This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

DNS redirects: jjh.exe suspected

64 min read

This thread's last reply is from June 12, 2010, 8:03 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Hi Lets see if we can reinstall it.



SystemLook

Please download SystemLook by jpshortstuff from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
    sr.inf
    sr.sys

  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Look grayed out the "look" button, and displayed "scanning." Then displayed the "look" button again. No notepad window.
Is the file not on your desktop?
SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 07:49 on 11/06/2010 by Paul (Administrator - Elevation successful)

========== filefind ==========

Searching for "sr.inf"
No files found.

Searching for "sr.sys"
C:\WINDOWS.1\ServicePackFiles\i386\sr.sys -----c 73472 bytes [06:06 04/08/2004] [18:36 13/04/2008] 76BB022C2FB6902FD5BDD4F78FC13A5D

-=End Of File=-
Do you have your Windows CD?
I have a microsoft windows XP CD that includes SP1, and one that I labeled slipstreamed XP lite SP3
Show Hidden Folders

  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab. Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.


Then:

  1. Confirm that the folder C:\Windows.1\inf is present.
  2. Insert your Windows disk
.

Go Start > Run and copy/paste the following command:

expand X:\i386\sr.in_ C:\Windows.1\inf\sr.inf

Where X pertains to your CD_Rom Drive letter

Example. If your CD_ROM drive letter is E: the command will be:

expand E:\i386\sr.in_ C:\Windows.1\inf\sr.inf


Confirm that the above was successful before we continue.
Confirmed: sr.inf is now in the c:\windows.1\inf folder
Ok - Good.

With your XP CD still inserted, Go Start > Run and copy/paste the following command into the run box:

rundll32.exe advpack.dll,LaunchINFSection C:\Windows.1\Inf\sr.inf

You will be prompted for the file SR.sys. Copy/paste C:\WINDOWS.1\ServicePackFiles\i386 into the (Copy files from:) box and click OK.

You'll then see a window copying all the files over from the XP CD that are needed to reinstall System Restore.

You'll see a message "You must restart your computer before the new settings will take effect.
Do you want to restart your computer now
?"

Click Yes and allow the computer to reboot.


Let me know if you have System restore working.
Another box pops up requesting srframe.mmf


SystemLook doesn't find it

:filefind
srframe.mmf
Confirm that the folder C:\Windows.1\System32\Restore is present.

With your Windows disk inserted still, go Start > Run and copy/paste the following command:

expand X:\i386\SRFRAME.MM_ C:\Windows.1\System32\Restore\SRFRAME.MMF

Where X pertains to your CD_Rom Drive letter,

When you are then prompted for the file when installing System Restore copy/paste into the (Copy files from:) box:

C:\Windows.1\System32\Restore

and click OK
done

no request for reboot, however
Do you have a working System Restore now then?
I have a SR line under Accessories/System tools, but when I click on it I get a message

System Restore is not able to protect your computer. Please restart your computer and run System Restore again.

twice, now

I conclude that it isn't working.
I checked the Computer Management system - no System Restore under Services and Applications/Services