These files are infected with a virus...

O.o · May 04, 2003, 17:16 hrs

My operating system is Windows XP. I scanned my laptop with my Norton Antivirus Professional Edition. The files cmd32.exe and kernel32.dll were infected with the virus. My Norton automatically deleted both files. How can I get these back? Do these files serve a big purpose on my computer?

Thanks for any help

query · May 04, 2003, 17:23 hrs

The former is not a windows file and can be left deleted. The latter is a Windows file, which needs to be replaced from the OS CD.

For details on how to do this, see

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/winxppro/reskit/prgg_det_pvfh.asp

Make sure you re-apply all service packs after you replace the file.

O.o · May 04, 2003, 17:28 hrs

Sorry I don't understand this, could you say it again in a more simple way and thx alot query.

O.o · May 04, 2003, 17:35 hrs

Actually I just searched on Google and read some topics. They said CMD32.exe is not a original Windows file. So I removed all traces of CMD32.exe in the registry. And I tried to replace the file Kernel32.dll but it said I can't change it because it is being used by another program. I tried downloading kernel32.dll from this site:
http://www.dll-files.com/dllindex/dll-files.shtml?kernel32
tried to replace it but the error message said it is being used by another process
I did ctrl+alt+delete and checked for any traces of kernel32.dll in processes but it wasn't anywhere. How can I replace this file without this error message

query · May 04, 2003, 17:41 hrs

You have two options for replacing that file. Copy it to a floppy, and install the Recovery Console (from i386 directory in a command window, type winnt32 /cmdcons) and boot to the recovery console (you can also do this by booting the CD and choosing a Repair using the recovery console). Manually copy the file from the floppy to the hard drive (copy a:\kernel32.dll c:\windows\system32).

The other option is to get a copy of the Windows 2000 Resource Kit (works with XP too) and use a utility called InUse, which allows you to replace system dlls that are locked open by a running copy of Windows.

There's no way to shut off this dll while Windows is running, so you must either copy the file outside of Windows in graphical mode, or use the inuse utility from the Resource Kit.

O.o · May 04, 2003, 17:54 hrs

Where is this i386 folder, I can't find it anywhere

O.o · May 04, 2003, 18:00 hrs

Oh nevermind I found it in C:\WINDOWS\Driver Cache\i386 .
There were six files:
ntkrnlmp.exe
ntkrnlpa.exe
ntkrpamp.exe
ntoskrnl.exe
mrxsmb.sys
driver.cab
What do I do?

pat · May 04, 2003, 18:04 hrs

XxazndragonxX

Have a look at this article from MS. Perhaps this will help.

HOW TO: Install and Use the Recovery Console in Windows XP

query · May 04, 2003, 18:05 hrs

Use the CD -- it will have the i386 folder on it. However, some OEM recovery CDs don't include the recovery console.

You should be able to download the recovery console contents from Microsoft if your CD doesn't have them - or, boot the XP CD and load the recovery console from there.

O.o · May 04, 2003, 18:18 hrs

Thanks Alot Pat
Okay I installed the recovery console then rebooted. Now where is the recovery console? What is this boot menu?

pat · May 04, 2003, 18:37 hrs

When you restart your computer you should see a choice presented to you to either go to the recovery console or boot to Windows. Just pick the choice to go to the recovery console. If you wait too long the computer will just continue to load windows.

O.o · May 04, 2003, 19:31 hrs

uhh I am screwed windows won't even start up anymore theres always a file missing when I get back the previous one. What command would I use to reinstall Windows XP in the recovery console?

O.o · May 04, 2003, 19:41 hrs

I just checked the guide and couldn't find any command that could reinstall windows xp what could i do????
please help

query · May 04, 2003, 19:47 hrs

Which file is missing?

You can reinstall XP by booting the XP CD and choosing a Repair install, but don't go that far just yet.

O.o · May 04, 2003, 19:50 hrs

I can't do anything, everytime i pick windows xp professional edition from the boot menu it says the file is missing. In simple words I am stuck in the boot menu.

ntoskrnl.exe is missing but last time i replaced the file hal.dll it said ntoskrnl.exe is missing I think something was wrong with the kernel32.dll that i used to replace the infected one

query · May 04, 2003, 20:02 hrs

Try using the above instructions (the ones from Microsoft's website) to extract the ntoskrnl.exe from the \i386 directory on the installation CD.

O.o · May 04, 2003, 20:16 hrs

ok i coped ntoskrnl.exe to my windows/system32
now when i try to start up windows it says:
windows could not start because of an error in the software.
Please report this error as :
load need dlls for kernel.
Please contact your support person to report this problem.

query · May 04, 2003, 20:26 hrs

At this point, you have a mixed set of boot files on the system. The kernel32.dll file you replaced must have been an older or newer version than the one that was there.

If you have a second hard drive, I would suggest building a Windows XP install on it, then slave the existing drive and backup your data.

If you don't have another drive, you may have to take your chances with a Repair installation - use the boot CD, choose Repair, which will locate you current windows installation and try to repair it.

Once the repair is done, re-apply SP1 and subsequent security patches.

O.o · May 04, 2003, 20:29 hrs

What boot cd??

query · May 04, 2003, 20:31 hrs

The Windows XP installation CD.

O.o · May 04, 2003, 20:33 hrs

yeah I put it in and it still don't work

query · May 04, 2003, 20:43 hrs

Is it an XP CD or a restoration CD from a manufacturer? If it is the latter, and it's not bootable, you'll either have a boot floppy set or need to make one (you can download the tools to make the boot floppies from Microsoft).

If it's a restoration CD, DO NOT do a restore unless you can afford to lose everything on your hard drive - restoration CDs will wipe out the drive and return it to an as-shipped state.

O.o · May 04, 2003, 20:46 hrs

It is a XP cd.

query · May 04, 2003, 20:50 hrs

Did you boot from the CD?

O.o · May 04, 2003, 20:51 hrs

What do you mean?

query · May 04, 2003, 20:53 hrs

You must boot from the CD in order to do a repair installation - you cannot begin it from the CD under Windows.

Boot from the CD, then choose Repair instead of installing a new copy of Windows. If you have an emergency rescue floppy, use it - otherwise, do an automated repair on the installation on the C drive.

http://www.microsoft.com/WindowsXP/expertzone/tips/dougknox/doug92.asp

pat · May 04, 2003, 21:20 hrs

QuoteWhat do you mean?

This means that instead of turning on your computer and letting it boot (start) from the hard drive, you would put the windows cd in and then restart your computer. It would then boot (start) from the cd. You would have to be sure that your cd drive is 1st in boot order in bios.
Just put the cd in and restart your computer. If it doesn't start from the cd we'll take it from there.

O.o · May 04, 2003, 21:30 hrs

the cd doesn't boot first.

O.o · May 04, 2003, 21:32 hrs

are yousure there absolutely no waysto run any program?

pat · May 04, 2003, 21:44 hrs

Well not unless you want to make the boot floppies.
You should be able to enter bios and change the boot order.
Just restart your computer and depending on the make of your bios, you press a key and go the the bios setup.
A common key to press is the delete key.
Once in bios look for an option like advanced settings, look for 1st boot device it's most likely set to your floppy drive. Just change it to the cd drive save and exit bios.
when you restart your computer next time with the windows cd in it should start from the cd.

What is the make of your computer.

News:

These files are infected with a virus...