Deleted system32rundll and help w/Java

Discussion in 'Software' started by aviano_2004, Aug 3, 2005.

  1. aviano_2004

    aviano_2004 Private E-2

    Hi,

    I've received some great help over in the spyware area and have attached what has happened so far.

    I just downloaded AIDA, and am wondering which report I should attach for my system specs, etc.

    Thank you!
    Cindy
     

    Attached Files:

  2. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Different Program but the instructions are the same; See this POST.

    What is the exact problem are you having?
     
  3. aviano_2004

    aviano_2004 Private E-2

    Hello and thanks for replying!

    OK, Everest file attached.

    Well, the problem that started all of this is that I can't get access any longer to a web/java based IM program that I use to contact my husband while he is away. It was available on all three of my computers prior to now, but then it went away on all three of them the same day.

    I'm at the point on two of the three computers that I can get to the website, can log in, but then when the java window comes up, I get a red X in the corner of the screen. Oh, and I did have someone else test my account on their computer, and everything worked fine.

    The problem I wanted to fix before attempting anything with the Java is: Through the clean up of this computer, I inadvertantly deleted the system32rundll while using HijackThis to remove way too much spyware etc.

    Thank you!
    Cindy
     

    Attached Files:

  4. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Do this Start -> Run

    type sfc /scannow

    Click on OK

    Do this from a profile that has adminstrator privilages. This command will replace all missing or corrupt windows system files on your computer. You may have to run Windows Update after the scan is completed; as some of the files may be replaced with older versions.
     
  5. aviano_2004

    aviano_2004 Private E-2

    I typed sfc /scannow into RUN. It prompted me for my Windows XP disc. I put the XP disc in and then it ran through the end of the scan.
    After the scan, I checked for windows updates. Two small ones were available for XP.
    After downloading the updates, I opened the control panel and attempted to click on the add/remove icon. It came up with the same error I've been receiving for many other things: Windows cannot find 'C:\WINDOWS\system32\rundll32.exe'

    Cindy
     
  6. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Do this:

    1. Configure the computer to start from the CD-ROM or DVD-ROM drive. For information about how to do this, see your computer documentation, or contact your computer manufacturer.

    2. Insert the Windows XP CD-ROM into your CD-ROM or DVD-ROM drive, and then restart your computer.

    3. When you receive the "Press any key to boot from CD" message, press a key to start your computer from the Windows XP CD-ROM.

    4. When you receive the "Welcome to Setup" message, press R to start the Recovery Console.

    5. If you have a dual-boot or multiple-boot computer, select the installation that you have to use from the Recovery Console.

    6. When you are prompted, type the administrator password, and then press ENTER.

    7. At the C:\WINDOWS> prompt, type the following:
    map
    NOTE THE DRIVE LETTER OF YOUR CDROM
    expand cdrom drive letter:\I386\RUNDLL32.EX_ C:\WINDOWS\System32\Rundll32.exe
    8. Press Enter. At the C:\> prompt, type the following: exit

    9. Press Enter.


    The system automatically restarts. If the computer does not start normally, continue to the next Step.
     
  7. aviano_2004

    aviano_2004 Private E-2

    Hello!

    Well, I got as far as your step 7, and attempted to try it several times, but the message I kept receiving was: Unable to create file rundll32.exe. 0 file(s) expanded.

    :) Cindy
     
  8. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Use this command instead:

    expand cdrom drive letter:\I386\RUNDLL32.EX_ C:\WINDOWS\System32
     
  9. theefool

    theefool Geekified

    Ugh...Deleted my post....


    No wait, that will expand the file, but name the file as rundll32.ex_

    After that you would have to:
    ren rundll32.ex_ rundll32.exe

     
    Last edited: Aug 6, 2005
  10. theefool

    theefool Geekified

    aviano_2004:

    If what Shadow_Puter_Dude gave you to try does not work, then try:

    expand cdrom drive letter:\I386\RUNDLL32.EX_ C:\

    If that doesn't work, then try:

    expand cdrom drive letter:\I386\CMD.EX_ C:\

    If you get the same error, then you may have a bad cd. Or try a neighbors xp cdrom.

