BleepingComputer.com: I need Major help!!!

Hello guys,
I recently downloaded a virus(a Trojan I believe) that directed me to abnow.com whenever I clicked a link in a Google, Bing, Yahoo search etc. I tried removing it with many free programs but none of them worked, so I downloaded "Spyware Doctor" yesterday which fixed the problem of being redirected to abnow.com. However, this morning, when I tried to connect to the internet, it said Acquiring Network address and remained that way forever. First I uninstalled Spyware Doctor cause I thought it might be responsible. Then, I tried a system restore to yesterday, but the computer will not reboot now. It says, "We apologize for the inconvenience, but Windows did not start successfully. A recent hardware or software change might have caused this." It then lets me choose from: Safe Mode, Safe Mode with Networking, Safe Mode with Command Prompt, Last Known Good Configuration, and Start Windows Normally. No matter which one I click, it tries rebooting and then brings me right back to this page........... I am somewhat adept at using computers, but this is beyond me. Please Help!!
Thanks

This post has been edited by hamluis: 09 February 2012 - 12:57 PM
Reason for edit: Moved from XP to Am I Infected.

Hi,

Lets give it a try.

We will need to view the system status from an external environment. You will need a USB drive and a CD to burn. There will be several steps to follow.

Download GETxPUD.exe to the desktop of your clean computer

• Run GETxPUD.exe
  
• A new folder will appear on the desktop.
  
• Open the GETxPUD folder and click on the get&burn.bat
  
• The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
  
• Click on Start and follow the prompts to burn the image to a CD.
  
• Next download driver.sh to your USB drive
  
• Also Download Query.exe to the USB drive. In your working computer, navigate to the USB drive and click on the Query.exe. A folder and a file, query.sh, will be extracted.
  
• Remove the USB & CD and insert them in the sick computer
  
• Boot the Sick computer with the CD you just burned
  
• The computer must be set to boot from the CD
  
• In some computers you need to tap F12 and choose to boot from the CD, in others is the Esc key. Please consult your computer's documentation.
  
• Follow the prompts
  
• A Welcome to xPUD screen will appear
  
• Press File
  
• Expand mnt
  
• sda1,2...usually corresponds to your HDD
  
• sdb1 is likely your USB
  
• Click on the folder that represents your USB drive (sdb1 ?)
  
• Confirm that you see driver.sh that you downloaded there
  
• Press Tool at the top
  
• Choose Open Terminal
  
• Type bash driver.sh
  
• Press Enter
  
• After it has finished a report will be located on your USB drive named report.txt
  
• Then type bash driver.sh -af
  
• Press Enter
  
• You will be prompted to input a filename.
  
• Type the following:
  
  
  Winlogon.exe
  
  
• Press Enter
  
• If successful, the script will search for this file.
  
• After it has completed the search enter the next file to be searched
  
• Type the following:
  
  
  volsnap.sys
  
  
• Press Enter
  
• If successful, the script will search for this file.
  
• After it has completed the search enter the next file to be searched
  
• Type the following:
  
  
  explorer.exe
  
  
• Press Enter
  
• After it has completed the search enter the next file to be searched
  
• Type the following:
  
  
  Userinit.exe
  
  
• Press Enter
  
• After the search is completed type Exit and press Enter.
  
• After it has finished a report will be located in the USB drive as filefind.txt
  
• While still in the Open Terminal, type bash query.sh
  
• Press Enter
  
• After it has finished a report will be located in the USB drive as RegReport.txt
  
• Then type dd if=/dev/sda of=mbr.bin bs=512 count=1
  
  
  
  Leave a space among the following Statements:
  
  dd is the executable application used to create the backup
  if=/dev/sda is the device the backup is created from - the hard drive when only one HDD exists
  of=mbr.bin is the backup file to create - note the lack of a path - it will be created in the directory currently open in the Terminal
  bs=512 is the number of bytes in the backup
  count=1 says to backup just 1 sector
  
  
  It is extremely important that the if and of statements are correctly entered.
  
  
• Press Enter
  
• After it has finished a report will be located in the USB drive as mbr.bin
  
• Plug the USB back into the clean computer, zip the mbr.bin, and except for the mbr.bin zipped file, post the contents of the report.txt, filefind.txt and RegReport.txt in your next reply. The mbr.bin zipped file must be attached to your reply.

Hello, just letting you know I moved this topic to Here in the Virus, Trojan, Spyware, and Malware Removal Logs forum where it will stay.

Please remember to click the Watch Topic button at the top right and select Immediate Notification so you do not miss any replies now that you were moved.

Thanks JSntgRvr for helping me.
I followed your instructions and was able to boot from the CD. However, even though "driver.sh" is clearly on my portable hard drive, when I clicked on the sdb1 folder, I couldn't find it. For that matter, I din't recognize any of the files and folders in that folder......No "My Documents, My Music, etc." that I have on my portable hard drive. Let me know what to do.
I greatly appreciate this

Is it a Portable Hard Drive or USB Flash Drive? While on xPUD, remove the USB drive, wait two seconds and reinsert. See if xPUD will mount it. You will be able to see the progress on the top right corner in xPUD.

This post has been edited by JSntgRvr: 11 February 2012 - 01:41 PM

Ok, that worked so I finished all the other steps. Unfortunately, when I plugged my hard drive in to the clean computer, the mbr.bin report dissapeared even though I could see it on the protable hard drive when it was plugged into the broken computer. Should I start the steps over from a certain place? Anyway, here are the contents from the other reports:

report.txt:

Sun Feb 12 18:06:07 UTC 2012
Driver report for /mnt/sdb2/WINDOWS/system32/drivers

