Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

I get a BSOD when I try to install antivirus!!

Posted on 2010-01-07
37
Medium Priority
?
570 Views
Last Modified: 2013-11-22
Greetings,

I am trying to fix a computer that was infected with some viruses, I used the eset online scanner and found 19 viruses, then I used ad aware and removed all of the spyware that it found then I installed malwarebytes but it would not run. then I tried to install a antivirus program and everytime I do even in Safemode it goes to BSOD.
I ran the eset online scanner again and bit torrent and both said the machine is clean.

So what now?

Thanks
0
Comment
Question by:Maxonx
  • 18
  • 17
  • +1
37 Comments
 
LVL 22

Expert Comment

by:optoma
ID: 26206300
Download Combofix to desktop.If it does not run, redownload Combofix and rename it to fc.exe prior to saving it to desktop.
Follow it's instructions from following link.
Attach logfile here after

http://www.bleepingcomputer.com/combofix/how-to-use-combofix
0
 
LVL 22

Expert Comment

by:optoma
ID: 26206309
Could you also attach Eset's logfile>location:
C:\Program Files\EsetOnlineScanner\log.txt
0
 

Author Comment

by:Maxonx
ID: 26206333
This is vista!  Combo fix isnt for Vista.

I wish it was.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
LVL 22

Expert Comment

by:optoma
ID: 26206397
It does run on Vista, unless its 64 bit :)
0
 
LVL 22

Expert Comment

by:BitsBytesandMore
ID: 26206537
I would suggest that you first removed the hard drive from the current machine and plug it into another computer with MalwareBytes installed. Scan it from there.
Then place it back. You might need to repair the startup if it does not boot after removing the malware. You also might need to run from the command prompt:
sfc /scannow
To make sure all critical system files are present and not damaged.
After this, if the computer continues to give you problems you might need to do a clean repair install of Vista. Microsoft changed the way it names the repair install in XP to Upgrade Install in Vista. It also assumes that you must be able to be in Vista to run it.
If you need additional info on the repair install let me know.
Keep me posted on your progress.
Bits...
0
 
LVL 22

Expert Comment

by:senad
ID: 26208101
Your system,it seems,is still infected and some virus generated service
is preventing the installation or successful scanning of your drive.
You can not install programs in safe mode.That must be done
within the active system.
To accomplish this we must remove this rogue service and startup entries that trigger it.
To do this we must boot into safe mode.
Do you understand this far ?
0
 

Author Comment

by:Maxonx
ID: 26297665
Ok Sorry I havent replied..Ive been sick and was out of town on vaca, but heres the skinny now, I ran combo fix in safe mode and then when it went to reboot I get a BSOD with a stop error  STOP: 0X0000007E (0x080000003, 0X829F84AD,0X80405770,0X8040546C) and I tried doing the startup repair and it failed and then I tried running sfc/scannow from the C: prompt and it says "There is a system repair pending which requires reboot to complete. Restart Windows and run sfc again."
But it wont restart only gives the BOSD..
I ran a chkdsk /r and it completed but didnt seem to acomplish anything..

Thanks

0
 
LVL 22

Expert Comment

by:optoma
ID: 26297939
Is your machine 32bit or 64bit?

Try startup repair again and when it fails to repair system, opt launch System Restore.
Pick a date prior to running Combofix.

Once restored, manually create a restore point and note whatever name you call it.

If 32bit
Rerun Combofix in normal mode and attach its logfile after.
From above link. Read its proceedure carefully on Combofix's running
0
 
LVL 22

Expert Comment

by:optoma
ID: 26297967
Also attach Esets logfile:
C:\Program Files\ESET\ESET Online Scanner\log.txt
0
 

Author Comment

by:Maxonx
ID: 26297984
Tried that but There arent any restore points
0
 
LVL 22

Expert Comment

by:optoma
ID: 26298057
Ok, Any of these boot options work:
Last Known Good Configuration
Safe Mode with Networking
Safe Mode with command prompt
Safe Mode
0
 

Author Comment

by:Maxonx
ID: 26298601
Negative..tried them all, What about going into C:\Windows\winsxs\pending.xml and deleting the pending.xml ?

0
 
LVL 22

Expert Comment

by:optoma
ID: 26298932
That would clear any updates "stuck" but unsure of the consequences :(
0
 

Author Comment

by:Maxonx
ID: 26299793
Ok tried to delete the pending.xml and it deleted it but that didnt do anything, Is there away to delete the pending system repair?
0
 
LVL 22

Expert Comment

by:optoma
ID: 26301470
Launch System Repair again. If it fails try System Restore and select to pick an older System Restore point, if any.

Be careful not to select full computer restore or restore to factory image as all will be gone!
I came accross this article which has a few methods to try
http://social.technet.microsoft.com/forums/en-US/itprovistasp/thread/31ca7aee-2c6c-400c-aeee-bb00286d192a/
0
 

Author Comment

by:Maxonx
ID: 26304341
When I launch system repair and chose system restore it says "No restore points have been created on your computers system disk. To create a restore point open System proctection."



0
 

Author Comment

by:Maxonx
ID: 26307365
I used a Knoppix cd and recovered some files from the hd, Now is there anyway of deleting the pending system repair?
0
 
LVL 22

Expert Comment

by:optoma
ID: 26308490
From above link:Quote:

 After BIOS screen, hit F8 for the windows boot menu.
- Select the "repair" option (it is first on the list)
- Open a command prompt.

