Guest Rinnousuke Posted February 19, 2009 Posted February 19, 2009 A warning message popped up unexpectedly on my laptop by my antivirus software F-Secure. Infection: Trojan.Win32.Patched.fk Path: C:\Windows\system32 File: user32.dll The software couldn't remove the infection by itself, so I decided to manually rename it temporarily, which seems now like a bad move, and search for a way to fix the problem. I followed the suggestion of a related thread and tried to replace the user32.dll file in system32 with the one in i386, but found that the file in i386 is also infected. What should I do now? Regards Rinnousuke Quote
Guest Frazer Jolly Goodfellow Posted February 19, 2009 Posted February 19, 2009 On Thu, 19 Feb 2009 10:35:04 -0800, Rinnousuke wrote: <span style="color:blue"> > A warning message popped up unexpectedly on my laptop by my antivirus > software F-Secure. > > Infection: Trojan.Win32.Patched.fk > Path: C:Windowssystem32 > File: user32.dll > > The software couldn't remove the infection by itself, so I decided to > manually rename it temporarily, which seems now like a bad move, and search > for a way to fix the problem. I followed the suggestion of a related thread > and tried to replace the user32.dll file in system32 with the one in i386, > but found that the file in i386 is also infected. What should I do now? > > Regards > Rinnousuke</span> You may find help towards a solution here: http://support.microsoft.com/kb/142676 Quote
Guest 1PW Posted February 19, 2009 Posted February 19, 2009 On 02/19/2009 10:35 AM, Rinnousuke sent:<span style="color:blue"> > A warning message popped up unexpectedly on my laptop by my antivirus > software F-Secure. > > Infection: Trojan.Win32.Patched.fk > Path: C:Windowssystem32 > File: user32.dll > > The software couldn't remove the infection by itself, so I decided to > manually rename it temporarily, which seems now like a bad move, and search > for a way to fix the problem. I followed the suggestion of a related thread > and tried to replace the user32.dll file in system32 with the one in i386, > but found that the file in i386 is also infected. What should I do now? > > Regards > Rinnousuke</span> Upload your suspected user32.dll (renamed or not) to: <http://www.virustotal.com/> After it's been analyzed, cut and paste the report into a reply to this thread. Pete -- 1PW @?6A62?FEH9:DE=6o2@=]4@> [r4o7t] Quote
Guest FromTheRafters Posted February 19, 2009 Posted February 19, 2009 "Rinnousuke" <Rinnousuke@discussions.microsoft.com> wrote in message news:3F143620-E2A3-41A5-AF31-F6E5ADE316B5@microsoft.com...<span style="color:blue"> >A warning message popped up unexpectedly on my laptop by my >antivirus > software F-Secure. > > Infection: Trojan.Win32.Patched.fk > Path: C:Windowssystem32 > File: user32.dll > > The software couldn't remove the infection by itself, so I > decided to > manually rename it temporarily, which seems now like a bad > move, and search > for a way to fix the problem. I followed the suggestion of > a related thread > and tried to replace the user32.dll file in system32 with > the one in i386, > but found that the file in i386 is also infected. What > should I do now?</span> The chances are very good that this is a false positive declaration by your AV program. 1PW has given you a way to gain more insight into this possibility and at the same time clue them in to a need to fix their definition file. Quote
Guest Max Wachtel Posted February 19, 2009 Posted February 19, 2009 Rinnousuke, after much thought, came up with this jewel:<span style="color:blue"> > A warning message popped up unexpectedly on my laptop by my antivirus > software F-Secure. > > Infection: Trojan.Win32.Patched.fk > Path: C:Windowssystem32 > File: user32.dll > > The software couldn't remove the infection by itself, so I decided to > manually rename it temporarily, which seems now like a bad move, and search > for a way to fix the problem. I followed the suggestion of a related thread > and tried to replace the user32.dll file in system32 with the one in i386, > but found that the file in i386 is also infected. What should I do now? > > Regards > Rinnousuke</span> This site has helped me with problem .dlls They have .dlls that you can download for free. http://www.dll-files.com/dllindex/dll-files.shtml?user32 -- Virus Removal http://max.shplink.com/removal.html Keep Clean http://max.shplink.com/keepingclean.html Change nomail.afraid.org to gmail.com to reply by email. nomail.afraid.org is specifically setup for use in USENET Quote