841f385c6cfaf66b58fbd898722bb4f0 aec.sys
Microsoft Corporation

fbbcb95f677cbaa924140b6ea2d9a97b ALCXSENS.SYS
Sensaura

45bf4e8d77d700ff54d6d1097750f64e ALCXWDM.SYS
Realtek Semiconductor

dad16a9d5c873e7219e6b43802ed316a amdk6.sys
Microsoft Corporation

680ad1c1bb16239e28d8f33a54a7a3c7 amdk7.sys
Microsoft Corporation

f0d692b0bffb46e30eb3cea168bbc49f arp1394.sys
Microsoft Corporation

d9f724aa26c010a217c97606b160ed68 audstub.sys
Microsoft Corporation

c1b486a7658353d33a10cc15211a873b cdaudio.sys
Microsoft Corporation

b562592b7f5759c99e179ca467ecfb4c cinemst2.sys
Ravisent Technologies

9624293e55ad405415862b504ca95b73 cpqdap01.sys
Compaq Computer Corp

6af1684ccaac3f7ef4ee9ba65eb0677a crusoe.sys
Microsoft Corporation

a6f881284ac1150e37d9ae47ff601267 DMusic.sys
Microsoft Corporation

1ed4dbbae9f5d558dbba4cc450e3eb2e drmkaud.sys
Microsoft Corporation

ff86422268de771d571e123eb7092c6a drmk.sys
Microsoft Corporation

80d1b490b60e74e002dc116ec5d41748 enum1394.sys
Microsoft Corporation

1e580770bdece924494b368ac980749e Fasttx2k.sys
Promise Technology

455f778ee14368468560bd7cb8c854d0 fsvga.sys
Microsoft Corporation

8210b0b16e674586d331e804f81635bd GEARAspiWDM.sys
GEAR Software

cbbb304dc69e0b56f789852f6455f7ec Hdaudbus.sys
Windows Server DDK provider

160b24fd894e79e71c983ea403a6e6e7 Hdaudio.sys
Windows Server DDK provider

53fdf10a5baf4f0a345bc5e941392186 ialmnt5.sys
Intel Corporation

d93cad07c5683db066b0b2d2d3790ead kmixer.sys
Microsoft Corporation

eb7ffe87fd367ea8fca0506f74a87fbb ksecdd.sys
Microsoft Corporation

b9540e258f952650de8dec68719a5c97 ks.sys
Microsoft Corporation

729d83e56c29c510258a6e9e79ffddc3 mf.sys
Microsoft Corporation

6fc6f9d7acc36dca9b914565a3aeda05 modem.sys
Microsoft Corporation

34e1f0031153e491910e12551400192c mouclass.sys
Microsoft Corporation

ae431a8dd3c1d0d0610cdbac16057ad0 MSKSSRV.sys
Microsoft Corporation

13e75fef9dfeb08eeded9d0246e1f448 MSPCLOCK.sys
Microsoft Corporation

1988a33ff19242576c3d0ef9ce785da7 MSPQM.sys
Microsoft Corporation

469541f8bfd2b32659d5d463a6714bce mssmbios.sys
Microsoft Corporation

34d6cd56409da9a7ed573e1c90a308bf ndisuio.sys
Microsoft Corporation

5c5c53db4fef16cf87b9911c7e8c6fbc nic1394.sys
Microsoft Corporation

be984d604d91c217355cdd3737aad25d nikedrv.sys
Diamond Multimedia Systems

b78be402c3f63dd55521f73876951cdd ntfs.sys
Microsoft Corporation

228a9c8361ab4dc379f17890cd9f05fe nv4_mini.sys
NVIDIA Corporation

c0fcd544a1c4eea6d11a0ae6a07dac9d nv_agp.SYS
NVIDIA Corporation

3e16eff2a6fed2d8d7f5a66dfe65d183 p3.sys
Microsoft Corporation

29744eb4ce659dfe3b4122deb45bc478 parport.sys
Microsoft Corporation

3478cc7a161365ab999108008434a74c portcls.sys
Microsoft Corporation

0d97d88720a4087ec93af7dbb303b30a processr.sys
Microsoft Corporation

9b793a1ffd480155fe9ee5261153f21b PS2.sys
Hewlett-Packard

d6ab98dcf05efe76431414efb49ed66a pxhelp20.sys
Sonic Solutions

2ef9c0dc26b30b2318b1fc3faa1f0ae7 R8139n51.sys
Realtek Semiconductor

a2cae2c60bc37e0751ef9dda7ceaf4ad rdpdr.sys
Microsoft Corporation

b31b4588e4086d8d84adbf9845c2402b redbook.sys
Microsoft Corporation

a56fe08ec7473e8580a390bb1081cdd7 rio8drv.sys
Diamond Multimedia Systems

0a854df84c77a0be205bfeab2ae4f0ec riodrv.sys
Diamond Multimedia Systems

6a00e322875e3b3a074ad6d45e7b7e36 RtkHDAud.sys
Realtek Semiconductor

d507c1400284176573224903819ffda3 RTL8139.sys
Realtek Semiconductor

61ca562def09a782d26b3e7edec5369a SISAGPX.SYS
Silicon Integrated Systems

7467e510c81b19a6b590a3868f499b23 sisgrp.sys
Silicon Integrated Systems

addc9e4757a68ab60562ad3cb9c288d6 sonydcam.sys
Microsoft Corporation

8e186b8f23295d1e42c573b82b80d548 splitter.sys
Microsoft Corporation

14ed728e44b0e7a169217127d8510ca9 srvkp.sys
Silicon Integrated Systems

c43356072eb3e88cd62958db10cead47 stream.sys
Microsoft Corporation

03c1bae4766e2450219d20b993d6e046 swenum.sys
Microsoft Corporation

94abc808fc4b6d7d2bbf42b85e25bb4d swmidi.sys
Microsoft Corporation

82191317e87f7a6585f64a5fc4bcc82e symdns.sys
Symantec Corporation

05d9613efe7809e384c10da26958dfa4 SYMEVENT.SYS
Symantec Corporation

4d66e4ca207dc90819ad6cfc834e21ae symfw.sys
Symantec Corporation

f0416c78d40c763c24fd3707e34c7755 SymIDSCo.sys
Symantec Corporation

fb2d0c80a7feb284353e397cd18816ad symids.sys
Symantec Corporation

3e01bb3970c24ac02d56b11cddb0d2ad symndis.sys
Symantec Corporation

d709583a1efb3a293267d637a10e5413 symredrv.sys
Symantec Corporation

f5c8782c206a3860cb3cdd68f2810993 symtdi.sys
Symantec Corporation

650ad082d46bac0e64c9c0e0928492fd sysaudio.sys
Microsoft Corporation

a540a99c281d933f3d69d55e48727f47 termdd.sys
Microsoft Corporation

699450901c5ccfd82357cbc531cedd23 tosdvd.sys
Microsoft Corporation

d74a8ec75305f1d3cfde7c7fc1bd62a9 tsbvcap.sys
Toshiba Corporation

87a0e9e18c10a9e454238e3330e2a26d tunmp.sys
Microsoft Corporation

61018ba9df6b63e51d9753c980e73ec2 usbcamd2.sys
Microsoft Corporation

2654eecc6fb13603ebddcd5c8ea943d1 usbcamd.sys
Microsoft Corporation

2853fd4c4489e0f8bfcf78efcdb7e998 usbintel.sys
Microsoft Corporation

55e01061c74a8cefff58dc36114a8d3f vdmindvd.sys
Ravisent Technologies

4b039bbd037b01f5db5a144c837f283a VIAAGP1.SYS
VIA Technologies

19bba101cb87d18ff04e7f24e1792ab0 vtmini.sys
tH`VS_VERSION_INFOnn?b*StringFileInfoBn'CompanyNameCopyright©VIA/SGraphicsCo,Ltd.XFileDescriptionVIA/SGMiniportDriverRFileVersion...-...vInternalNamevtmini.sysELegalCopyrightCopyright©VIATechnologies,Inc.andSGraphicsCo,Ltd.>vOriginalFilenamevtmini.sysTProductNameUniChrome(Pro)IGPDriverVProductVersion...-...DVarFileInfo$Translationt*

2797f33ebf50466020c430ee4f037933 wdmaud.sys
Microsoft Corporation

Driver report for /mnt/sdb1/MiniNT/system32/drivers
3dcbaa767f4bda89e33729628ebe7739 Ramdrv.sys has NO Company Name!

