Spyware corrupting Windows system files

  • Thread starter Thread starter george
  • Start date Start date
G

george

Maybe not the appropriate question to ask but thought it
relevant since you may have seen this problem.

We are getting multiple computers suddenly getting the
message:

The CD your provided is the wrong CD. Please insert
Windows 2000 professional CD into your CD ROM Drive.
Files that are required for Windows to run properly have
been replaced by an unrecognizable version. To maintain
system stability, windows must restore the original
version of these files.

Microsoft's beta antispyware was applied to one machine.
it found 5000 infected keys and 41 known issues. Upon
rebooting most of the infections came back.

If you reinsert the Windows 2000 CD the above message
comes back after reboot. If you choose to not restore the
original versions, if you reboot it still happens.

I suspect spyware but havent found any new outbreaks this
week.

GE
 
GE,
I have had this happen on clients that had adware that the
beta removed. You will notice an event 64033 in the event
log refering to "Windows File Protection". Microsoft has
a KB-Q296241 for this where you reapply a certificate.
However this does not resolve the issue. Sytem restore or
a ERD does not fix it either. If anyone has a fix to this
Issue please post it here.
If you leave the Windows 2000 CD in the cd drive you will
not get the error on logon. As soon as you remove the cd
the problem willl reappear.
Ayyayyay
Steve
 
Called this number, they indicated that they are not aware
of this problem. Waiting for a call back though.
 
It sounds like Windows File Protection except for the bit
about the CD being wrong.

http://support.microsoft.com/default.aspx/kb/222193/EN-US/?

We got a similar message once after upgrading our Norton
Anti Virus.


Run HijackThis and SCAN your system then SAVE LOG and send
me the log.

http://www.tomcoyote.com/hjt/HijackThis.exe

Ron Kinner

rkinner AT att DOT net

or post the log as an attachment to a new thread in the HP
forum with Hijack in the subject

http://forums1.itrc.hp.com/service/forums/familyhome.do?
familyId=116
 
Back
Top