21 replies to this topic

[oldtrig]

I have a good one. I helped a good friend about three weeks ago get his computer back going. He has a Dell Inspiron 1501 running windows Vista. When he brought it to me it was so infected I just run the factory image by hitting the F8 key and doing a complete destructive restore. He takes it home and uses it for several days and today brings it back to me messed up again. This time I cannot get to the hidden partition. I go through the steps to restore a Dell and it brings me to a weird desktop and in the center of screen it shows a box that says OTHER USER. It asked for a username and password. I never put any password on this PC. I can boot into safemode and I actually think I was able to run system restore from a command prompt. I went to my computer and I see the PC Restore. I click to run the EXE and it I get prompted to put a check to reformat HD and all will be lost. It starts and then I get error and it stops. I know the error is the virus because of the way the error box looks. I included a picture of what I get. Anyway to rid this computer of this trojan. I remember seeing one time AV Virus 2010 I think. I cannot get to regular desktop to try to remove with malwarebytes. Help

Attached Images

• 

[Broni]

Let's see, if we can look at your computer booting from an external source.

Please download OTLPE (filesize 120,9 MB)

• When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.
  
• Reboot your system using the boot CD you just created.
  
  • Note : If you do not know how to set your computer to boot from CD follow the steps here
• Your system should now display a REATOGO-X-PE desktop.
  
• Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.
  
• Double-click on the OTLPE icon.
  
• When asked Do you wish to load the remote registry, select Yes
  
• When asked Do you wish to load remote user profile(s) for scanning, select Yes
  
• Ensure the box Automatically Load All Remaining Users" is checked and press OK
  
• OTL should now start.
  
• Press Run Scan to start the scan.
  
• When finished, the file will be saved in drive C:\OTL.txt
  
• Copy this file to your USB drive if you do not have internet connection on this system
  
• Please post the contents of the OTL.txt file in your reply.

[oldtrig]

Downloading that now Broni. I was able to boot into safe mode with networking and downloaded malwarebytes, updated it and run and it found nothing. Strange. I also one time got a very quick blue screen. Did not have time to read what it was as the computer rebooted. I am not wondering if the restore image someway got infected. He told me he never got on the internet after it left my house?? I find that odd because I was able to see where windows updates had installed on several dates. He swears to me that it never worked when he took it home. This friend is going through a divorce so I am not sure if he was telling me the truth. Anyway I will let you know when I get the boot disk burned to cd.

[Broni]

Quote

I am not wondering if the restore image someway got infected

Not possible, because that partition is read-only.
However, that partition could get just corrupted some way.

We may be dealing here with hard drive issue maybe, but we'll see what OTL log will show.

[oldtrig]

Broni, if it will help I now got to regular windows and am posting from the infected computer. I am still downloading the file on my pc but being I now can get to desktop here there might be a better way???

[Broni]

Sure. Keep that program downloading though. You'll find that CD as a gem, when you deal with not bootable computers.

Now, follow these steps: http://www.smartestc...ease-read-this/

[oldtrig]

Broni, I tried to uninstall trends and it has locked up. If I could I want to use the PC Restore and do this think over fresh. Here is the one thing you wanted me to post about MBR, do you see anything that might be causing this Dell not to be able to do the PC Restore?