0bb606c67a0fa5b49575fdffd41fab50 1394bus.sys
Microsoft Corporation

f5e227af17514d92c180b7723573a7de 1394vdbg.sys
Microsoft Corporation

6abb91494fe6c59089b9336452ab2ea3 abp480n5.sys
Microsoft Corporation

0d77d50de9e4aa8e71fb06cfc303210a acpiec.sys
Microsoft Corporation

1bec76bb56f57be93cfe588f6a8600dc acpi.sys
Microsoft Corporation

9a11864873da202c996558b2106b0bbc adpu160m.sys
Microsoft Corporation

560dce566000fed5bbfcbca321dbb84b afd.sys
Microsoft Corporation

c23ea9b5f46c7f7910db3eab648ff013 aha154x.sys
Microsoft Corporation

19dd0fb48b0c18892f70e2e7d61a1529 aic78u2.sys
Microsoft Corporation

b7fe594a7468aa0132deb03fb8e34326 aic78xx.sys
Microsoft Corporation

1140ab9938809700b46bb88e46d72a96 aliide.sys
Acer Laboratories

79f5add8d24bd6893f2903a3e2f3fad6 amsint.sys
Microsoft Corporation

69eb0cc7714b32896ccbfd5edcbea447 asc3350p.sys
Microsoft Corporation

5d8de112aa0254b907861e9e9c31d597 asc3550.sys
Advanced System Products

62d318e9a0c8fc9b780008e724283707 asc.sys
Advanced System Products

03f403b07a884fc2aa54a0916c410931 asyncmac.sys
Microsoft Corporation

a64013e98426e1877cb653685c5c0009 atapi.sys
Microsoft Corporation

9528b988ac46697efbcab6017e6525a0 b1cbase.sys
AVM GmbH

da1f27d85e0d1525f6621372e7b685e9 beep.sys
Microsoft Corporation

90a673fc8e12a79afbed2576f6a7aaf9 cbidf2k.sys
Microsoft Corporation

f3ec03299634490e97bbce94cd2954c7 cd20xrnt.sys
Microsoft Corporation

c1b486a7658353d33a10cc15211a873b cdaudio.sys
Microsoft Corporation

bab95bbefd0676eab2dc02cf88c99fc5 cdfs.sys
Microsoft Corporation

cb762e814f602229a574f4d78d3d6a30 cdrom.sys
Microsoft Corporation

488fcf3bc3651a4a7681f4f5052d6801 classpnp.sys
Microsoft Corporation

ed146077f90dc8c5efa48525a005f711 cmdide.sys
CMD Technology

3ee529119eed34cd212a215e8c40d4b6 cpqarray.sys
Microsoft Corporation

e550e7418984b65a78299d248f0a7f36 dac2w2k.sys
Mylex Corporation

683789caa3864eb46125ae86ff677d34 dac960nt.sys
Microsoft Corporation

5f34383e02721891f92bd2d7ba39b712 dgapci.sys
Digi International

9ae322f68cb80e6b1681b3a650e93edd digirlpt.sys
Digi International

99a1ffd0e527d3b88e34735d85eaaa04 dimaint.sys
Eicon Technology

46f833f8bcb4af005802a1743b6fcbaa diskdump.sys
Microsoft Corporation

43a10cd19d648e57ed039a6caa667a56 disk.sys
Microsoft Corporation

dcca5bfbe72293ffeae85fdffbdc2359 dmboot.sys
Microsoft Corp

dd4aaa1feaf418efcc3bf6b5515d76f7 dmio.sys
Microsoft Corp

e9317282a63ca4d188c0df5e09c6ac5f dmload.sys
Microsoft Corp

40f3b93b4e5b0126f2f5c0a7a5e22660 dpti2o.sys
Microsoft Corporation

fe97d0343acfdebdd578fc67cc91fa87 dxapi.sys
Microsoft Corporation

eb4d3fd051c7acedee85f430314aeb6e dxg.sys
Microsoft Corporation

a73f5d6705b1d820c19b18782e176efd dxgthk.sys
Microsoft Corporation

4063a77fa6f2c8cd48cbe9ac6eb8d213 em556n4.sys
Com Corporation

80d1b490b60e74e002dc116ec5d41748 enum1394.sys
Microsoft Corporation

52016d76b6f9810186dfdd5ccd53fa79 et4000.sys
Microsoft Corporation

998bbf32a142910b5e539df4225df892 fastfat.sys
Microsoft Corporation

f0196b7a8fe3098099721675db361272 fasttrak.sys
Promise Technology

2c0d70f0318870257ad99bf400f0c596 fasttx2k.sys
Promise Technology

19c5c7eac0190a42522290bf002f64ea fdc.sys
Microsoft Corporation

21e41e89b9b191b685f99b7a8885310b flpydisk.sys
Microsoft Corporation

3e1e2bd4f39b0e2b7dc4f4d2bcc2779a fs_rec.sys
Microsoft Corporation

7cb1a1f0cb7996f95b35e1bb3be5e3ad fsvga.sys
Microsoft Corporation

f0196b7a8fe3098099721675db361272 ft100.sys
Promise Technology

869fe1b01ac3bf08555d7a6d7d605aee ftdisk.sys
Microsoft Corporation

b16e2511bb8acd1180db6c3b25ea5f0f fttx2.sys
Promise Technology

8605e1476922cdf789ca0f2e682d8ca2 hidclass.sys
Microsoft Corporation

d099d5a07e97b09ca6a8070ca58678e7 hidparse.sys
Microsoft Corporation

1de6783b918f540149aa69943bdfeba8 hidusb.sys
Microsoft Corporation

b028377dea0546a5fcfba928a8aefae0 hpn.sys
Microsoft Corporation

28af0055d23aeb3eaefda362342704fd hpt366.sys
Microsoft Corporation

a59c16c709ba100c0f1d70f404cf129f hpt371.sys
HighPoint Technologies

cd983677b18396fd9d8788366a63d31f hpt374.sys
HighPoint Technologies

026ebdbf49a5017187a99c7e2634ce5f hpt3xxNT.sys
HighPoint Technologies

b077b7f8e79779ea967e84a4fc040227 hpt3xx.sys
HighPoint Technologies

24bd4052a2c5eb5dadc6cc69b57f0ffa hptpro.sys
HighPoint Technologies

aeb15ed12bb5a2ce62d900a97207e78b i2omgmt.sys
Microsoft Corporation

83e0f7a55077ba8d13421f0febbae2fa i2omp.sys
Microsoft Corporation

66f668c8f0fa089e2c6c1a9320425002 i8042prt.sys
Microsoft Corporation

50b56e7de809be4b8f4d24b3f0381520 iaStor.sys
Intel Corporation

4a40e045faee58631fd8d91afc620719 ini910u.sys
Microsoft Corporation

808720499635df975919e055d6c54a94 inport.sys
Microsoft Corporation

d57b586caf15482ae5beef2eb8082766 intelide.sys
Microsoft Corporation

8f1604ad7f8f8b6339e53d93c46187a8 io8.sys
Perle Systems

731f22ba402ee4b62748adaf6363c182 ipfltdrv.sys
Microsoft Corporation

f56dd863ba732a4e8ee58d486c31250f ipinip.sys
Microsoft Corporation

fc672ad6e9676814a0c844912f2abcff ipnat.sys
Microsoft Corporation

1c4802409cfd4a7051f458b744cfcaa5 ipsec.sys
Microsoft Corporation

d6bfe76282f47d1d054511639d17fc9e isapnp.sys
Microsoft Corporation

c53360c1932904fe89c6be55378628cb iteraid.sys
Integrated Technology Express

5d11ec35cb37a17562d8ff8056b4d14d kbdclass.sys
Microsoft Corporation

0d2b027eef0ca56a93e98015ec7f0533 kbdhid.sys
Microsoft Corporation

abc70e8b89cce44731a346deb764bf95 ksecdd.sys
Microsoft Corporation

08f2089704ffe8ba672ab2130fb82111 ks.sys
