Can't get into the BIOS screen.
I was working on someone else's Dell 8200 computer today. P4 1.8 . I installed a variety of antivirus software to help fix it. It's full of spyware and Norton Systemworks 2003 says it has a Trojan Horse that it can't fix. The red warning screen opens on boot up and will not close.
They had NO virus protection at all. No firewall, not even SP1!
I'll have to do a full reformat and reinstall of XP Home. But when I put the recovery CD in, it doesn't boot off the CD. Boot order must be wrong. But I can't get into the BIOS either! I tried restarting it 3 times while pressing the Delete key over and over. Nothing. It just loads up XP like it normally would.
So how can I get to the BIOS to set the boot sequence? Type some special command after Start << Run? Pull the CMOS battery for 30 seconds? Is there a reset to default jumper on the motherboard somewhere? I wasn't able to open up the case today. I'll have to do it next time. It may have had a recovery floppy disk, I didn't look for it today. They were so worried about saving some photo files that we couldn't even FIND that I have to wait until they call me to come finish the work.
I've only worked on 2 computers for other people so far, and it amazes me how they can know NOTHING about spyware / viruses / pop up ads until their computer won't run anymore.
They had NO virus protection at all. No firewall, not even SP1!
I'll have to do a full reformat and reinstall of XP Home. But when I put the recovery CD in, it doesn't boot off the CD. Boot order must be wrong. But I can't get into the BIOS either! I tried restarting it 3 times while pressing the Delete key over and over. Nothing. It just loads up XP like it normally would.
So how can I get to the BIOS to set the boot sequence? Type some special command after Start << Run? Pull the CMOS battery for 30 seconds? Is there a reset to default jumper on the motherboard somewhere? I wasn't able to open up the case today. I'll have to do it next time. It may have had a recovery floppy disk, I didn't look for it today. They were so worried about saving some photo files that we couldn't even FIND that I have to wait until they call me to come finish the work.
I've only worked on 2 computers for other people so far, and it amazes me how they can know NOTHING about spyware / viruses / pop up ads until their computer won't run anymore.
0
Comments
Try F1, F2, Insert, Backspace, Home, F9 and F5.
Uhhhhh you don't have to format either. Install the OS to another directory. Just name it soemthing differant. Then run the virus scan and he doesnt lose any documents etc..
The dell should still brfiefly show the bios setup key on boot. Try f10
I will try F2 next time, and other keys if F2 doesn't work for some strange reason.
You have a trojan horse that possibly was ID'd but not killed-- i.e. the
AV could not DELETE or REMOVE the trojan from the file. One way is to see if Symantec has an article about how to remove the trojan that NAV\Symantec AV detected (by virus name and\or FILE name) online in its AV knowledge base\encyclopedia.
So, let's think about ways to kill this thing. Have another HD handy???
If so, install both XP and an F-Prot AV trial on that (while the infect drive is out of the box or not connected at all). See if you can run the new HD as master, and the old one as slave, AFTER you have set up the XP and F-Prot trial on the new HD.
Then, run F-Prot on all the data on both HDs. It should find the same file name, different trojan name. Since the slave drive is essentially DATA to the new XP, you can now kill the file with F-Prot.
HERE's why this works:
First, the NAV could not kill the file because the Trojan horse managed to system register itself, as an OS protected process. To undo this system protection, and not have your new copy of XP infected if the Trojan let someone feed the XP instance that is now corrupt (on old HD) probably other viral things, you need the new instance system protected with good AV (and F-Prot is VERY good) AND you need to NOT be running a system off of the registry that has the keys in it that protect this thing. So, you build ANOTHER instance, on a different HD first. THEN you stick AV on it. THEN you hook up the corrupt HD worth of system. THEN, since the registry on the corrupt HD is NOT running, you can work with the file as if it is not system protected-- because it is not, under this system scenario.
One other major thing: Most of the 8000 series from Dell come with a set of recovery CDs. They do NOT come with a recovery floppy any more, and do not need one. IF you are doing system recovery, and you build an XP from those on a new HD, you can install AV with the drive that has the corrupt mess totally not connected to the computer. Dell can and will ship recovery CDs if ownership of computer is proven to them-- there will be a fee if the box is out of warranty. What I commonly do is to sell a HD upgrade while I am at it, given that the HD is almost full that would be a good idea here also.
Once the pictures are found, you can move them to new HD unless one or more actually is infected with something (remember I said to scan BOTH HDs with F-Prot), then wipe and reformat and reconfigure the old HD for just data use or for backups or some of each. I'd work the scenario to sell a HD and recover the box, and charge a good $80.00 capped fee for recovery alone, were I doing it. One reason for the fee is to emphasize to folks that much time and effort is needed to recover an unprotected box adn in fact is worht lots of money becasue it takes SKILL that is worth money to recover without wiping and losing everything on the HD-- they will be more likely to in fact make an effort to really protect thier investment if you explain how to recover the computer without massive data loss and in fact if they want to, let them watch how you go about it and what you have to do to get the computer back to normal. Oh, F-Prot runs $29.95 a YEAR for updates of definitions, heuristics, and the ability to get program updates free during that year.
One more hint:
The latest F-Prot trial is part of my software tool kit here, adn I run it here on XP. IT behaves on XP, XP SP1, and XP SP2. It does BOTS, trojans, worms, plain old viruses, and a bunch of malware, and knows Windows and Unix virals and a bunch of malware. My whole family uses F-Prot, as I got a bulk license for it. I will be renewing that license. I will be reselling F-Prot every chance I get(I've used NAV, McAfee, and Trend Micro's PC-Cillin and F-Prot beats them all as to what it does for less cost). I would suggest if you or your customer like it, you or your customer talk to the Folks at RAE Internet (up in New Jersey) about end client versions, NOT server versions, for what you want to do. They have it on CD.
RAE Internet will get support for you at need, you can go through THEM for support. Thier sales went through the roof since they got CDs of F-Prot and they are a major AV and antispam vendor for servers also. They are a US distributor for F-Prot, and the customer number they give you or your customer will let you or your customer get download access to new versions of F-Prot, and those versions will now upgrade onto older ones. Viral update checks and autoinstalls can be run every 12 hours, and that is what I do here, automatically.
Turn on (or restart) your computer.
When the blue Dell™ logo appears, press <F2> immediately.
If you wait too long and the operating system logo appears, continue to wait until you see the Microsoft® Windows® desktop.
http://support.dell.com/support/edocs/systems/dim8200/syssetup.htm#109711
Main support page
http://support.dell.com/support/topics/global.aspx/support/en/product_support_hub?c=us&cs=19&l=en&s=dhs&~ck=mn