Trashed XP

[lewmur]

Have a client's computer whose HD was so badly infected that I couldn't even run anti-malware aqpps. Pulled the hd and put it in another computer and removed a mess of malware. Now every time I attempt to run a anything, either it tells me it can't find C:\Windows\system32\run32dll.exe or it displays the box asking me what application I want to use to run the program. Even though what I'm attempting to run is an exe file. So I can't even run the restore program.I'm assuming the registry is corrupted. I recall something about copying files from the c:\Windows\system32\restore directory to fix this but don't recall what to copy and where to put it.This computer has a bunch of apps installed and I would really hate to start from scratch with a clean install.

[aldago]

Have a client's computer whose HD was so badly infected that I couldn't even run anti-malware aqpps. Pulled the hd and put it in another computer and removed a mess of malware. Now every time I attempt to run a anything, either it tells me it can't find C:\Windows\system32\run32dll.exe or it displays the box asking me what application I want to use to run the program. Even though what I'm attempting to run is an exe file. So I can't even run the restore program.I'm assuming the registry is corrupted. I recall something about copying files from the c:\Windows\system32\restore directory to fix this but don't recall what to copy and where to put it.This computer has a bunch of apps installed and I would really hate to start from scratch with a clean install.

Try start/run and type sfc.exe /scannow. If you're asked to put in the windows CD do so. This should replace any corrupt windows files.

[Peachy]

Have you tried a repair install? Put in the appropriate XP installation CD and select Repair from the main installation screen (not the first instance of repair; that takes you to a command mode.) In this type of installation, XP will install a clean registry and the original Windows system dlls but retain all the installed apps and setting for those apps so you don't have to reinstall anything else.

[Ed_P]

I'm assuming the registry is corrupted. I recall something about copying files from the c:\Windows\system32\restore directory to fix this but don't recall what to copy and where to put it.

Try this script.RegRecovery.cmd

:: http://support.microsoft.com/kb/307545@echo Registry Recovery script@echo.@pause@echo Are you sure?@echo.@pause@set Bkup=X%Bkup%:cd \md tmpcopy   c:\windows\system32\config\system   %Bkup%:\tmp\system.bakcopy   c:\windows\system32\config\software %Bkup%:\tmp\software.bakcopy   c:\windows\system32\config\security %Bkup%:\tmp\security.bakcopy   c:\windows\system32\config\sam	  %Bkup%:\tmp\sam.bakcopy   c:\windows\system32\config\default  %Bkup%:\tmp\default.bakdelete c:\windows\system32\config\systemdelete c:\windows\system32\config\softwaredelete c:\windows\system32\config\securitydelete c:\windows\system32\config\samdelete c:\windows\system32\config\defaultcopy   c:\windows\repair\system   c:\windows\system32\config\systemcopy   c:\windows\repair\software c:\windows\system32\config\softwarecopy   c:\windows\repair\security c:\windows\system32\config\securitycopy   c:\windows\repair\sam	  c:\windows\system32\config\samcopy   c:\windows\repair\default  c:\windows\system32\config\default

Adjust the value of Bkup to fit your needs. I normally use a USB stick.

Edited August 26, 2009 by Ed_P

[V.T. Eric Layton]

Better you than me, Lew! Some help I am, huh?

[striker]

The system was compromised, period. No matter what it takes and how long, I would start from scratch with a new, fresh installed clean system. (That's why it is vital to keep up to date images which run under DOS)

[lewmur]

Try this script.RegRecovery.cmd

:: http://support.microsoft.com/kb/307545@echo Registry Recovery script@echo.@pause@echo Are you sure?@echo.@pause@set Bkup=X%Bkup%:cd \md tmpcopy   c:\windows\system32\config\system   %Bkup%:\tmp\system.bakcopy   c:\windows\system32\config\software %Bkup%:\tmp\software.bakcopy   c:\windows\system32\config\security %Bkup%:\tmp\security.bakcopy   c:\windows\system32\config\sam	  %Bkup%:\tmp\sam.bakcopy   c:\windows\system32\config\default  %Bkup%:\tmp\default.bakdelete c:\windows\system32\config\systemdelete c:\windows\system32\config\softwaredelete c:\windows\system32\config\securitydelete c:\windows\system32\config\samdelete c:\windows\system32\config\defaultcopy   c:\windows\repair\system   c:\windows\system32\config\systemcopy   c:\windows\repair\software c:\windows\system32\config\softwarecopy   c:\windows\repair\security c:\windows\system32\config\securitycopy   c:\windows\repair\sam	  c:\windows\system32\config\samcopy   c:\windows\repair\default  c:\windows\system32\config\default

Adjust the value of Bkup to fit your needs. I normally use a USB stick.

Thanks Ed. That was what I was looking for.

[jolphil]

lew,I am curious if this worked or not..I looked at the bulletin and it stated that this method should not be used on OEM XP..Apparently they use a different hive..Most of my family's are OEM's.. My grandson(35) recently got into a similar situation and I told him about the XP repair function as noted above..After the repair he still had the trojan/virus and ultimately had to reformat and reinstall..Sad...Anyway, good luck to you and if anyone can get it going again you can.. jolphil

[lewmur]

lew,I am curious if this worked or not..I looked at the bulletin and it stated that this method should not be used on OEM XP..Apparently they use a different hive..Most of my family's are OEM's.. My grandson(35) recently got into a similar situation and I told him about the XP repair function as noted above..After the repair he still had the trojan/virus and ultimately had to reformat and reinstall..Sad...Anyway, good luck to you and if anyone can get it going again you can.. jolphil

Well, it worked somewhat but I still had to do a new install. My problem was that I could never get programs that used .Net Framework 2 to work.