Microsoft Corporation

db35284e9acd15ec5337a50023d5394c lbrtfdc.sys
Toshiba Corporation

64e8b7c65eb4796939c0f64f8170821b loop.sys
Microsoft Corporation

d1f8be91ed4ddb671d42e473e3fe71ab mcd.sys
Microsoft Corporation

9c46695db5d49d9a7333807430a43be2 mf.sys
Microsoft Corporation

4ae068242760a1fb6e1a44bf4e16afa6 mnmdd.sys
Microsoft Corporation

7760873e4ec17f288e61f00044dea000 modem.sys
Microsoft Corporation

f6fd0aaa4f925b470e15fda1f07874c1 mouclass.sys
Microsoft Corporation

fe9f5189d425465373850ed362f8e817 mouhid.sys
Microsoft Corporation

d4face53a1c48cf8419b4cf494d2ee2e mountmgr.sys
Microsoft Corporation

3f4bb95e5a44f3be34824e8e7caf0737 mraid35x.sys
American Megatrends

a1831538e119363d0d90d757ac8a2012 msfs.sys
Microsoft Corporation

099a20936df7e93a4718a3577518a2f0 mup.sys
Microsoft Corporation

3b350e5a2a5e951453f3993275a4523a ndis.sys
Microsoft Corporation

59fc3fb44d2669bc144fd87826bb571f ndproxy.sys
Microsoft Corporation

20aba9f035e3a98877480e34fcc4dcb3 npfs.sys
Microsoft Corporation

70fae0dcfdfaa0838d6778fca028ce01 ntfs.sys
Microsoft Corporation

73c1e1f395918bc2c6dd67af7591a3ad null.sys
Microsoft Corporation

4b7a1230820ed27834050cb32a0e3b64 NvAtaBus.sys
NVIDIA Corporation

55db817feb931ac38c01a0fc9886fa76 nvraid.sys
NVIDIA Corporation

d72273fefcc1fb32f214e344667c243f ohci1394.sys
Microsoft Corporation

4bb30ddc53ebc76895e38694580cdfe9 oprghdlr.sys
Microsoft Corporation

548fd57f202b1078d3fb9a0c7915b00a parport.sys
Microsoft Corporation

3334430c29dc338092f79c38ef7b4cd0 partmgr.sys
Microsoft Corporation

93868ff47f04e1137ad510eec0955e45 parvdm.sys
Microsoft Corporation

eeee81c859fe3f1ae769c13adccc12c8 pciide.sys
Microsoft Corporation

9ea1e5058f8bc648b4d14425189d85a4 pciidex.sys
Microsoft Corporation

9390447f3b1be5064a3ebe98c555a1e5 pci.sys
Microsoft Corporation

a9bed83ec41b38bee62bf9413f4b7d24 pcmcia.sys
Microsoft Corporation

f50f7c27f131afe7beba13e14a3b9416 perc2hib.sys
Microsoft Corporation

6c14b9c19ba84f73d3a86dba11133101 perc2.sys
Microsoft Corporation

7244caa53fd234cec0cbfbf8cef7927f ppa3.sys
Microsoft Corporation

0a63fb54039eb5662433caba3b26dba7 ql1080.sys
QLogic Corporation

6503449e1d43a0ff0201ad5cb1b8c706 ql10wnt.sys
Microsoft Corporation

156ed0ef20c15114ca097a34a30d8a01 ql12160.sys
QLogic Corporation

70f016bebde6d29e864c1230a07cc5e6 ql1240.sys
Microsoft Corporation

907f0aeea6bc451011611e732bd31fcf ql1280.sys
QLogic Corporation

3e9e4476b6cda375409fd3216e5e824e ramdisk.sys
Microsoft Corporation

3dcbaa767f4bda89e33729628ebe7739 Ramdrv.sys

f18e651e4b6c7d8bd367454e016ab5d4 rndismp.sys
Microsoft Corporation

0d3830c0d64a2a9ec4238a758850ae39 sbp2port.sys
Microsoft Corporation

9b6b64c62f137b3a5e0df30f623c3c18 scsiport.sys
Microsoft Corporation

65a7c4d86c153c82e33a552c217abb29 serenum.sys
Microsoft Corporation

28d34224f1d792e85a4f98192db25d5a serial.sys
Microsoft Corporation

a1f76325cef251827a78e8aeb93504dd setupdd.sys
Microsoft Corporation

cc9f1e77ba1777a0d25b05b278731a7d sfloppy.sys
Microsoft Corporation

19b8d029bce41c88fc53167726774502 SI3114R.sys
Silicon Image

1582e88c6f340627247b1ecd00fa84fe SIWinAcc.sys
Silicon Image

80b86f9b9ec4cd0e25627e4a7c54826a slip.sys
Microsoft Corporation

017daecf0ed3aa731313433601ec40fa smclib.sys
Microsoft Corporation

83c0f71f86d3bdaf915685f3d568b20e sparrow.sys
Adaptec

fc127c45cf908c633b2c032f7c406718 spddlang.sys
Microsoft Corporation

f4901a7692349f01d20e39a7f3d1d3d6 speed.sys
Perle Systems

c0e7e159415c1d10a88297b7eba01066 streamip.sys
Microsoft Corporation

064740c5c02de46723c4b8200ee876df swenum.sys
Microsoft Corporation

1ff3217614018630d0a6758630fc698c symc810.sys
Symbios Logic

070e001d95cf725186ef8b20335f933c symc8xx.sys
LSI Logic

80ac1c4abbe2df3b738bf15517a51f2c sym_hi.sys
LSI Logic

bf4fab949a382a8e105f46ebb4937058 sym_u3.sys
LSI Logic

2352864ea90cb23dfc7ed5d44283bae7 tape.sys
Microsoft Corporation

fd6a09d156139030729cf5f08f5d0cb9 tdi.sys
Microsoft Corporation

550d77c8ea289f67c9ef7d179379015e tffsport.sys
M-Systems

699450901c5ccfd82357cbc531cedd23 tosdvd.sys
Microsoft Corporation

f85e286f98b44e20420a792aa5abf5a5 toside.sys
Microsoft Corporation

5b96ede913bfa5384725ce1cc4e2b6e4 u133.sys
Promise Technology

0bad94aa644ce926cdeb6e57fca09031 udfs.sys
Microsoft Corporation

1b698a51cd528d8da4ffaed66dfc51b9 ultra.sys
Promise Technology
Promise Technology
Promise Technology
Promise Technology
Promise Technology

164cfae1d766905f56c432acfc54f28c update.sys
Microsoft Corporation

7f3366de16a0e9390da0ed32ab58d05d usbccgp.sys
Microsoft Corporation

596eb39b50d6ebd9b734dc4ae0544693 usbd.sys
Microsoft Corporation

2d0c2f3836f72e85d41d9c50aeeb5423 usbehci.sys
Microsoft Corporation

1766faa3a5079d0db3efb331dac587ed usbhub.sys
Microsoft Corporation

ba6b6215621255f0cd231f08b7d5d8cb usbohci.sys
Microsoft Corporation

81d55a273810e5b20456e4decb7e00ff usbport.sys
Microsoft Corporation

694f2b90124eb086c38c18da97a13e48 usbstor.sys
Microsoft Corporation

b8f6119fd7df389d823ba27a3023e150 usbuhci.sys
Microsoft Corporation

1e379233dd5ead78bd367c94576a1fc2 vga.sys
Microsoft Corporation

1c0cbb4e50d37059ce41cd134f6b5ab7 viaide.sys
Microsoft Corporation

81e7d3857a6ab6416fddf36a97fd65b7 videoprt.sys
Microsoft Corporation

2f31b7f954bed437f2c75026c65caf7b wmilib.sys
Microsoft Corporation

6abe6e225adb5a751622a9cc3bc19ce8 ws2ifsl.sys
Microsoft Corporation

Driver report for /mnt/sdb1/i386/system32/drivers
3dcbaa767f4bda89e33729628ebe7739 Ramdrv.sys has NO Company Name!

