Can't Get Rid of Anti-Malware Doctor

[Perutom]

I just tried it again, and I now can get it to load in safe mode, but not regular mode.

T

Only after the last fix. Before that, I couldn't get it to load regular windows, but I could load in safe mode. Before all the fixes, I could load windows, but I had no internet.

T

[kahdah]

Please go to Start>Run type in Notepad.

Copy what is in the code box below into the open Notepad window.

Change the "Save As Type" to "All Files". Save it as search.bat on your Desktop.

@Echo off

dir /s kbdclass.sys >log.txt
start log.txt
del %0

Then please double click on search.bat a window will open and close quickly.This is normal.

Post the log that opens please.

[Perutom]

This is the log:

volume in drive C has no label.

volume Serial Number is F887-D01C

Please go to Start>Run type in Notepad.

Copy what is in the code box below into the open Notepad window.

Change the "Save As Type" to "All Files". Save it as search.bat on your Desktop.

@Echo off

dir /s kbdclass.sys >log.txt
start log.txt
del %0

Then please double click on search.bat a window will open and close quickly.This is normal.

Post the log that opens please.

[kahdah]

Ok that didn't work very well.

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  :Filefind
  kbdclass.*

  
  

• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

[Perutom]

Here it is:

SystemLook v1.0 by jpshortstuff (11.01.10)

Log created at 15:24 on 25/05/2010 by Administrator (Administrator - Elevation successful)

========== Filefind ==========

Searching for "kbdclass.*"

C:\WINDOWS\ERDNT\cache\kbdclass.sys --a--- 24576 bytes [21:03 21/05/2010] [18:39 13/04/2008] 463C1EC80CD17420A542B7F36A36F128

C:\WINDOWS\i386\KBDCLASS.SY_ --a--c 12067 bytes [17:34 03/09/2003] [12:00 31/03/2003] 8534CC28B96502EA3A76ADD70A8E01BC

C:\WINDOWS\ServicePackFiles\i386\kbdclass.sys ------ 24576 bytes [05:58 04/08/2004] [18:39 13/04/2008] 463C1EC80CD17420A542B7F36A36F128

C:\WINDOWS\system32\drivers\kbdclass.sys --a--- 24576 bytes [01:27 29/08/2002] [18:39 13/04/2008] 463C1EC80CD17420A542B7F36A36F128

-=End Of File=-

[kahdah]

===============First===============

Please go to Start > Run then type in cmd then hit the ok button.

In the black box that comes up please copy the text in bold below into the command prompt window and hit enter.

expand /y "C:\WINDOWS\i386\KBDCLASS.SY_" C:\

If it works correctly you will see a 1 file(s) expanded message.

If you do not see that message then DO NOT PROCEED but rather stop and alert me to it.

===============Second===============

If you do see the 1 file(s) copied message then do the following.

1. Please download The Avenger2 by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All..."
  
• Follow the prompts and extract the avenger folder to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to move:
C:\KBDCLASS.SYS | C:\WINDOWS\system32\drivers\kbdclass.sys

Files to delete:
c:\windows\system32\Spool\prtprocs\w32x86\G5i55.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
  
• You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
  
• Click on Execute
  
• Answer "Yes" twice when prompted.
  

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

5. Please copy/paste the content of c:\avenger.txt into your reply.

===========================

Note it is important to try to boot into normal mode after the avenger step so it can complete it's run.

[Perutom]

step 1 doesn't work. I get this message when I hit enter: "Unrecognized switch -y."

===============First===============

Please go to Start > Run then type in cmd then hit the ok button.

In the black box that comes up please copy the text in bold below into the command prompt window and hit enter.

expand /y "C:\WINDOWS\i386\KBDCLASS.SY_" C:\

If it works correctly you will see a 1 file(s) expanded message.

If you do not see that message then DO NOT PROCEED but rather stop and alert me to it.

===============Second===============

If you do see the 1 file(s) copied message then do the following.

