Windows XP can not read install cd/dvds, data disk OK

[TTKK]

I did try another CD/DVD Drive, you may have not seen it, it was earlier in the post.

Any other idea's?

Any comments on doing a registory compare?

 

[floppybootstomp]

I did try another CD/DVD Drive, you may have not seen it, it was earlier in the post.

Any other idea's?

Any comments on doing a registory compare?

My apologies, must confess I didn't read the whole thread through again before posting.

I don't really understand what you mean about a 'registry compare'. Compare with what?

 

[TTKK]

I was think of comparing the registory of the problem machine to another machine that is OK.


So one would export the entire registory from each machine and do a compare, such as with dos comp command.

 

[Silverhazesurfer]

My IT guy gave me a boot CD disk, it boots up fine.

He also gave me a cd with Malwarebytes', The scan should the following:
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.


it did not find anything else,

My cd /dvd drive still will not read installation media.

any other idea's

As per this post right here...

The hardware works fine. The problem is software related, directly to a virus. I have seen it first hand, and I believe I even posted in this thread about it. I was not able to catch it without removing the drive from the machine and scanning. Even then I had to reformat the machine as the malware mucked up all kinds of stuff.

edit* found the post:

I just ran across this issue today. The issue is malware related. The registry keys that were disabled, I believe, were wactually changed by the malware to allow links to be run from that notification. It also installed some application in my windows/drivers folder. I had to get to Safe Mode and run Rkill to allow Malwarebytes to find the infection. It is a bot for running applications. It hid all of my folders on my profile for that machine. I am in process of cleaning the system now and will update information as I get it.

For now, it found three registry keys, a hijacker for taskmanager and the drivers file. The driver file appeared to be just random numbers for a file name.

You can only remove this in Safe Mode, so if you cannot get there, you're done. It even killed my main monitor out of a multi monitor set so I could not see the start button, bar or main desktop shortcuts.

I hope to have a name for it soon. Until then, Rkill and Malwarebytes.

*edit: I got the infection from a drive by of a site selling apple components. My browser blocked pop ups and active X controls for the site, but it still got in. MS Security Essentials found it, but after the infection had occurred. Norton didn't do anything. I'm fairly certain that McAffee won't either.

Give the machine to your IT guys and have them reformat the system. Provided you backed up your machine, the time spent troubleshooting is far greater than reformatting. If you didn't back up your information: bad employee, you deserve a metaphorical spanking.


BTW: comparing the registry to another machine is a super bad idea. The registry contains information regarding multiple users and uses security IDs to reference users and software. Each security ID is different. Loading a complete registry from another machine will destroy any attempts you have at salvaging the data you currently have on the machine without having to take it apart.

 

[TTKK]

It was not my intention to load the other registery into another machine, it was to see if there was some setting that could be causing this issue.

In regards to the virus, how would I know if my machine is infected with a virus, or just some setting some where is different?

It seems that the rule is if it does not work right, and can not find any virus problems, one is to assume that there is a viirus. and reformat the disk in a another machine. Then take your chances that it will happen again, because I don't know how are where it happend in the first place. This whole process seems not very productive. Isn't there a better way?

btw I have a backup.

Any comments on what Rkill found?

 

[Silverhazesurfer]

The registry keys are the big tip off that you have a virus. I also encountered the same keys during my check. These keys are changed as soon as the virus has infected your system. It is part of its process.

The fact that Rkill showed something was running is a huge indicator that you have malware. If Rkill kills something, it isn't supposed to be running there. Hence, virus, or malware. Generally, not good software.

It seems that the rule is if it does not work right, and can not find any virus problems, one is to assume that there is a viirus. and reformat the disk in a another machine. Then take your chances that it will happen again, because I don't know how are where it happend in the first place. This whole process seems not very productive. Isn't there a better way?

Please note: I am generalizing the following statements. This is what your IT guy thinks about all the time.

As an IT guy myself, I can offer the paradigm of "how much money do I want to spend fixing this problem?" I am bound to preserve as much data as possible. I am also bound to resolve problems in a timely manner for my employer as to not waste his money. One must strike a balance here to achieve this cost effective operation. This is where you get caught.

Productivity on both of our parts is at risk as well. The longer I leave your machine this way, the longer you complain about it and fail to achieve your tasks. The faster I can resolve your problem will result in you being able to get back to work faster.

You, as an employee are responsible for your data. My job is to make sure that you are setup with instructions on how to keep your data safe and redundant. I also keep the servers up and running as well as backed up with information you place on the server. I am not, however, responsible for careless actions resulting in data loss. This includes physical damage to the machine or malware activity. I can minimize this by restricting access to your Internet connection by restricting your machine's ability to get online without going through my server. But in the end, all that does is get you upset that you cannot go to XYZ.com to check out the latest sports scores.

There are many times where I would rather troubleshoot an issue than reformat because it genuinely interests me to find out why I see it. If I see a trend with a particular issue, I will isolate the machine and work on it to resolve the issue to keep it from happening again. However, realizing the balance between cost and efficiency, sometimes I have to say **** it and reformat your machine. It pains me just as much as it does you, for varying reasons. Some the same, some very, very different.

BTW: good on you for backing up. I wish my users paid more attention to their information.

Again, I do not wish to offend in anyway. This was mainly to explain the thinking of your IT group. In the end, with this situation, you could have had this resolved a month ago if you would have let them reformat the machine.

 

[floppybootstomp]

On the registry compare:

I can't see how that would be advantageous. Every registry is unique so comparisons are pointless.

I suppose a line of Dells coming off the production line with identical software installed could be identical but two machines that have seen everyday use will never be the same.

imo the surfing silver one is offering good advice and I think it would be beneficial to heed it.

 

[muckshifter]

PUM stands for Potentially Unwanted Modifications.

These entries simply indicate that settings have been changed so that Windows Security Center will not notify you if your antivirus and firewall, respectively, have been turned off.

AVs such as Norton turns these settings off to prevent duplicate notifications, since Norton will also alert you to these events.

Letting Malwarebytes' fix these will result in a Windows warning along with a Norton warning whenever your anitvirus and/or firewall is disabled.

So the choice to fix these or ignore them is a mattter of personal preference.


My advice at this stage ... follow the sound advice from Silverhazesurfer & your own IT guy ... reformat the PC.