Missing System 32 Folder

Discussion in 'Software' started by noelg24, Sep 30, 2004.

  1. noelg24

    noelg24 Terabyte Poster

    3,334
    26
    139
    I have a got a friend who received a bogus email and her daughter opened it by mistake..apparently it was something labelled Al-Qieida...and when it was opened it deleted the System32 folder and has now killed her machine. its got a point where she cant even get into BIOS to boot from CD and try to repair the OS. its XP Pro...she can boot up and it does tell her she needs to repair but the CD is not being recognised...seems like the whole system is gone but can someone relate to this and find a solution...I am thinking its probably hardware related but if someone can shed any light that would be great. thanks...
     
    Certifications: A+
    WIP: my life
  2. Phoenix
    Honorary Member

    Phoenix 53656e696f7220 4d6f64

    5,749
    200
    246
    i doubt the virus caused any problem to her hardware
    there are very few viruses that affect hardware, and they are usually VERY well publicised, take the CIH virus of the late 90s for instance, caused massive damage when it struck

    i recommend resetting the bios, and keep trying to get into it,
    re install windows too
    not sure what chance there is of repair
    but the virus is not likley to of caused hardware problems
     
    Certifications: MCSE, MCITP, VCP
    WIP: > 0
  3. Nelix
    Honorary Member

    Nelix Gigabyte Poster

    1,416
    3
    82
    I'm fairly confident that the email is not responsible for them not being able to access the BIOS, I have found in the past that if you have more than 1 cd drive only one of them will boot from cd, could this be the case here??, have they tried all the usual keys to enter the BIOS i.e. F1, F2, F5, DEL, Ctrl + S, F10 dependin the the machine make there could be a menu to select boot device, I know the IBM's we used to use at work gave you a Boot Device menu at startup if you pressed F12, this saved you having to change the settings in BIOS for this one instance of changing the Boot Device.


    Hope this helps
     
    Certifications: A+, 70-210, 70-290, 70-291, 74-409, 70-410, 70-411, 70-337, 70-347
    WIP: 70-346
  4. noelg24

    noelg24 Terabyte Poster

    3,334
    26
    139
    Yes she has tried all this...Phoenix if what you say is true how come Lou's mums PC got hacked and in the end the problem was the memory? I thought it wasnt a hardware problem to begin with then I bought a new mobo and HDD and that still didnt fix it...so I bought a new stick of 256MB RAM and voila she was back to normal!! but my friend knows more about software like stopping viruses and not much about hardware...I have explained all what you guys have told me...but its baffling me...if she cant get into BIOS she cant get this fixed...she doesnt want to take it to another PC shop cos they always rip her off...and I cant fix it as I live in Aberdeen and she is in Derby! in the end it can only be done at a PC shop...but keep the ideas coming in guys...I want her PC to be working again...oh she only has one CD drive...how about moving the HDD to another PC and accessing stuff from there?
     
    Certifications: A+
    WIP: my life
  5. Phoenix
    Honorary Member

    Phoenix 53656e696f7220 4d6f64

    5,749
    200
    246
    how do you know her machine got 'hacked' thats what everyone says when there machine slows down and gets a bit of spyware
    thats not getting hacked, its self inflicted!!

    and the two had nothing to do with each other, just had bad luck
     
    Certifications: MCSE, MCITP, VCP
    WIP: > 0
  6. noelg24

    noelg24 Terabyte Poster

    3,334
    26
    139
    Phoenix she was download songs off WinMX...and on both occasions her PC stopped and just crashed...how else would you explain it? she's got NTL for broadband...didnt you read my thread about this when I came back from Grimsby?

    here you go even you are in it...

    http://www.certforums.com/forums/thread2630.html
     
    Certifications: A+
    WIP: my life
  7. punkboy101
    Honorary Member

    punkboy101 Back from the wilderness

    942
    2
    62
    Umm, could be the software, could be the RAM, could be the HD, could be the MoBo, could be a virus, or could be spyware, this list is endless. If everytime I downloaded something from winMX, my machine crashed, I wouldn't blame hacker's, I'd start with the software, and work my way down. Have you checked the event log's to see what they are saying. Noel, you can find a wealth of information there, and it's a good place to start looking.


    BTW, What are the indication's that she has been hacked? Did they leave a note behind? lol I'm just wondering, because most hacker's do not leave easy to find trails if they got in. If they haven't got in, it's easier to spot, because they haven't been able to hide their access attempts!

    Andy
     
    Certifications: CCNA
    WIP: Nada
  8. noelg24

    noelg24 Terabyte Poster

    3,334
    26
    139
    like I said she received an emaill...I was talking about my mother-in-laws problem...but my friend received an email...and when her daughter opened it by mistake all hell broke loose on the system...I just want to know how she can recover it...Im not saying she got hacked..it could be anything but this has never happened before and her PC has always worked fine til this happened...
     
    Certifications: A+
    WIP: my life
  9. shaunyboy

    shaunyboy Nibble Poster

    75
    1
    27
    Could it be that the CD is in some way damaged hence the drive will not boot from it. Try a new CD.

    I have seen some CDroms with dirty heads that will not boot in the limited time the BIOS affords. Try a head cleaner.

    It may be that the drive is one you cannot boot from, in which case create some boot floppies and access the drive from there or change the CD drive.

    I cannot imagine a virus that removes the system32 folder would then go on to destroy the BIOS.

    Finally, there are data recovery tools that you may be able to use to recover the system32 folder, even if you have to copy to a new drive and then copy across to the original. Deleting only removes the OS's abitity to access them by and large, the fact that little disk activity has happened since the accident suggests you may well be able to do this.

    Hope you get it back,

    Shaun
     
    Certifications: A+, MCSA, MCSE
    WIP: Exchange
  10. Nelix
    Honorary Member

    Nelix Gigabyte Poster

    1,416
    3
    82
    you could put the HD in another machine as a slave in retrieve the data but that still leaves the 'entering BIOS' problem.


    I know on my machine that if I wait until it tells me to press the DEL key to enter setup I never get in, no matter how quick I am. I tend to start pressing it about twice a second from the moment I turn the machine on, if it gets to the 'starting windows' part of boot I know it did'nt work, at that point you can reset and try a different key.

    Hope this helps
     
    Certifications: A+, 70-210, 70-290, 70-291, 74-409, 70-410, 70-411, 70-337, 70-347
    WIP: 70-346
  11. noelg24

    noelg24 Terabyte Poster

    3,334
    26
    139
    Certifications: A+
    WIP: my life
  12. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    I was fortunate enough to be privvy to an email recently circulating around a large Police Division (obviously, I shan't name the division) that was warning of a severe virus alert that causes system file deletion, and damage to the MBR on HDDs.


    At the time, I had a quick look around the net to find some info on it, but drew a blank. May be insignifcant in this case, but thought I'd mention it anyway.

    Now wtf is that blue flashing light outside my window ..... :ohmy
     
    Certifications: MCP, A+, Network+
    WIP: Clarity
  13. noelg24

    noelg24 Terabyte Poster

    3,334
    26
    139
    that would be the wife...coming home about that email you sent her...ad she bought back up too...:hahaha
     
    Certifications: A+
    WIP: my life
  14. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    Now that is TOO scary a thought, Noel :blink :cry:
     
    Certifications: MCP, A+, Network+
    WIP: Clarity

Share This Page

Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.