    OR, there may be a way to just download the file in question to the c:\, then reboot into recovery console, then copy the files in question.
     
  11. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Valid point there theefool. If you have the folder C:\I386 on your hard drive, you can issue this command:

    expand C:\I386\RUNDLL32.EX_ C:\WINDOWS\System32
     
  12. aviano_2004

    aviano_2004 Private E-2

    OH good! The first suggestion/solution by Shadow_Puter_Dude worked! :) THANK you!!! Thank you for the suggestions from both of you.

    So, now I'm on to my next situation:The possible Java problem, aka "Accessing the website that was the root of all of these problems."

    Just now, I cleared everything out and ran spyware scans using CCleaner, Disc Cleanup, defrag. Spybot and AdAware. I then clicked on Tools then Sun Java Console. The only reason I did this is because the times I've been able to even log onto at least the first, non-IM part of the site, a good number of the times has been when I had the console open, then minimized, with the little java logo present as still running.
    I was able to log in under my name, but then when it was time to launch the IM window, it went to the standard error message: This page cannot be displayed: The page you are looking for is currently unavailable. The website might be experiencing tech. difficulties, or you may need to adjust your browser settings. (then the list of suggestions on what to try)
    I was able to click on one area in the original, non-IM window that allowed me to change the connection to one that was firewall friendly. But now, even after signing off as suggested to activate said friendly firewall, as well as the majority of the other times when I try and re-login, it goes directly to the 'page cannot be displayed' message. This is not even in the IM window.
    OK...any ideas?
     
  13. aviano_2004

    aviano_2004 Private E-2

    The website that is the root of all the problems was/is a government web portal for IM conversations.
     
  14. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Are you talking about the IM that is part of AKO?
     
  15. aviano_2004

    aviano_2004 Private E-2

    Hello there..

    As you may know, I'm on a bit of a time delay for postings. Thank you for being so speedy with your replies.

    Well, I'm not familiar with the acronym AKO. The website to which I refer is the Air Force Portal. It is the same portal that the Air Force uses for other functions for active duty members. Now there is the added capability for friends and family to chat with the active duty member. (wow)

    On an unrelated note:

    While browsing through some of the posts on the software forum prior to clicking on your response, I started reading the thread that you have with Eigenvalue. I'm only on message 37 or so, but WOW, what an incredible thread! (HUGE understatement) It is neat to see that you are retired military as well. It is also great to see the help that you've been providing to this very intelligent gentleman. I look forward to finishing all of the messages in the thread.

    OK, I'll mosey on along now.

    Best regards,
    Cindy
     
  16. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    AKO = Army Knowledge Online, it is the Army Web Portal that's probably similar to the Airforce portal. I wouldn't be suprised if the underlying code is the same. The IM on AKO requires Java 1.4.1 or greater to be installed. I bet the Airforce one is the same. I tried the one on AKO and it won't work for me, I keep getting "Java must be Installed to use," and I have Java 5.0 Update 4 installed.

    What version of Java do you have installed?

    Yeah, that thread with eigenvalue is long, take you a while to read it all.

    There are quite a few former military on the forum.
     
  17. aviano_2004

    aviano_2004 Private E-2

    Hello,

    Yes, the AF version sounds similar to the Army version. I have the same Java that you have. I did notice on two separate screens at the portal site, conflicting information. One said that the minimum is the 1.4.1, the other said that the only one acceptable is the 1.4.1 and that 5 would not work. The link to get the Java from the AF site takes you to the 5.
    When I troubleshooted on the Java site, it got me to the point that because of the red X where the java screen sometimes is (when I can get it to load at all) I needed to have a proxy server. ???? I'm somewhat familiar with that concept, but how do I obtain those settings? Bear in mind that it is all in italian here, though I can use my slowly evolving italian language skills combined w/ Babelfish.
    I hate to lead you in the wrong direction completely though. I'm still thinking it could be something related to firewall settings or security settings or something else entirely.