Guest David H. Lipman Posted February 19, 2009 Posted February 19, 2009 From: "FromTheRafters" <erratic@nomail.afraid.org> | The chances are very good that this is a false positive | declaration by your AV program. 1PW has given you a way to | gain more insight into this possibility and at the same time | clue them in to a need to fix their definition file. Actually if it was F-Secure then chances are USER32.DLL was indeed trojanized. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest David H. Lipman Posted February 19, 2009 Posted February 19, 2009 From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> | A warning message popped up unexpectedly on my laptop by my antivirus | software F-Secure. | Infection: Trojan.Win32.Patched.fk | Path: C:\Windows\system32 | File: user32.dll | The software couldn't remove the infection by itself, so I decided to | manually rename it temporarily, which seems now like a bad move, and search | for a way to fix the problem. I followed the suggestion of a related thread | and tried to replace the user32.dll file in system32 with the one in i386, | but found that the file in i386 is also infected. What should I do now? | Regards | Rinnousuke What you need to do is boot into the Windows Recovery Console. Either installed on your PC or boot off a Windows installation CDROM. In the Recovery Console, copy... C:\WINDOWS\ServicePackFiles\i386\user32.dll to C:\WINDOWS\system32 Another way to do this is put the hard disk in an external chassis (USB to IDE or USB to SATA depending on what the hard disk is) and connect it to a surrogate PC. Using the surrogate PC perform the copy as suggested. That is if the external hard disk on the surrogate PC is assigned "E:"... copy... E:\WINDOWS\ServicePackFiles\i386\user32.dll to E:\WINDOWS\system32 -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest FromTheRafters Posted February 20, 2009 Posted February 20, 2009 "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message news:O$VUrIukJHA.2460@TK2MSFTNGP06.phx.gbl...<span style="color:blue"> > From: "FromTheRafters" <erratic@nomail.afraid.org> > > | The chances are very good that this is a false positive > | declaration by your AV program. 1PW has given you a way > to > | gain more insight into this possibility and at the same > time > | clue them in to a need to fix their definition file. > > Actually if it was F-Secure then chances are USER32.DLL > was indeed trojanized.</span> Both copies? It just seemed too coincidental to me. QC would be most difficult on such a variable file. I don't mean to imply F-Secure is anything but a top notch scanner. Anyway, you are probably right - but submitting the file to further scrutiny certainly won't hurt. Quote
Guest David H. Lipman Posted February 20, 2009 Posted February 20, 2009 From: "FromTheRafters" <erratic@nomail.afraid.org> | Both copies? It just seemed too coincidental to me. QC would | be most difficult on such a variable file. I don't mean to | imply F-Secure is anything but a top notch scanner. | Anyway, you are probably right - but submitting the file to | further scrutiny certainly won't hurt. Of course - 2cnd opinion. