I am trying to get rid of some Trojan Horses on my mother-in-laws computer. I posted a thread in the malware section where they realized I didn't have the XP SP2 updates. So I went to get and install them. After the installation the computer had to reboot, so I let it. Windows started to boot as usual, and the Windows XP screen came up with the blue loading bar moving underneath. After less than a minute I hear a click, and the computer reboots itself and starts over. This happens over and over again. So, I tried to get into Safe mode, but no luck. It does the same thing, rebooting after a certain point.

So, what can I do about this? Any help is greatly appreciated!

You can manually copy the data from a System Restore point to it's correct locations from the Recovery Console. See here:

http://forums.cclonline.com/showthread.php?t=1183

If you don't have an XP CD download either of these and create a bootable CD from the .iso file

XP Recovery Console
Another XP Recovery Console

You don't burn the iso file itself to CD., you create a CD from the iso file using your CD burning software. There is a good freeware burner called DeepBurner which will do this. Another called ISO Recorder is also very easy to use.

Boot the CD and at the first opportunity, enter R to start the Recovery Console.
Next, choose which XP installation you want to login to. Normally this will be 1.
Lastly you will be asked for the Administrator password. Just press the Enter key as the Administrator does not have a password (unless you gave it one, then you would enter it).

The alternative and maybe the only way you will fix this, is to do a Repair Install, but that will require either a XP CD or a OEM recovery CD or partition that supports it.

I'm trying to follow the instructions on the link you provided. Specifically:

When you get to the recovery console follow these instructions.

Type CD\ then Enter
Then cd system~1\_resto~1 then Enter
Type dir then Enter

None of them work if I follow the instructions as written. Can you please advice on what I'm supposed to do? I've never been in the Recovery Console before, and those instructions keep coming back with "The command is not recognized. Type HELP for a list of supported commands."

Okay, here is a better explanation (thanks wannabe1 )

Note the space between cd and the rest of the command. Ditto for copy.

When you get to the recovery console prompt:

• Type cd \ and press "Enter".
• Type cd system~1\_resto~1 and press "Enter".
• Type dir and press "Enter".

After you press enter you will see a list of folders (like rp1, rp2) If the list of restore points has more than one page then press the "Enter" key until you reach the end of the list

• Type cd rp {number of the second to last folder in the list} and press "Enter". (Example: Type cd rp9 if rp10 is the last restore point.)
• Type cd snapshot and press "Enter".
• Type copy _registry_machine_system c:\windows\system32\config\system and press "Enter".
• Type copy _registry_machine_software c:\windows\system32\config\software and press "Enter".
• Type exit and press "Enter".

Your PC will reboot.

If you get an access denied error when doing the above, then do the following at the recovery console:

• Type cd \ and press "Enter".
• Type cd windows\system32\config and press "Enter".
• Type ren system system.bak and press "Enter".
• Type exit and press "Enter".

Your PC will reboot, go back into the Recovery Console and start from the beginning.

Ok, I did all as instructed. PC rebooted and it came up with this error:

Windows could not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SYSTEM

You can attempt to repair this file by starting Windows Setup using the original Setup CD-ROM.
Select 'r' at the first screen to start repair.

So, is that what I should do next?

Also, will I have to attempt to redownload and install SP2, or will that be there still?

What you want to do now is to boot the computer. Don't worry about the installation or uninstallation of sp-2 at this stage.

1: In recovery console type chkdsk /r and press Enter. Let the process run to the end. If that doesn't enable bootup you will have to try the long process of registry hives repair.

Repair Registry Hives (adapted from Microsoft article 307545). Can only be performed on non-OEM operating systems.

Part 1:

At the recovery console (press Enter after each command):

md tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak
copy c:\windows\system32\config\software c:\windows\tmp\software.bak
copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak
copy c:\windows\system32\config\security c:\windows\tmp\security.bak
copy c:\windows\system32\config\default c:\windows\tmp\default.bak

delete c:\windows\system32\config\system
delete c:\windows\system32\config\software
delete c:\windows\system32\config\sam
delete c:\windows\system32\config\security
delete c:\windows\system32\config\default

copy c:\windows\repair\system c:\windows\system32\config\system
copy c:\windows\repair\software c:\windows\system32\config\software
copy c:\windows\repair\sam c:\windows\system32\config\sam
copy c:\windows\repair\security c:\windows\system32\config\security
copy c:\windows\repair\default c:\windows\system32\config\default

Type exit to quit Recovery Console. Your computer will restart.

Part 2:

1: Boot in safe mode.
2: In Folder Options uncheck "hide protected operating system file".
3: Double click C: drive.
4: Open the System Volume Information folder in c:
5: Open the folder restore-{………….}. The RPx folders inside are old restore points.
5: Right click the RP folder and click Properties. This will show when the restore point was created.
6: Inside there is a folder named snapshot. Open it, copy the following files and paste them into C:\windows\tmp folder.

_REGISTRY_USER_.DEFAULT
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_MACHINE_SAM

7: Rename the files in the C:\Windows\Tmp folder as follows:
• Rename _REGISTRY_USER_.DEFAULT to DEFAULT
• Rename _REGISTRY_MACHINE_SECURITY to SECURITY
• Rename _REGISTRY_MACHINE_SOFTWARE to SOFTWARE
• Rename _REGISTRY_MACHINE_SYSTEM to SYSTEM
• Rename _REGISTRY_MACHINE_SAM to SAM


Part 3:

1.Start Recovery Console. At the command prompt, type the following lines, pressing ENTER after you type each line:

del c:\windows\system32\config\sam
del c:\windows\system32\config\security
del c:\windows\system32\config\software
del c:\windows\system32\config\default
del c:\windows\system32\config\system

copy c:\windows\tmp\software c:\windows\system32\config\software
copy c:\windows\tmp\system c:\windows\system32\config\system
copy c:\windows\tmp\sam c:\windows\system32\config\sam
copy c:\windows\tmp\security c:\windows\system32\config\security
copy c:\windows\tmp\default c:\windows\system32\config\default

Type exit to quit Recovery Console. Your computer restarts.


Part 4:

1: Click Start, and then click All Programs.
2.Click Accessories, and then click System Tools.
3.Click System Restore, and then click Restore to a previous RestorePoint.


If still not successful then I am afraid that you are facing a backup of data and clean installtion of XP.

I completed part 1, but it will not boot into safe mode, nor regular mode at all. So, I guess I'm going to have to do a clean install.

Where do I format the disk? I believe the command is c:\format, correct? But I'm not sure where to do it.

I'll just start from scratch. I think it will be less headache. Thanks for the help. You can go ahead and close this thread.

This post has been edited by x__CRASH__x: Apr 27 2008, 01:47 PM