    OK, bye for now!
    Cindy
     
  18. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Java(TM) 2 Runtime Environment, Standard Edition 1.4.2_08

    You could unistall Java 5 and install this version. I don't know why you would need to use a proxy server. You could check your firewall setting to make sure that the firewall isn't blocking the IM, or check and make sure your AV isn't blocking Java Script. If your are using IE making sure that Java Scripting is enabled.
     
  19. aviano_2004

    aviano_2004 Private E-2

    OK thank you for the reply. :)

    I uninstalled 5.0 on Java and installed the other version as per your suggestion. Unfortunately it didn't work. Additionally I kept receiving reminders to update to 5.0. LOL. So, I went back to 5.0.
    I'm really thinking that it might be something with how I have my Trend Micro and/or browser security settings set up. Would you be willing to look at them for me to see if you can troubleshoot them for me?

    Thanks,
    Cindy
     
  20. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

  21. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    The IM works in Firefox. So, it has to be something with IE that is keeping it from running.
     
  22. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    The IM is working in IE also. I think the problem may have been on their end. At least the IM on the Army web portal is now working in both IE & Firefox. Give it a day or so the see if the IM on the Airforce web portal starts working.
     
  23. aviano_2004

    aviano_2004 Private E-2

    NEW Problem with missing file for startup WRe: Deleted system32rundll and help w/Java

    OK, quick update...

    When this first started, I had a friend living in a different country log on to the AF site using my name and password. It worked perfectly. So, I'm fairly certain I've blocked it here somehow. :p

    But, I've had to put that whole situation on hold temporairly. The laptop I've been using for everything else, has now come up with a cute little message that says:

    Windows could not start because the following file is missing or currupt:
    <windows root> \system32\ntoskrnl.exe.

    Please re-install a copy of the above file.

    So, I then went to F12 "Boot from DVD Windows XP", then setup, then Repair using Recovery console. I did this and then logged on to 1: C:\WINDOWS
    I typed in Map and then Expand D the Map and EXPAND cdrom drive letter (in this case D): then ??????

    Or am I completely doing something not related to my current problem?

    Additionally I did F8, Last Known Good Configuration, which gave me the same "Windows could not start...etc" message from above. Could this have been because I had system restore disabled?

    So, then I tried F12 Diagnostics:

    I got as far as the following:

    Pre-boot System Assessment Build 3009
    Device: Hard Drive
    Test DST Short Status Test
    Status : ERROR

    Test results: Fail
    Error code 1000-0142
    Msg Unit 4 Drive Self Test failed
    Status Byte = 89

    The beeps were: (lol at sounding out the beeps)
    1 long beep, PAUSE, 4 short beeps, PAUSE, 2 short beeps.

    OK, whew.

    Thanks
     
  24. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Windows could not start because the following file is missing or currupt:
    <windows root> \system32\ntoskrnl.exe


    Insert your XP CD into the CD drive, choose the boot from command prompt option in the menu that you are presented with

    At the command prompt, type in the following:

    copy d:\I386\Driver.cab c:\system32\ntoskrnl.exe /v

    where d is the letter of your cd drive

    press enter

    Take the CD out when verified and reboot your computer.

    1 long beep, PAUSE, 4 short beeps, PAUSE, 2 short beeps


    Explanation: A failure of some sort was encountered either initializing or testing the first 1 MB of system memory.

    Diagnosis: The first bank of memory probably has a bad memory chip in it somewhere. It is possible that there is a failure related to the motherboard or a system device as well.

    Recommendation: Download MEMTEST86+, unzip the file, using your favorite CD burning application to Create a CD from Image File. DO NOT burn the ISO image straight to the CD this will not create a working bootable CD.

    If you do not have a CD burning program you can use CDBurnerXP to create the CD.

    Insert the newly created Bootable CD into your CD Drive and boot the computer from CD. Follow the on-screen instructions, if after 5 passes no problems have been found, most likely you do not have a problem with the install memory.
     
  25. aviano_2004

    aviano_2004 Private E-2

    Hi!

