144 replies to this topic

[forest5678]

It did the same thing. Says disk error. The disk reads Windows xp proffesional includes service pack 2. Thanks!!!!!!

[oldman960]

Hi forest5678,

Is there any other thing on the disk such as who the disk is from? Microsof, Dell etc?

Also what drive letter does the infected computer see the CD as?

Copy and paste the following bold text into a notepad, transfer the notepad to the infected computer. Then copy and paste the text into SystemLook. Don't miss the : at the beginning.


:reg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
:folderfind
i386

Please post the results.

Thanks

[forest5678]

It reads as drive letter E. The disk has Microsoft Not For Resale Genuine. SystemLook 04.09.10 by jpshortstuff Log created at 21:47 on 15/06/2011 by DJ Dash Administrator - Elevation successful ========== reg ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup] "DriverCachePath"="%SystemRoot%\Driver Cache" "BootDir"="C:\" "PrivateHash"=46 f9 22 56 c2 97 d1 44 27 2d e6 ad 22 fd 39 8f (REG_BINARY) "Installation Sources"="E: E:\ C:\DOCUMENTS AND SETTINGS\DJ DASH\MY DOCUMENTS\DOWNLOADS\MONITOR_ACER_1.0_VISTAX86_H233H\MONITOR_ACER_1.0_VISTAX86_H233H F:\I386 C:\DOCUMENTS AND SETTINGS\DJ DASH\DESKTOP O:\SVR_2003\I386 C:\DOCUMENTS AND SETTINGS\DJ DASH\MY DOCUMENTS\SNIFFER\NDISXP C:\VIEWSONIC E:\DRIVERS\DOT4\WIN2000" "SourcePath"="E:\" "ServicePackSourcePath"="E:\" "CDInstall"= 0x0000000001 (1) "LogLevel"= 0x0000000101 (257) "ServicePackCachePath"="c:\windows\ServicePackFiles\ServicePackCache" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\BaseWinOptions] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Oc Manager] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\WindowsFeatures] ========== folderfind ========== Searching for "i386" C:\129f963a7e098b297558f8\i386 d------ [07:13 09/11/2009] C:\Garmin\USB_Drivers\I386 d------ [11:55 11/05/2009] C:\Oracle\ftk2\jdk\jre\lib\i386 d------ [02:47 19/08/2009] C:\Oracle\ftk2\jre\1.4.2\lib\i386 d------ [02:47 19/08/2009] C:\Program Files\Common Files\i4j_jres\1.6.0\lib\i386 d------ [10:31 23/06/2010] C:\Program Files\Debugging Tools for Windows (x86)\sdk\lib\i386 d------ [18:41 21/10/2009] C:\Program Files\Java\jre6\lib\i386 d------ [15:12 18/03/2010] C:\Program Files\Ovis\jre\lib\i386 d------ [07:10 05/11/2010] C:\WINDOWS\Driver Cache\i386 d------ [06:12 23/04/2009] C:\WINDOWS\ServicePackFiles\i386 d------ [05:23 05/06/2009] C:\WINDOWS\ServicePackFiles\ServicePackCache\i386 d------ [05:27 05/06/2009] C:\WINDOWS\system32\DRVSTORE\povrtdev_98DBE8AE5C50DC6C12E4A2975B791CB777D3F880\i386 d----c- [08:50 26/07/2010] C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386 d------ [23:15 23/04/2009] C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386 d------ [09:58 25/04/2009] C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386 d------ [09:58 25/04/2009] C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386 d------ [09:58 25/04/2009] C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386 d------ [12:05 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386 d------ [12:05 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386 d------ [12:05 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0026\DriverFiles\i386 d------ [12:05 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0027\DriverFiles\i386 d------ [12:05 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0029\DriverFiles\i386 d------ [12:06 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0030\DriverFiles\i386 d------ [12:06 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0031\DriverFiles\i386 d------ [12:06 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0032\DriverFiles\i386 d------ [12:06 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0033\DriverFiles\i386 d------ [12:06 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0047\DriverFiles\i386 d------ [12:05 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0049\DriverFiles\i386 d------ [12:05 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0053\DriverFiles\i386 d------ [12:05 11/05/2009] C:\WINDOWS\system32\ReinstallBackups\0058\DriverFiles\i386 d------ [15:51 02/06/2009] C:\WINDOWS\system32\ReinstallBackups\0059\DriverFiles\i386 d------ [15:54 02/06/2009] C:\WINDOWS\system32\ReinstallBackups\0062\DriverFiles\i386 d------ [18:27 14/07/2009] C:\WINDOWS\system32\ReinstallBackups\0066\DriverFiles\i386 d------ [23:10 07/07/2009] C:\WINDOWS\system32\ReinstallBackups\0067\DriverFiles\i386 d------ [23:10 07/07/2009] C:\WINDOWS\system32\ReinstallBackups\0069\DriverFiles\i386 d------ [18:27 14/07/2009] C:\WINDOWS\system32\ReinstallBackups\0078\DriverFiles\i386 d------ [09:13 06/10/2010] C:\WINDOWS\system32\ReinstallBackups\0080\DriverFiles\i386 d------ [21:51 25/11/2010] C:\WINDOWS\system32\spool\XPSEP\i386 d------ [02:04 06/05/2009] C:\WINDOWS\system32\spool\XPSEP\i386\i386 d------ [02:04 06/05/2009] -= EOF =-