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest Rinnousuke Posted February 20, 2009 Posted February 20, 2009 I've uploaded and analyzed both the renamed file and the copy in i386 to the site, and the results were exactly the same, although somehow their F-Secure failed to show a positive. The results are below: File user32.dll received on 02.20.2009 10:45:49 (CET) Current status: finished Result: 1/39 (2.56%) Antivirus Version Last Update Result a-squared 4.0.0.93 2009.02.20 - AhnLab-V3 2009.2.20.1 2009.02.20 - AntiVir 7.9.0.85 2009.02.20 - Authentium 5.1.0.4 2009.02.20 - Avast 4.8.1335.0 2009.02.19 - AVG 8.0.0.237 2009.02.19 - BitDefender 7.2 2009.02.20 - CAT-QuickHeal 10.00 2009.02.20 - ClamAV 0.94.1 2009.02.20 - Comodo 983 2009.02.19 - DrWeb 4.44.0.09170 2009.02.20 - eSafe 7.0.17.0 2009.02.19 - eTrust-Vet 31.6.6366 2009.02.20 - F-Prot 4.4.4.56 2009.02.19 - F-Secure 8.0.14470.0 2009.02.20 - Fortinet 3.117.0.0 2009.02.20 - GData 19 2009.02.20 - Ikarus T3.1.1.45.0 2009.02.20 - K7AntiVirus 7.10.637 2009.02.19 - Kaspersky 7.0.0.125 2009.02.20 - McAfee 5530 2009.02.19 - McAfee+Artemis 5530 2009.02.19 - Microsoft 1.4306 2009.02.20 - NOD32 3871 2009.02.20 - Norman 6.00.06 2009.02.19 - nProtect 2009.1.8.0 2009.02.20 - Panda 10.0.0.10 2009.02.20 - PCTools 4.4.2.0 2009.02.19 - Prevx1 V2 2009.02.20 - Rising 21.17.42.00 2009.02.20 - SecureWeb-Gateway 6.7.6 2009.02.20 - Sophos 4.38.0 2009.02.20 - Sunbelt 3.2.1855.2 2009.02.17 Trojan.Win32.Patched.B (vf) Symantec 10 2009.02.20 - TheHacker 6.3.2.3.261 2009.02.20 - TrendMicro 8.700.0.1004 2009.02.20 - VBA32 3.12.10.0 2009.02.20 - ViRobot 2009.2.20.1616 2009.02.20 - VirusBuster 4.5.11.0 2009.02.19 - "1PW" wrote: <span style="color:blue"> > On 02/19/2009 10:35 AM, Rinnousuke sent:<span style="color:green"> > > A warning message popped up unexpectedly on my laptop by my antivirus > > software F-Secure. > > > > Infection: Trojan.Win32.Patched.fk > > Path: C:Windowssystem32 > > File: user32.dll > > > > The software couldn't remove the infection by itself, so I decided to > > manually rename it temporarily, which seems now like a bad move, and search > > for a way to fix the problem. I followed the suggestion of a related thread > > and tried to replace the user32.dll file in system32 with the one in i386, > > but found that the file in i386 is also infected. What should I do now? > > > > Regards > > Rinnousuke</span> > > Upload your suspected user32.dll (renamed or not) to: > > <http://www.virustotal.com/> > > After it's been analyzed, cut and paste the report into a reply to this > thread. > > Pete > -- > 1PW @?6A62?FEH9:DE=6o2@=]4@> [r4o7t] > </span> Quote
Guest Antioch Posted February 20, 2009 Posted February 20, 2009 "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message news:%23oWZnLukJHA.1292@TK2MSFTNGP02.phx.gbl...<span style="color:blue"> > From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> > > | A warning message popped up unexpectedly on my laptop by my antivirus > | software F-Secure. > > | Infection: Trojan.Win32.Patched.fk > | Path: C:Windowssystem32 > | File: user32.dll > > | The software couldn't remove the infection by itself, so I decided to > | manually rename it temporarily, which seems now like a bad move, and > search > | for a way to fix the problem. I followed the suggestion of a related > thread > | and tried to replace the user32.dll file in system32 with the one in > i386, > | but found that the file in i386 is also infected. What should I do now? > > | Regards > | Rinnousuke > > What you need to do is boot into the Windows Recovery Console. Either > installed on your > PC or boot off a Windows installation CDROM. > > In the Recovery Console, copy... > C:WINDOWSServicePackFilesi386user32.dll > to > C:WINDOWSsystem32 > > Another way to do this is put the hard disk in an external chassis (USB to > IDE or USB to > SATA depending on what the hard disk is) and connect it to a surrogate PC. > Using the > surrogate PC perform the copy as suggested. That is if the external hard > disk on the > surrogate PC is assigned "E:"... > > copy... > E:WINDOWSServicePackFilesi386user32.dll > to > E:WINDOWSsystem32 > > -- > Dave > http://www.claymania.com/removal-trojan-adware.html > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp > ></span> Hello David Memory jog :-) This looks the same as the one I reported on behalf of my son at Christmas - user32.dll, which was picked up by Avast AV but no other AV scanners which he/we tried at that time. However, his problem seems to come and go - one day Avast will find it and on another day, not find it. Anyhow, his computer is still running OK. Antioch Quote
