PAV XP no boot

Dadcc

PAV hit my daughters machine July 14. I have been trying since then to 'bring it back.' Popups could not be removed, or PC would freeze. Safemode would do no more than say it on DOS screen. No SFC, or anything else. Every time it was booted, it would have a little more damage. Finally I got it to 3 popups (Explorer, View mng and Internet Explorer errors. Do you want to send reports [no because that would freeze machine]). I was able to do disk cleanup and CCleaner, only. SpyDoctor, Zenturi, REVO, SAS, AVG would either not initiate, or claimed expired. Malware protected itself. I have for years been able to repair hits to my daughters laptop, but not this one. Last step required Repair from XP CD. Spent hours with decent hearted tech at Dell who basically read off Geek Squad sheet. H/D was rebuilt, checkdsk and other scan ran successfully then on to the dreaded REPAIR. I did that before calling them (they said they would walk me through when ready, but I thought it seemed safe). Repair ran from third screen and all checked out OK. When I got to end, disc was left in to reboot from. Screen read same setup menus again. Enter to upgrade, R for repair and F3 to exit. I was concerned upgrade meant NEW so I exited. Prompt said XP was not installed. I continued. Desktop (NORMAL) does not come up any longer. Cycles from Dell icon screen to DOS screen (flashing cursor top left) and then to Windows XP load screen. Nothing to load. Friend who is a techie said I did not overwrite original settings, BUT I used an OEM made for Dell and should have used XP Home Edition CD (Dell said it was the same). He said at last window click on ENTER for Upgrade and machine will connect XP so it will be seen at load link. ORIGINAL (WHAT I DESPERATELY NEED) settings and installation will boot back up and without the malware. Do you agree? School in session for a week now and no laptop to use. Dell says they can do no more, but talk me through partition to access (not boot to) existing data. Microsoft virus service cannot help me because of OEM. I NEED NORMAL BOOT TO MY DAUGHTERS MACHINE. Can you help? Is Upgrade what I should click on? Will I not perform a new installation? Daddy has to be the hero again.

Thrax

Welcome to Icrontic.

I admit I had significant trouble following what repair steps you undertook, so I'm providing a solution that will get you to the data and get Windows back on the machine in less than 3 hours.

#1: http://icrontic.com/articles/easy_data_recovery -- This guide will teach you how to hook up your daughter's laptop hard drive to another PC. Spyware is not infectious, so you have no risk of damaging the PC you connect it to. From there, you can pull all of her data off to the hard drive on the clean PC.

#2: Reinstall her drive into the laptop and use the Dell OEM recovery CDs to restore the PC to its factory state. Nothing on the drive matters any more, because it has all been backed up to a secondary PC.

#3: Once the drive has had Windows installed, once again connect it to the secondary PC and move the data back onto the drive.

Realize that any applications that were installed on the PC will be wiped out by this process. Any programs you copy to the secondary PC will probably not function when they are copied back, but all the data (pictures, movies, music, documents) will work just fine.

Here are list of locations and methods to recover data people commonly used. This information is from our "Reformatting Windows XP the Right Way" article:

<ul>
<li>If you use Firefox, Mozilla outlines a <a href="http://support.mozilla.com/en-US/kb/Backing+up+your+information&quot; target="_blank">method</a> that can be used to store and restore your profile in the event that a utility cannot be used.</li>
<li>If you use Internet Explorer, your favorites will be backed up when you archive the user profile folders in the Documents and Settings directory as described below.</li>
<li>If you manage your mail with Outlook Express, Microsoft <a href="http://support.microsoft.com/kb/188854&quot; target="_blank">outlines how</a> to find and store this information as a backup. Move all of the data uncovered with their walkthrough to the appropriate folders you've created on your external disk.</li>
<li>If you're an iTunes user, the program features the ability to store iTunes files to CD or DVD, but it's an option you cannot access at this time. Instead, follow <a href="http://uneasysilence.com/how-to-backup-your-windows-itunes/&quot; target="_blank">these instructions</a> to migrate the information from your internal hard drive to the external disk.</li>
<li>Back up the <strong>My Documents </strong>folder for each user account on the system to save critical documents, pictures and other files that typically get stored here. To do this, navigate to the <strong>Documents and Settings\USER ACCOUNT NAME\My Documents </strong>folder, where "USER ACCOUNT NAME" is the login name that user uses to access the Windows desktop. Move the the contents of each user's My Documents directory to unique folders on the external disk. After the Windows installation is finished, each user's data can be copied back from the external drive.</li>
<li>Don't forget any additional information like pictures, saved games or financial information. These will be wiped from the system throughout the course of this guide.</li>
</ul>

