missing system32 folder

while installing an undelete program I inadvertanly installed the following virus. " C:\WINDOWS\system32\p2pnetwork.exe ". As you can see it put it in my system32 folder. When norton found it, it removed it and since then i have not been able to find my system32 folder. Is there anyway to restore the folder and its contents without putting this virus back on my machine?
I dont know if you can restore the folder off the windows cd or through recovery console ( which i have not figured out how to use)

Any help is greatly appreciated.

 

you might try a system restore back before the infection.

 

There might be something here that is helpful,

http://forums.vnunet.com/thread.jsp?forum=10&thread=60433&message=391418


snowbound

 

if you are running xp or win2k you can go to command prompt and type the follwing sfc /scannow and put in your os cd. the command checks and restores the system files from the cd. the command sfc stands for system file checker.

 

The invisible system32 folder is sometimes caused as a side-effect of the Alcan-worm

*Click Here to download Killbox by Option^Explicit.
*Extract the program to your desktop and double-click on its folder, then double-click on Killbox.exe to start the program.
*In the killbox program, select the Delete on Reboot option.
*Copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\Program Files\MsConfigs\MsConfigs.exe
C:\WINDOWS\system32\p2pnetwork.exe
C:\WINDOWS\system32\CMD.COM
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\ping.com
C:\WINDOWS\system32\regedit.com
C:\WINDOWS\system32\tasklist.com
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\taskmgr.com
C:\WINDOWS\system32\tracert.com

*Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
*Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

After the reboot check if it worked.

Regards,

Pieter

 

Ravin,

Does that still work, if you have an OEM cd and already have SP2?
What about that Windoz File Protector?

Thanks!

Marjaj

 

according to the status dialog that appears when this command is run it checks and verify's that the system files are intact and in there original version. I have used this command tool on machines with SP4 and have not encountered any problems with older versus updated system files. as for xp and file protection i am sure you would have to stop monitoring to run this command. Also you can do a search at microsoft for sfc and the other options you can use at the command line. Hope this helps.

 

Thanks much, Ravin!!

Appreciate your time!

Marja

 

I have used SFC and not only did it not find anything it did not restore my system32 folder. I have also tried to restore the system to an earlier point but it always says it cant do that. The virus is gone and so is the system32 folder. Is it possible that it is still being referenced from another location?

When i scan my computer with webroot spysweeper it says its scanning my system32 folder, but when i look for it, its not there.??

Is it possible that Norton Antivirus has quarentined the whole file, but is still letting me use it in some way. Dont you need that file for windows to operate? guess not if i dont have it anymore.

 

I found this answer at another thread and hope it will fix your prob. (
go to run, type system32 in the box.. after you open it look for command.exe (usually the string that exe is not included) so just look for command....after opening that type this...

attrib -a -h -r -s c:\windows\sytem32 (and hit enter)

or

attrib -a -h -r -s c:/windows/sytem32

thats it, look to your windows folder and you can access it again there!
hope this works to all of you!

 

Hi Webnetjogger,

Pieter is both a spyware veteran and a Windows MVP. I would try his suggestion in post # 5 before you try anything else ...

 

Webnetjogger,

It would probably save you TONS of time and aspirin to listen Pieter!



Good Luck!


Marja

 

Well Ravin, you are awesome!!!!! I thank everyone for thier help but Ravin nailed it right on the head!!!!. I had tried everyones suggestions but Ravins worked first time out. I thank you again Ravin this one was literally driving me insane.
It worked because the command reset the attributes for the folder. Brilliant!!
(wish i had thought of that)
Thanks again.

 

Thank you. i had the same problem as the other guy and this made it work.
one other problem i'm having however is that ctrl alt delete won't open task manager. Now that i found how to open system32 again i tried to open it from there, but a message says "another program is currently using this file". If you can't help me, or if this isn't the place, can someone direct me to somewhere that can.

thanks