Guest Rinnousuke Posted February 20, 2009 Posted February 20, 2009 Hello David, I tried to boot into the Windows Recovery Console with a Windows installation CDROM as you suggested, but there was a problem after pressing "R": the computer couldn't locate the hard drive. Are there any advice to fixing this? Regards Rinnousuke "David H. Lipman" wrote: <span style="color:blue"> > From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> > > | A warning message popped up unexpectedly on my laptop by my antivirus > | software F-Secure. > > | Infection: Trojan.Win32.Patched.fk > | Path: C:Windowssystem32 > | File: user32.dll > > | The software couldn't remove the infection by itself, so I decided to > | manually rename it temporarily, which seems now like a bad move, and search > | for a way to fix the problem. I followed the suggestion of a related thread > | and tried to replace the user32.dll file in system32 with the one in i386, > | but found that the file in i386 is also infected. What should I do now? > > | Regards > | Rinnousuke > > What you need to do is boot into the Windows Recovery Console. Either installed on your > PC or boot off a Windows installation CDROM. > > In the Recovery Console, copy... > C:WINDOWSServicePackFilesi386user32.dll > to > C:WINDOWSsystem32 > > Another way to do this is put the hard disk in an external chassis (USB to IDE or USB to > SATA depending on what the hard disk is) and connect it to a surrogate PC. Using the > surrogate PC perform the copy as suggested. That is if the external hard disk on the > surrogate PC is assigned "E:"... > > copy... > E:WINDOWSServicePackFilesi386user32.dll > to > E:WINDOWSsystem32 > > -- > Dave > http://www.claymania.com/removal-trojan-adware.html > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp > > > </span> Quote
Guest Rinnousuke Posted February 20, 2009 Posted February 20, 2009 Hello Antioch, The file is probably the same indeed, as the date of the last modification to that file was on April 15, 2008, just one day after your version. Regards Rinnousuke "Antioch" wrote: <span style="color:blue"> > > "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message > news:%23oWZnLukJHA.1292@TK2MSFTNGP02.phx.gbl...<span style="color:green"> > > From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> > > > > | A warning message popped up unexpectedly on my laptop by my antivirus > > | software F-Secure. > > > > | Infection: Trojan.Win32.Patched.fk > > | Path: C:Windowssystem32 > > | File: user32.dll > > > > | The software couldn't remove the infection by itself, so I decided to > > | manually rename it temporarily, which seems now like a bad move, and > > search > > | for a way to fix the problem. I followed the suggestion of a related > > thread > > | and tried to replace the user32.dll file in system32 with the one in > > i386, > > | but found that the file in i386 is also infected. What should I do now? > > > > | Regards > > | Rinnousuke > > > > What you need to do is boot into the Windows Recovery Console. Either > > installed on your > > PC or boot off a Windows installation CDROM. > > > > In the Recovery Console, copy... > > C:WINDOWSServicePackFilesi386user32.dll > > to > > C:WINDOWSsystem32 > > > > Another way to do this is put the hard disk in an external chassis (USB to > > IDE or USB to > > SATA depending on what the hard disk is) and connect it to a surrogate PC. > > Using the > > surrogate PC perform the copy as suggested. That is if the external hard > > disk on the > > surrogate PC is assigned "E:"... > > > > copy... > > E:WINDOWSServicePackFilesi386user32.dll > > to > > E:WINDOWSsystem32 > > > > -- > > Dave > > http://www.claymania.com/removal-trojan-adware.html > > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp > > > ></span> > Hello David > Memory jog :-) > This looks the same as the one I reported on behalf of my son at Christmas - > user32.dll, which was picked up by Avast AV but no other AV scanners which > he/we tried at that time. > However, his problem seems to come and go - one day Avast will find it and > on another day, not find it. > Anyhow, his computer is still running OK. > > Antioch > > > </span> Quote
