Win XP Product ID corrupt

[sparkax]

After repairing "broken" pc running Win XP SP2,all seemed well.
However,I noticed that the Product ID in the My Computer/Properties/ System Properties/General has been corrupted and reads "VIRUS ALERT !"
Although the system runs OK, and viruses/trojans appear to have been removed by using several Antivirus and Malware programs (Avg,Avira ,Avast ... ) and there appear to be no errant programs running.
-this problem refuses to go away.
Regedit appears to show the correct ID-unless I have missed an entry.
Any Ideas how to correct this annoyance without a clean install.?

[Bob_180_Bob]

Rather than type out a page of information for different problems, I have listed a lot of easy fixes below. A lot of problems can be fixed with a simple solution, please try to one or, if necessary, all of the following to try and get your PC working again. Start at the first, working your way to the last, that is, if you are able to access the programs shown. If you know your way around a PC, I am sorry for the full details but this is to help people that don’t know how.

Check Disk

1. Right click your disk drive icon (normally “C”),
2. Click “Properties.”
3. Click “Tools”
4. In “Error checking” click “Check Now”
5. Check the 2 boxes, “Automatically fix file system errors” and “Scan for and attempt recovery of bad sectors”
6. Click “Start”
7. At the pop-up window “The disk check could not……” Click “Yes”
8. Re-boot your PC and allow disk checker to start. (Do not press any key before it starts)

Check Disk from Boot

1. Re-boot PC, after the single “Beep” tap F8 several times until the windows boot window appears.
2. Scroll to “Safe Mode with command prompt”
3. At command prompt Type “ chkdsk /f” (Note;- Space after chkdsk.)

Alternative Start Mode

1. Re-boot PC, after the single “Beep” tap F8 several times until the windows boot window appears.
2. Scroll to “Start with last known good configuration.)
3. Press “Enter”

Or
4. Re-boot PC, after the single “Beep” tap F8 several times until the windows boot window appears.
5. Scroll to “Safe Mode” (With networking, if you want to access the internet)
6. Press “Enter”

Verify Window’s Files

1. Go “START”, “RUN” type “CMD” Press “OK” or Boot PC into “safe mode with command prompt”
2. Type sfc /scannow /f (note:- space after sfc)
3. Windows file protection will check your files. Follow any prompts; you may be required to use your XP CD.
4. Re-boot your PC

System Restore from boot

1. Re-boot PC, after the single “Beep” tap F8 several times until the windows boot window appears.
2. Scroll to “Safe Mode” and press “Enter”
3. A window will open asking if you want to use “System Restore”
4. Select “Cancel” to enter “System Restore”
5. Ensure “Restore to an earlier time” is checked and click “Next”
6. Select an earlier date when your PC worked well. (Must be a highlighted date)
7. Click “Next”
8. Allow system restore and reboot.
9. Check to see if problem still exists.

System Restore

1. Go “Start”
2. “All programs”
3. “Accessories”
4. “System tools”
5. “System Restore”
6. Ensure “Restore to an earlier time” is checked and click “Next”
7. Select an earlier date when your PC worked well. (Must be a highlighted date)
8. Click “Next”
9. Allow system restore and reboot.
10. Check to see if problem still exists.

Clean Boot

1. Go “Start”
2. “Run”
3. Type “msconfig”
4. Click “OK”
5. Click “Services”
6. Check box “Hide all Microsoft services”
7. Click “Disable All”
8. Click “Apply”
9. Click “Restart”
10. System will reboot, Check if problem still exists. (Do not access the internet or open any file you are unsure of as you have no virus protector running.)
11. If problem is fixed, enable the disabled items 1 at a time until you find the one causing the problem. If not fixed, re-enable all and re-boot.

On-line Virus Scan

Go to one or all of these sites and do an online virus scan.

housecall.trendmicro.com

security.symantec.com

us.mcafee.com/root/mfs/default.asp

Check Malware

Go to http://www.besttechie.net/tools/mbam-setup.exe
and download and run Malwarebytes' Anti-Malware.

Check Spyware

Go to www.safer-networking.org and download and run Spybot

[sparkax]

Appreciate your help Bob_180_Bob but the problem is much greater than anticipated.
Nothing worked because the file System
is reported as being RAW.
I shall have to recover files and format the
Hard Drive.
Again -thanks for your time and consideration.

[Bob_180_Bob]

Try a repair first!!

To Repair Windows XP from your XP CD…..

1. Re-start PC with XP CD in drive (Have your serial number handy)
2. As your PC starts press “F12” for boot menu (Or what your PC may ask for)
3. Scroll to and select “boot from CD.”
4. At prompt “Press any key to boot from CD” Press “Any key”
5. In the Windows XP Setup window, Press “Enter” to set up windows XP, (Don’t worry, this is a repair only, not a fresh install.)
6. At next window, Press “F8” to accept license agreement
7. Wait until windows displays your current version of XP and asks “To repair the selected windows XP installation press R”
8. Press “R”
9. Enter serial number when prompted.
10. Wait for files to be copied (PC will indicate 39 mins, it will take a lot less.)
11. When asked to adjust Regional language options, click “Next” as it is still set.
12. PC will re-boot.
13. If you have AVG Free, copy serial number to a file as you will lose it on repair. After repair a window will pop up asking how you want to treat AVG, Click repair and when prompted enter serial number.
14. Check to see if problem still exists.

[gerbil]

I am not sure a Repair will do it, bob.. Repair would want to format the drive [partition]. I think all that his virus/pest has done is alter the piece of code in the boot sector which defines partition encoding type... ie changed it from NTFS or FAT32 to RAW . And it would only have to alter the code in the boot partition [usually C:] That code can be directly edited to whatever it was using [free] 3rd party tools. I have not done it, though. May have a scout around.
I'm looking for tools which you can boot with as well; I have a couple of tools which can directly edit partition type from a running XP.. so Sparkax would have to slave the drive to use them... but there is no problem there. Both are straightfwd to use, both can do EXTREME damage [it is their nature].
Testdisk-6.9
MBRWhiz [command line tool] [or MBRWhiskey for a GUI version] - the latter is simpler to use.
Anyway, both will allow you to edit the file structure type. They don't ask for confirmation... eg. if you set them to delete a partition, they just do it. BANG.

[sparkax]

Thanks both
I have downloaded MBRWhiz and will give it a try.
Wish me Luck !

[gerbil]

Oops! I meant, of course, MBRWiz [or MBRWhiskey]... but you'd have found it.
Sorry...
http://red.boot-land.net/index.html
This dl contains both tools, the latest versions.
The commandline tool is straightfwd, as I said earlier... just save it [may have to unzip first], open cmd, cd to the path and then type..
mbrwiz -to see the parameter helplist.
So basically:
mbrwiz /list
mbrwiz /disk= yours, counts from zero
mbrwiz /part= yours, counts from zero
So: mbrwiz /disk= the one /part=the one /type=07
07 is ntfs...
0c is FAT32...

[sparkax]

I slaved the offending hard drive and used
the above mentioned programs. to examine it.
There were bad sectors and corrupt files.
I was able to retrieve important files before repairing and formatting the hard drive and re-installing Windows.
Again Thanks.

[gerbil]

That is sometimes how it goes with virii. Because you have MBRWiz you have the opportunity to save to a FLOPPY a copy of your MBR. Most likely will never need it, however... If you wish to make a copy of it wait until you have laid down your last primary or your extended partition, then the MBR partition table is no more changed. Adding more logicals has no effect.
Cheers.