1. Please download The Avenger2 by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All..."
  
• Follow the prompts and extract the avenger folder to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to move:
C:\KBDCLASS.SYS | C:\WINDOWS\system32\drivers\kbdclass.sys

Files to delete:
c:\windows\system32\Spool\prtprocs\w32x86\G5i55.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
  
• You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
  
• Click on Execute
  
• Answer "Yes" twice when prompted.
  

4. The Avenger will automatically do the following:

[*]It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)

[*]On reboot, it will briefly open a black command window on your desktop, this is normal.

[*]After the restart, it creates a log file that should open with the results of Avenger

[kahdah]

Try it like this expand "C:\WINDOWS\i386\KBDCLASS.SY_" C:\ then hit y at the prompt (if prompted)

[Perutom]

I get this message then:

Expanding c:\windows\i386\kbdclass.sy_ to c:\c:\.

Can't open output file: c:\c:\.

[kahdah]

Hi this you copied 2 times c:\

It should be this only:

expand "C:\WINDOWS\i386\KBDCLASS.SY_" C:\ only one of these C:\

[Perutom]

okay, I see the expanded message now with the correction. I'm continuing with step 2.

[Perutom]

Do I close the C: prompt and continue with Avenger?

[Perutom]

Okay, I get to step four and then in the process of rebooting and starting windows, after having run avenger, it crashes with a blue screen.

I've tried a few times to let it reboot normally, as instructed, and each time, it crashes. The error message for the blue screen is below:

*** STOP: 0x0000007E (0xC0000005, 0x80599F19, 0xF7B21690, 0xF7B2138C)

Now what?

[kahdah]

OK please boot into Safe Mode as you did before.

Go to this folder C:\Windows\minidump

There should be some minidump files in there.

Zip up those latest ones (they are arranged by date) at least the last four that are present

Then I will need you to upload the files Click Here please.

You may have to transfer them over using a flash drive or cd.

[Perutom]

There are no files in C:Windows\minidump?

OK please boot into Safe Mode as you did before.

Go to this folder C:\Windows\minidump

There should be some minidump files in there.

Zip up those latest ones (they are arranged by date) at least the last four that are present

Then I will need you to upload the files Click Here please.

You may have to transfer them over using a flash drive or cd.

[kahdah]

Ok well that isn't going to help then.

It is very strange that error is usually caused by a hard disk controller being patched or removed but since you can boot into Safe Mode that is not the case.

For now do the following.

From another computer you will need to transfer this file to the infected computer to run it.

Please click here to download Kaspersky Virus Removal Tool.

1. Double click on the file you just downloaded and let it install.
   
2. It will install to your desktop.
   
3. After that leave what is selected and put a check next to My Computer.
   
4. Click on the option that says Threat Detection and change it to Disinfect,delete if disinfection fails.
   
5. Then click on Start Scan.
   
6. Before it is done it may prompt for action regardless of the setting so choose delete if prompted.
   
7. When the scan is done no log will be produced.
   
8. Click on the bottom where it says Report to open the report.
   
9. Then highlight of of the items found by using ctrl + a on your keyboard to select all or use your mouse to select all then right click and choose copy.
   
10. This will copy the items that it found to the clipboard you can then open notepad (go to start then run then type in notepad) and choose paste to paste the contents into Notepad.
    
11. You can save this on the desktop.
    
12. Post the contents of the document in your next reply.
    

Note: This tool will self uninstall when you close it so please save the log before closing it.

[Perutom]

Okay, I've run the Kaspersky scan. The log is below. It says that various viruses were removed. The computer restarted, but couldn't open normally. I could open it in safe mode, however. As well, the Avenger log popped up when I was about to load Kaspersky. I've attached it below as well.

Now what?

