Restore sys files in XP+SP2

[Akshay]

Recently my sys was affected by some tengo virus. Kaspersky detected it and disinfected around 25 files mostly from \system32 directory. But I think that kaspersky deleted/modified those files instead of cleaning them.

Now even files like cmd.exe, calc, spider, solitaire, etc. cannot be found. I copied some files from \servicepackfiles\i386. But how do I automatically restore sys files? I use XP + SP2. Which cd will be required for restoration of files?

 

[\/endett/\]

repair after booting from installation CD (winxp+sp2)

 

[dIgItaL_BrAt]

run 'sfc /scannow' and insert the xp cd when required.

 

[martian]

Recently my sys was affected by some tengo virus. Kaspersky detected it and disinfected around 25 files mostly from \system32 directory. But I think that kaspersky deleted/modified those files instead of cleaning them.

Now even files like cmd.exe, calc, spider, solitaire, etc. cannot be found. I copied some files from \servicepackfiles\i386. But how do I automatically restore sys files? I use XP + SP2. Which cd will be required for restoration of files?

Boot the computer using your XP CD. When you see the "Welcome To Setup" screen, you will see these options below:

1) To setup Windows XP now, press ENTER.
2) To repair a Windows XP installation using Recovery Console, press R.
3) To quit Setup without installing Windows XP, press F3.

Press Enter to start the Windows setup (DO NOT press 'R' and go to recovery console). Accept the License Agreement and Windows will search for existing Windows installations. Select the XP installation you want to repair from the list and press R to start the repair. Setup will copy the necessary files to the hard drive and reboot. Do not press any key to boot from CD when the message appears. Setup will continue as if it were doing a clean install, but your applications and settings will remain intact! [Well, if REPAIR is not one of the options, END setup. Or else you will delete your Windows folder and the Documents and Settings folders] You should exit setup if the repair option is not available and consider OTHER options stated below.

This is a possible Fix by reconfiguring boot.ini using Recovery Console.

1) Boot with XP CD or 6 floppy boot disk set.
2) Press R to load the Recovery Console.
3) Type bootcfg.
4) This should fix any boot.ini errors causing setup not to see the XP OS install.
5) Try the repair install.

If all these don't work, Reboot. This time press R to repair the Windows XP installation using Recovery Console. If your CD or DVD drive letter is say H: give these commands:

copy H:\i386\ntldr C:\
copy H:\i386\ntdetect.com C:\

And the following two commands might be needed

1) Type: attrib -h -r -s C:\boot.ini del C:\boot.ini
2) Type: BootCfg /Rebuild

As these two commands will get rid of any damaged boot.ini, search the disk for systems and make a new one. This might even result in a damaged windows reappearing; but gives another chance of getting at the repair.

Source of Info: *michaelstevenstech.com/XPrepairinstall.htm

 

[Akshay]

Thnx all for ur help but...

1. "run 'sfc /scannow' and insert the xp cd when required"
Nothing happens when I enter this command at the command prompt or in "run"

2. "Setup will copy the necessary files to the hard drive and reboot. Do not press any key to boot from CD when the message appears. Setup will continue as if it were doing a clean install, but your applications and settings will remain intact!..."

There seems to be a big risk in doing so as there r gr8 chances of corrupting OS here "Setup will continue as if it were doing a clean install..."

3. Regarding boot.ini, there is no prb. with the boot.ini file as the files required in \system32 are missing.

Is there not a utility/command which can scan sys files, report changes and then automatically restore selected files from the CD? Will reinstalling SP2 help?

 

[dIgItaL_BrAt]

Thnx all for ur help but...

1. "run 'sfc /scannow' and insert the xp cd when required"
Nothing happens when I enter this command at the command prompt or in "run"

does'nt the windows file protection dialog pop up?

 

[iMav]

2. "Setup will copy the necessary files to the hard drive and reboot. Do not press any key to boot from CD when the message appears. Setup will continue as if it were doing a clean install, but your applications and settings will remain intact!..."

There seems to be a big risk in doing so as there r gr8 chances of corrupting OS here "Setup will continue as if it were doing a clean install..."

what he means by that is xp will do an auto install (repair) of the OS and ur machine should possibly be back in working condition ..... if no1 else comes up with another solution which u feel is safer, take my advise this is a better option

 

[Akshay]

No. The windows protection dialog did not appear...

I remember reading in some issue of digit wherein exact command was given to extract modified/deleted files... If poss. will do it or will jus follow martian...

Meanwhile can anyone tell me which is d file which controls volume? my vol. icon has disappeared

 

[martian]

Akshay, when you do that way, all that Windows will do is replace all the required system files with new ones... And that way you can get back all your corrupted and lost system files! All unnecessary files will stay intact because your partition is not getting formatted...

I remember reading in some issue of digit wherein exact command was given to extract modified/deleted files... If poss. will do it

I think you can try copying those files this way from your Boot CD to your OS partition... If your CD or DVD drive letter is say H:, try this:

copy H:\i386\filename1 C:\
copy H:\i386\filename2 C:\ etc.

 

[Akshay]

Phew... finally d prb is solved.. ended up FORMATTING d sys... followd ur steps till

"Do not press any key to boot from CD when the message appears. Setup will continue as if it were doing a clean install, but your applications and settings will remain intact!..."

But after dat xp went on with installation as if doing a fresh installation and den d sys hung for quite sometime.. Had to restart bt by den everything was corrupt. Thankfully had taken back up of data... Guess I went wrong somewhere with installation...

 

[martian]

that shouldn't be happening... But... that should've worked

 

[uttoransen]

well sfc works and it's my favorite

just open the command prompt, type in sfc /scannow
and it's done, you need the xp cd to finish the process

 

[Akshay]

Digital brat had already suggested that but it didnt work...

 

[martian]

I'm sorry dude... Can't come up with a solution