Please help with Win XP recovery!!!

[undisclosed]

Hi I would really appreciate any help with this.

My antivirus found that a .dll file was infected and so I told it to
delete the file. Didn't know this would be a mistake...

Now the pc won't load into windows. It just hangs half way through boot
up.

I do have data on the drive I want to try to recover if possible so if
anyone can give me some ideas about what I should try to get it up and
running again that would be amazing.

The file was ws2_32.dll
PC is running WinXP Pro SP3
I have one hard drive partitioned into C: (Win install) and D: (apps
and files)

THANKS!!!


--
captain_69uk

[jose]

On Feb 9, 8:33

[r. mccarty]

That file is a monitored SFC/Windows File Protection component. As
soon as you deleted it the file would have been quietly replaced from the
DllCache or Service Pack source folder.

To get Windows running you might try a Safe Mode boot using the
"Last Known Working Configuration". Press F8 from a Cold boot to
get to the Safe Mode menu options.

The Dynamic Link Library file is a key Windows component related to
networking.

<undisclosed> wrote in message
news:3cad088f7b5926f7230ed71d31561459@nntp-gateway.com...
>
> Hi I would really appreciate any help with this.
>
> My antivirus found that a .dll file was infected and so I told it to
> delete the file. Didn't know this would be a mistake...
>
> Now the pc won't load into windows. It just hangs half way through boot
> up.
>
> I do have data on the drive I want to try to recover if possible so if
> anyone can give me some ideas about what I should try to get it up and
> running again that would be amazing.
>
> The file was ws2_32.dll
> PC is running WinXP Pro SP3
> I have one hard drive partitioned into C: (Win install) and D: (apps
> and files)
>
> THANKS!!!
>
>
> --
> captain_69uk

[undisclosed]

Thank you R I tried pressing F8 severl times after a cold boot but
nothing different happens. It gets to the same point in start up and
freezes. There is no instruction to hit F8 for options at any point
before the system freezes.

Is there anything else I could try?

Thanks


--
captain_69uk

[r. mccarty]

To "Catch" the safe mode menu you have to repeatedly press F8 at
about a 1/2 second interval. There is only a short time that the system
detects and responds to the F8 key press.

The reason for the Safe Mode boot is to determine if Windows is
bootable ( & not corrupted ). If Safe Mode does not work then the
next step is to perform an in-place or repair install of XP. :However,
if you have really critical data that must be saved you'd want to image
or backup the machine before attempting a repair install. For that
you would need bootable imaging capability from a program like
Acronis True Image or other imaging software.

If Safe Mode does work you would want to use that opportunity to
backup your data to something like a Flash Thumb drive.

<undisclosed> wrote in message
news:b319bb136d316e1237bab3cd062d3a1c@nntp-gateway.com...
>
> Thank you R I tried pressing F8 severl times after a cold boot but
> nothing different happens. It gets to the same point in start up and
> freezes. There is no instruction to hit F8 for options at any point
> before the system freezes.
>
> Is there anything else I could try?
>
> Thanks
>
>
> --
> captain_69uk

[william r. walsh]

Hi!

> The file was ws2_32.dll

How about this? You'll need a second computer, hopefully running the
same release of Windows at the same service pack level.

Put the hard drive from the computer that won't start up into the
working computer. Set it up as a slave drive (PATA) or plug it into an
open connector (for SATA drives). Then you should be able to copy the
missing file back to where it belongs, and your system should hopefully
start up again.

Update your anti-virus software immediately afterward if you are
successful in getting the system to run again.

William

[undisclosed]

Hi
thank you very much for all the replies.

to start with i have tried the easiest thing - i plugged in my old C:
hard drive which also still has winxp pro installed. i activated it and
it works.

i have also plugged in the problem drive (one that won't boot) in the
second SATA slot and windows explorer shows it as drive D:

BUT when try to open it i get a message saying 'drive D: is not
formatted. do you want to format it now?' !!!

what? how can this be the case?
has this virus somehow prevented acces to the hdd or should i try some
other options before re-installing windows?

as before any help is extremely gratefully received.
THANKS!