- Rename the following files:

 

C:\windows\winsxs\pending.xml C:\windows\winsxs\pending.old.xml

C:\windows\winsxs\cleanup.xml -> C:\windows\winsxs\cleanup.old.xml
0
 

Author Comment

by:Maxonx
ID: 26310308
I deleted the winsxs folder on accident ..lol

Can I replace this from the disc and what would be the cmd line for that?

Thanks
0
 
LVL 22

Expert Comment

by:optoma
ID: 26310388
I think it can only be replaced if the system boots correctly.
You can try a repair but I doubt it.

Since you have a backup a full system recovery maybe the only option :(
0
 

Author Comment

by:Maxonx
ID: 26310695
I think you are right about that and thats what I didnt want to hear..as I do not have the original vista home premium disc.

I wish there was a way to get rid of that pending system repair, I tried running sfc/scannow again and it said the same thing.
Thanks for your help!

0
 
LVL 22

Expert Comment

by:optoma
ID: 26311906
Whats the make and model of machine?
0
 

Author Comment

by:Maxonx
ID: 26313609
Hp Pavillion dv6000
0
 
LVL 22

Expert Comment

by:optoma
ID: 26314453
I think its the only option is to factory restore the machine.
You have your data backed up, which is good.
You will lose programs you installed, unless you have the cds to reinstall after factory restore.

When you go into launch startup repair is there an option to put machine back to factory settings from an image or something like that
0
 

Author Comment

by:Maxonx
ID: 26314998
yes there is..
0
 

Author Comment

by:Maxonx
ID: 26315492
Isnt there a way to go into bcdedit from cmd prompt and delete the pending system repair on reboot?
0
 
LVL 22

Expert Comment

by:optoma
ID: 26317448
Ok well full system recovery is there which is good.

This is from above link i gave.
Read through this and try from step14  onwards.
Reason is you dont have a installation DvD and winsxs is gone!

1. Insert the Windows Vista install DVD, and restart the computer.
2. Press any key when it asks you if you want to boot from the dvd.
3. Select your language, country, and keyboard type from the prompt. If you are in the US its probably already right.
4. choose "Repair your Computer".
5. Select your operating system from the list and click next.
6. on the system recovery options page, click Command Prompt.
7. Type regedit and press enter
8. Select HKEY_LOCAL_MACHINE. Don't expand it, just click the title to highlight it.
9. Click file and click load hive.
10. Locate the folder c:\Windows\winsxs.
11. Find the file named pending.xml.
12. Right click on the file and click rename.
13. Change the name from pending.xml to pending.old
14. Then navigate to the folder C:\windows\system32\config\components.
15. When prompted for a name "Offline_Components"
16. Open the registry HKML\Offline Components and delete the file AdvancedInstallersNeededResolving.
17. Then delete PendingXmlIdentifier.
18. Restart the computer and it should be fixed.
0
 

Author Comment

by:Maxonx
ID: 26317819
Ok I opened a cmd  prompt and I typed in C:\windows\system32\config\components but it says  " the directory name is invalid' So i tried C:\windows\system32\config\ and that worked then I typed in dir and components is there so is components.sav.. Well I typed in regedit and clicked on HKEY_LOCAL_MACHINE and then clicked on file and loaded the hive and components is there..I opened it with notepad but now what should I do?

Thanks
0
 

Author Comment

by:Maxonx
ID: 26318360
Right I think I got this but I need some clarification.. #15 when and how am I promted for a name?( thats not happing)
I foumd the files in 16 &17 Under hkey_local_machine_Components should I just proceed or do I need to make a new string called 'Offline components"?

Thanks
0
 

Author Comment

by:Maxonx
ID: 26318484
Also when I booted from knoppix I seen that there was a hp recovery partition could I use that to fix this?
0
 
LVL 22

Expert Comment

by:optoma
ID: 26318731
Sorry, start with step7 and load the hive.

Hp recovery partition will restore machine to factory settings.
0
 

Author Comment

by:Maxonx
ID: 26320293
Ok I did everything from #7 on down and rebooted and same results bsod then it reboots...This blows!
0
 
LVL 22

Expert Comment

by:optoma
ID: 26321015
Boot into Knoppix and grab ten recent minidump files to attach here.
Located at c:\windows\minidump

Also get Esets logfile:
C:\Program Files\ESET\ESET Online Scanner\log.txt
0
 

Author Comment

by:Maxonx
ID: 26324918
I just found out a friend of mine has a copy of Vista premium from dell and Im gona just reinstall it..
 
0
 
LVL 22

Expert Comment

by:optoma
ID: 26325264
No prob.
The recovery partition will do that for you and will have all drivers installed.
0
 

Author Comment

by:Maxonx
ID: 26327982
Vista is such a POS I cannot belive that microsoft was alowed to release it and get away with it!!

0
 
LVL 22

Accepted Solution

by:
optoma earned 2000 total points
ID: 26328059
In my opinion, its repair function is somewhat lacking :(

But Vista with latest service pack and other updates is stable.

If you could, can you get those minidumps and Esets logfile.
It may shed some light on why :)
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many admins will agree: WSUS is is a nice invention but using it on the client side when updating a newly installed computer is still time consuming as you have to do several reboots and furthermore, the procedure of installing updates, rebooting a…
It’s been over a month into 2017, and there is already a sophisticated Gmail phishing email making it rounds. New techniques and tactics, have given hackers a way to authentically impersonate your contacts.How it Works The attack works by targeti…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

572 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question