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows Vista Home Basic Edition
Windows Information: (build 6000), 32-bit
Base Board Manufacturer: Dell Inc.
BIOS Manufacturer: Dell Inc.
System Manufacturer: Dell Inc.
System Product Name: Inspiron 1501
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 143):
0x81C00000 \SystemRoot\system32\ntkrnlpa.exe
0x81FA1000 \SystemRoot\system32\hal.dll
0x858C7000 \SystemRoot\system32\kdcom.dll
0x802C2000 \SystemRoot\system32\PSHED.dll
0x802BA000 \SystemRoot\system32\BOOTVID.dll
0x8027F000 \SystemRoot\system32\CLFS.SYS
0x8051F000 \SystemRoot\system32\CI.dll
0x80204000 \SystemRoot\system32\drivers\Wdf01000.sys
0x80512000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x804CF000 \SystemRoot\system32\drivers\acpi.sys
0x804C6000 \SystemRoot\system32\drivers\WMILIB.SYS
0x804BE000 \SystemRoot\system32\drivers\msisadrv.sys
0x80499000 \SystemRoot\system32\drivers\pci.sys
0x8048A000 \SystemRoot\system32\drivers\volmgr.sys
0x80201000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x80480000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x80470000 \SystemRoot\System32\drivers\mountmgr.sys
0x80469000 \SystemRoot\system32\drivers\pciide.sys
0x8045B000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x80411000 \SystemRoot\System32\drivers\volmgrx.sys
0x80409000 \SystemRoot\system32\drivers\atapi.sys
0x807E2000 \SystemRoot\system32\drivers\ataport.SYS
0x807B1000 \SystemRoot\system32\drivers\fltmgr.sys
0x807A1000 \SystemRoot\system32\drivers\fileinfo.sys
0x80400000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x8069D000 \SystemRoot\system32\drivers\ndis.sys
0x80672000 \SystemRoot\system32\drivers\msrpc.sys
0x80639000 \SystemRoot\system32\drivers\NETIO.SYS
0x81AF8000 \SystemRoot\System32\Drivers\Ntfs.sys
0x81A8E000 \SystemRoot\System32\Drivers\ksecdd.sys
0x80603000 \SystemRoot\system32\drivers\volsnap.sys
0x81A86000 \SystemRoot\System32\Drivers\spldr.sys
0x81A77000 \SystemRoot\System32\drivers\partmgr.sys
0x81A68000 \SystemRoot\System32\Drivers\mup.sys
0x81A43000 \SystemRoot\System32\drivers\ecache.sys
0x81A32000 \SystemRoot\system32\drivers\disk.sys
0x81A11000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x81A09000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x81A00000 \SystemRoot\system32\drivers\crcdisk.sys
0x87206000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x872FD000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x82830000 \SystemRoot\system32\DRIVERS\amdk8.sys
0x87306000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x87ECF000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x87A44000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x87A37000 \SystemRoot\System32\drivers\watchdog.sys
0x87E49000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x87256000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x87D6C000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x87A29000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x87A11000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x87B1E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x87B0B000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x87A06000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x87D41000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8732C000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x87B00000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x82D1C000 \SystemRoot\system32\DRIVERS\bcm4sbxp.sys
0x87D29000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x87D1B000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x8735C000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x87CF0000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x87CB0000 \SystemRoot\system32\DRIVERS\storport.sys
0x87CA5000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x87C8E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x87C83000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x87C60000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x87C51000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x87C3E000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x87C22000 \SystemRoot\system32\DRIVERS\termdd.sys
0x87324000 \SystemRoot\system32\DRIVERS\swenum.sys
0x887D6000 \SystemRoot\system32\DRIVERS\ks.sys
0x87DA9000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x88618000 \SystemRoot\system32\DRIVERS\TM_CFW.sys
0x87C31000 \SystemRoot\system32\DRIVERS\umbus.sys
0x889CC000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x82D4C000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8897F000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8887C000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x88D4C000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8886F000 \SystemRoot\system32\drivers\modem.sys
0x88CA9000 \SystemRoot\system32\drivers\stwrt.sys
0x88802000 \SystemRoot\system32\drivers\portcls.sys
0x88C84000 \SystemRoot\system32\drivers\drmk.sys
0x872F4000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x87271000 \SystemRoot\System32\Drivers\Null.SYS
0x87B90000 \SystemRoot\System32\Drivers\Beep.SYS
0x88C68000 \SystemRoot\System32\drivers\vga.sys
0x88C47000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x82C0A000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x87380000 \SystemRoot\system32\drivers\rdpencdd.sys
0x88C1C000 \SystemRoot\System32\Drivers\Msfs.SYS
0x88C0E000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8730F000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x88F2F000 \SystemRoot\System32\drivers\tcpip.sys
0x88F16000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x88F01000 \SystemRoot\system32\DRIVERS\tdx.sys
0x88EED000 \SystemRoot\system32\DRIVERS\smb.sys
0x88EA6000 \SystemRoot\system32\drivers\afd.sys
0x88E74000 \SystemRoot\System32\DRIVERS\netbt.sys
0x88E5E000 \SystemRoot\system32\DRIVERS\pacer.sys
0x88C00000 \SystemRoot\system32\DRIVERS\netbios.sys
0x88E4B000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x88E3A000 \SystemRoot\system32\DRIVERS\tmtdi.sys
0x899C5000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x87DB3000 \SystemRoot\system32\drivers\nsiproxy.sys
0x88E23000 \SystemRoot\System32\Drivers\dfsc.sys
0x8727B000 \SystemRoot\System32\Drivers\crashdmp.sys
0x87266000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x873F8000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x89830000 \SystemRoot\System32\Drivers\fastfat.SYS
0x8CE00000 \SystemRoot\System32\win32k.sys
0x87DBD000 \SystemRoot\System32\drivers\Dxapi.sys
0x8E66C000 \SystemRoot\system32\DRIVERS\monitor.sys
0x8EC00000 \SystemRoot\System32\TSDDD.dll
0x8EC10000 \SystemRoot\System32\cdd.dll
0x8FF65000 \SystemRoot\system32\drivers\luafv.sys
0x898A9000 \SystemRoot\system32\DRIVERS\tmpreflt.sys
0x8FE53000 \SystemRoot\system32\DRIVERS\vsapint.sys
0x8FE11000 \SystemRoot\system32\drivers\TmXPFlt.sys
0x908F2000 \SystemRoot\system32\drivers\spsys.sys
0x82CEC000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9084D000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x87E17000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x908A2000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9168D000 \SystemRoot\system32\drivers\HTTP.sys
0x90887000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x908D9000 \SystemRoot\system32\DRIVERS\bowser.sys
0x914F8000 \SystemRoot\System32\drivers\mpsdrv.sys
0x914D9000 \SystemRoot\system32\drivers\mrxdav.sys
0x9152B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9154D000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x91400000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9159F000 \SystemRoot\System32\DRIVERS\srv2.sys
0x923B4000 \SystemRoot\System32\DRIVERS\srv.sys
0x87330000 \SystemRoot\system32\DRIVERS\dsunidrv.sys
0x9226A000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0x92C62000 \SystemRoot\system32\drivers\peauth.sys
0x87E2B000 \SystemRoot\System32\Drivers\secdrv.SYS
0x8A35B000 \SystemRoot\System32\drivers\tcpipreg.sys
0x935B8000 \SystemRoot\system32\DRIVERS\xaudio.sys
0x8F6EA000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x77990000 \Windows\System32\ntdll.dll

