how to turn Automatic Updates on here

---

I also recommend you to switch your antivirus program to a better one. Here are some suggestions:

• avast! 7 Home Edition - Don't use it with Online Armor
• Avira AntiVir Personal
• Microsoft Security Essentials

In addition to your antivirus, you need additional protection such as a firewall and behavioural blocker.

• Online Armor
• Comodo Firewall - If you are an advance user

Here are only a few suggestions that will improve your system security. Should you wish to allow us to make full recommendations and set your PC up with maximum security, please start a thread here. Our community of PC enthusiasts and experts will give you feedback and help you secure your system from future malware infections.

---

Internet Explorer may be the most popular browser but it's definitely not the most secure browser. Consider using other browsers with addition add-ons to safeguard your system while browsing the internet.

Firefox is a more secure, faster browser than Internet Explorer. Firefox contains less vulnerabilities, reducing the risk of drive-by downloads. In addition, you can add the following add-ons to increase security.

• KeyScramber - Encrypts your keystrokes to protect you against keyloggers that steals personal & banking information
• AdBlock - Disable/blocks advertisements on websites so you won't accidentally click on a malicious ad.
• NoScript - Disables Flash & Java contents to avoid exploits or drive-by attacks
• Web of Trust - Shows the website rating by other users and blocks dangerous and poor-rated sites

Google Chrome is another good browser that is faster and more secure than Internet Explorer by having a sandbox feature. Additionally, you can add the following add-on to Chrome to heighten security.

• AdBlock

---

Lastly, it is important to perform system maintenance on a regular basis. Here are a few tools and on-demand scanners that you should keep & use every 1-2 weeks to keep your system healthy.

• CCleaner
• Malwarebytes Anti-Malware
• Temp File Cleaner by OldTimer

Other than that, stay safe out there! If you have any other questions or concerns, feel free to ask

<hr />
What's next?

1. Bulild up your malware defenses by starting a new thread in Security Configuration Wizard forum.
2. Learn how to avoid malware by reading this article <a href="http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/">How to easily avoid malware</a>
3. Be an active member in the MalwareTips community!

My virus removal help is always free. Should you wish to show your appreciation via a donation, it will be much appreciated.​