0bb606c67a0fa5b49575fdffd41fab50 1394bus.sys
Microsoft Corporation

f5e227af17514d92c180b7723573a7de 1394vdbg.sys
Microsoft Corporation

6abb91494fe6c59089b9336452ab2ea3 abp480n5.sys
Microsoft Corporation

0d77d50de9e4aa8e71fb06cfc303210a acpiec.sys
Microsoft Corporation

1bec76bb56f57be93cfe588f6a8600dc acpi.sys
Microsoft Corporation

9a11864873da202c996558b2106b0bbc adpu160m.sys
Microsoft Corporation

560dce566000fed5bbfcbca321dbb84b afd.sys
Microsoft Corporation

c23ea9b5f46c7f7910db3eab648ff013 aha154x.sys
Microsoft Corporation

19dd0fb48b0c18892f70e2e7d61a1529 aic78u2.sys
Microsoft Corporation

b7fe594a7468aa0132deb03fb8e34326 aic78xx.sys
Microsoft Corporation

1140ab9938809700b46bb88e46d72a96 aliide.sys
Acer Laboratories

79f5add8d24bd6893f2903a3e2f3fad6 amsint.sys
Microsoft Corporation

69eb0cc7714b32896ccbfd5edcbea447 asc3350p.sys
Microsoft Corporation

5d8de112aa0254b907861e9e9c31d597 asc3550.sys
Advanced System Products

62d318e9a0c8fc9b780008e724283707 asc.sys
Advanced System Products

03f403b07a884fc2aa54a0916c410931 asyncmac.sys
Microsoft Corporation

a64013e98426e1877cb653685c5c0009 atapi.sys
Microsoft Corporation

9528b988ac46697efbcab6017e6525a0 b1cbase.sys
AVM GmbH

da1f27d85e0d1525f6621372e7b685e9 beep.sys
Microsoft Corporation

90a673fc8e12a79afbed2576f6a7aaf9 cbidf2k.sys
Microsoft Corporation

f3ec03299634490e97bbce94cd2954c7 cd20xrnt.sys
Microsoft Corporation

c1b486a7658353d33a10cc15211a873b cdaudio.sys
Microsoft Corporation

bab95bbefd0676eab2dc02cf88c99fc5 cdfs.sys
Microsoft Corporation

cb762e814f602229a574f4d78d3d6a30 cdrom.sys
Microsoft Corporation

488fcf3bc3651a4a7681f4f5052d6801 classpnp.sys
Microsoft Corporation

ed146077f90dc8c5efa48525a005f711 cmdide.sys
CMD Technology

3ee529119eed34cd212a215e8c40d4b6 cpqarray.sys
Microsoft Corporation

e550e7418984b65a78299d248f0a7f36 dac2w2k.sys
Mylex Corporation

683789caa3864eb46125ae86ff677d34 dac960nt.sys
Microsoft Corporation

5f34383e02721891f92bd2d7ba39b712 dgapci.sys
Digi International

9ae322f68cb80e6b1681b3a650e93edd digirlpt.sys
Digi International

99a1ffd0e527d3b88e34735d85eaaa04 dimaint.sys
Eicon Technology

46f833f8bcb4af005802a1743b6fcbaa diskdump.sys
Microsoft Corporation

43a10cd19d648e57ed039a6caa667a56 disk.sys
Microsoft Corporation

dcca5bfbe72293ffeae85fdffbdc2359 dmboot.sys
Microsoft Corp

dd4aaa1feaf418efcc3bf6b5515d76f7 dmio.sys
Microsoft Corp

e9317282a63ca4d188c0df5e09c6ac5f dmload.sys
Microsoft Corp

40f3b93b4e5b0126f2f5c0a7a5e22660 dpti2o.sys
Microsoft Corporation

fe97d0343acfdebdd578fc67cc91fa87 dxapi.sys
Microsoft Corporation

eb4d3fd051c7acedee85f430314aeb6e dxg.sys
Microsoft Corporation

a73f5d6705b1d820c19b18782e176efd dxgthk.sys
Microsoft Corporation

4063a77fa6f2c8cd48cbe9ac6eb8d213 em556n4.sys
Com Corporation

80d1b490b60e74e002dc116ec5d41748 enum1394.sys
Microsoft Corporation

52016d76b6f9810186dfdd5ccd53fa79 et4000.sys
Microsoft Corporation

998bbf32a142910b5e539df4225df892 fastfat.sys
Microsoft Corporation

f0196b7a8fe3098099721675db361272 fasttrak.sys
Promise Technology

2c0d70f0318870257ad99bf400f0c596 fasttx2k.sys
Promise Technology

19c5c7eac0190a42522290bf002f64ea fdc.sys
Microsoft Corporation

21e41e89b9b191b685f99b7a8885310b flpydisk.sys
Microsoft Corporation

3e1e2bd4f39b0e2b7dc4f4d2bcc2779a fs_rec.sys
Microsoft Corporation

7cb1a1f0cb7996f95b35e1bb3be5e3ad fsvga.sys
Microsoft Corporation

f0196b7a8fe3098099721675db361272 ft100.sys
Promise Technology

869fe1b01ac3bf08555d7a6d7d605aee ftdisk.sys
Microsoft Corporation

b16e2511bb8acd1180db6c3b25ea5f0f fttx2.sys
Promise Technology

8605e1476922cdf789ca0f2e682d8ca2 hidclass.sys
Microsoft Corporation

d099d5a07e97b09ca6a8070ca58678e7 hidparse.sys
Microsoft Corporation

1de6783b918f540149aa69943bdfeba8 hidusb.sys
Microsoft Corporation

b028377dea0546a5fcfba928a8aefae0 hpn.sys
Microsoft Corporation

28af0055d23aeb3eaefda362342704fd hpt366.sys
Microsoft Corporation

a59c16c709ba100c0f1d70f404cf129f hpt371.sys
HighPoint Technologies

cd983677b18396fd9d8788366a63d31f hpt374.sys
HighPoint Technologies

026ebdbf49a5017187a99c7e2634ce5f hpt3xxNT.sys
HighPoint Technologies

b077b7f8e79779ea967e84a4fc040227 hpt3xx.sys
HighPoint Technologies

24bd4052a2c5eb5dadc6cc69b57f0ffa hptpro.sys
HighPoint Technologies

aeb15ed12bb5a2ce62d900a97207e78b i2omgmt.sys
Microsoft Corporation

83e0f7a55077ba8d13421f0febbae2fa i2omp.sys
Microsoft Corporation

66f668c8f0fa089e2c6c1a9320425002 i8042prt.sys
Microsoft Corporation

50b56e7de809be4b8f4d24b3f0381520 iaStor.sys
Intel Corporation

4a40e045faee58631fd8d91afc620719 ini910u.sys
Microsoft Corporation

808720499635df975919e055d6c54a94 inport.sys
Microsoft Corporation

d57b586caf15482ae5beef2eb8082766 intelide.sys
Microsoft Corporation

8f1604ad7f8f8b6339e53d93c46187a8 io8.sys
Perle Systems

731f22ba402ee4b62748adaf6363c182 ipfltdrv.sys
Microsoft Corporation

f56dd863ba732a4e8ee58d486c31250f ipinip.sys
Microsoft Corporation

fc672ad6e9676814a0c844912f2abcff ipnat.sys
Microsoft Corporation

1c4802409cfd4a7051f458b744cfcaa5 ipsec.sys
Microsoft Corporation

d6bfe76282f47d1d054511639d17fc9e isapnp.sys
Microsoft Corporation

c53360c1932904fe89c6be55378628cb iteraid.sys
Integrated Technology Express

5d11ec35cb37a17562d8ff8056b4d14d kbdclass.sys
Microsoft Corporation

0d2b027eef0ca56a93e98015ec7f0533 kbdhid.sys
Microsoft Corporation

abc70e8b89cce44731a346deb764bf95 ksecdd.sys
Microsoft Corporation

08f2089704ffe8ba672ab2130fb82111 ks.sys
Microsoft Corporation

db35284e9acd15ec5337a50023d5394c lbrtfdc.sys
Toshiba Corporation

64e8b7c65eb4796939c0f64f8170821b loop.sys
Microsoft Corporation

d1f8be91ed4ddb671d42e473e3fe71ab mcd.sys
Microsoft Corporation

9c46695db5d49d9a7333807430a43be2 mf.sys
Microsoft Corporation

4ae068242760a1fb6e1a44bf4e16afa6 mnmdd.sys
Microsoft Corporation

7760873e4ec17f288e61f00044dea000 modem.sys
Microsoft Corporation

f6fd0aaa4f925b470e15fda1f07874c1 mouclass.sys
Microsoft Corporation

fe9f5189d425465373850ed362f8e817 mouhid.sys
Microsoft Corporation

d4face53a1c48cf8419b4cf494d2ee2e mountmgr.sys
Microsoft Corporation

3f4bb95e5a44f3be34824e8e7caf0737 mraid35x.sys
American Megatrends

a1831538e119363d0d90d757ac8a2012 msfs.sys
Microsoft Corporation

099a20936df7e93a4718a3577518a2f0 mup.sys
Microsoft Corporation

3b350e5a2a5e951453f3993275a4523a ndis.sys
Microsoft Corporation

59fc3fb44d2669bc144fd87826bb571f ndproxy.sys
Microsoft Corporation

20aba9f035e3a98877480e34fcc4dcb3 npfs.sys
Microsoft Corporation

70fae0dcfdfaa0838d6778fca028ce01 ntfs.sys
Microsoft Corporation

73c1e1f395918bc2c6dd67af7591a3ad null.sys
Microsoft Corporation

4b7a1230820ed27834050cb32a0e3b64 NvAtaBus.sys
NVIDIA Corporation

55db817feb931ac38c01a0fc9886fa76 nvraid.sys
NVIDIA Corporation

d72273fefcc1fb32f214e344667c243f ohci1394.sys
Microsoft Corporation

4bb30ddc53ebc76895e38694580cdfe9 oprghdlr.sys
Microsoft Corporation

548fd57f202b1078d3fb9a0c7915b00a parport.sys
Microsoft Corporation

