141 replies to this topic

[sdabbs]

just this - Volume in drive C has no label. Volume Serial Number is 1403-B6F1

[noahdfear]

Are you sure you waited long enough? It should return to the x:\i386\system32> command prompt when the search is complete.

[sdabbs]

yes sorry - i did'nt wait Volume in drive C has no label. Volume Serial Number is 1403-B6F1 Directory of c:\WINDOWS\$NtServicePackUninstall$ 08/03/2004 09:59 PM 95360 atapi.sys 1 File(s) 95360 bytes Directory of c:\WINDOWS\ServicePackFiles\i386 04/13/2008 06:40 PM 96512 atapi.sys 1 File(s) 96512 bytes Directory of c:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e 04/13/2008 06:40 PM 96512 atapi.sys 1 File(s) 96512 bytes Directory of c:\WINDOWS\system32\drivers 04/13/2008 06:40 PM 96512 atapi.sys 1 File(s) 96512 bytes Directory of c:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386 08/03/2004 09:59 PM 95360 atapi.sys 1 File(s) 95360 bytes Total Files Listed: 5 File(s) 480256 bytes 0 Dir(s) 30334029824 bytes free

[noahdfear]

Using windows explorer, rename the c:\WINDOWS\system32\drivers\atapi.sys file to atapi.sys.vir Now copy c:\WINDOWS\ServicePackFiles\i386\atapi.sys to the c:\WINDOWS\system32\drivers folder. Reboot and see if it boots normally.

[sdabbs]

I renamed the file atapi.sys.vir, and moved this file that I renamed (atapi.sys.vir) to c:\WINDOWS\system32\drivers (I assume you meant the new renamed file atapi.sys.vir as I could not find c:\WINDOWS\ServicePackFiles\i386\atapi.sys

[noahdfear]

The search results show there is an atapi.sys file in the i386 folder.

Directory of c:\WINDOWS\ServicePackFiles\i386

04/13/2008 06:40 PM 96512 atapi.sys
1 File(s) 96512 bytes

I'm a bit confused as to what you renamed/moved.
Lets repeat the search now. Please don't do anymore renaming, copying or moving at this time.

dir c:\atapi.sys /s >"%userprofile%\desktop\atapi.txt"

[sdabbs]

I'm sorry I think I renamed c:\WINDOWS\system32\drivers\atapi.sys file to atapi.sys.vir and thyen I copied it to the c:\WINDOWS\system32\drivers folder. (instead of copying c:\WINDOWS\ServicePackFiles\i386\atapi.sys). Volume in drive C has no label. Volume Serial Number is 1403-B6F1 Directory of c:\WINDOWS\$NtServicePackUninstall$ 08/03/2004 09:59 PM 95360 atapi.sys 1 File(s) 95360 bytes Directory of c:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e 04/13/2008 06:40 PM 96512 atapi.sys 1 File(s) 96512 bytes Directory of c:\WINDOWS\system32\drivers 04/13/2008 06:40 PM 96512 atapi.sys 1 File(s) 96512 bytes Directory of c:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386 08/03/2004 09:59 PM 95360 atapi.sys 1 File(s) 95360 bytes Total Files Listed: 4 File(s) 383744 bytes 0 Dir(s) 30333931520 bytes free

[noahdfear]

Looks like the servicepackfiles folder went missing. We need to find it. Please do another search. dir c:\atapi.sys* /s >"%userprofile%\desktop\atapi.txt"

[sdabbs]

Volume in drive C has no label. Volume Serial Number is 1403-B6F1 Directory of c:\Qoobox\Quarantine\C\WINDOWS\system32\drivers 04/13/2008 06:40 PM 96512 atapi.sys.vir 1 File(s) 96512 bytes Directory of c:\WINDOWS\$NtServicePackUninstall$ 08/03/2004 09:59 PM 95360 atapi.sys 1 File(s) 95360 bytes Directory of c:\WINDOWS\ServicePackFiles\i386 04/13/2008 06:40 PM 96512 atapi.sys.vir 1 File(s) 96512 bytes Directory of c:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e 04/13/2008 06:40 PM 96512 atapi.sys 1 File(s) 96512 bytes Directory of c:\WINDOWS\system32\drivers 04/13/2008 06:40 PM 96512 atapi.sys 04/13/2008 06:40 PM 96512 atapi.sys.vir 2 File(s) 193024 bytes Directory of c:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386 08/03/2004 09:59 PM 95360 atapi.sys 1 File(s) 95360 bytes Total Files Listed: 7 File(s) 673280 bytes 0 Dir(s) 30333931520 bytes free

[noahdfear]

Copy the contents of the code box below and save it to text.

ren c:\WINDOWS\ServicePackFiles\i386\atapi.sys.vir atapi.sys
del /q c:\WINDOWS\system32\drivers\atapi.sys.vir
ren c:\WINDOWS\system32\drivers\atapi.sys atapi.sys.vir
copy c:\WINDOWS\ServicePackFiles\i386\atapi.sys c:\WINDOWS\system32\drivers
exit
cls

Transfer the text file to MiniXP, then open and copy again.
Open a command window and paste the copied text.
The command window will close on it's own.

Restart and see if bootup is successful.

[sdabbs]

You are a genius! it has now booted up in normal windows

[noahdfear]

Happy to hear that! Please disable your security applications and run ComboFix again. Make sure you allow it to update. Post the new log when it completes.

[noahdfear]

Oh - please make sure the computer's time and date are set properly before running ComboFix.

[sdabbs]

hi, The computer is really slow at the moment, mcafee keeps popping up telling me that it has discovered different trojans. Anyway, I've been trying to run combofix a I got a windows message saying windows cannot open this file : nircmd.cfxxxe Then the second time I tried it said that some files could not be created, and I need to restart windows - I will keep trying!

[sdabbs]

It also said that (in a command prompt) that the system could not find the file CFVersionOld And then it said it was attempting a system restore point but just kept like that for 15 minutes