Guest David H. Lipman Posted February 20, 2009 Posted February 20, 2009 From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> | Hello David, | I tried to boot into the Windows Recovery Console with a Windows | installation CDROM as you suggested, but there was a problem after pressing "R":: the computer couldn't locate the hard drive. Are there any advice to | fixing this? | Regards | Rinnousuke It might need a hard disk controller driver. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest Rinnousuke Posted February 20, 2009 Posted February 20, 2009 Hello David What is a hard disk controller driver? And how do I use it? Regards Rinnousuke "David H. Lipman" wrote: <span style="color:blue"> > From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> > > | Hello David, > > | I tried to boot into the Windows Recovery Console with a Windows > | installation CDROM as you suggested, but there was a problem after pressing > "R":: the computer couldn't locate the hard drive. Are there any advice to > | fixing this? > > | Regards > | Rinnousuke > > It might need a hard disk controller driver. > > > -- > Dave > http://www.claymania.com/removal-trojan-adware.html > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp > > > </span> Quote
Guest 1PW Posted February 20, 2009 Posted February 20, 2009 On 02/20/2009 02:07 AM, Rinnousuke sent:<span style="color:blue"> > I've uploaded and analyzed both the renamed file and the copy in i386 to the > site, and the results were exactly the same, although somehow their F-Secure > failed to show a positive. > > The results are below: > > File user32.dll received on 02.20.2009 10:45:49 (CET) > Current status: finished > > Result: 1/39 (2.56%) > > Antivirus Version Last Update Result > a-squared 4.0.0.93 2009.02.20 - > AhnLab-V3 2009.2.20.1 2009.02.20 - > AntiVir 7.9.0.85 2009.02.20 - > Authentium 5.1.0.4 2009.02.20 - > Avast 4.8.1335.0 2009.02.19 - > AVG 8.0.0.237 2009.02.19 - > BitDefender 7.2 2009.02.20 - > CAT-QuickHeal 10.00 2009.02.20 - > ClamAV 0.94.1 2009.02.20 - > Comodo 983 2009.02.19 - > DrWeb 4.44.0.09170 2009.02.20 - > eSafe 7.0.17.0 2009.02.19 - > eTrust-Vet 31.6.6366 2009.02.20 - > F-Prot 4.4.4.56 2009.02.19 - > F-Secure 8.0.14470.0 2009.02.20 - > Fortinet 3.117.0.0 2009.02.20 - > GData 19 2009.02.20 - > Ikarus T3.1.1.45.0 2009.02.20 - > K7AntiVirus 7.10.637 2009.02.19 - > Kaspersky 7.0.0.125 2009.02.20 - > McAfee 5530 2009.02.19 - > McAfee+Artemis 5530 2009.02.19 - > Microsoft 1.4306 2009.02.20 - > NOD32 3871 2009.02.20 - > Norman 6.00.06 2009.02.19 - > nProtect 2009.1.8.0 2009.02.20 - > Panda 10.0.0.10 2009.02.20 - > PCTools 4.4.2.0 2009.02.19 - > Prevx1 V2 2009.02.20 - > Rising 21.17.42.00 2009.02.20 - > SecureWeb-Gateway 6.7.6 2009.02.20 - > Sophos 4.38.0 2009.02.20 - > Sunbelt 3.2.1855.2 2009.02.17 Trojan.Win32.Patched.B (vf) > Symantec 10 2009.02.20 - > TheHacker 6.3.2.3.261 2009.02.20 - > TrendMicro 8.700.0.1004 2009.02.20 - > VBA32 3.12.10.0 2009.02.20 - > ViRobot 2009.2.20.1616 2009.02.20 - > VirusBuster 4.5.11.0 2009.02.19 - > > > "1PW" wrote: > <span style="color:green"> >> On 02/19/2009 10:35 AM, Rinnousuke sent:<span style="color:darkred"> >>> A warning message popped up unexpectedly on my laptop by my antivirus >>> software F-Secure. >>> >>> Infection: Trojan.Win32.Patched.fk >>> Path: C:Windowssystem32 >>> File: user32.dll >>> >>> The software couldn't remove the infection by itself, so I decided to >>> manually rename it temporarily, which seems now like a bad move, and search >>> for a way to fix the problem. I followed the suggestion of a related thread >>> and tried to replace the user32.dll file in system32 with the one in i386, >>> but found that the file in i386 is also infected. What should I do now? >>> >>> Regards >>> Rinnousuke</span> >> Upload your suspected user32.dll (renamed or not) to: >> >> <http://www.virustotal.com/> >> >> After it's been analyzed, cut and paste the report into a reply to this >> thread. >> >> Pete >> -- >> 1PW @?6A62?FEH9:DE=6o2@=]4@> [r4o7t] >></span></span> I'm happy for you that this was very likely a false positive. If in all other cases you are running good antimalware, and no other symptoms are present, I would recommend you monitor this condition but do little else. Pete -- 1PW @?6A62?FEH9:DE=6o2@=]4@> [r4o7t] Quote
