allen2

Could you check on your XP x64 CD if you have the following files: cpu.in_ (or cpu.inf) and intelppm.sy_ (or intelppm.sys and it could be in drivers.cab) ? If you don't have them then your CD is missing some files.

It could be a fan (most likely the cpu fan if it is a fan). Maybe something got stuck in it doing the noise.

The invalid serial number might happen in at least two cases: - if the bios battery is dying - if a bad bios flash happened So i'd try replacing the bios battery, and also do if needed a bios reset and then loading setup default should solve the problem.

Remove the dependency in "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp" the value "DependOnService" should contain (on windows XP) only: Tcpip Afd NetBT If there are any other value, you can remove it.

Did you tried to boot to safe mode and then to remove the folder temp in the infected profile(s) ?

Could please post the hardware id and the exact model of the card ( if you don't find what you need there ) ?

I'd remove usbstor.* from txtsetp.sif, layout.inf and drvindex.inf.

Look inf c:\windows\inf there should a file named sap5.inf, you might be able to fix your problem, by right clicking on sapi5.inf and do install. By the way, the speech icon is in sapi.cpl.

There might be also a problem with the screensaver settings, some tv doesn't like the "turn off monitor" but most tv having a vga connector are fully compatible.

The ramdisk installed is most likely Qsoft ramdisk, so you should have this reg entry HKLM\system\currentcontrolset\services\ramdisk. Backup the key using regedit export function, then remove it. Reboot, go to c:\windows\system32\drivers and there should a file ramdisk.sys, you should remove it.

I did some benchmarks and there are no performance difference between a dynamic volume and a basic volume as long as you don't use the dynamic features: - a dynamic volume extended will be slower than the same basic volume extended => the extension feature of dynamic disk reduce performance and the main reason behind this fact is that when you extend a dynamic disk it create another partition even when it is not needed (i.e. when it is on the same disk). - as for the aggregate feature, it indeed increase the performances (like any software raid) when using many disks but the risk of data loss is very high and even with daily backups, you don't want to restore your data just because you lost access to one of the drives for 1s or so. Also by design, dynamic disks use something like driver filter which is behind the filesystem driver and the storage driver and only this fact should slow down (but sometime not enough to be identified) a little the hardware.

I would also let them as Basic and would avoid at all costs dynamic in server environment. That's the best way to loose data.

I had a similar problem and if i remember correctly i was a group policy: user configuration, administrative templates, startmenu and taskbar and there it was either/both "do not keep history of recent opened documents" or "clear history of recently opened documents on exit" settings.

Perhaps uac is turned off after the script is run or isn't turned of for the user running the script because "reg import" will always output something. Try with those tricks to bypass uac.

It is allowed and (even required) for alternate data streams and example of how how Microsoft use those. Edit Reason: More detailled examples there.

If uac isn't turned off regedit command doesn't run. Perhaps that's why also i would replace "regedit" with "reg import".

Try running DEL /?. You will notice how: DEL [/P] [/F] [/Q] [/A[[:]attributes]] names the red part is inside square brackets. Would this mean anything? jaclaz That doesn't answer anything about why the "del" command would delete the file "C:\Documents and Settings\Elkian\Local Settings\Temp:winupd.exe" with "DEL/A/F "%TEMP%\WINUPD.EXE"" more efficiently than doing "del /q /f "C:\Documents and Settings\Elkian\Local Settings\Temp:winupd.exe"". In fact i don't even see how it would delete it because there are no ":" before the trojan filename.

How would this delete an alternate datastream ? To my knowledge "/A" is to delete files based on their attribute and needs an attributes like S as in this example "/A:S" to work.

The trojan seem to be stored in an alternate datastream. Try safe mode and command prompt and del /q /f "C:\Documents and Settings\Elkian\Local Settings\Temp:winupd.exe" If it doesn't work, you might need to use gmer or rootkit revealer.

The only simple way to do something like this would be adding entries (shortcut to the destination folders) in the "send to" contextual menu but that won't react to a shortcut key.

Yes.

My 2 cents there: - a bad phone wiring shouldn't change with time if no one make changes. - sometimes router needs a hard reboot as some router won't make a real reboot if you just power on and then on. Also next time you get the problem, you should try at least the following (from a command prompt) : - nslookup the unreachable website address for example : nslookup www.msfn.org and if it doesn't work then the problem is that you can't reach a working dns for this website. - try a traceroute to the destination: if using windows, tracert -d www.msfn.org and you might be able to see where it is dropping the packets. Of course, it is good to have a traceroute made when all is working and compare as sometimes firewalls drop the packets when they reach or almost reach the destination. - if you had problem at the dns step, you could try a traceroute to see if you can reach them: get your dns servers from the result of ipconfig /all and then do a traceroute with the dns server ips (one at time of course). - you can also try using pathping instead of tracert. The tracert -d option is recommended to disable ip resolution when tracing and get a faster trace. A similar option exist for pathping and is -n.

Hum sorry but you're wrong the template can be used for domain policy or local policy. In a new or existing domain policy, you need to add the template and then configure the settings and it works. Of course, you need to do this on a DC and check if the template is correctly replicated on each DC if you never used/created gpo template before.

Did you tried this ?

So you didn't answer the only question and don't tell if you check what i said so why did you post the same thing again?