Help! Virus on laptop? Cannot login. Sasser?

Browntoa

Running System Restore from the command line is often the only way to get a system back up and running. I'll describe it from the initial boot.

1. Restart your system 2. When the system first boots, type F8 to bring up the boot menu 3. Select the

Safe Mode with Command Prompt option
4. Log-on as administrator if needed
5. At your command prompt type %systemroot%\system32\restore\rstrui.exe
6. Hit Enter
6. This will open the system restore wizard...

notanothergreyhair

Thanks Browntoa...

How do I get it to not reboot...what do I type into the command prompt?

Browntoa

hopefully it won't reboot once in command line

At your command prompt type %systemroot%\system32\restore\rstrui.exe

notanothergreyhair

I will see if I can type that quickly enough

Browntoa

if you can download a linux disk like Knoppix then you can access the hard disk without using xP and then do this (knoppix has a similar program to windows explorer)

Rename c:\windows\system32\config\system to c:\windows\system32\config\system.bak

Rename c:\windows\system32\config\software to c:\windows\system32\config\software.bak

Rename c:\windows\system32\config\sam to c:\windows\system32\config\sam.bak

Rename c:\windows\system32\config\security to c:\windows\system32\config\security.bak

Rename c:\windows\system32\config\default to c:\windows\system32\config\default.bak

Browntoa

Open one of these folders to locate a Snapshot subfolder. The following path is an example of a folder path to the Snapshot folder:

C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}\RP1\Snapshot

From the Snapshot folder, copy the following files to the c:\windows\system32\config\ folder:

•_REGISTRY_USER_.DEFAULT
•_REGISTRY_MACHINE_SECURITY
•_REGISTRY_MACHINE_SOFTWARE
•_REGISTRY_MACHINE_SYSTEM
•_REGISTRY_MACHINE_SAM

Rename the files in the c:\windows\system32\config\ folder as follows:

•Rename _REGISTRY_USER_.DEFAULT to DEFAULT
•Rename _REGISTRY_MACHINE_SECURITY to SECURITY
•Rename _REGISTRY_MACHINE_SOFTWARE to SOFTWARE
•Rename _REGISTRY_MACHINE_SYSTEM to SYSTEM
•Rename _REGISTRY_MACHINE_SAM to SAM


reboot the PC as Normal

notanothergreyhair

I will have to try your linux method...hope I can manage it!

Tried to type in on the command prompt but it said I have insufficient priviliges again Again, it freezes when I try and sign in as NAGH

Browntoa

copying those files will force the Laptop to use an earlier restore point

look for an early restore point from the dates....

no guarantee it will fix the problem, but won't do any harm to try

I've done it myself, you will find it's easiest to do it file by file

notanothergreyhair

I can't rename the files using Browntoa's suggestion. I realise there is a default setting of 'read only', but it won't allow me to change this.

Any other suggestions?

Browntoa

this might do it

http://www.bootdisk.info/modules.php?modid=1&action=show&id=88

download here

http://ubcd4win.com/downloads.htm

UBCD4Win is a bootable CD which contains software that allows you to repair, restore, or diagnose almost any computer problem. Our goal is to be the ultimate free hardware and software diagnostic tool. All software included in UBCD4Win are freeware utilities for Windows®. UBCD4Win is based on Bart's PE©. Bart's PE© builds a Windows® "pre-install" environment CD, basically Windows® booted from CD. We include many free hardware and software diagnostic tools that allow you to fix almost any problem you will face with your computer. With network support, the ability to modify NTFS volumes, recover deleted files, create new NTFS volumes, scan hard drives for viruses, etc. this project includes almost everything you need to repair your system problems. This project has been put together to be the ultimate recovery cd and not a replacement OS