BleepingComputer.com: Request info on how best to uninstall/reinstall XP's SP3.

Hello Good People of Bleeping Computer!

I'm in the final stages of fixing a friend's computer that had been infected with Malware. If you're interested in the details of the fix, you can refer to this post:

Malware Posting for Vae Victis

The last entry in that post from the fabulous volunteer that's helping me clear my friend's computer recommends this:

"There is one problem left with the system that should be fixed. ComboFix identified 52 different modules with bad digital signatures which means that the Windows catroot catalog was probably corrupted by the infection. The recommended fix is to reinstall SP3 (service pack 3), but I am probably not the guy to help you with that. I think you would be better off getting someone from the XP operating system forum to assist you."

And so here I am. My friend's laptop seems to be clear of the effects of the Malware for now, but it appears that if I don't go through this step of reinstalling SP3, I might still run into troubles. I thought that I might try the Add or Remove Software control panel, but even though Service Pack 3 is listed, it doesn't provide the option to remove it. I wouldn't have done it anyways without asking the advice of this forum, but I wanted to see if it was even an option. So, can anyone out there provide some guidance on how to go about implementing the advice from the Malware thread so I can reinstall SP3 and start moving on with my life???

Please? Let me know if there's information you need regarding my friend's system. It's an HP Laptop with Windows XP, Home Edition, Version 2002, Service Pack 3, AMD Turion 64 Mobile.

Thanks so much for any assistance you can offer.

Jay

Have you tried any of these methods listed in this article : http://support.microsoft.com/kb/950249

Romeo29:

Thanks for the quick response. I had not seen that link yet. I tried the first option, but wasn't given the option of removing SP3. I'm a bit reluctant to try option 3, as the person that's helping me remove the Malware is recommending doing a System Restore AFTER I reinstall SP3. I don't know that it's a reason not to try option 3, but I will give it a shot if I don't see any other option. Option 4 isn't feasible as I don't have the Windows CD (it's not my computer and I'm not sure the owner still has the HP/Windows recovery CD.

So that leaves me with option 2, which seems easy enough.

In your experience, does reinstalling SP3 immediately after uninstalling SP3 seem like a fairly straightforward thing? Any thing I should be on the lookout for?

Thanks so much,

Jay

In my personal experience, I never had to go through any of these steps. I have slip-streamed SP3 with Windows XP and made a CD.
On a friends P3 computer, I once uninstalled SP3 and then reinstalled it and it took long time. I used the method 2 from the article I posted.

It is easy process. First uninstall SP3. Then after restarting your computer you can re-install SP3 again.

Romeo29:

I elected to follow the same method you did (Method 2). Everything went to hell afterwards. The uninstall seemed to go okay, although I was extremely nervous when it listed all of the "things" that could be impacted by the uninstall.

IE8 didn't work well after the uninstall, but it finally allowed me to download and reinstall SP3 from the Microsoft Update site. The reinstall took a long time but seemed trouble free until the reboot. After the reboot, IE8 refuses to connect to the Microsoft Update site. Absolutely refuses. And since I'm forced to use IE to get to the site (can't use Opera or Firefox or...), I have no manual way of getting all of the patches that need to be installed after the SP3 installation. I confirmed that automatic updates is enabled, and the laptop seemed to have downloaded a couple of patches, but I can't confirm that they actually got installed.

When I launch the "Add or Remove Software" control panel, the window that opens is blank. It shows nothing at all - no applications, no updates, no nothing. IE8 connects okay to other sites, as does Firefox. But it will not connect to Microsoft Update at all. So it seems that I am unable to get all of the myriad of updates that the computer now needs due to the fresh reinstall of SP3.

Any suggestions?

Jay

The WUS site is not the only way to get updates...have you tried connecting to the main Microsoft site?

Can you connect to an AV download website and download an AV program?

Have you run a full scan of the system with the installed AV program?

System manufacturer and model?

Did you read any guidance put out by the manufacturer of your system...before installing SP3?

Louis

FWIW: It seems that damaged files are often the results (IMO) of malware and malware-removal efforts. In such instances, the only way that I know of that can repair such...is a repair install of XP or running the sfc /scannow command with the appropriate updated CD.

Hamluis:

Thanks for your post. I have not tried connecting to the main Microsoft site - I went directly to Microsoft Updates. I'll try that tonight. But it seems like from there I'd still have to get to the Microsoft Update site, so I guess I'm missing the distinction you're making.