    Well, first a quick question. When you said to choose the boot from command prompt.... I did this:

    I hit F12, which then gave me choices on what to boot from, I chose my DVD where the XP CD is located. (D)
    Then I got to setup/Recovery Console, and I logged in to 1: C:\Windows

    From there, at that prompt, I typed in the command you recommended:

    copy d:\I386\Driver.cab c:\system32\ntoskrnl.exe/v <-----I couldn't tell from your post if the final v was supposed to be attached or not, so I typed it in both ways.

    From the above command it says: The system cannot find the file or directory specified.

    When I detached the /v, the response was "The parameter is not valid. Try /? for help.

    I havent started the second half of your response.

    :) Cindy
     
  26. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    At the recovery console type map make a note of what the CD-ROM dirve letter.

    copy d:\I386\Driver.cab c:\system32\ntoskrnl.exe /v

    Replace d: with the drive letter from the map
    command

    NOTE:
    There is a space between ntoskrnl.exe and /v
     
  27. aviano_2004

    aviano_2004 Private E-2

    OK!

    Now I'm back to the response of, "The parameter is not valid. Try /? for help."

    I've triple checked my typing for errors, unlike the error in my previous message when I spelled corrupt, "currupt" LOL

    Cindy
     
  28. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Sorry, I put the swith in the wrong place. Try this one:

    copy /v d:\I386\Driver.cab c:\system32\ntoskrnl.exe

    If that fails just eliminate the /v, it just verifies that the copy executed correctly.
     
  29. aviano_2004

    aviano_2004 Private E-2

    Well, at least now I'm back to the response of "The system cannot find the file of directory specified!" My DVD that has the CD in it seems to be working fine...I'm not sure why it won't bring it up!
     
  30. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

  31. aviano_2004

    aviano_2004 Private E-2

    OK, the first two choices were still giving me the parameter response. Just now I tried typing your command without the /v and got the response:

    Overwrite ntoskrnl.exe? (Yes/No/All):

    I haven't responded.
     
  32. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Yes, you want to overwrite the ntoskrnl,
     
  33. aviano_2004

    aviano_2004 Private E-2

    Yippee! brb
     
  34. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    I take it, that it copied the ntoskrnl to the hard drive. Have you tried to boot the system yet?
     
  35. aviano_2004

    aviano_2004 Private E-2

    On reboot I received:

    Windows could not start etc.... due to....

    \WINDOWS\SYSTEM32\CONFIG\SYSTEM

    You can attempt to repair this file by starting Windows Setup using the original Setup CD-ROM.
    Select 'r' at the first screen to start repair.

    It then suggested the repair function. I rebooted again to make sure, but it did it again. I'm at the repair screen now.....


    Thank you again, for all of this. I really do appreciate it.

    Cindy
     
  36. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    OK, this fix is a little long and somewhat complicated.

    How to recover from a corrupted registry that prevents Windows XP from starting

    Please print out these instructions so that you can operate with All Browser Windows CLOSED.

    This article describes how to recover a Windows XP system that does not start because of corruption in the registry. This procedure does not guarantee full recovery of the system to a previous state; however, you should be able to recover data when you use this procedure.

    Warning:
    Do not use the procedure that is described in this article if your computer has an OEM-installed operating system. The system hive on OEM installations creates passwords and user accounts that did not exist previously. If you use the procedure that is described in this article, you may not be able to log back into the recovery console to restore the original registry hives.

    You can repair a corrupted registry in Windows XP. Corrupted registry files can cause a variety of different error messages. See the Microsoft Knowledge Base for articles about error messages that are related to registry issues.

    This article assumes that typical recovery methods have failed and access to the system is not available except by using Recovery Console. If an Automatic System Recovery (ASR) backup exists, it is the preferred method for recovery. Microsoft recommends that you use the ASR backup before you try the procedure described in this article.

    NOTE: Make sure to replace all five of the registry hives. If you only replace a single hive or two, this can cause potential issues because software and hardware may have settings in multiple locations in the registry.

    When you try to start or restart your Windows XP-based computer, you may receive one of the following error messages:

    Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM

    Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SOFTWARE

    Stop: c0000218 {Registry File Failure} The registry cannot load the hive (file): \SystemRoot\System32\Config\SOFTWARE or its log or alternate

    System error: Lsass.exe
    When trying to update a password the return status indicates that the value provided as the current password is not correct.


