Can't get past the BSOD

[Horchheimer]

Oops... running it again. Thank you.

[Horchheimer]

Ok, I've opened up the boot.ini and made my changes, but what I wasn't 100% sure on whas how to save it, so I right clicked the top bar and saw an option that said "Remember.." and at the bottom of that drop down there was an option to "Save on close" which I checked. So I closed it when I was finished, and then I reopened the file to see if those changes were made (the removing of the /SAFEBOOT:MINIMAL text... by the by, ALTERNATESHELL text was not at the tail end of that), now here's what I'm seeing...

A window opens up and it looks like just some sort of DOS editor, but there's a message underneath that reads the following...

E325: ATTENTION
Found a swap file by the name "/medi/hda1/.boot.ini.swp"
owned by: knoppix dated: Tue Nov 10 11:11:23 2009
file name: /media/hda1/boot.ini
modified: YES
user name: knoppix host name: Knoppix
process ID: 5247
While opening file "/media/hda1/boot/ini"
dated: Sun Nov 8 14:53:30 2009

(1) Another program may be editing the same file.
If this is the case, be careful not to end up with two
different instances of the same file when making changes.
Quit, or continue with caution.

(2) An edit session for this file crashed.
If this is the case, use ":recover" or "vim -r /media/hda1/boot.ini"
to recover the changes (see ":help recovery").
If you did this already, delete the swap file "/media/hda1/.boot.ini.swp"
to avoid this message.

Swap file "/medi/hda1/.boot.ini.swp" already exists!
[O]pen Read-Only, (E)dit anyway, (R)ecover, (D)elete it, (Q)uit, (A)bort:


How should I proceed?

[arraknid]

Close that window, then check your changes were saved. If yes, exit and shut down. Remember to remove the USB device and reset your boot order to the HD before restarting.

Remember also, that you have the option of saving any important files whilst you are accessing Windows.

[Horchheimer]

Those changes aren't saving.

But I just noticed that there's a second file in the windows folder called boot.ini.SAB too.

[arraknid]

You need to change the read/write mode. This will explain the steps to do that.

[MrDarn]

Also, Vundo can be a begger to completly get rid of.

I seriously urge you to seek advice from a professional helper in one of the many spyware/malware removal forums available. We have one such forum right here, but we are quite busy, as arraknid has mentioned.

[arraknid]

@MrDarn

Check out difficult post thread in SFD.

[Horchheimer]

Read the provided link, but I'm not seeing the following...

i. Right-click your windows drive and press “mount”.

when i right click, I see a little window pop up with three lines that read as follows: Top Line "Hard Disk", Middle Line "Unmount /mnt/hda1" and there's a little square next to that, Bottom Line "Properties". Anything I click on, has no response except properties and when i open that it reads as follows;


Config : /home/knoppix/.xtdesktop/hda1.lnk

table Icon
Type: Program
Copation: Hard Disk\nPart. [hda1]
Command: mount /mnt/hda1 ; rox-filer /mnt/hda1
Icon: .xtdesktop/harddisk.png
X: 140
Y: 150
MenuCommand1: Unmount /mnt/hda1 : /mnt/hda1
end

Save Cancel


ii. Right-click the drive again and press “change read/write mode” in order to be able to edit the boot.ini file.

Right-clicking shows me nothing different. However, when I look in the drive and check the boot.ini file's properties I see all the basic information, but in the permissions boxes, everything is checked as Read, Write and Exec for owner, Group and World. The only boxes that are not checked are SUID, SGID and Sticky.

[arraknid]

Sorry, I should have explained that the Knoppix text editor is pretty basic and doesn't work in the same way as, for instance, Wordpad or Notepad.

Modifications to text are made by moving the small square cursor to the end of the line to edit and pressing the X key to delete each letter. Any changes can be saved by pressing ZZ. Moving the cursor can be done via the mouse or by using the arrow keys.

I found the user manual for the text editor - called VIM, which may help.

See if that helps.

[Horchheimer]

Ahhh... Ok.

Just "X'd" the safeboot and "ZZ'd" the file, then ZZ'd everything.

Pulled the jump drive out when indicated to, and restarted, I'm finally passed the BSOD Thank you arraknid!

Ok, so when it came back up, I've got two error windows.

RUNDLL - Error loading c:\windows\system32\makizomo.dll The specified module could not be found"

LOGON.EXE - Windows cannot find 'logon.exe'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.