Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Entire c:\Windows\ directory has been corrupted: Win XP Pro

Feb 4, 2004 1:34PM PST

Entire c:\Windows\ directory has been corrupted

OS: Windows XP Professional
Partition: C: drive

I think I may have downloaded a virus (possibly wuauclt trojan) that allowed someone to corrupt my Windows directory.

When my computer WAS running, I used task manager, and explorer.exe had huge memory leak problems = very slow computer. Stupid me, I rebooted only to not be able to start windows: "Missing file <windows root>\system32\hal.dll"

I ran NTFSPro (read/write) capabilities and tried checking out the windows directory. I could see it, but it did not allow me to change present working directory to c:\windows, which most likely meant more than just one file (hal.dll) missing.

I ran NTFSChk which proceeded to tell me that "file record segments [28 thru 35] is unreadable." It also proceeded to delete index entry "WINDOWS."

I installed XP Home on another blank partition to check out what I did. c:\Windows directory is GONE. NTFSChk created about 7 directories in its own directory called "found.000", 2 of the 7 look like the System32 and System subdirectories. However, what seems to be the System32 directory is missing all files that are supposed to be in the "config" directory. I don't know what else is missing.

The "repair" directory has all necessary files in it.

To wrap up my essay. I know the Windows directory is gone. I have 7 directories that NTFSchk created, all of which I think were subdirectories of the Windows directory. Also, I did a mcafee online virus scan and it turned up nothing of the C: drive. What I need is maybe a listing, or better yet a picture of the entire structure of the Windows directory so I know where to replace the directories/files that NTFSChk found. I also need ANY extra help anyone can give. Would a "repair" using the WinXPPro setup CD help? Would copying the contents of the repair folder to the config folder help?

Don't spare me on technical info, I'm not a beginner.
Thanks for reading. PLEASE REPLY!
mikedmc23@hotmail.com

Discussion is locked

- Collapse -
UPDATE: Re:Entire c:\Windows\ directory has been corrupted: Win XP Pro
Feb 4, 2004 1:57PM PST

UPDATE: I ran Norton Disk Doctor and received the following errors for C:

INDEXES STATUS
--------------

The 'Fix errors' checkbox was not checked.
Corrective actions indicated below were not written to the disk.

Recovering orphaned file cis.scp (773) into directory file 33.
Recovering orphaned file pad.inf (2041) into directory file 33.
Recovering orphaned file slip.scp (2324) into directory file 33.
Recovering orphaned file slipmenu.scp (2325) into directory file 33.
Recovering orphaned file switch.inf (2395) into directory file 33.

SECURITY DESCRIPTORS STATUS
---------------------------
The 'Fix errors' checkbox was not checked.
Corrective actions indicated below were not written to the disk.
Norton Disk Doctor found problems with the file system. Run Norton Disk Doctor and check the Fix Errors option.

- Collapse -
This looks like hardware
Feb 4, 2004 3:01PM PST

I would think this is more of a hardware failure.

If you can get your data off the drive save it all now.

Then get the test utils for your hard drive and fully test it. Hard drive and or mainboard error may be the cause. At this point as destroyed as C:\windows is just forget about replacing folders.
Wipe the drive if it tests OK and re-install.

Be very cautious of the system, as usually after stuff like this occurs it occurs again until the bad hardware is found.

- Collapse -
Re:This looks like hardware
Feb 4, 2004 10:59PM PST

Weird... So, I've found the 'Windows' directory using NTFSChk via dos. I said before that it found about 7 directories... well those directories are:
1 'Windows' minus 'System' and 'System32'
2 'System32' minus '\config, \drivers and \spool' directories
3 'System32\config' dir
4 'System32\drivers' dir
5 'System32\spool' dir
6 'System32\spool\drivers' dir
7 'System' directory

I guess I'll proceed with backing up as much as I can and try to NTFSPro a new Windows directory and substructure... just to see if it works... the more fun way.
QUESTION:
1. Do I have Norton Disk Doctor 'FIX' the index errors noted in my 2nd "UPDATE:" post?

mikedmc23@hotmail.com