I have McAfee installed. I ran a full scan right before uninstalling SP3 and their were no issues identified.

The laptop is an HP, but I'm afraid I don't know the model number at the moment - I'll have to check when I get home this evening. The laptop is not mine - it belongs to a friend. I'm helping him remove some Malware that was causing browser redirects. One of the last steps in the process of removing the malware was to reinstall SP3 (you can follow that thread in detail from the link I provided in my first posting on this topic if you'd like).

I must admit that I did not read any guidance from HP regarding SP3 before reinstalling it on my friend's laptop. I concluded, perhaps incorrectly so, that if I were only reinstalling a program (e.g., SP3) that I had just uninstalled, there shouldn't be too many issues with it. My reasoning, simple as it may seem, was that if SP3 was on the laptop 20 minutes ago before I uninstalled it, then there shouldn't be much of a problem with putting SP3 back on it (I'm getting the feeling that was a very naive perspective). Both my wife and I have very similar (and perhaps the same) HP laptops as my friend's system, and my wife and I both loaded SP3 on our laptops when it was first made available. Neither of us have had any issues with SP3 on our HPs, and my friend didn't have any problems with SP3 on his system. The only reason I was uninstalling it and reinstalling it was at the suggestion of the volunteer in the Malware forum that is helping to rid my friend's laptop of the Malware.

That's where things stand now. I am frustrated that I may now have to reinstall XP or even worse (e.g., format the hard drive and start from scratch) after having spent > 2 weeks in the Malware forum running all sort of Malware-removal processes. I appreciate all of the help I've received on BleepingComputer and understand completely that as a volunteer-led program, I need to be patient and recognize that I'm getting free assistance to help with a very difficult issue. But if I have to start from scratch and reinstall XP, I would have preferred (obviously) to have done that 2+ weeks ago and saved myself and my friend a whole lot of hours and downtime. I'm not complaining - this site and it's volunteers have been very helpful and I owe them a wealth of gratitude. It's just that I feel the last 2+ weeks of "stuff" may have all been for nothing.

If that turns out to be the case, then the lesson that I will have learned from this experience is that if you get Malware and it takes more than 30 minutes to get rid of it, then plan on reloading the OS from scratch and save yourself a lot of time and hassle.

I'm still open to suggestions, but I'm getting close to pulling the plug and reloading XP and not sleeping for a couple of nights while I install the multitude of XP patches, etc. that I'll need to get the system back to where it's supposed to be.

I hope there's a separate level of hell for Malware authors and I hope that I can visit there often, bringing a big 'ole can of whoop-ass as a gift I can leave behind. It would also be nice if this particular level of hell didn't have the Internet, thereby creating panic and anxiety and a sense of loss in its wicked inhabitants. Yes, that would indeed be nice.

Again, thanks for your post. Any further support/ideas you can offer are greatly appreciated. I really mean that.

Jay

HP Instructions for SP3 - http://h10025.www1.hp.com/ewfrf/wc/documen...cname=c01452495

HP Instructions, Updating to SP2 - http://h10025.www1.hp.com/ewfrf/wc/documen...228&lang=de

<<I'm still open to suggestions, but I'm getting close to pulling the plug and reloading XP and not sleeping for a couple of nights while I install the multitude of XP patches, etc. that I'll need to get the system back to where it's supposed to be.>>

Well, you need to remember the time which has elapsed (and the malware vulnerabilities discovered) since SP3 was issued. I know that there are about 100 critical updates since then (I did a clean install on a system about 1 month ago). If you have a broadband connection, it goes fast. IE 8 is included in those updates, since reinstalling XP thru SP3 from a CD reverts back to IE 7.

<<Thanks for your post. I have not tried connecting to the main Microsoft site - I went directly to Microsoft Updates. I'll try that tonight. But it seems like from there I'd still have to get to the Microsoft Update site, so I guess I'm missing the distinction you're making.>>

All critical updates can be downloaded individually...the WUS is merely a convenient method for obtaining such, with a minimal amount of effort by the user. If a user examines the Security Bulletins issued by Microsoft since SP3...he/she can individually download the critical updates issued.

http://www.microsoft.com/technet/security/...in/summary.mspx

But...if you cannot access the general Microsoft site (not WUS), then that path is not available...and you have a problem that needs resolution.

Louis

Thanks for the info, Louis. I'll do some more work at home this evening and will gladly post the results of my vacation in hell as I attempt to unwind this laptop from the grips of almost certain doom.

Your advice and insight is greatly appreciated.

Regards,

Jay