---------------------

Kaspersky Report:

Autoscan: completed 4 minutes ago (events: 58, objects: 228068, time: 02:13:38)

5/26/2010 9:18:46 AM Task started

5/26/2010 10:44:46 AM Detected: Trojan.Win32.FraudPack.apxl C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\E598DE6242B331FC4697A9B7D87903A5\hookdll.dll.vir

5/26/2010 10:44:50 AM Detected: HEUR:Trojan.Win32.Generic C:\Qoobox\Quarantine\C\WINDOWS\Amodua.exe.vir

5/26/2010 10:44:51 AM Detected: Trojan.Win32.Pakes.oep C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\E598DE6242B331FC4697A9B7D87903A5\gotnewupdate000.exe.vir

5/26/2010 10:44:51 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/-f36decbb.exe

5/26/2010 10:44:53 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/-f36decbb.exe

5/26/2010 10:44:53 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/7gMY7c3.dll

5/26/2010 10:44:53 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/7gMY7c3.dll

5/26/2010 10:44:54 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/93179g17a.dll

5/26/2010 10:44:54 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/93179g17a.dll

5/26/2010 10:44:54 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/9i1qG317k.dll

5/26/2010 10:44:54 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/9i1qG317k.dll

5/26/2010 10:44:54 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/aA31793.dll

5/26/2010 10:44:54 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/aA31793.dll

5/26/2010 10:44:54 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/c9sK7y3.dll

5/26/2010 10:44:54 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/c9sK7y3.dll

5/26/2010 10:44:54 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/cEI55.dll

5/26/2010 10:44:54 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/cEI55.dll

5/26/2010 10:44:54 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/IQ1wS31sK.dll

5/26/2010 10:44:54 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/IQ1wS31sK.dll

5/26/2010 10:44:54 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/q1wSKU79.dll

5/26/2010 10:44:54 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/q1wSKU79.dll

5/26/2010 10:44:54 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/SK93g7.dll

5/26/2010 10:44:54 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/SK93g7.dll

5/26/2010 10:44:54 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/SKUOC7.dll

5/26/2010 10:44:54 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\[4]-Submit_2010-05-21_21.09.40.zip/SKUOC7.dll

5/26/2010 10:45:10 AM Deleted: Trojan.Win32.FraudPack.apxl C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\E598DE6242B331FC4697A9B7D87903A5\hookdll.dll.vir

5/26/2010 10:45:10 AM Detected: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\C\WINDOWS\system32\-81dbeb3f.exe.vir

5/26/2010 10:45:11 AM Deleted: Trojan.Win32.Pakes.oep C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\E598DE6242B331FC4697A9B7D87903A5\gotnewupdate000.exe.vir

5/26/2010 10:45:13 AM Deleted: Backdoor.Win32.Agent.avdv C:\Qoobox\Quarantine\C\WINDOWS\system32\-81dbeb3f.exe.vir

5/26/2010 10:45:19 AM Detected: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP762\A0123771.exe

5/26/2010 10:45:19 AM Detected: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP762\A0124782.exe

5/26/2010 10:45:20 AM Deleted: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP762\A0123771.exe

5/26/2010 10:45:21 AM Deleted: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP762\A0124782.exe

5/26/2010 10:45:24 AM Detected: Trojan.Win32.VBKrypt.wo C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP762\A0124818.exe/PE_Patch.PECompact/PecBundle/PECompact

5/26/2010 10:45:25 AM Detected: Trojan.Win32.FraudPack.apxl C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP762\A0124831.dll

5/26/2010 10:45:26 AM Deleted: Trojan.Win32.VBKrypt.wo C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP762\A0124818.exe

5/26/2010 10:45:28 AM Deleted: Trojan.Win32.FraudPack.apxl C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP762\A0124831.dll

5/26/2010 10:45:29 AM Detected: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0125845.exe

5/26/2010 10:45:29 AM Detected: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0125844.exe

5/26/2010 10:45:30 AM Deleted: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0125845.exe

5/26/2010 10:45:30 AM Deleted: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0125844.exe

5/26/2010 10:45:31 AM Detected: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0127843.exe

5/26/2010 10:45:31 AM Detected: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0127845.exe

5/26/2010 10:45:33 AM Deleted: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0127845.exe

5/26/2010 10:45:33 AM Detected: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0128884.exe

5/26/2010 10:45:33 AM Detected: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0128886.exe

5/26/2010 10:45:33 AM Deleted: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0127843.exe

5/26/2010 10:45:34 AM Deleted: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0128884.exe

5/26/2010 10:45:35 AM Deleted: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0128886.exe

5/26/2010 10:45:42 AM Detected: Trojan.Win32.FraudPack.apxl C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0128978.dll