    The procedure that this article describes uses Recovery Console and System Restore. This article also lists all the required steps in specific order to make sure that the process is fully completed. When you finish this procedure, the system returns to a state very close to the state before the problem occurred. If you have ever run NTBackup and completed a system state backup, you do not have to follow the procedures in parts two and three. You can go to part four.

    Download and save regcopy1.txt and regcopy2.txt to Floppy

    PART ONE

    In part one, you start the Recovery Console, create a temporary folder, back up the existing registry files to a new location, delete the registry files at their existing location, and then copy the registry files from the repair folder to the System32\Config folder. When you have finished this procedure, a registry is created that you can use to start Windows XP. This registry was created and saved during the initial setup of Windows XP. Therefore any changes and settings that occurred after the Setup program was finished are lost.

    To complete part one, follow these steps:

    1. Insert the Windows XP startup disk into the floppy disk drive, or insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer. Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted to do so.

    2. When the "Welcome to Setup" screen appears, press R to start the Recovery Console.

    3. If you have a dual-boot or multiple-boot computer, select the installation that you want to access from the Recovery Console.

    4. When you are prompted to do so, type the Administrator password. If the administrator password is blank, just press ENTER.

    5. At the Recovery Console command prompt, type the following commands and press ENTER after each line:
    copy a:\regcopy1.txt c:\

    copy a:\regcopy2.txt c:\

    batch regcopy1.txt
    DO NOT run regcopy2.txt at this time, it is needed latter in Part three of this article.

    6. Type exit to quit Recovery Console. Your computer will restart.

    NOTE: This procedure assumes that Windows XP is installed to the C:\Windows folder. Make sure to change C:\Windows to the appropriate windows_ folder if it is a different location.

    PART TWO

    To complete the procedure described in this section, you must be logged on as an administrator, or an administrative user (a user who has an account in the Administrators group). If you are using Windows XP Home Edition, you can log on as an administrative user. If you log on as an administrator, you must first start Windows XP Home Edition in Safe mode. To start the Windows XP Home Edition computer in Safe mode, follow these steps.

    NOTE Print these instructions before you continue. You cannot view these instructions after you restart the computer in Safe Mode. If you use the NTFS file system, also print the instructions from Knowledge Base article KB309531.

    1. Click Start, click Shut Down (or click Turn Off Computer), click Restart, and then click OK (or click Restart).

    2. Press the F8 key.

    On a computer that is configured to start to multiple operating systems, you can press F8 when you see the Startup menu.

    3. Use the arrow keys to select the appropriate Safe mode option, and then press ENTER.

    4. If you have a dual-boot or multiple-boot system, use the arrow keys to select the installation that you want to access, and then press ENTER.

    In part two, you copy the registry files from their backed up location by using System Restore. This folder is not available in Recovery Console and is generally not visible during typical usage. Before you start this procedure, you must change several settings to make the folder visible:

    1. Start Windows Explorer.

    2. On the Tools menu, click Folder options.

    3. Click the View tab.

    4. Under Hidden files and folders, click to select Show hidden files and folders, and then click to clear the Hide protected operating system files (Recommended)

    5. Click Yes when the dialog box that confirms that you want to display these files appears.

    6. Double-click the drive where you installed Windows XP to display a list of the folders. If is important to click the correct drive.

    7. Open the System Volume Information folder. This folder is unavailable and appears dimmed because it is set as a super-hidden folder.

    NOTE This folder contains one or more _restore {GUID} folders such as "_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}".

    NOTE You may receive the following error message:

    check box. C:\System Volume Information is not accessible. Access is denied.

    If you receive this message, see the following Microsoft Knowledge Base article to gain access to this folder and continue with the procedure:

    309531 (http://support.microsoft.com/kb/309531/) How to gain access to the System Volume Information folder

    8. Open a folder that was not created at the current time. You may have to click Details on the View menu to see when these folders were created. There may be one or more folders starting with "RPx under this folder. These are restore points.

