Member Avatar for ldblack

I'm in need of serious help. I'm one of those "I think I can do it myself" people when I really can't. Here's my problem: I have a trojan virus that I can't get rid of. system32\37B.tmp. It won't let me delete it because it says its being used by another program. What do I do? Also, in the process of trying to get rid of a system32\hal.dll error I somehow made it so I can't get onto my computer at all. Not even in safe mode. It says that I have to re-install it. How am I supposed to do that?
I really could use some help here and being that I'm obviously not good with computers and have no business trying to do this by myself can someone please tell me very simply how to do this stuff?
I would be most grateful!:-|

  • 2 Contributors
  • 2 Replies
  • 102 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

A concise, practical plan that builds on ’s suggestion and fills in next steps for the two linked problems: the trojan file in the Windows system folder and the HAL error that prevents any boot.

First, protect data and work from outside the infected Windows image. If an XP install disc is not available, remove the drive and attach it to another clean machine or boot from a known-good live environment (rescue CD/USB) to copy Documents, Desktop, browser bookmarks and any mail store. Do not copy executables from System32 or Program Files; scan all user files on a clean system before restoring them.

Second, perform an offline malware cleanup before attempting system repairs. Use a current vendor rescue environment (bootable AV rescue ISO) so the trojan in System32 cannot block removal. Update signatures on the rescue media if possible, run a full scan and quarantine/delete the infected items. Offline removal avoids reinfection of any files restored during repair.

Third, once the malware is neutralized, restore the correct HAL and repair boot configuration from recovery media that matches the installed XP build (retail/OEM and service pack level). From the Windows Recovery Console the core steps are to expand or copy the HAL from the CD’s i386 folder and rebuild/fix the boot records if needed. Example commands (adjust the CD drive letter to match the environment):

expand D:\i386\hal.dl_ C:\Windows\System32\hal.dll
bootcfg /rebuild
fixboot
fixmbr

Notes and cautions: use recovery media that matches the installed Windows version (wrong HAL can cause the same error), back up everything before any repair or reinstall, and if any step is unclear or the disk shows physical errors, consider a professional repair. If the system remains unstable after offline cleaning and HAL restoration, a clean reinstall after full data backup is the safest route.

Recommended Answers

All 2 Replies

Member Avatar for gerbil

We gotta stop the trojan for a start, cos to fix hal while it is running would invite problems. With your XP install CD proceed to Recovery Console -it's about the first option/decision point you will arrive at.... just use delete to remove that system32\37B.tmp file. To be sure when you boot from the CD it will not be running!!
Done that? then say so n we'll go from there. [if you broke hal then you def won't get any part of windows running til we fix it]

To save a posting relay because you may not be in possession of an Xp install CD, here's a boot disc with a recovery console on it; the console runs from the cd so you don't need an xp cd or any files from your C drive. I know it works. All you need is an image burner like Nero 6, CD Writer...
Tips... unzip the file to get the iso and then BURN THE IMAGE. Do not use Data CD or any other mode cos all you will get is a copy of the iso [which you have already...and your new CD will not be bootable]; if you look at the files on your new cd and see .iso mentioned anywhere, start over. If you use Nero 6 then the defaults for image burning are fine, skip the silly advice that you may find on the web. Burn it to a CD-RW if you wish; there is no need to close/finalise the CD whether it is a RW or R, cos later you may wish to add other good files. Multisession works fine. If you use a CD-R then hold the burn speed lowish, say 4x.
May i leave you to work out what to do with recovery console? delete /? will give you a bit of help.
http://www.webtree.ca/windowsxp/Tool...xp_rec_con.zip

Since you now have Recovery Console open, run chkdsk also.
Note:.. first run chkdsk /p to perform a simple check of the drive. If there are any errors reported you must then do chkdsk /r to attempt to recover them, and follow with chkdsk /p to see if it is fixed. If not, try /r again, and so on.
{{{ chkdsk with /p as parameter will not fix a thing. Promise you. Some websites say it does.... well, if /p runs and reports no errors there were no errors there in the first place to be fixed}}}

Member Avatar for gerbil

of course, to get that CD file and to burn it you will need a friend.... an I quietly curse ppl who alter links so that you will go first to their homepage for the ads etc.... Use this link:

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.