3334430c29dc338092f79c38ef7b4cd0 partmgr.sys
Microsoft Corporation

93868ff47f04e1137ad510eec0955e45 parvdm.sys
Microsoft Corporation

eeee81c859fe3f1ae769c13adccc12c8 pciide.sys
Microsoft Corporation

9ea1e5058f8bc648b4d14425189d85a4 pciidex.sys
Microsoft Corporation

9390447f3b1be5064a3ebe98c555a1e5 pci.sys
Microsoft Corporation

a9bed83ec41b38bee62bf9413f4b7d24 pcmcia.sys
Microsoft Corporation

f50f7c27f131afe7beba13e14a3b9416 perc2hib.sys
Microsoft Corporation

6c14b9c19ba84f73d3a86dba11133101 perc2.sys
Microsoft Corporation

7244caa53fd234cec0cbfbf8cef7927f ppa3.sys
Microsoft Corporation

0a63fb54039eb5662433caba3b26dba7 ql1080.sys
QLogic Corporation

6503449e1d43a0ff0201ad5cb1b8c706 ql10wnt.sys
Microsoft Corporation

156ed0ef20c15114ca097a34a30d8a01 ql12160.sys
QLogic Corporation

70f016bebde6d29e864c1230a07cc5e6 ql1240.sys
Microsoft Corporation

907f0aeea6bc451011611e732bd31fcf ql1280.sys
QLogic Corporation

3e9e4476b6cda375409fd3216e5e824e ramdisk.sys
Microsoft Corporation

3dcbaa767f4bda89e33729628ebe7739 Ramdrv.sys

f18e651e4b6c7d8bd367454e016ab5d4 rndismp.sys
Microsoft Corporation

0d3830c0d64a2a9ec4238a758850ae39 sbp2port.sys
Microsoft Corporation

9b6b64c62f137b3a5e0df30f623c3c18 scsiport.sys
Microsoft Corporation

65a7c4d86c153c82e33a552c217abb29 serenum.sys
Microsoft Corporation

28d34224f1d792e85a4f98192db25d5a serial.sys
Microsoft Corporation

a1f76325cef251827a78e8aeb93504dd setupdd.sys
Microsoft Corporation

cc9f1e77ba1777a0d25b05b278731a7d sfloppy.sys
Microsoft Corporation

19b8d029bce41c88fc53167726774502 si3114r.sys
Silicon Image

1582e88c6f340627247b1ecd00fa84fe SIWinAcc.sys
Silicon Image

80b86f9b9ec4cd0e25627e4a7c54826a slip.sys
Microsoft Corporation

017daecf0ed3aa731313433601ec40fa smclib.sys
Microsoft Corporation

83c0f71f86d3bdaf915685f3d568b20e sparrow.sys
Adaptec

fc127c45cf908c633b2c032f7c406718 spddlang.sys
Microsoft Corporation

f4901a7692349f01d20e39a7f3d1d3d6 speed.sys
Perle Systems

c0e7e159415c1d10a88297b7eba01066 streamip.sys
Microsoft Corporation

064740c5c02de46723c4b8200ee876df swenum.sys
Microsoft Corporation

1ff3217614018630d0a6758630fc698c symc810.sys
Symbios Logic

070e001d95cf725186ef8b20335f933c symc8xx.sys
LSI Logic

80ac1c4abbe2df3b738bf15517a51f2c sym_hi.sys
LSI Logic

bf4fab949a382a8e105f46ebb4937058 sym_u3.sys
LSI Logic

2352864ea90cb23dfc7ed5d44283bae7 tape.sys
Microsoft Corporation

fd6a09d156139030729cf5f08f5d0cb9 tdi.sys
Microsoft Corporation

550d77c8ea289f67c9ef7d179379015e tffsport.sys
M-Systems

699450901c5ccfd82357cbc531cedd23 tosdvd.sys
Microsoft Corporation

f85e286f98b44e20420a792aa5abf5a5 toside.sys
Microsoft Corporation

5b96ede913bfa5384725ce1cc4e2b6e4 u133.sys
Promise Technology

0bad94aa644ce926cdeb6e57fca09031 udfs.sys
Microsoft Corporation

1b698a51cd528d8da4ffaed66dfc51b9 ultra.sys
Promise Technology
Promise Technology
Promise Technology
Promise Technology
Promise Technology

164cfae1d766905f56c432acfc54f28c update.sys
Microsoft Corporation

7f3366de16a0e9390da0ed32ab58d05d usbccgp.sys
Microsoft Corporation

596eb39b50d6ebd9b734dc4ae0544693 usbd.sys
Microsoft Corporation

2d0c2f3836f72e85d41d9c50aeeb5423 usbehci.sys
Microsoft Corporation

1766faa3a5079d0db3efb331dac587ed usbhub.sys
Microsoft Corporation

ba6b6215621255f0cd231f08b7d5d8cb usbohci.sys
Microsoft Corporation

81d55a273810e5b20456e4decb7e00ff usbport.sys
Microsoft Corporation

694f2b90124eb086c38c18da97a13e48 usbstor.sys
Microsoft Corporation

b8f6119fd7df389d823ba27a3023e150 usbuhci.sys
Microsoft Corporation

1e379233dd5ead78bd367c94576a1fc2 vga.sys
Microsoft Corporation

1c0cbb4e50d37059ce41cd134f6b5ab7 viaide.sys
Microsoft Corporation

81e7d3857a6ab6416fddf36a97fd65b7 videoprt.sys
Microsoft Corporation

2f31b7f954bed437f2c75026c65caf7b wmilib.sys
Microsoft Corporation

6abe6e225adb5a751622a9cc3bc19ce8 ws2ifsl.sys
Microsoft Corporation

filefind.txt:

Search results for Winlogin.exe


Search results for volsnap.sys

4c8fcb5cc53aab716d810740fe59d025 /mnt/sdb2/WINDOWS/ServicePackFiles/i386/volsnap.sys
51.1K Apr 13 2008

ee4660083deba849ff6c485d944b379b /mnt/sdb2/WINDOWS/$NtServicePackUninstall$/volsnap.sys
51.1K Aug 4 2004


Search results for explorer.exe

7712df0cdde3a5ac89843e61cd5b3658 /mnt/sdb2/WINDOWS/$hf_mig$/KB938828/SP2QFE/explorer.exe
1009.0K Jun 13 2007

12896823fb95bfb3dc9b46bcaedc9923 /mnt/sdb2/WINDOWS/ServicePackFiles/i386/explorer.exe
1009.5K Apr 14 2008

abed5616f2a315f20fb61c0b4935cd50 /mnt/sdb2/WINDOWS/ie7/explorer.exe
1009.0K Apr 14 2008

12896823fb95bfb3dc9b46bcaedc9923 /mnt/sdb2/WINDOWS/explorer.exe
1009.5K Apr 14 2008

a0732187050030ae399b241436565e64 /mnt/sdb2/WINDOWS/$NtServicePackUninstall$/explorer.exe
1008.0K Aug 4 2004


Search results for Userinit.exe

a93aee1928a9d7ce3e16d24ec7380f89 /mnt/sdb2/WINDOWS/ServicePackFiles/i386/userinit.exe
25.5K Apr 14 2008

39b1ffb03c2296323832acbae50d2aff /mnt/sdb2/WINDOWS/$NtServicePackUninstall$/userinit.exe
24.0K Aug 4 2004

585398603f570f9705774d65d292e5d1 /mnt/sdb1/MiniNT/system32/userinit.exe
21.0K Aug 17 2001

585398603f570f9705774d65d292e5d1 /mnt/sdb1/i386/system32/userinit.exe
21.0K Aug 17 2001


Search results for Exit

RegReport.txt:

Remote Registry Report

Hive </mnt/sdb2/WINDOWS/system32/config/software>
\Microsoft\Windows NT\CurrentVersion> Value <ProductName> of type REG_SZ, data length 42 [0x2a]
Microsoft Windows XP
\Microsoft\Windows NT\CurrentVersion> Value <CSDVersion> of type REG_SZ, data length 30 [0x1e]
Service Pack 2
\Microsoft\Windows NT\CurrentVersion> Value <SystemRoot> of type REG_SZ, data length 22 [0x16]
C:\WINDOWS
\Microsoft\Windows NT\CurrentVersion\Windows> Value <AppInit_DLLs> of type REG_SZ, data length 2 [0x2]
(...)\Windows NT\CurrentVersion\Winlogon> Value <Shell> of type REG_SZ, data length 26 [0x1a]
Explorer.exe
(...)\Windows NT\CurrentVersion\Winlogon> Value <Userinit> of type REG_SZ, data length 68 [0x44]
C:\WINDOWS\system32\userinit.exe,
(...)\Windows NT\CurrentVersion\Winlogon\Notify> Node has 10 subkeys and 0 values
<crypt32chain>
<cryptnet>
<cscdll>
<igfxcui>
<ScCertProp>
<Schedule>
<sclgntfy>
<SensLogn>
<termsrv>
<wlballoon>
\Microsoft\Windows\CurrentVersion\Run> Node has 1 subkeys and 20 values
<OptionalComponents>
size type value name [value if type DWORD]
102 REG_SZ <SunJavaUpdateSched>
62 REG_SZ <hpsysdrv>
66 REG_SZ <IgfxTray>
60 REG_SZ <HotKeysCmds>
36 REG_SZ <KBD>
140 REG_SZ <TkBellExe>
82 REG_SZ <iTunesHelper>
62 REG_SZ <Recguard>
106 REG_SZ <NvCplDaemon>
90 REG_SZ <nwiz>
24 REG_SZ <VTTimer>
26 REG_SZ <AlcxMonitor>
26 REG_SZ <SoundMan>
24 REG_SZ <AlcWzrd>
22 REG_SZ <Alcmtr>
56 REG_SZ <PS2>
116 REG_SZ <ccApp>
170 REG_SZ <NAV CfgWiz>
170 REG_SZ <IS CfgWiz>
150 REG_SZ <SSC_UserPrompt>
(...)\Windows\CurrentVersion\policies\system> Node has 0 subkeys and 5 values
4 REG_DWORD <dontdisplaylastusername> 0 [0x0]
4 REG_DWORD <legalnoticecaption> 1 [0x1]
8 REG_SZ <legalnoticetext>
4 REG_DWORD <shutdownwithoutlogon> 1 [0x1]
4 REG_DWORD <undockwithoutlogon> 1 [0x1]