Guest David H. Lipman Posted February 20, 2009 Posted February 20, 2009 From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> | Hello David | What is a hard disk controller driver? And how do I use it? | Regards | Rinnousuke It is the hardware driver the OS uses to communicate with the hard disk contraoller. Some SATA and SCSI controllers can't use the stiock driver. Slaving the drive in a surrogate PC may be easier. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest Rinnousuke Posted February 21, 2009 Posted February 21, 2009 Hello David I'm not really sure how to use a surrogate PC to boot my laptop. Could you explain in more detail? Regards Rinnousuke "David H. Lipman" wrote: <span style="color:blue"> > From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> > > | Hello David > > | What is a hard disk controller driver? And how do I use it? > > | Regards > | Rinnousuke > > It is the hardware driver the OS uses to communicate with the hard disk contraoller. Some > SATA and SCSI controllers can't use the stiock driver. > > Slaving the drive in a surrogate PC may be easier. > > > > -- > Dave > http://www.claymania.com/removal-trojan-adware.html > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp > > > </span> Quote
Guest David H. Lipman Posted February 21, 2009 Posted February 21, 2009 From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> | Hello David | I'm not really sure how to use a surrogate PC to boot my laptop. Could you | explain in more detail? | Regards | Rinnousuke As I stated... Another way to do this is put the hard disk in an external chassis (USB to IDE or USB to SATA depending on what the hard disk is) and connect it to a surrogate PC. Using the surrogate PC perform the copy as suggested. That is if the external hard disk on the surrogate PC is assigned "E:"... copy... E:\WINDOWS\ServicePackFiles\i386\user32.dll to E:\WINDOWS\system32 -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest Rinnousuke Posted February 21, 2009 Posted February 21, 2009 Hello David The part which I don't understand is how to put my hard disk in an external chassis. Can you be more specific on the procedures? Regards Rinnousuke "David H. Lipman" wrote: <span style="color:blue"> > From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> > > | Hello David > > | I'm not really sure how to use a surrogate PC to boot my laptop. Could you > | explain in more detail? > > | Regards > | Rinnousuke > > As I stated... > > Another way to do this is put the hard disk in an external chassis (USB to IDE or USB to > SATA depending on what the hard disk is) and connect it to a surrogate PC. Using the > surrogate PC perform the copy as suggested. That is if the external hard disk on the > surrogate PC is assigned "E:"... > > copy... > E:WINDOWSServicePackFilesi386user32.dll > to > E:WINDOWSsystem32 > > > > -- > Dave > http://www.claymania.com/removal-trojan-adware.html > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp > > > </span> Quote
