Re: Compromised WinXP box prob

Thank you for all of your responses. I had decided to go with a new installation of WinXP unless anyone had any further ideas, which I have already gone ahead with (customer data backed up already). The clean install has worked without incident.

There were one or two suggestions about taking the disk out and virus-scanning it. I did do this already, there were a few extra infected executables such as lsass.exe (and the files were cleaned not removed), but the installation still didn't work properly.

A few people suggested system restore - the only way (AFAIK) that this could be done with things as they were would have been if I had substituted logonui.exe for the system restore exe, which considering the limited success I had with registry editor and the command prompt, I don't think this would have worked (I think the customer/Symantec had also tried to use system restore without success before the current situation got as bad as it did). Also, do people here think that system restore could have handled a situation where the whole CurrentControlSet key structure was unavailable?

I tried one last thing before going with a clean install, which was a repair install, however that tripped up on the problem that I couldn't start the computer in normal mode, it just went straight into safe mode. Does anyone know why WinXP might automatically go into safe mode even if normal mode is chosen? I would bet that a lack of CurrentControlSet key might do it, but I would have thought a repair install would disgard that key structure anyway.

The other thing I would like to know is where the rights and privileges settings are stored on an XP installation. I snooped around using the registry editor in the security hive on the ntpasswd boot CD but I don't have any experience with that hive.

There was a suggestion or two along the lines of that it wasn't worth my time or money and/or that it wasn't in the best interests of the customer for me to try and troubleshoot the problem any further. Personally I don't consider myself to be at the pinnacle of knowledge when it comes to problems like these but I will always as many of my ideas a shot as possible, as this and/or customers might benefit from this investigation. I also think that doing a clean install for customers is an absolute last resort as that itself can bring complications, such as the loss of the customer's settings, and the possible finger-pointing that "the computer doesn't run as well as it used to since you messed with it", justified or not. Of course it is a case of picking the right time to close the investigation and to correct the overall problem the quick way, but I am sure that everyone on this list used to use an OS reinstall as the answer to their problems more often than they do now.




--
Mike Moratz-Coppins
mike@xxxxxxxxxxxxxxxx
http://www.mikeymike.org.uk/

Relevant Pages

  • Re: Compromised WinXP box prob
    ... install has worked without incident. ... A few people suggested system restore - the only way that this ... start the computer in normal mode, it just went straight into safe mode. ... customer for me to try and troubleshoot the problem any further. ...
    (Focus-Microsoft)
  • Re: PowerPoint 2007 crashes on exit
    ... The problem was that the customer had made a-non complete ... How to install a TEST printer driver ... Quitting PowerPoint aned ... not all add-ins appear in the Add-ins section of PowerPoint ...
    (microsoft.public.powerpoint)
  • Re: PowerPoint 2007 crashes on exit
    ... The problem was that the customer had made a-non complete ... How to install a TEST printer driver ... Quitting PowerPoint aned ... not all add-ins appear in the Add-ins section of PowerPoint ...
    (microsoft.public.powerpoint)
  • Re: Windows Genuine Disadvantage
    ... another who told me there was only email tech support at Microsoft only - no phone support - which having delete with some very good tech support by phone in the past I knew was Bull. ... Spent the next 1 1/2 hour on the phone while the tech tried to fix the product key issue and failed. ... At this point signed off with MS Support, leaving case open, because I had to install SP3 and MSIE 7. ... These products are written sloppy, support articles are written obtusely or reference completely off point topics, Microsoft support for WGA are contracted out to untrained, unknowledgable personnel who are apparently trained to lie to the customer. ...
    (microsoft.public.windowsupdate)
  • RE: Windows Genuine Disadvantage
    ... Discovered that the latest WGA "update" failed to install. ... Tried calling WGA support to be treated extremely ... product key in the System properties anymore. ... What value added did We the Customer get out of this ...
    (microsoft.public.windowsupdate)
Quantcast