Hive </mnt/sdb1/MiniNT/system32/config/software>
\Microsoft\Windows NT\CurrentVersion> Value <ProductName> of type REG_SZ, data length 42 [0x2a]
Microsoft Windows XP
\Microsoft\Windows NT\CurrentVersion> cat_vk: No such value <CSDVersion>
\Microsoft\Windows NT\CurrentVersion> cat_vk: No such value <SystemRoot>
\Microsoft\Windows NT\CurrentVersion\Windows> Value <AppInit_DLLs> of type REG_SZ, data length 2 [0x2]
(...)\Windows NT\CurrentVersion\Winlogon> Value <Shell> of type REG_SZ, data length 26 [0x1a]
Explorer.exe
(...)\Windows NT\CurrentVersion\Winlogon> Value <Userinit> of type REG_SZ, data length 18 [0x12]
userinit
(...)\Windows NT\CurrentVersion\Winlogon\Notify> Node has 4 subkeys and 0 values
<cscdll>
<ScCertProp>
<SensLogn>
<wlballoon>
\Microsoft\Windows\CurrentVersion\RunOnce> Node has 0 subkeys and 0 values


Hive </mnt/sdb1/i386/system32/config/software>
\Microsoft\Windows NT\CurrentVersion> Value <ProductName> of type REG_SZ, data length 42 [0x2a]
Microsoft Windows XP
\Microsoft\Windows NT\CurrentVersion> cat_vk: No such value <CSDVersion>
\Microsoft\Windows NT\CurrentVersion> cat_vk: No such value <SystemRoot>
\Microsoft\Windows NT\CurrentVersion\Windows> Value <AppInit_DLLs> of type REG_SZ, data length 2 [0x2]
(...)\Windows NT\CurrentVersion\Winlogon> Value <Shell> of type REG_SZ, data length 26 [0x1a]
Explorer.exe
(...)\Windows NT\CurrentVersion\Winlogon> Value <Userinit> of type REG_SZ, data length 18 [0x12]
userinit
(...)\Windows NT\CurrentVersion\Winlogon\Notify> Node has 4 subkeys and 0 values
<cscdll>
<ScCertProp>
<SensLogn>
<wlballoon>
\Microsoft\Windows\CurrentVersion\RunOnce> Node has 0 subkeys and 0 values


Hive </mnt/sdb2/Documents and Settings/Administrator/NTUSER.DAT>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 1 values
size type value name [value if type DWORD]
62 REG_SZ <ctfmon.exe>
(...)\Windows\CurrentVersion\Policies\Explorer> Node has 0 subkeys and 1 values
4 REG_DWORD <NoDriveTypeAutoRun> 145 [0x91]


Hive </mnt/sdb2/Documents and Settings/Administrator.VEENKER/NTUSER.DAT>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 1 values
size type value name [value if type DWORD]
62 REG_SZ <ctfmon.exe>
(...)\Windows\CurrentVersion\Policies\Explorer> Node has 0 subkeys and 1 values
4 REG_DWORD <NoDriveTypeAutoRun> 145 [0x91]


Hive </mnt/sdb2/Documents and Settings/Compaq_Owner/ntuser.dat>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 1 values
size type value name [value if type DWORD]
62 REG_SZ <ctfmon.exe>
(...)\Windows\CurrentVersion\Policies\Explorer> Node has 0 subkeys and 1 values
4 REG_DWORD <NoDriveTypeAutoRun> 145 [0x91]


Hive </mnt/sdb2/Documents and Settings/Compaq_Owner.VEENKER/ntuser.dat>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 2 values
size type value name [value if type DWORD]
148 REG_SZ <swg>
62 REG_SZ <ctfmon.exe>
(...)\Windows\CurrentVersion\Policies\Explorer> Node has 0 subkeys and 1 values
4 REG_DWORD <NoDriveTypeAutoRun> 145 [0x91]


Hive </mnt/sdb2/Documents and Settings/TV/NTUSER.DAT>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 1 values
size type value name [value if type DWORD]
62 REG_SZ <ctfmon.exe>
(...)\Windows\CurrentVersion\Policies\Explorer> Node has 0 subkeys and 1 values
4 REG_DWORD <NoDriveTypeAutoRun> 145 [0x91]


Hive </mnt/sdb2/Documents and Settings/TV.VEENKER/ntuser.dat>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 5 values
size type value name [value if type DWORD]
62 REG_SZ <ctfmon.exe>
114 REG_SZ <OfficeSyncProcess>
194 REG_SZ <Akamai NetSession Interface>
234 REG_SZ <MusicManager>
208 REG_SZ <MediaGet2>
(...)\Windows\CurrentVersion\Policies\Explorer> Node has 0 subkeys and 1 values
4 REG_DWORD <NoDriveTypeAutoRun> 145 [0x91]

Thanks

I am seeing a report from two drives, /mnt/sdb2 and /mnt/sdb1. Can you tell me which of these drives is the main boot drive. You will be able to determine that by browsing both drives on areas that you know should be there.

Download Dumpit by noahdfear to the USB drive.

Boot to xPUD

• Click on the folder that represents your USB drive (sdb1 ?)
  
• Confirm that you see driver.sh that you downloaded there
  
• Press Tool at the top
  
• Choose Open Terminal
  
• Then type bash driver.sh -af
  
• Press Enter
  
• You will be prompted to input a filename.
  
• Type the following:
  
  
  Winlogon.exe
  (Check your syntax, it is Winlogon.exe not Winlogin.exe)
  
  
  
• Press Enter
  
• After the search is completed type Exit and press Enter.
  
• After it has finished a report will be located in the USB drive as filefind.txt
  
• Close the Terminal window.
  
• Double click on Dumpit.
  
• After it has finished a report will be located in your USB drive named mbr.zip
  
• Attach this file to a reply and post the contents of the filefind.txt

The main boot drive is sdb2. I wasn't able to run "Dumpit" because it downloaded as a text file and did nothing when I double clicked it on the broken computer. So I still don't have the "mbr.zip" file......what should I do?

filefind.txt:

Search results for Winlogon.exe

ed0ef0a136dec83df69f04118870003e /mnt/sdb2/WINDOWS/ServicePackFiles/i386/winlogon.exe
496.0K Apr 14 2008

01c3346c241652f43aed8e2149881bfe /mnt/sdb2/WINDOWS/$NtServicePackUninstall$/winlogon.exe
490.5K Aug 4 2004

2b0e480e975ee51f2d5ce5f068fed6e2 /mnt/sdb1/MiniNT/system32/winlogon.exe
420.0K Aug 17 2001

2b0e480e975ee51f2d5ce5f068fed6e2 /mnt/sdb1/i386/system32/winlogon.exe
420.0K Aug 17 2001


Search results for Exit

Boot to xPUD.

Expand /mnt/ and browse to the sdb2/WINDOWS/ServicePackFiles/i386 folder. Locate the userinit.exe file. Right click on it and select Copy.

