My Windows has a virus

I

IRAY

Bit poster
I've been running Windows XP on Parallels 3.0 for months with no problem. But last week I woke to find my Windows frozen and I had to do a force quit. Since then I cannot reboot Windows. (Parallels starts normally.) I get a screen advising me to open in safe mode, normally, or in the last configuration that worked. It tries to boot, but then I'll briefly see the dreaded Windows "blue screen of death" displaying some kind of error message that flashes by so quickly I cannot read it. It keeps trying to start, but no go.

A tech at the local Mac Store genius bar thinks I have a virus (although I've always run a virus program). He didn't know enough about Parallels Windows to advise further. I'm willing to give up on Windows, but first I want to retrieve the files I had there (pictures and documents).

My question is, should I merely reinstall Windows to fix this? Will this gain me access to the files and programs I've loaded there? So far, one step I have taken was to open a new virtual machine with a new installation of Windows XP. It runs fine, but it doesn't provide access to the files I have on the corrupted VM. Or is there a way for me to access them thru the new VM that I don't know about? Any thoughts?
 
The first screen I get is this...

http://forum.parallels.com/images/attach/jpg.gif

When I choose any of those boot options, I can see it briefly trying to start Windows, then it flips immediately to this error screen...

http://forum.parallels.com/attachment.php?attachmentid=1085&stc=1&d=1201730678


That screen lasts just a second before it returns to the first screen shown here. I did not have this screen capture to show the tech at the genius bar, but I think that brief glimpse of the blue screen led him to believe I have a virus. Each attempt to boot is the same - a vicious circle!

PS: I have not tried a "repair your Windows installation" (yet). Thanks!
 

Attachments

  • Parallels Error 1 copy.jpg
    Parallels Error 1 copy.jpg
    126.2 KB · Views: 10
  • Parallels Error copy.jpg
    Parallels Error copy.jpg
    153.7 KB · Views: 13
Looks like you have a a serious problem.

Here is what Microsoft says about stop 0x24 http://support.microsoft.com/kb/228888

Even though the above article does not have XP as part of the affected systems, this error in XP is the same as the one in 2000 and NT. Since the Parallels disks are not a true disks, the ways to fix the disk are limited. You could try and boot off your XP install CD and opt out of the installation to run chkdsk /r. Maybe you will get lucky and be able to repair enough of the disk structures to boot into safe mode. Perhaps there is a way in Parallels to mount another Parallels disk, such that your working install can mount the bad disk structures as a non boot drive.

In my configuration file is a disk section.

---
[IDE devices]
Disk 0:0 enabled = 1
Disk 0:0 = 1
Disk 0:0 media = 0
Disk 0:0 connected = 1
Disk 0:0 image = winxp.hdd
Disk 0:0 cylinders = 0
Disk 0:0 heads = 0
Disk 0:0 sectors = 0
Disk 0:1 enabled = 1
Disk 0:1 = 2
Disk 0:1 media = 1
Disk 0:1 connected = 0
Disk 0:1 image = Default CD/DVD-ROM
Disk 1:0 enabled = 0
Disk 1:0 = 0
Disk 1:1 enabled = 0
Disk 1:1 = 0
----

Perhaps someone from Parallels support will show us how to add a second disk image to the IDE disk section manually. This may allow you to retrieve "some" files from the damaged image.
 
Try booting you XP VM in SafeMode, if you haven't already to see if your VM is not corrupt. If is boots then you see that it may be driver issue. Have you installed any new hardware recently?
 
Also, if you just want to recover your files, can you open the .hdd file that you run your VM off of with Parallels Explorer? If so, you can just browse through and grab all of your files.
 
Thanks all for your comments.

Stacy, I'm running Mac OS X Vers 10.4.11; Parallels Build 3.0. I don't use Boot Camp. I hit a snag using the repair method as instructed on your link page. I'll explain that later (I have to make some screen grabs).

gegervision, I wasn't able to boot in safe mode.

Eru Ithildur, at this point I'd be thankful to just recover my files from Windows; not sure what you mean by running Parallels explorer, though...
 
Last edited:
In the Applications Folder on your Mac side look for the Parallels Folder. The is a file named Parallels Explorer. Run it. It'll automatically fine your Parallels .hdd file. You have to make sure Parallels is not running that the same time.
 
Yes!!! Thru Parallels Explorer I was able to access my files and copy them over to Mac. This makes me feel a WHOLE lot better!

Now I just have to concentrate on getting my Windows operative again. I now have the old non-working version, and a newly created 2nd Windows VM that works. If it comes to me having to re-create the first version VM by installing my Windows programs into the new VM, shall I simply delete the corrupted first VM?

Thanks for turning me on to Parallels Explorer!

I'm still curious if anyone thinks my whole problem started as the result of a virus...
 
Last edited:
I don't think it was a virus but anything is possible. VMs can get corrupt...that's life. :-(

Anyway once you know you get everything off your corrupt VM you can trash it. If you want, you can keep it on an external drive indefinitely. Your call.
 
You must log in or register to reply here.
Back
Top