Processes (total 70):
0 System Idle Process
4 System
380 C:\Windows\System32\smss.exe
512 csrss.exe
564 C:\Windows\System32\wininit.exe
572 csrss.exe
604 C:\Windows\System32\winlogon.exe
652 C:\Windows\System32\services.exe
664 C:\Windows\System32\lsass.exe
672 C:\Windows\System32\lsm.exe
812 C:\Windows\System32\svchost.exe
900 C:\Windows\System32\svchost.exe
1080 C:\Windows\System32\Ati2evxx.exe
1096 C:\Windows\System32\svchost.exe
1124 C:\Windows\System32\svchost.exe
1216 C:\Windows\System32\audiodg.exe
1260 C:\Windows\System32\SLsvc.exe
1336 C:\Windows\System32\svchost.exe
1420 C:\Windows\System32\Ati2evxx.exe
1484 C:\Windows\System32\svchost.exe
1716 C:\Windows\System32\WLTRYSVC.EXE
1736 C:\Windows\System32\BCMWLTRY.EXE
1824 C:\Windows\System32\spoolsv.exe
1848 C:\Windows\System32\svchost.exe
400 C:\Windows\System32\dwm.exe
2188 C:\Windows\System32\svchost.exe
2240 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
2336 C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe
2400 C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
2508 C:\Windows\System32\svchost.exe
2556 C:\Windows\System32\SearchIndexer.exe
2652 C:\Windows\System32\drivers\XAudio.exe
3576 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3700 C:\Windows\sttray.exe
3716 C:\Windows\System32\WLTRAY.EXE
3736 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
3744 C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
3804 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
3872 C:\Program Files\Digital Line Detect\DLG.exe
3888 C:\Program Files\Dell\QuickSet\quickset.exe
2304 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
2996 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
3712 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
2868 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
2604 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
2780 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
2612 C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
2892 C:\Windows\System32\mobsync.exe
4812 C:\Program Files\Dell Support Center\bin\sprtsvc.exe
4932 C:\Program Files\Dell Support Center\bin\sprtcmd.exe
5544 C:\Program Files\Trend Micro\Internet Security 14\pccmain.exe
5576 C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
4832 C:\Windows\System32\svchost.exe
1256 C:\Windows\System32\taskeng.exe
1760 C:\Windows\System32\taskeng.exe
2464 C:\Windows\explorer.exe
2040 C:\Windows\System32\msiexec.exe
3180 C:\Windows\System32\VSSVC.exe
5376 C:\Windows\System32\svchost.exe
5520 C:\Windows\System32\dllhost.exe
5360 C:\Windows\Temp\remove.exe
2104 C:\Windows\System32\msiexec.exe
3232 C:\Windows\System32\msiexec.exe
6916 C:\Windows\servicing\TrustedInstaller.exe
4588 C:\Program Files\Internet Explorer\ieuser.exe
5352 C:\Program Files\Internet Explorer\iexplore.exe
6572 <unknown>
6620 <unknown>
3588 C:\Windows\System32\WerFault.exe
7240 C:\Users\ROBERT\Downloads\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`85700000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000000`05700000 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK8037GSX, Rev: DL240D