Browse back to the /sdb2/WINDOWS/System32 folder. Right click on an empty space and select Paste.

That should copy the sdb2/WINDOWS/ServicePackFiles/userinit.exe file into the System32 folder.

If successful, attempt to boot in Normal Mode.

If able to do so, run Combofix as follows:

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
  
• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  -----------------------------------------------------------
  
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    
  • Click on this link or this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    -----------------------------------------------------------
  
  
  • Close any open browsers.
    
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  
  -----------------------------------------------------------
  
• Double click on combofix.exe & follow the prompts.
  
• Install the Recovery Console if prompted.
  
• When finished, it will produce a report for you.
  
• Please post the "C:\ComboFix.txt" .

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version.

Ok, I copied the file to system32. When I tried to boot up normal mode it said "Windows could not start because of an error in the software. Please report this problem as: load needed DLLS for kernel. Please contact your support person to report this problem." Do I need the CD in or hard drive plugged in to run in normal mode?

This post has been edited by Cerberus Galaxy: 13 February 2012 - 08:13 PM

Does it give you a list of those missing files?

Boot to xPUD

• Click on the folder that represents your USB drive (sdb1 ?)
  
• Confirm that you see driver.sh that you downloaded there
  
• Press Tool at the top
  
• Choose Open Terminal
  
• Type bash driver.sh -af
  
• Press Enter
  
• You will be prompted to input a filename.
  
• Type the following:
  
  
  ntoskrnl.exe
  
  
• Press Enter
  
• If successful, the script will search for this file.
  
• After it has completed the search enter the next file to be searched
  
• Type the following:
  
  
  hal.dll
  
  
• Press Enter
  
• If successful, the script will search for this file.
  
• After it has completed the search enter the next file to be searched
  
• Type the following:
  
  
  KDCOM.DLL
  
  
• Press Enter
  
• After it has completed the search enter the next file to be searched
  
• Type the following:
  
  
  Userinit.exe
  
  
• Press Enter
  
• After the search is completed type Exit and press Enter.
  
• After it has finished a report will be located in the USB drive as filefind.txt

Post the contents of this file.

Filefind report:

Search results for ntoskrnl.exe

cef243f6defd20be4adde26c7ecacb54 /mnt/sdb2/WINDOWS/$hf_mig$/KB929338/SP2QFE/ntoskrnl.exe
2.1M Dec 19 2006

5a5c8db4aa962c714c8371fbdf189fc9 /mnt/sdb2/WINDOWS/$hf_mig$/KB931784/SP2QFE/ntoskrnl.exe
2.1M Feb 28 2007

6a936e9d7badaf3caaeed1e1966ec1b0 /mnt/sdb2/WINDOWS/$hf_mig$/KB956572/SP2QFE/ntoskrnl.exe
2.1M Feb 6 2009

7a95b10a73737ebf24139aaa63f5212b /mnt/sdb2/WINDOWS/$hf_mig$/KB956572/SP3GDR/ntoskrnl.exe
2.1M Feb 6 2009

efe8eace83eaad5849a7a548fb75b584 /mnt/sdb2/WINDOWS/$hf_mig$/KB956572/SP3QFE/ntoskrnl.exe
2.1M Feb 8 2009

31914172342bff330063f343ac6958fe /mnt/sdb2/WINDOWS/$hf_mig$/KB956841/SP3QFE/ntoskrnl.exe
2.1M Aug 14 2008

fde779ea1a564ebfe16f4e0f82b61bad /mnt/sdb2/WINDOWS/$hf_mig$/KB971486/SP3QFE/ntoskrnl.exe
2.1M Aug 4 2009

05be3d9a71972223aff6a3c823ba51b1 /mnt/sdb2/WINDOWS/$hf_mig$/KB977165/SP3QFE/ntoskrnl.exe
2.1M Dec 9 2009

e1f653a542449d54fa2d27463d99b6b6 /mnt/sdb2/WINDOWS/$hf_mig$/KB979683/SP3QFE/ntoskrnl.exe
2.1M Feb 16 2010

28187802b7c368c0d3aef7d4c382aabb /mnt/sdb2/WINDOWS/$hf_mig$/KB890859/SP2QFE/ntoskrnl.exe
2.1M Mar 2 2005

a2abbec40cdb57454645d06b7ebd22f5 /mnt/sdb2/WINDOWS/$hf_mig$/KB981852/SP3QFE/ntoskrnl.exe
2.1M Apr 27 2010

a531bbd3de13121c1380ed7dc99082db /mnt/sdb2/WINDOWS/$hf_mig$/KB2393802/SP3QFE/ntoskrnl.exe
2.1M Dec 9 2010

f512c662874d7545e5bd8005e6800a44 /mnt/sdb2/WINDOWS/$hf_mig$/KB2633171/SP3QFE/ntoskrnl.exe
2.1M Oct 25 13:34

0c89243c7c3ee199b96fcc16990e0679 /mnt/sdb2/WINDOWS/ServicePackFiles/i386/ntoskrnl.exe
2.1M Apr 13 2008

64c1adf6df629f340c5a439fe0ef8ed1 /mnt/sdb2/WINDOWS/$NtUninstallKB2633171$/ntoskrnl.exe
2.1M Dec 9 2010

892cddff7ef96951b9b0b50974070e47 /mnt/sdb2/WINDOWS/Driver Cache/i386/ntoskrnl.exe
2.1M Oct 25 13:33

facebb0ca3154f77009cdfee78a00bbb /mnt/sdb2/WINDOWS/$NtServicePackUninstall$/ntoskrnl.exe
2.1M Feb 6 2009


Search results for hal.dll

6db1e72ad3b372dfc451b7f54ba08aa7 /mnt/sdb2/WINDOWS/ServicePackFiles/i386/hal.dll
102.9K Apr 13 2008

f9a0f579fc18036ffdd9e26e0d268ccd /mnt/sdb2/WINDOWS/system32/hal.dll
128.9K Aug 4 2004

f9a0f579fc18036ffdd9e26e0d268ccd /mnt/sdb2/WINDOWS/$NtServicePackUninstall$/hal.dll
128.9K Aug 4 2004

c771ce18d003db50e6e5c64435ed937e /mnt/sdb1/MiniNT/system32/hal.dll
100.1K Aug 17 2001

c771ce18d003db50e6e5c64435ed937e /mnt/sdb1/i386/system32/hal.dll
100.1K Aug 17 2001


Search results for KDCOM.DLL

945fbb881ae927a44dfd96440f2f4f44 /mnt/sdb1/MiniNT/system32/kdcom.dll
6.9K Aug 17 2001

945fbb881ae927a44dfd96440f2f4f44 /mnt/sdb1/i386/system32/kdcom.dll
6.9K Aug 17 2001


Search results for Userinit.exe

a93aee1928a9d7ce3e16d24ec7380f89 /mnt/sdb2/WINDOWS/ServicePackFiles/i386/userinit.exe
25.5K Apr 14 2008

a93aee1928a9d7ce3e16d24ec7380f89 /mnt/sdb2/WINDOWS/system32/userinit.exe
25.5K Apr 14 2008

39b1ffb03c2296323832acbae50d2aff /mnt/sdb2/WINDOWS/$NtServicePackUninstall$/userinit.exe
24.0K Aug 4 2004

585398603f570f9705774d65d292e5d1 /mnt/sdb1/MiniNT/system32/userinit.exe
21.0K Aug 17 2001

585398603f570f9705774d65d292e5d1 /mnt/sdb1/i386/system32/userinit.exe
21.0K Aug 17 2001

You didn't answer the question. Does it give you a list of those missing files?

Copy /mnt/sdb2/WINDOWS/ServicePackFiles/i386/ntoskrnl.exe to the System32 folder.

Sorry, it did not give me a list of missing files......I copied the "ntoskrnl.exe" file to the system32 folder.

Copy /mnt/sdb2/WINDOWS/ServicePackFiles/i386/volsnap.sys file to the to /mnt/sdb2/WINDOWS/System32/drivers folder.

Boot in Normal Mode. Let me know the outcome. Copy and paste any error message on your next reply.

This post has been edited by JSntgRvr: 14 February 2012 - 07:50 PM