5/26/2010 10:45:43 AM Detected: HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0128982.exe

5/26/2010 10:45:43 AM Deleted: Trojan.Win32.FraudPack.apxl C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0128978.dll

5/26/2010 10:45:44 AM Detected: Trojan.Win32.Pakes.oep C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0128977.exe

5/26/2010 10:45:49 AM Deleted: Trojan.Win32.Pakes.oep C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP763\A0128977.exe

5/26/2010 10:46:44 AM Detected: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP765\A0131816.dll

5/26/2010 10:47:42 AM Deleted: Backdoor.Win32.Agent.avdv C:\System Volume Information\_restore{9D18FA02-EA44-4A6E-9693-FBE3D5ED316F}\RP765\A0131816.dll

5/26/2010 11:32:25 AM Task completed

---------------------

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

No rootkits found!

Error: file "C:\KBDCLASS.SYS" not found!

File move operation "C:\KBDCLASS.SYS|C:\WINDOWS\system32\drivers\kbdclass.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

File "c:\windows\system32\Spool\prtprocs\w32x86\G5i55.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

---------------------

Ok well that isn't going to help then.

It is very strange that error is usually caused by a hard disk controller being patched or removed but since you can boot into Safe Mode that is not the case.

For now do the following.

From another computer you will need to transfer this file to the infected computer to run it.

Please click here to download Kaspersky Virus Removal Tool.

1. Double click on the file you just downloaded and let it install.
   
2. It will install to your desktop.
   
3. After that leave what is selected and put a check next to My Computer.
   
4. Click on the option that says Threat Detection and change it to Disinfect,delete if disinfection fails.
   
5. Then click on Start Scan.
   
6. Before it is done it may prompt for action regardless of the setting so choose delete if prompted.
   
7. When the scan is done no log will be produced.
   
8. Click on the bottom where it says Report to open the report.
   
9. Then highlight of of the items found by using ctrl + a on your keyboard to select all or use your mouse to select all then right click and choose copy.
   
10. This will copy the items that it found to the clipboard you can then open notepad (go to start then run then type in notepad) and choose paste to paste the contents into Notepad.
    
11. You can save this on the desktop.
    
12. Post the contents of the document in your next reply.
    

Note: This tool will self uninstall when you close it so please save the log before closing it.

[kahdah]

OK the Avenger failed because the file was not located in the C:\ drive or at least it did not expand it to C:\

Either way you have some system files missing when I tried to replace them the system didn't boot correctly.

Since those files are necessary I would like to rollback service pack 3 and let it replace those files automatically.

This will get you back into Windows normally and hopefully get your internet back as well.

1. Click Start, click Run, type c:\windows\$NtServicePackUninstall$\spuninst\spuninst.exe in the Open box, and then click OK.
   
2. When the Windows XP Service Pack 3 Removal Wizard starts, click Next.
   
3. Follow the instructions on the screen to remove Windows XP SP3.
   

After that let it reboot normally and you should get into Windows normally.

Let me know what happens.

[Perutom]

It won't work. I get this message:

c:\windows\$NtServicePackUninstall$\spuninst refers to a location that is unavailable. it could be on a hard drive on this computer, or on a network. Check to make sure that the disk is properly inserted, or that you are connected to the Internet or your network, and then try again. If it still cannot be located, the information might have been moved to a different location.

[kahdah]

See if service pack 3 is listed in the add\remove program section.

You will have to place a check mark at the top to Show Updates.

If it is listed there then please uninstall it from there.

[Perutom]

It's not listed in the add/remove programs. I also don't have an XP CD.

[kahdah]

Ok please copy and paste this into your Run box (To get there go to start > Run) C:\WINDOWS\ERDNT\subs\erdnt.exe then hit ok after copy\pasting.

This will restore the registry please reboot after that and see if you can boot into normal mode then.

Let me know how it goes.

[Perutom]

It didn't work. The blue error screen came up again.

[Perutom]

Is there a way to download sp3 again to a flash and load it from there?

[kahdah]

No it is already installed if it was able to uninstall then you could re-download it again.

But for now let me research the issue.

I will be back with you in a bit.