    9. Open one of these folders to locate a Snapshot subfolder. The following path is an example of a folder path to the Snapshot folder:

    C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}\RP1\Snapshot

    10. From the Snapshot folder, copy the following files to the C:\Windows\Tmp folder:


    • _REGISTRY_USER_.DEFAULT
    • _REGISTRY_MACHINE_SECURITY
    • _REGISTRY_MACHINE_SOFTWARE
    • _REGISTRY_MACHINE_SYSTEM
    • _REGISTRY_MACHINE_SAM
    11. Rename the files in the C:\Windows\Tmp folder as follows:

    • Rename _REGISTRY_USER_.DEFAULT to DEFAULT
    • Rename _REGISTRY_MACHINE_SECURITY to SECURITY
    • Rename _REGISTRY_MACHINE_SOFTWARE to SOFTWARE
    • Rename _REGISTRY_MACHINE_SYSTEM to SYSTEM
    • Rename _REGISTRY_MACHINE_SAM to SAM
    These files are the backed up registry files from System Restore. Because you used the registry file that the Setup program created, this registry does not know that these restore points exist and are available. A new folder is created with a new GUID under System Volume Information and a restore point is created that includes a copy of the registry files that were copied during part one. Therefore, it is important not to use the most current folder, especially if the time stamp on the folder is the same as the current time.

    The current system configuration is not aware of the previous restore points. You must have a previous copy of the registry from a previous restore point to make the previous restore points available again.

    The registry files that were copied to the Tmp folder in the C:\Windows folder are moved to make sure that the files are available under Recovery Console. You must use these files to replace the registry files currently in the C:\Windows\System32\Config folder. By default, Recovery Console has limited folder access and cannot copy files from the System Volume folder.

    NOTE The procedure described in this section assumes that you are running your computer with the FAT32 file system.

    PART THREE

    In part three, you delete the existing registry files, and then copy the System Restore Registry files to the C:\Windows\System32\Config folder:

    1. Start Recovery Console (or by using a Windows 98 Boot Disk).

    2. At the command prompt, type the following command and press ENTER after you type the line:

    batch regcopy2.txt
    3. Type exit to quit Recovery Console. Your computer restarts.

    NOTE This procedure assumes that Windows XP is installed to the C:\Windows folder. Make sure to change C:\Windows to the appropriate windows_folder if it is a different location.

    PART FOUR


    1. Click Start, and then click All Programs.

    2. Click Accessories, and then click System Tools.

    3. Click System Restore, and then click Restore to a previous RestorePoint.
     
  37. aviano_2004

    aviano_2004 Private E-2

    OK! I'll be back as soon as I can. Thank you!

    Ciao,
    Cindy
     
  38. aviano_2004

    aviano_2004 Private E-2

    OK...I do not have immediate access to my removable floppy, and decided to save the regcopy files to a usb memory stick. I wanted to verify that instead of using the "A" drive for the copy, I would instead replace it with the correct drive letter where my USB is located.

    copy d:\regcopy1.txt c:\
    copy d:\regcopy.2.txt c:\

    Thanks!

    Cindy
     
  39. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    I've never tried to do that. You could try that, make sure the memory stick is attached to a USB port on the computer when you boot. Type map at the recovery console prompt, and note the drive letter of the USB device, if it is active.
     
  40. aviano_2004

    aviano_2004 Private E-2

    Hello..

    When I saved regcopy1 and regcopy2, I saved them in Word, so their actual name ended up being regcopy1.txt.doc and regcopy2.txt.doc...that then meant that I saved them to C in that format as well.

    When I attempted to type in the command: batch regcopy1.txt.doc, I get the response of: The system cannot find the file or directory specified.

    So, should I somehow go back and delete regcopy1.txt.doc and regcopy2.txt.doc , before attempting to save them to my USB as regcopy1.txt and regcopy2.txt and starting the process again?

    Thank you again!
    Cindy
     
  41. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Right-click the link and select Save Link As, the file has to be an ascii text file for that to work. You successfully copied the files to C:\? If batch regcopy1.txt doesn't work, then try batch c:\regcopy1.txt, if that still fails then one or more of the registry files that the batchfile is trying to copy don't exist. Then a Repair Install will need to be done.
     