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 0C0E7F154151469D03B17DE3B60CAFCFD0398D69


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

[Broni]

Possibly....

Quote

PhysicalDrive0 MBR Code Faked!

Run MBRCheck again.

When it's done you'll see the following line:
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Press the Y key and then press Enter

When the program asks you to Enter your choice, enter 2 and press the Enter key.

Next the program will ask you to Enter the physical disk number to fix (0-99, -1 to cancel):
Enter 0 (zero) and press the Enter key.

Next the program will show Available MBR codes:, followed by a list of operating systems.
Please enter 3 for Windows Vista, and then press Enter.

Next the program will prompt for confirmation.
Type YES and hit Enter.

When it's done there should be a text file with the results on your desktop.
Please copy and paste it back here.

Then reboot, run MBRCheck again and post new log.

[oldtrig]

Also here is the prompt I get after I rebooted. I do not have a clue how I got to the desktop earlier but I cannot get there now. I will not have to use the cd you uploaded so I can get back to post or I can try safemode again.

Attached Images

• 

[oldtrig]

This is what I get before I click anything. This is really strange. I have worked with pc's for many years now and never run on this one. I get prompted to repair computer after I hit the F8 key. That is how I have always used PC restore on Dell's with Vista but it bypasses the repair and brings me to this screen. It is late now and I have to get some sleep but I want to try and figure this one out if we can. Thanks and I will see you tomorrow. Td

Attached Images

• 

[Broni]

Did you actually try CTRL+F11 at Dell's logo?
This is how you get to recovery partition.