--
captain_69uk

[sc tom]

<undisclosed> wrote in message
news:b319bb136d316e1237bab3cd062d3a1c@nntp-gateway.com...
>
> Thank you R I tried pressing F8 severl times after a cold boot but
> nothing different happens. It gets to the same point in start up and
> freezes. There is no instruction to hit F8 for options at any point
> before the system freezes.
>
> Is there anything else I could try?
>
> Thanks
>
>
> --
> captain_69uk

If you have a USB keyboard, you may have to either go into your BIOS and
make sure Legacy USB Devices is enabled, or plug in a PS/2 keyboard so the
F8 keystroke is recognized.
--
SC Tom

[thecreator]

Hi captain_69uk,

Reformat and reinstall the Windows XP Pro under the original setup by
booting from the installation CD. Just make sure that the Data partition is
seen. You will need to reinstall all the other programs.


--
thecreator





<undisclosed> wrote in message
news:6f42decf3762872d4f881a6048ef4289@nntp-gateway.com...
>
> Hi
> thank you very much for all the replies.
>
> to start with i have tried the easiest thing - i plugged in my old C:
> hard drive which also still has winxp pro installed. i activated it and
> it works.
>
> i have also plugged in the problem drive (one that won't boot) in the
> second SATA slot and windows explorer shows it as drive D:
>
> BUT when try to open it i get a message saying 'drive D: is not
> formatted. do you want to format it now?' !!!
>
> what? how can this be the case?
> has this virus somehow prevented acces to the hdd or should i try some
> other options before re-installing windows?
>
> as before any help is extremely gratefully received.
> THANKS!
>
>
> --
> captain_69uk

[undisclosed]

Hi all thanks for all the answers.

I have done a Malwarebytes scan of the drive and it produces this log
file:

Malwarebytes' Anti-Malware 1.44
Database version: 3720
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/02/2010 17:03:46
mbam-log-2010-02-10 (17-03-46).txt

Scan type: Full Scan (D:\|)
Objects scanned: 106777
Time elapsed: 1 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Didn't take very long considering the size of all the media files that
are on there...

I have tried running setup from the WinXP cd and the program only sees
a partition which is approx 130gb (out of 320) and does NOT show
anything else!
It can't see the rest of the drive? I'm not sure what is best to do
now?

Any more help gratefully received!!!


--
captain_69uk

[undisclosed]

I also tried running the first stage of teh disk formatting program in
windows for teh problem drive and it only shows it has being 127gb when
its a 320gb drive...

I did transfer the whole of my old C: drive with windows install over
to this one (current problem drive) - could that be causing the problem?
The thing is i'm sure i formatted it before i did this so windows should
not be telling me the drive is not formatted, surely?

Anyone got any ideas? Reckon the HDD has somehow gone faulty?

thanks for any responses in advance.


--
captain_69uk

[thecreator]

Hi captain_69uk,

That's your problem. Never transfer. How large was the old Hard Drive?

Also the Hard Drive isn't faulty, your Windows XP CD is. It needs to be
at least Windows XP Pro Service Pack 2. You need to create a SlipStream XP
CD or buy one.

http://www.theeldergeek.com/slipstreamed_xpsp2_cd.htm


--
thecreator



<undisclosed> wrote in message
news:c7f8b4adbd27b43836309224f720e2b2@nntp-gateway.com...
>
> I also tried running the first stage of teh disk formatting program in
> windows for teh problem drive and it only shows it has being 127gb when
> its a 320gb drive...
>
> I did transfer the whole of my old C: drive with windows install over
> to this one (current problem drive) - could that be causing the problem?
> The thing is i'm sure i formatted it before i did this so windows should
> not be telling me the drive is not formatted, surely?
>
> Anyone got any ideas? Reckon the HDD has somehow gone faulty?
>
> thanks for any responses in advance.
>
>
> --
> captain_69uk

[undisclosed]

thanks

well that is a shame... so you're saying i won't be able to recover the
data on teh hard drive?


--
captain_69uk

[william r. walsh]

Hi!

> to start with i have tried the easiest thing - i plugged
> in my old C: hard drive which also still has winxp pro
> installed. i activated it and it works.

> what? how can this be the case?

It could be a very simple problem. How up to date is the old copy of XP
that you are using? Is it at least at the SP1 level?

If not, you need to fix that if you intend to use that to recover data
from your other drive.

If you do have SP1 or later, and the drive with the damaged copy of
Windows on it is larger than 137 gigabytes, you MUST enable 48-bit or
"big" LBA support by changing a registry setting.

http://support.microsoft.com/kb/303013

Otherwise, you won't be able to access the contents of a large drive,
and if you persist in trying, you will corrupt its contents, possibly
beyond any means of recovery.

William