Dadcc

Personal Anti Virus (Innovagest 2000/Spain/Russia) is a worm that hunts information. It does not allow you to repair anything. If you do not buy it's program (and provide personal information) it slowly corrupts your drive, starting with loss on internet access. It force downloads onto your h/d from a site you visit. Facebook (the site my daughter was on) takes no responsibility for what happened. Your first symptom is an icon PAV on your desktop (and folder in Program Files) and almost immediately follow the pop ups. "You have a virus." "You have a malware." "You have this virus which can only be removed via our upgrade (which you must buy)." It took repeated re boots to test what I could do. I learned to minimize pop ups and remove others. At first I was unable to use Safemode, then I was. I could not do defrag, but did disk cleanup. I was able to use Crap Cleaner. Could not use nCleaner, or any anti virus software. While on desktop, PAV is not listed in add/remove. The folder is in programs, but deleting it brings other issues. AFTER checkdsk, rebuild and repair (all scans show fine), I am not schooled in appropriate boot language. Thank you for your kind and instant reply, but I cannot RE load a new version of XP. I need to get my daughters ORIGINAL settings, her machine back to her. Not to get to into it, but it is self esteem issue. She is shy and private and her PC was her window to the outside as it is for many teenagers. She was proud of what she did with it and on it. She has learned and done things I could never teach her. She is disappointed at herself for what happened and I have told her it is my skill that is at issue and she did nothing. I am disabled and use to repair PC's as I could. I do what I can now. I cannot afford to do much but what I have for the last few years. I hate what this company has done. I have read over 80 documents about PAV and nothing resolves it, or REPORTS IT. Thank you, again.

Thrax

Fortunately PAV isn't a worm at all, it's just a generic spyware application that masquerades as a legitimate antivirus application. So the privacy of her information is completely safe. It also doesn't slowly corrupt the hard drive. It's just particularly good at what it does.

I hate to say the failed Windows repair installations had far more to do with the damaged state of the Windows installation than the spyware could ever do.

At this time, I must ask: Do you have a *standard* Windows XP CD that matches the version currently installed? Not a Dell recovery CD or anything, but a real Windows XP CD? That's the only thing that could potentially recover the OS to a state where further repairs could be done.

And there is a fairly simple PAV removal guide, too: http://www.bleepingcomputer.com/virus-removal/remove-personal-antivirus

Personal Antivirus is a rogue anti-spyware created by company named Innovagest 2000 and is a clone of General Antivirus and Internet Antivirus Pro. This program is advertised through the use of Trojans that display fake security alerts on your computer. These alerts will contain messages stating that your computer is under attack or that malware has been detected running on your computer. When you click on these alerts, Personal Antivirus will be installed on your computer and automatically be configured to run when you start Windows. When running, it will scan your computer and display a variety of infections that cannot be removed unless you first purchase the program. In reality, though, these infections are all fake and are only be shown to scare you into purchasing the program.

Nate_LapT

I hate PAV, I've been fixing a clients pc for the past few days. The recovery was a partition which ended up having 1mb free so I've been scanning it with my hiren 9.9 cd over night. seems clean. Now I just have to restore the clients data and clean that.

I hate AV2008 2009 pav

Nate_LapT

bleh, guess I could of ran malware bytes and probably fixed it eariler.

Dadcc

Thrax wrote:

Fortunately PAV isn't a worm at all, it's just a generic spyware application that masquerades as a legitimate antivirus application. So the privacy of her information is completely safe. It also doesn't slowly corrupt the hard drive. It's just particularly good at what it does.

I hate to say the failed Windows repair installations had far more to do with the damaged state of the Windows installation than the spyware could ever do.

At this time, I must ask: Do you have a *standard* Windows XP CD that matches the version currently installed? Not a Dell recovery CD or anything, but a real Windows XP CD? That's the only thing that could potentially recover the OS to a state where further repairs could be done.

And there is a fairly simple PAV removal guide, too: http://www.bleepingcomputer.com/virus-removal/remove-personal-antivirus

No. OEM reads DELL Operating System Reinstallation CD Microsoft Windows XP Home Edition Including Service Pack 1/2002 (along with a note: "Only use this CD to reinstall the operating system on a Dell computer". Dell said they have none to send me since Microsoft stopped manufacturing them. They kept asking me about using the CD to install a partition. EVEN if I get the original CD, I need to know what instructions (first Repair screen, Recovery Console, or third screen after 'F8' license agreement acceptance screen,or? And what to do at end of disk/repair process) to follow. Is "Upgrade" acceptance of Repair, or a NEW installation? One person was kind enough to offer "Leave the CD in and do not try to take it out." "It will continue to ask for input and eventually leave repaired O/S and boot to Normal screen". Right now, the CD is not seen. I have to press the F12 key and go from there. Thank you for sticking with this. I am afraid to touch the Repair part of anything now.

