Windows stops loading

First off this isnt my computer... i am working on it for a friend of family (like I always do) and well they were hacked... they had no administrator password... they got hacked.. and the hacker added the administrator password, I took the Original SAM file and put it into place (from the Repair folder) everything worked fine... then when i restart when I added a password to it the Windows logo showed up... then the screen went blank
After being freakin sick of this computer by now and just wanting to leave, I formated reinstalled windows and all seemed well... installed all the updates... restarted... saw everythin worked, and left...
They restarted the computer and BOOM it did the same thing!! I can get into safe mood but I can not do it in "normal" mood

this does have SP2
This is Windows Xp Home

This computer had sp2 on it for a month, before. WTF IS GOING ON! I can not figure it out? Im starting to think Its internal!

REPLY ASAP

This computer already had sp2 on it with no problem its something else

had you installed any new software or hardware before the computer crashed????
......when you injected the SAM file you tripd a windows security feature, that is why it did not reboot the first time.....

After i injected the sam file it did work but when i restarted it did it
then now that I FORAMTED and its doing again

Quote:

---

i'm starting to think its internal

---

this could very well be, you see when when you power on, your post is ran. but when windows is loading it runs its own little proccess for detecting and setting up hardware. so if it is intearnal you need to get your hands dirty (not litaraly, you better wash them and proply ground yourself).... unplug the computer....

well i'm sure you know what to do. but if you need further instruction let me know...


<edit>
sorry for this post i was under the impresstion that he can't enter into safemode.... my screen reader (yes i am blind) talks a little fast. i just slowed it down so i could understand it better.
</edit>

JAsoN74185

Could it be hardware? Yep, however, judging by what you have mentioned thus far I don't believe so!

You said it was hacked you formatted and re-installed it worked you added the SP's and then it wouldn't boot into normal. However it could boot into safe mode. That doesn't necessarily indicate a hardware problem.

So I don’t believe you're at the stage of jumping in and ripping everything out and changing parts out. You can still boot into safe mode and there are a few things you should try first. Did you install any other programs other than XP, like MS Office, AV’s, Spybot, etc.? They could be the source of your woes as well. Conflicts, programs like your AV interfering with boot, etc.

So boot into safe mode and remove all programs you don’t absolutely need in startup, to make it work. Clean up the temporary files. Run chkdsk and scan also. Might have a bad sector that's causing the problems but you won't know that without going through the process. Defrag the HDD. Give it the once over and then try a normal boot. Let us know everything that you have done on the software side of this.

And of course there is the possibility of hardware and a software issue happening at the same time. Heat, issues with memory could be surfacing and you can always try and reseat the memory sticks. But if you open it up, check all connections on your ribbon cables, fans, etc.

cheers

edit: Here are some other definite possibilities:

Quote:

---

Installing Microsoft Windows XP Service Pack 2 on a PC with a "Prescott" CPU and certain chip sets can cause it to fail to reboot completely. The problem can be solved with a workaround or a BIOS update....

http://techrepublic.com.com/5100-6268_11-5330486.html

---

Quote:

---

When Windows fails to boot it is normally caused by you installing a program or device and it has caused a conflict with one or more other programs. This will no doubt give you plenty of heartaches if you're not certain which program caused Windows to not boot up.

http://www.techtutorials.com/tutoria...problems.shtml

---

if you say he got hacked then something else that might have happened is the cracker placed some malware in your MBR maybe...or a place that a format doesnt whipe out......if alll the above listed ideas fail i would try low level formating....that way EVERYTHING is gone.and your sure of it

Have you tried a logged boot up?

You can investigate the boot.log file to see where it stops?

This might lead you to your problem, it's not a definate, but worth trying!

As hexadecimal suggests, it may be worth re-writting the Master Boot Record (MBR).

Do let us know how you get on, one way or the other. It would be useful to make a note of the steps you've followed so you can post detailed information and as a reference for yourself.


Tip Try to be methodical in your approach. Create a check list and cross them off as you go.

Good luck.

It seems you have all the advice you need here...So I have just one quick comment.

