Avast stopped working, virus?

[oldman]

I don't know. But from the text file that came with the software "2. The standard DIR and DEL commands will NOT work 100%"

A&b are usually reserved for floppies, but if that what you saw then a:\ it is. If a:\ wasn't a valid or not ready drive you would have recieved a message stating so.

Since you are in the a: drive, we'll do the following

xcopy(space)a:\ntoskernl.exe(space)c:\windows\system32(enter)

You may get a message like do you want to over write existing file.If so type y and hit enter.

If there where instructions for exiting use them. If not remove the cd, give the computer the three finger salute(control,alt,del at the same time). Cross said fingers,say a prayer hopefully your computer will boot.

Post back with the results. It's late here and I've got an early morning. We can carry on tomorrow.

[oldman]

TYPO in post above

xcopy(space)a:\ntoskernl.exe(space)c:\windows\system32(enter)

should be

xcopy(space)a:\ntoskrnl.exe(space)c:\windows\system32(enter)

[BJS]

Thanks, I will do it and post my results for you to read in the morning. Thanks for all the help...

[oldman]

You're very welcome and good luck.

If you get a file can't be found error, put the cd back in your computer and copy down the exact path. Then try again. The drive letter will still be a:\ when you put it back in the sick one.

[BJS]

Well, we gave it a good try anyway.

I typed in the xcopy command, crossed my fingers and.....it said "this program cannot be run in DOS mode"

I guess it is back to finding a copy of XP eh? 

[oldman]

"ntfswcdd.iso is a another version of the bootable cd. It includes cdrom
drivers so before you burn it one can add files to the .iso that you
may want to copy to your ntfs drive. The files you add will be seen in
Drive R: "

Looking at the documentation again I found the above. could you try again. Boot with cd and use the same path but substitute the a:\ with r:\

xcopy(space)r:\ntoskrnl.exe(space)c:\windows\system32(enter)

It's a strange error as xcopy is a dos command

[mauserme]

I wonder if the copy command would work better than xcopy.  Copy is an internal comand while xcopy is external, and that may make a difference under these circumstances.

[oldman]

He can try it. I was just going by the documentation. The author said xcopy worked better.

@BSL

try the dir command again after you boot with the cd. Maybe booting it loads some of the program.

[oldman]

Ok, let's try this one more time.

Sorry but the brain was getting foggy last night. I had my morning coffee, better now.

I should have gotten you to reboot with the new cd. I think not doing so accounts for the 0 bytes with the dir \p command and the program cannot run.........error. The program that was trying to run was probably the program on the cd. It didn't even get to the xcopy command.

so restart the computer with the new boot disk, at the command prompt

type

copy(space)a:\ntoskrnl.exe(space)c:\windows\system32(enter)


If you get file not found error, try r:\ as the source drive as per documentation.The boot disk program may have created a r:\ partition on it.

[BJS]

Ok will do...

[BJS]

I tried you recommendations but it still won't work. I think the problem is bootcd. The original one (without the ntoskrnl.exe file) booted up fine with no problems. The second CD (with the ntoskrnl.exe. file) did not boot. I tried using the original bootdisc (so I could get into DOS) and then I replaced it with the second bootdisk to see if it would work. I ran dir but it still read 0 files. I doublechecked the file on the second bootdisk on my computer and all the files were listed on the CD (including the ntoskrnl.exe file)
I do not know why the dir command would not recognize the files.

I tried copy instead of xcopy and it said that 0 files copied (instead of cannot do this in DOS)
I tried the r drive and it did not recognize it.

I am fairly certain that I can borrow a copy of XP sometime next week. That might be the best route.
I just don't want to waste you or Mauserme's time. I do appricate all the help though.

[mauserme]

I am fairly certain that I can borrow a copy of XP sometime next week. That might be the best route.
I just don't want to waste you or Mauserme's time. I do appricate all the help though.

You are not wasting anybody's time.  We're here because we want to help, and learn.  Right now its a learning experience.  We'll get back to helping in a while 

I'm inclined to recommend a repair install of the operating system at this point unless oldman has other ideas.  Besides ntoskrnl.exe we know chkdsk.exe was reported missing and you were getting errors prior to starting the malware removal.  If reinstalling ntoskrnl.exe could have been a quick fix that would be one thing, but apparently its not going to be that easy.

A repair install will require an XP disk and product key, but let's wait for oldman's input.

[Lisandro]

A repair install will require an XP disk and product key, but let's wait for oldman's input.

Overinstallation can solve the problem and you won't lose your programs, settings, data, files, etc.
Just choose 'Repair' installation of Windows and install 'over' the old installation.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;315341
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314058
http://www.webtree.ca/windowsxp/repair_xp.htm

After that, visit Windows Update and install ALL security patches/updates.

[oldman]

I echo mauserme's sentiments. It's a learning experience for everyone no matter if things seem to be going south. That happens sometimes. But even then something is learned. I thought perhaps we'd stumbled on to something here, how to get around some of windows security. The access denied error.

Anyway, an overinstall may be the route to go given the number of errors you had before and who knows how deep the problem goes. That's the nice thing about xp, you can over install without losing your data.

What about the nasty critters living on the hard drive now? Will they wreck havoc with an over install? I once had an experience with sasser that let you think you where running the restore discs.

I'm going to look at the documentation for the bootcd again. There should have been a version of check disk included.

Stay tuned, we're still ready to assist.

[BJS]

Ok, I appreciate it!  I will post as soon as I do the overinstall, and thanks for the microsoft links Tech™