  42. aviano_2004

    aviano_2004 Private E-2

    Hi..

    I was able to save the two files to my USB, then copy both of them. I even ran the batch command as well.

    I prompted the computer to restart in safe mode (after exiting). At first I was given the message that I had to activate windows to continue (yes, in safe mode) So, I restarted again, in safe mode and now I'm receiving the error message of:

    userinit.exe - Application Error
    The application failed to initialize properly. (0xc00000006). Click ok to terminate the application.

    Thanks!
    Cindy
     
  43. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    1. Start the Recovery Console. If you do not have the Recovery Console installed, start it from the Windows XP compact disc (The CD). Follow the a. b. c. d. steps to install Recovery Console:

    a. Insert the Windows XP CD in your CD drive and restart your computer. If prompted, select any options required to boot from the CD.

    b. When the text-based part of Setup begins, follow the prompts; you need to choose the repair or recover option by pressing R .

    c. If you have a dual-boot or multiple-boot system, choose the installation that you need to access from the recovery console.

    d. When your prompted, type the Administrator password.

    2. At the command prompt, type cd system32 , and then press ENTER.

    3. Type ren userinit.exe wsaupdater.exe , and then press ENTER.

    4. Type map , and then press ENTER.

    5. Note the drive letter assigned to the CD-ROM drive that contains the Windows XP CD. It is displayed in a format similar to the following:

    D: \Device\CdRom0

    6. Type expand drive \i386\userinit.ex_ (where drive is the drive letter of the CD-ROM drive that contains the Windows XP CD), and then press ENTER. For example:

    Expand d:\i386\userinit.ex_ C:\WINDOWS\SYTEM 32

    Note
    the underscore character after the "X" in userinit.ex_

    The following message appears:

    userinit.exe
    1 file(s) expanded.

    7. Type in exit, after the computer restarts remove the Windows XP CD and start the computer normally

    You should be able to log into windows

    goto start , run then type regedit

    find the following registerkey :

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

    Userinit string value should be:

    C:\WINDOWS\system32\userinit.exe,

    On the damaged installations it's one of these:

    C:\WINDOWS\system32\wsaupdater.exe,
    C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wsaupdater.exe,

    In this case edit the string to :

    c:\windows\system32\userinit.exe,

    Everything should work fine now !
     
  44. aviano_2004

    aviano_2004 Private E-2

    Well, at this point, I received this again:

    userinit.exe - Application Error
    The application failed to initialize properly. (0xc00000006). Click ok to terminate the application.
     
  45. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

  46. aviano_2004

    aviano_2004 Private E-2

    Oooh, an "arrrrrrghhh" from your side as well!

    I truly do appreciate your help!

    Cindy
     
  47. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Windows just wants to be stubborn. There is only one option left if the repair install fails.
     
  48. aviano_2004

    aviano_2004 Private E-2

    Well........






    I got this dialogue box after entering my product code:

    COM+ Setup Error

    Sub-component COM+ raised an exception while processing the OC_COMPLETE_INSTALLATION setup message.
    d:\nt\com\com1x\src\complussetup]comsetup\scetuputil.cpp (line 3406)
    Error Code = 0x8007007f

    The specified procedure could not be found.
    Failed to load the library 'C:\WINDOWS\System32\comuid.dll'.


    There is an OK button at the bottom that I have not clicked yet.
     
  49. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Hit OK. Make a note of the file and error message and any futher messages so we can go back and fix those after you finished the repair install.

    If this fails you are going to have to do a clean install. Do you have a 'Knoppix CD'? That way you can backup any data you need to save.
     
  50. aviano_2004

    aviano_2004 Private E-2

    Cool name, but unfortunately I don't have it. I have a recent backup, with the majority of my files due to having to do a clean install on this computer at the beginning of June. Anything after that time is not worth saving. EXCEPT.....lol.........I have 4 albums of pictures taken this summer, that I have not yet uploaded and/or saved.

    Do you have a link for the knoppix?

    Thanks!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds