SP4

  • Thread starter Thread starter Jacqui
  • Start date Start date
J

Jacqui

Hi,

I've attempted to install Service Pack 4 but when the
process is close to completion I receive this
error: "Setup cannot copy the file csrsrv.dll." It is
nowhere to be found on the hard drive and there are no
hits on google for this error. When I cancel the install
it crashes the system, putting it in an infinite reboot
loop. I have to run the repair program from cd, go into
Safe Mode and remove the files that the computer seems to
think are still there. I am quite frustrated and have no
idea what to do now. I'm on my second run of downloading
it with the same error. Any ideas on where I could find
this errant file or how to get the service pack to
unistall without crashing the system?
 
-----Original Message-----
Hi,

I've attempted to install Service Pack 4 but when the
process is close to completion I receive this
error: "Setup cannot copy the file csrsrv.dll." It is
nowhere to be found on the hard drive and there are no
hits on google for this error. When I cancel the install
it crashes the system, putting it in an infinite reboot
loop. I have to run the repair program from cd, go into
Safe Mode and remove the files that the computer seems to
think are still there. I am quite frustrated and have no
idea what to do now. I'm on my second run of downloading
it with the same error. Any ideas on where I could find
this errant file or how to get the service pack to
unistall without crashing the system?
.
Click to expand...

I'm having the same problem you're having, except that the
file it couldn't find was "conf.exe".

It seems that the only solution at this point is to
completely reinstall Windows 2000, which is truly a PAIN.

Sure hope there is an alternative.

John Knight
 
-----Original Message-----


I'm having the same problem you're having, except that the
file it couldn't find was "conf.exe".

It seems that the only solution at this point is to
completely reinstall Windows 2000, which is truly a PAIN.

Sure hope there is an alternative.

John Knight
.
Click to expand...

On second thought, if you've already had this happen
twice, then perhaps it's a virus on our systems which is
causing the SP4 installation program to search for the
wrong program.

It's hard to imagine that this file would be missing from
the actual Windows service pack after millions of
supposedly successful downloads.

Yes, it's extremely frustrating.

The good news, if there is any, is that I just completed
the installation of Windows for the nth time (and probably
lost all the personal data and settings, yet again).

John Knight
 
-----Original Message-----


On second thought, if you've already had this happen
twice, then perhaps it's a virus on our systems which is
causing the SP4 installation program to search for the
wrong program.

It's hard to imagine that this file would be missing from
the actual Windows service pack after millions of
supposedly successful downloads.

Yes, it's extremely frustrating.

The good news, if there is any, is that I just completed
the installation of Windows for the nth time (and probably
lost all the personal data and settings, yet again).

John Knight
.
Click to expand...

I doubt it is a virus because the computer was clean
before I updated it. The virus scanner was up to date
and our IT department is very quick to shut down any port
that looks like it might be infected with a virus. I am
at a point where I have run the Repair program and it
boots into Safe Mode alright, but in normal mode the
screen turns into pinstripe lines of red, green, blue,
and white. *sigh* I think I'm about to break down and
reformat.
 
This IS a virus. Actually a trojan. You will note that there is a folder
at the root drive called "Update". You have been hit by the RPC
vulnerability. We had dozens of these on campus. I am support on a
University campus.

csrsrv.dll is still there, just hidden. csrsrv.exe is now in that folder,
along with another exe file that I can't remember. Go into safe mode,
delete that csrsrv.exe file from the system folder, then delete the other
file that was created on the same date, delete that Update folder and all
the associated files in that folder. There is also some registry fixes that
need to be done. Do a search on Symantec's site and you will find an
automated tool I believe.

If you have a computer nextwork, you can actually attach to that folder and
you will see csrsrv.dll is still there. You can do this from an uninfected
PC, just share out that folder.

Bob
 
Thank you, Bob, for that excellent suggestion. Though
this "Update" folder is not visible in Windows Explorer,
maybe it can be located once it's accessed from a network,
or in safe mode?

Will advise of my progress, though I'm now really
reluctant to try any more "patches" like this,
particularly when a "patch" is a 650 k file.

John Knight
 
I am having the exact same problem. Could you please e-
mail me any help or links that U get. Thanks, Brad
 
Here, follow these instructions.

http://securityresponse.symantec.com/avcenter/venc/data/trojan.stealther.b.html

We originally found this vulnerability because of pushing out the SP4
update. We had no idea that these PCs had been hit already, and they will
operate fine. Once hit, they create a backdoor into your system. It's
possible that your system was hit by a cleaner version that cleaned up after
itself and removed the "update" folder. That would not surprise me.

Try the cleanup tool that Symantec has, and see what happens then. Let me
know how it goes.

Bob
 
Back
Top