Sys File Repair

[timw128]

Hi- I need to repair my System Files. I am running XP Pro SP3 x86. What I am trying to do is make a bootable CD from my Genuine Windows XP Pro SP2 disk and slipstream SP3 to it, so I can run the Repair. I have never done this before, and I am with the understanding that in order to accomplish the task there must be an i386 folder in C:\. Here is what is confusing me- I do not have said folder directly in C:\, but it is contained in a folder named '403971ec4f6071759b'. This folder has 2 files: amd64 and i386, and they both contain the identical data. I do not know how this happened.
Here is an example of the structure: C:\403971ec4f6071759b\amd64 and C:\403971ec4f6071759b\i386.
What I need to end up with is: C:\i386 So, my thinking is to delete the '403971ec4f6071759b' and the 'amd64', I could conceivably wind up with C:\i386.
To be honest, I am not sure that the data within the i386 file is what is supposed to be there.
All of this has happened as a result of an attack, and I noticed that something was definitely wrong via Event Viewer and general performance.
Could I please get some advice on this matter?
Thank you, and Merry Christmas!
tim

 

[Chicano]

Well, your system may have been hijacked and maybe a remote installation was under way.. but who knows!. To prevent such hijackings your system can be secured by stopping a few Windows Services; Remote Registry, Computer Browser, Server, Remote Access Connectiopn Manager (Other Serivces starting with "Remote" except RPC), Telephony, Telnet... This is not a 100% secure but those services are unnecessary vulnerabilities in a standalone computer. Other precautions are to have a real time web-network shield enabled to detect infections before they download to the computer and it's also usefull to remove all firewall exceptions.

 

[timw128]

Thanks for the advice, Chicano. I have my 'services.msc' set-up like you mentioned. My avast! Internet Security 6 incorporates it's own Firewall and Real time Web-Network Shield running. I have no exceptions enabled in the Firewall, too.

 

[Chicano]

Thanks for the advice, Chicano. I have my 'services.msc' set-up like you mentioned. My avast! Internet Security 6 incorporates it's own Firewall and Real time Web-Network Shield running. I have no exceptions enabled in the Firewall, too.

Then who knows what really happened... maybe the following part in one of your answers explains the interrupted installation;

The people who interpreted the ComboFix and the HJT files (plus MGTools and a few other tools for Rootkits, etc.) have both confirmed what I found on my own. A Trojan and a Trojan Initiator.

 

[timw128]

Agreed... But what happened to the intact OS?... I couldn't tell if it was a Highjack situation as I could not get to my documents. Something weird, for sure!
Hey, do they have a Smartphone section to this Forum?