Guest David H. Lipman Posted February 21, 2009 Posted February 21, 2009 From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> | Hello David | The part which I don't understand is how to put my hard disk in an external | chassis. Can you be more specific on the procedures? | Regards | Rinnousuke They are common of the shelf (COTS) products. You buy the chassis. Remove its cover. Take drive out of affected computer. Place drive in external chassis. Connect external chassis to USB interface of surrogate PC. Power-up external chassis. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest Rinnousuke Posted February 21, 2009 Posted February 21, 2009 Hello David Thank you for your explanation, but the affected computer in this case is a notebook, which can't be dissected like desktop computers. Any other options? Regards Rinnousuke "David H. Lipman" wrote: <span style="color:blue"> > From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> > > | Hello David > > | The part which I don't understand is how to put my hard disk in an external > | chassis. Can you be more specific on the procedures? > > | Regards > | Rinnousuke > > They are common of the shelf (COTS) products. > > You buy the chassis. > Remove its cover. > Take drive out of affected computer. > Place drive in external chassis. > Connect external chassis to USB interface of surrogate PC. > Power-up external chassis. > > > > -- > Dave > http://www.claymania.com/removal-trojan-adware.html > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp > > > </span> Quote
Guest David H. Lipman Posted February 21, 2009 Posted February 21, 2009 From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> | Hello David | Thank you for your explanation, but the affected computer in this case is a | notebook, which can't be dissected like desktop computers. Any other options? | Regards | Rinnousuke Easily is some case and difficult in others. For example... A notebook's hard disk using SATA will be easily be extracted and placed within a SATA external chassis. A Panasonic Toughbook hard disk will be more difficult to extract the drive from its shock mounted cage. A notebook using IDE may either require an external chassis that provides the IDE interface for 2 1/2" hard drives or a standard external IDE chassis for 3 1/2" har drives (that use a standard IDE interface) in combination with a 2 1/2" IDE interface conversion. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp Quote
Guest Rinnousuke Posted February 21, 2009 Posted February 21, 2009 Hello David Are there any other alternatives other than disassembling the notebook? Because I'm afraid that I might damage the hardware while doing so. Regards Rinnousuke "David H. Lipman" wrote: <span style="color:blue"> > From: "Rinnousuke" <Rinnousuke@discussions.microsoft.com> > > | Hello David > > | Thank you for your explanation, but the affected computer in this case is a > | notebook, which can't be dissected like desktop computers. Any other options? > > | Regards > | Rinnousuke > > Easily is some case and difficult in others. > > For example... > > A notebook's hard disk using SATA will be easily be extracted and placed within a SATA > external chassis. > > A Panasonic Toughbook hard disk will be more difficult to extract the drive from its shock > mounted cage. > > A notebook using IDE may either require an external chassis that provides the IDE > interface for 2 1/2" hard drives or a standard external IDE chassis for 3 1/2" har drives > (that use a standard IDE interface) in combination with a 2 1/2" IDE interface conversion. > > > > -- > Dave > http://www.claymania.com/removal-trojan-adware.html > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp > > > </span> Quote
Guest PA20Pilot Posted February 21, 2009 Posted February 21, 2009 Hi, ......Are there any other alternatives other than disassembling the notebook? There's really not much involved it taking the hard drive out of laptops. Usually, there's a door on the bottom with a couple of screws holding it in place. Remove the door, then you'll see another pair of screws holding down a thin metal plate. Short of removing the plug-in wire going to the end of the drive, that's about all there is to removing a drive. It's not like you have to go after the drive from the top down removing more things as you get deeper into it. ---==X={}=X==--- Jim Self AVIATION ANIMATION, the internet's largest depository. http://avanimation.avsupport.com Your only internet source for spiral staircase plans. http://jself.com/stair/Stair.htm Experimental Aircraft Association #140897 EAA Technical Counselor #4562 Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.