About a year ago, I had to format and reinstall XP with SP1 for the company I was working for.
I did everything by the books, but still when I was done and had to restart...the login screen came up and it still had the original user accounts on it. I formated again, and still the same thing. Finally I decided to go with the low level format, and everything worked just fine. I have never seen this since then, but it does seem to indicate that some form of glitch is present.
I am curious, was your partition FAT32 or NTFS? I'm asking this because for various reasons relating to the way NTFS partitions handle the MBR, I believe this only happens on non-NTFS drives...So I would go ahead and try some of the ideas posted here and if that doesn't work
try a low level format...

Good Day

The term "low level format" of today is not what was meant in the past. The old process employed eons ago was on MFM hard drives and somehow the term was carried on. We should actually call it a “Zero Fill” . And there are numerous tools available for the process.

Eraser
http://www.heidi.ie/erase

Clean Disk Security (shareware)
http://www.soft32.com/download_8448.html

BCwipe (free)
http://www.pcworld.com/downloads/fi...fid,6270,00.asp

Cyberscrub (15day trial)
http://www.cyberscrub.com/homegoogle.html

Quote:

---

IDE HARD DRIVES

IDE hard drives can only be properly low-level formatted at the factory. All IDE drives have control information on track 0 or -1 that only the controller can read. This information includes bad track information, head skew factors and zone sector information. Fortunately, all newer hard drives only operate in a translation mode, so we can successfully do a format that could be more properly called a mid-level format. I don't know of any virus that can infect the low-level format installed by the manufacturer.

The reason for this is twofold:

1. All hard drives are initially formatted in native mode, and all, except the oldest IDE drives, operate in translation mode. The special tracks containing information specifically for the controller cannot be accessed in translation mode. Even if you could access this information, the BIOS and operating system would not be able to read the hard drive, as they cannot handle Zoned Bit Recording.

2. All computer viruses are programs. They may be Java script, Word Macros, or machine language. They must be run on top of the operating system. The operating system cannot access your IDE hard drives, except when the drives are in translation mode.

http://www.ameriwebs.net/groupworks/

---

If he has a MBR problem, I just wonder what FIXMBR from a recovery console and your XP CD would do?


cheers

Let me clarify a little before this thread get's of topic. I'm not saying that it is definatly an MBR problem, only that if it is caused by some form of residual data thats left over from a previous installation (Which is possible, but not that likely), it would then be most certainly related to the MBR. As far as i'm aware this would be the only place that data could survive a format. That is assuming the computer was completely cold booted to negate any data in RAM, and nothing non-factory was in any removable media (like a floppy).

anyone got AIM? PLEASE IM ME on Ecko072unltd

There could be many issues at hand.

One makes me believe its the Video card. Reason being it locks up on bootup but not in safe mode, see safe mode runs at a different bit rate so less load on video card but when you boot normally there could be card problems.

My next thought would be memory dump
if you check the dump file you might be able to determine if its memory fault

My last Idea is power issue, was there any new hardware added to this box or is it still stock?

See I don't really believe you have a hacker issue or a virus/ worm issue unless it was a boot virus like monkey http://www.computerhope.com/monkey.htm but this is somewhat impossible to get these days with virus protection installed.

I also don't believe its a software issue unless the SP2 packet found a bad key and now locks you out (unlikely) but possible.

I have had issues before with bad motherboards where I was able to install w2k but when I tried to install the updates it locked up. Older P3 833Mhz junk

But this is the joy of being a Information Technology Specialist, rip it apart and test new hardware to see if this is a hardware issue, (not that hard to change an AGP card or RAM if you have it) and if its not the hardware go thru the motions again installing the OS
steps:
1. format HD using dos disk A:\ format C:
2. incert XP CD and Reboot
3. choose to reformat HD with XP disk and choose NTFS format
4. install your AV and FW before connecting to internet
5. update AV and FW and then the OS
6. choose to make a Restore point at this time.
7. continue to add other personnal software.

Now you may be asking yourself why did I format using a DOS disk and then again with the XP disk. well for one I wanted to be sure you are playing with a clean slate and two it doesnt hurt to format more than once. also sometimes when you format with the XP disk you wont have to reboot and if there is a HImem virus then your efforts are all for nothing. HImem is a location on your Memory where other 32 bit programs are stored and its also a great place for a polymorphic virus to sit.

So check it out and tell your clients that password protect next time. also look into a password reset disk. you can make one using the XP disk or there should be a linux version somewhere on the internet http://www.petri.co.il/what's_the_password_reset_disk_in_windows_xp.htm