[oldman960]

Hi forest5678, Sorry about the dlay, this is a head scratcher. Let's see if your disk will work to do this. There will be no fixing involved just a test to see if XP can be seen from the disk. You computer must be able to boot from the CD. Insert the Windows XP startup disk into the floppy disk drive, or insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer. 1. Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted. 2. When the "Welcome to Setup" screen appears, press R to start the Recovery Console. 3. You should now see a list of installations and the prompt "Which Windows Installation would you like to log on to?" Select the appropriate number for the Windows installation that you want to repair. If you only have one, press 1. If there are multiple choices one should be XP professional. 4. When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER. You should now have a C:\windows> prompt Let me know if you can get this far. Thanks

[forest5678]

yes I can get there, but I have to press esc when loading up and tell the pc to boot from cd-rom. and I have two choices: 1: C:\WINDOWS 2: E:\WINDOWS and I chose 1. Thanks!!!

[forest5678]

sorry I had an external hard drive plugged in. I think thats why I had 2. sorry. Thanks!

[oldman960]

Hi forest5678, Can you try that again without the external drive plugged in? Are you still given the 2 choices? Thanks

[forest5678]

yes I did it without the external and only had one option. thanks!!!!!!

[oldman960]

Hi forest5678, Ok, leave the external drive disconnected. Try running SFC again with the instructions in Post #84. Let us know what happens,

[forest5678]

It still will not run. Says wrong disk. Thanks!!

[oldman960]

Hi forest5678, I'm still looking into this.

[Ztruker]

I believe the problem s that your XP disc is at the SP2 level while your computer is at the SP3 level.

You can fix this by slipstreaming SP3 with your XP install CD.

Create XP CD slipstreamed with SP3:
The simplest way to create a Bootable Windows XP Pro or Home Installation CD Slipstreamed with SP3 is to use Autostreamer. You point to your XP Pro/Home CD, the SP3 Service Pack .exe file, give it a path to write the .iso file to and off it goes. In 5 or 10 minutes you have a .iso file that you can burn to CD with almost any CD burner program you want to use. I used Roxio 7. There is also a good freeware burner called ImgBurn which will do this for you.

Here is the link to Autostreamer: http://www.softpedia...ostreamer.shtml

You can download the SP3 .exe here: Windows XP Service Pack 3 Network Installation Package for IT Professionals and Developers

If you have an original XP Install CD with no Service Pack applied, not even SP1a then you will need to do the above in two steps. First you will have to splistream SP2 then repeat for SP3.

You can download SP2 .exe here: Windows XP Service Pack 2 Network Installation Package for IT Professionals and Developers

An excellent alternative is nLite. It allows you to merge SP2/SP3/Windows Updates into a new XP CD image that you can install from. Takes a bit of fiddling with but worth the effort since it also allows you to pre-answer all the questions asked during install so all you have to do is boot the new CD, select where you want to install, format or not and go to lunch. When you come back the install is finished and your are at the latest Service Pack and Update level. See here:
http://www.nliteos.com/

If you have Vista, then give Vlite a try:
http://www.vlite.net/

Use this site to get the MS updates: http://www.softwarepatch.com/windows/

You can also get updates from an MS site but it takes more work: http://windowsxp.mvp...saveupdates.htm

[oldman960]

Hi forest5678,


Let's see if copying a folder from the CD to the harddrive will help.

Insert the CD

• Click start > run
• in the runbox type XCOPY32 E:\I386\*.* C:\I386\ /E
  (note there is a space after the 32, a space after *.* and a space after C:\I386\
• hit enter

On the clean computer

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
"SourcePath"="C:\"

• Ensure there is no space above the REGEDIT4.
• ensure the text matches including the space between lines
• in notepad go to FILE > SAVE AS and in the dropdown box, set the top box SAVE IN to DESKTOP
• in the FILE NAME box type (including the " " marks), "fix.reg"

Click save.

This will create a fix.reg file on your desktop

Transfer the file to the infected computer's desktop.

To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.

Now try SFC.exe again.

Let us know how you make out.

[forest5678]

ok...I made the cd and all. I am assuming I was suppose to use it when I tried to run SFC. I also did all the rest of the instructions, but it still says wrong disk each time I try to run the program. Thanks!!!!!!

[oldman960]

Hi The post from Ztrucker incorrectly identified your computer as having XP SP3 on it. You in fact have SP2. When you ran the last set of instructions where you asked to insert a disk? Thanks