Thrax

That CD will work for this task.

Insert the CD and perform a REPAIR INSTALL. Follow this guide: http://pcsupport.about.com/od/operatingsystems/ss/instxprepair1.htm

If the repair install does not work, there is no way to rescue the current installation of Windows. The data will need to be archived, and the OS will need to be reloaded from scratch.

Dadcc

Nate_LapT wrote:

bleh, guess I could of ran malware bytes and probably fixed it eariler.

The sentiment is appreciated. Such repairs should not be at the verge of
destroying someones original settings. I had a CD with SEVERAL virus/malware applications and it would not allow (if it read the CD) them to be installed and if it did (Spyware Doctor) would not allow the engine to initialize AND existent installed such software would come up as Expired (which I don't think was accurate). The biggest issue toward information and repair: NO internet (had to use CD drive and no updates, which some such apps require even for a free scan).

Dadcc

Thrax wrote:

That CD will work for this task.

Insert the CD and perform a REPAIR INSTALL. Follow this guide: http://pcsupport.about.com/od/operatingsystems/ss/instxprepair1.htm

If the repair install does not work, there is no way to rescue the current installation of Windows. The data will need to be archived, and the OS will need to be reloaded from scratch.

Respectfully (I apologize if I misunderstood), why ask me if I had the MS CD? The repair did not work. I did not exit correctly and I did not install a new O/S. RE repairing only brought the same screens. So if I did another RE repair, what would I select to exit? Enter for the Upgrade, or F3 and leave the CD in for it to boot from, often, until it loads? Please let me know if the images well received?

Thrax

Ah, I see.

Unfortunately, the repair install procedure that did not/cannot complete (which I believe you originally talked about) has left the PC in limbo. There is no possible way the current installation of Windows can be recovered at this point.

I'm sorry. You'll need to grab the data and start over. I wish there was another way.

Nate_LapT

Dadcc wrote:

The sentiment is appreciated. Such repairs should not be at the verge of
destroying someones original settings. I had a CD with SEVERAL virus/malware applications and it would not allow (if it read the CD) them to be installed and if it did (Spyware Doctor) would not allow the engine to initialize AND existent installed such software would come up as Expired (which I don't think was accurate). The biggest issue toward information and repair: NO internet (had to use CD drive and no updates, which some such apps require even for a free scan).

I could of used a live cd but all my live cd's dont seem to have malware bytes on em :\ guess I need another. either way the system is almost restored in my case, I just need to finish pushing data back to the box and restore as many settings as I can.

Your system on the other hand I hope you grabbed all the data before you tried restoring windows. some recovery options format the drive before it reinstalls. If you were trying just a repair I dont think that would help much with a virus. maybe enough to install a scanner after and work from there.

Dadcc

Thrax wrote:

Ah, I see.

Unfortunately, the repair install procedure that did not/cannot complete (which I believe you originally talked about) has left the PC in limbo. There is no possible way the current installation of Windows can be recovered at this point.

I'm sorry. You'll need to grab the data and start over. I wish there was another way.

Since 'Normal' portal gone, thought I would play:

F12 to CD / Enter / F8 / R / process end nothing selected and boot after countdown

Files deleted and reinstalled (Repaired) successfully

Cycling (Dell screen / DOS screen / Windows XP boot (loading) screen)
continued about 25 times when I shut it down. It WAS trying to find those
files needed.

Tried on/off for several resets. Nothing.

Fan would not turn off (Bin / Power lights off / Battery at yellow) so had
to remove A/C and battery. Fan shut off (thought I somehow damaged
hardware that passed diagnostics).

Remembered (why not try) switch/remove RAM (to reset?). Did so and
did so and nothing.

Computer with CD in tray and ready to cycle again is off.

Still think there is something I can do to reestablish 'initialization/portal.'

On first (when it repeated Repair) effort I selected F3 (If you Exit you
will not have Setup Windows XP and will have to rescan disks) AND removed OEM CD. I think the F3 did it.

Since the CD would not have ejected if should not (I can dream) AND F3
was available instruction, still think BOOT may be in need of repair (even
though it was done).

No need to respond. I understand your postition. Anything (since, again
that portal seems closed) should come to mind, please let me know.

Again you have been more than kind to offer any help and thank you.

Chris.