[oldtrig]

That is how you got to the older Dell's Broni. On this Inspiron 1501 you have to hit the F8 key when first booting and you get prompted with a screen called advanced boot options and one option is to repair your computer. I have done many of these including this Laptop. I have done this particular one probably ten times for him. He does not know how to use a computer and keeps getting infected. Now when I hit the repair option it never gives me the option to do anything, just boots to the screen I showed you. One time while I was doing this I did get to the desktop. I do not have a clue how this happened but it did. Now I am back to where I was to begin with, all I see is this funny looking windows asking me for a username and password? When I use the advanced option after hitting the F8 key I should be prompted to do a complete reformat. Like I said I have used that option probably 10 times on this laptop. Now I only get the WAIT option and then boots to a screen saying OTHER USER. I have never seen a screen like this and I have worked on many many Dells. I also mentioned this person is going through a nasty divorce and I am now thinking someone done something to this PC while he was away. His EX has cleaned his bank account so he is calling on me again to help. He has no money and needs this pc to aid in many things while he is going through all this. I know you do not want to hear about all this but thought I would let you know what we are dealing with. I can always completely reformat the drive but I want to keep that partition because I know I will be seeing him again.
UPDATE
Now I cannot get to safe mode. It starts and at the bottom of screen it shows PLEASE WAIT and from there back to screen saying OTHER USER.

[Broni]

OK. At this point, we have two options.

1. He can call Dell and order recovery DVD (shouldn't be more, than $30), which will always come handy in the future.

2. We can try to solve booting issue, which may be a long shot, since we still don't know what the real culprit is. Corrupted recovery partition, some infection, hardware problem, or a combination of some of them.

Let me know, what you want to do.

[oldtrig]

Lets give it a try on booting problem. It could be hardware but I am still thinking the virus caused the problem. All I can get to now is the option that says OTHER USER and prompted me for a username and password. I will not be out anything if we mess up the recovery partition. Tom

[Broni]

In that case, proceed with my reply #2.

[oldtrig]

I got to the REATOGO desktop. I clicked OTLPE, a black screen shows for a second and thens disappears and I get a box that says BROWSE FOR FOLDER . I can then click C and I get RUNSCANNER Error !target is not windows 2000 or later
I do not get prompted
•When asked Do you wish to load the remote registry, select Yes
I also have internet on this live cd but when I type on some keys they are incorrect. I can go to google and type M and I get 0

Any suggestions on this weird one? thanks again and maybe we can fix this
Tom

[Broni]

Quote

and I get a box that says BROWSE FOR FOLDER . I can then click C and I get RUNSCANNER Error !target is not windows 2000 or later

Apparently, OTLPE is not even able to see any Windows installation.
Unfortunately, in case like this, there is not much, we can do.

Your only option is to call Dell for recovery DVD.
However, since even recovery partition doesn't want to work, I'd test your hard drive first.

Run hard drive diagnostics: http://www.tacktech....ay.cfm?ttid=287 (or http://www.bleepingc...rive+diagnostic)
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: http://www.imgburn.com/ to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.
For Toshiba hard drives, see here: http://sdd.toshiba.c...ties#diagnostic

[oldtrig]

Thanks Broni. I tested the HD and it showed good. This must have been a virus that done big time damage to the system files. I know one time I was able to get to the desktop and was able to boot into safe mode but that stopped. I have ordered windows xp and will just give it to him. I do not like Vista. I will leave the partition and use Norton ghost to make an image because I can bet you he will trash it again. I am helping this friend because I know for a fact he needs help. His EX wiped his bank account out and he is left with nothing. Thanks again and I will be in touch. Tom

[Broni]

Quote

This must have been a virus that done big time damage to the system files.

Possible, but unfortunately beyond repair.

Quote

I have ordered windows xp and will just give it to him

Lot of work to find all drivers.

Quote

I will leave the partition and use Norton ghost to make an image because I can bet you he will trash it again

Way to go....:)

[oldtrig]

Broni, one more question not really dealing with this but need to ask anyway. Do you know of a good program that one could use to uninstall a program that windows will not remove. I want it simple so another friend could use it and she knows nothing about computers. She does know how to remove from the add-remove panel but this one she tells me will not go away. Thanks again for you time. Also the drivers are found at Dell's website for the XP install which makes it good. Tom