Author Topic: Deleted consrv.dll - cannot start OS ( variant of MAX++ virus)  (Read 14216 times)

0 Members and 1 Guest are viewing this topic.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Deleted consrv.dll - cannot start OS ( variant of MAX++ virus)
« Reply #15 on: November 06, 2011, 06:29:47 PM »
If you do not have the disc then download this iso from here http://download.digiex.net/Apps/WindowsRecovery/WindowsVista64bitRecoveryDisc.zip

Using your burning software burn it to a bootable disc

mishura

  • Guest
Re: Deleted consrv.dll - cannot start OS ( variant of MAX++ virus)
« Reply #16 on: November 06, 2011, 10:45:57 PM »
I have the disk.It's just that chkdsk is extremely slow

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Deleted consrv.dll - cannot start OS ( variant of MAX++ virus)
« Reply #17 on: November 06, 2011, 11:54:38 PM »
Quote
CRCDISK.SYS identifies itself as a "Disk Block Verification Filter Driver" and was written by Microsoft. It does CRC checking on data being read off the disk.
Unfortunately it is quite slow as it needs to check all sectors on your drive.  The above is an explanation of what that file does

mishura

  • Guest
Re: Deleted consrv.dll - cannot start OS ( variant of MAX++ virus)
« Reply #18 on: November 07, 2011, 04:54:10 AM »
ran chkdsk twice, but sfc /scannow give an error - windows resource protection could not perform requested operation.

reboot, tried again, - same error. I tried to restart box in safe mode - restarts again after crcdisk

mishura

  • Guest
Re: Deleted consrv.dll - cannot start OS ( variant of MAX++ virus)
« Reply #19 on: November 07, 2011, 06:36:40 AM »
I just checked and there is still windows/system64 directory exists ( which I renamed to rename_system64_rename ). It has files with the identical names to the files in system32 and syswow64, but different timestamp. Can this prevent me from running sfc /scannow?

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Deleted consrv.dll - cannot start OS ( variant of MAX++ virus)
« Reply #20 on: November 07, 2011, 08:31:10 PM »
No it should not affect it as you are running from the CD

If sfc does not work from the disc I can see no other option than a reformat
You can use the Reatogo desktop to backup all your files...

mishura

  • Guest
Re: Deleted consrv.dll - cannot start OS ( variant of MAX++ virus)
« Reply #21 on: November 08, 2011, 06:31:07 AM »
no problem.. Thanks for the help anyway