[Don'tcompute]

But it will go off after like 12 seconds >.< Arr! What's the cause off this? It shows the little box but just goes off after about 10 to 12 seconds.

Edited by Don'tcompute, 30 December 2007 - 11:51 PM.

[Advertisements]

Try running it from a command prompt, see if you get any additional information. Also check Event Viewer, see if there is anything being logged there that might help determine what is going on.

You can also try running it from your hard drive if you want to take the time to set it up.

Copy the entire I386 directory from the XP Install CD to the root of your boot drive (usually C:). You can do this from windows Explorer. Then copy the following data into Notepad and save it as "RunSFCFromHD.reg" to your Desktop or wherever you want to save it (enclose in double quotes when saving from Notepad, that way .txt doesn't get tacked onto the end of it).
[codebox]Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]

"SourcePath"="C:\\"
"ServicePackSourcePath"="C:\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]

"SourcePath"="C:\\"[/codebox]

Right click on RunSFCFromHD.reg and select Merge. This will update the registry entries to point to C:\I386 on your hard drive for things like SFC or Windows File Protection. If you boot from a drive other than C:, change the above as needed.

[Ztruker]

Try running it from a command prompt, see if you get any additional information. Also check Event Viewer, see if there is anything being logged there that might help determine what is going on.

You can also try running it from your hard drive if you want to take the time to set it up.

Copy the entire I386 directory from the XP Install CD to the root of your boot drive (usually C:). You can do this from windows Explorer. Then copy the following data into Notepad and save it as "RunSFCFromHD.reg" to your Desktop or wherever you want to save it (enclose in double quotes when saving from Notepad, that way .txt doesn't get tacked onto the end of it).
[codebox]Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]

"SourcePath"="C:\\"
"ServicePackSourcePath"="C:\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]

"SourcePath"="C:\\"[/codebox]

Right click on RunSFCFromHD.reg and select Merge. This will update the registry entries to point to C:\I386 on your hard drive for things like SFC or Windows File Protection. If you boot from a drive other than C:, change the above as needed.

[Don'tcompute]

Thanks I'll try that. Now I just gotta wait for someone to get off the computer >.< Lol, I'm using my PSP right now.

Oh yeah, my laptop already came with a copy of the XP CD on the harddrive, so this should be easy.

Edited by Don'tcompute, 31 December 2007 - 03:27 PM.

[Don'tcompute]

Wait, if I already had a copy of the XP disk on my Drive, does that mean I don't need to do that registry thing?

[Ztruker]

You will still need to merge the registry changes. You can run regedit and check the keys in the registry to see what they are currently set to first if you want.

One thing I did not mention and should have is to make a backup of the registry first. The best tool around to do this is ERUNT. When you install it, allow it to place an entry in Startup, that way every time you boot it will backup the registry. By default it keeps up to 30 days worth. It's a great program and has little or no impact on boot times.

[Don'tcompute]

It still doesn't work. I even try to run SFC from the command prompt, does the same thing, it just doesn't show up.
The only way I can get it to show up (for about 10 seconds!) is if I use the command prompt and type sfc /scanonce so that it will start on reboot.
And I already had a back-up of my registry, just so you know.

[Ztruker]

Install Dependency Walker then run it. Do a File / Open for

C:\Windows\system32\sfc.exe

See what errors display at the bottom. SFC works on my system and when I run Dependency Walker against sfc.exe, the only error I get is:

Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module.

[Don'tcompute]

http://www.picoodle....m...back=&mode= This is a photo of the only errors I get (I scrolled through and didn't find any other errors) You'll need to enlarge the image.

[Don'tcompute]

http://www.imageshar...33/untitled.jpg Use this one.

[Ztruker]

You need to scroll up in the window that has Module and Timestamp column headers. See what other files are missing, but for sure, you need EFSADU.DLL in C:\Windows\system32 (that's where it is on my system). The file is on the XP CD in the \I386 directory in compressed format as EFSADU.DL_.

You can use the expand command from a command prompt to extract it from the CD and put it where it belongs. Enter expand /? for usage info.

[Don'tcompute]

Yeah, I already scrolled through to see if anything is missing, those were the only ones.
And I'll try that, thanks.

[Ztruker]

You might want to also replace all the sfc files.


sfc.dll
sfc.exe
sfcfiles.dll
sfc_os.dll

They are all in the \I386 directory on the CD and all go in C:\Windows\system32.

[Ztruker]

I should have said this before. There are several viruses that infect various parts of SFC. It would be a good idea for you to read through this area:
Malware Removal Guides and Tutorials

Post your HijackThis log here:
Malware Removal - HijackThis™ Logs Go Here

Be patient as the malware removal experts are extremely busy and it may take a day or three for them to get to you.

[Don'tcompute]

http://www.imageshar.../untitled_1.jpg I replaced that one .dll file. But what do the one's in red mean? (this time I combined two parts so you can see the other side)

By the way, I don't have a XP CD, only the copy on my harddrive, but I cant find any SFC files in there, I use the search function to search withen the I386 folder, but no results.

Oh yeah, I did a full scan today (Norton), no viruses.

Edited by Don'tcompute, 31 December 2007 - 07:16 PM.

[Don'tcompute]

Eh, the picture's a little small, oops.