[Snoofus]

Hi, I'd be really grateful of some help as this is driving me spare.

I had a problem with my PC not booting because of a missing Hal.dll
I fixed the problem (I thought) with Boofcfg /rebuild.

However it seems that my boot.ini file is getting deleted at every start-up.

I've run my virus scanner (FSecure) and also Kaspersky online scanner. Nothing comes up. I've also run various malware scanner that show nothing. Hijackthis also shows nothing suspicious.

I've mirrored my Hard Drive to a brand new Hard Drive incase it was a bad sector. But the new one repeats the problem.

I've also tried SFC /Scannow to replace damaged system files, but still with no success. At present I'm having to recreate the Boot.ini file after every start-up.

Would be extremely grateful of anymore suggestions before I have to to a full reformat and install.

Thanks,
Shawn.

[Advertisements]

This would have to be malware related, and it would be a pain to constantly run a rebuild of the boot.ini file everytime at startup.
The problem you are facing is nothing ordinary, and something the malware techs should look over.
Go here: http://www.geekstogo...uide-t2852.html
Follow that guide, and then post in the Malware Forum with the required logs.

[edge2022]

This would have to be malware related, and it would be a pain to constantly run a rebuild of the boot.ini file everytime at startup.
The problem you are facing is nothing ordinary, and something the malware techs should look over.
Go here: http://www.geekstogo...uide-t2852.html
Follow that guide, and then post in the Malware Forum with the required logs.

[Snoofus]

This would have to be malware related, and it would be a pain to constantly run a rebuild of the boot.ini file everytime at startup.
The problem you are facing is nothing ordinary, and something the malware techs should look over.
Go here: http://www.geekstogo...uide-t2852.html
Follow that guide, and then post in the Malware Forum with the required logs.

Thank you Edge. I will get onto it.

[edge2022]

You are welcome. If you have problems after you are given a clean bill of health by the malware techs, you can post here.

[JMorri01]

Hi there,

I had the same issue very recently on XP (MCE SP3) - pulled my hair out for a day or so, turned out in the end to be the fault of a recent upgrade to IE8! Uninstalled IE8 and reverted to IE7 and hey presto, the boot.inin stopped being deleted. There isn't much on the net about this, but it looks like an add-on manager is causing the problem in IE8. If you have recently upgraded to IE8 give it a try - this does NOT mean your HD is heading south (well not definitively anyway

Hope this helps.

[edge2022]

Thank you for the advice. If the poster is still around, he will appreciate it.
If you have any questions or problems, please open a new topic in the appropriate forum.

[BudmanWV]

I just wanted to say that I ran into the boot.ini problem today at a customer site. Removing IE8 fixed the problem -- it was on an XP Pro 32 Bit SP3 system.

Thanks JMorri01!

BudmanWV

[diabillic]

It appears the general consensus says its an IE8 issue. Don't install it!

[gilt46]

Unfortunately the solution with IE8 did not help me. I got rid of IE8 but the problem continues.

I have spent several days doing malware and virus scans with various recommended programs. While many suspicious elements were removed, the boot.ini file continues to be deleted every time I reboot.

I'm using XP Professional MCE SP 3. XP was already installed so I have no original XP discs (just a sticker on the case with the product number).

I spent the first six hours trying to figure out how to get into Windows since it wouldn't boot up. After that was resolved, I had use of the computer but couldn't shut it down without making sure that a suitable boot.ini was in msconfig. And so it is now. With every reboot, I must re-insert the boot.ini file.

Anyone have any ideas?

[edge2022]

Follow this guide: http://www.geekstogo...uide-t2852.html
Then, if the problem keep happening, post the required logs in the Malware Forum.

If you receive a clean bill of health from a Malware tech, then create a new topic in this forum, and give a link to your malware topic.

[britechguy]

This is my first post on "geeks to go" but I've been a tech geek since the mid-1980s.

I just wanted to report that I am experiencing exactly the same signs described at the outset of this thread. The computer belongs to a friend of mine and I just spent 9.5 hours trying to chase this down.

The machine has McAfee suite running on it and it has detected nothing. I installed and ran Spybot S&D, Spywareblaster [in an effort to prevent other future infections], UnHackThis, & GMER. I have not yet tried backing out IE8, but from what I understand it was installed a few weeks ago and the family uses Firefox as their primary browser.

I cannot tell you how many times I booted from the WinXP system disk, used the recovery feature, and did a "bootcfg /rebuild". In each and every instance, I could exit and successfully reboot from the hard disc once. If you went to C:\ after the boot completed the "boot.ini" file was gone after a very short period of time. What was even more interesting was that I managed to make copies of boot.ini twice, to two different file names, and in each instance these files were deleted as well.

If I get a chance, I will try to go through the whole malware reporting procedure, but since this is not my own computer (and I'm busy otherwise) I may not be able to do so.

I thought it was important to let people know that this is happening to others and to give some additional information about the odd behaviors observed.

[edge2022]

Thank you for the info; we really appreciate it.
If you need assistance, please open a new topic in the appropriate forum.

[steenkh]

What was even more interesting was that I managed to make copies of boot.ini twice, to two different file names, and in each instance these files were deleted as well.

Where did you put those copies? I have a similar situation, and I have found that something cleans out the entire root of C:, leaving only certain files. Anything, like test.txt left in C:\ is gone after a boot.

The same thing happens for C:\Documents and Settings\All Users\Application Data\ that seems to be brought back to a certain condition after each boot. Some of the configuration for my Office 2007 is getting deleted in this way, and some programs do not notice that they have been upgraded!

The problems could well have started when I upgraded to IE8, so when I get home to the machine I shall try reverting to IE7.

I am still in the investigating phase.

[britechguy]

What was even more interesting was that I managed to make copies of boot.ini twice, to two different file names, and in each instance these files were deleted as well.

Where did you put those copies? I have a similar situation, and I have found that something cleans out the entire root of C:, leaving only certain files. Anything, like test.txt left in C:\ is gone after a boot.

The same thing happens for C:\Documents and Settings\All Users\Application Data\ that seems to be brought back to a certain condition after each boot. Some of the configuration for my Office 2007 is getting deleted in this way, and some programs do not notice that they have been upgraded!

The problems could well have started when I upgraded to IE8, so when I get home to the machine I shall try reverting to IE7.

I am still in the investigating phase.

I placed the "backup copies" of boot.ini, one with a name like oldboot.ini and another with a name like myboot.bak, in C:\, the same directory as the boot file.

I just went through the whole "guided malware removal process" and succeeded in fixing this. You can read the thread here:

http://www.geekstogo...ot-t242927.html

I still have IE8 on the machine in question, and have installed it on others, so I really doubt that this is the culprit. My system "was healed" after having run TFC (Temp File Cleaner), and this was after having run quite a few other powerful antimalware programs, which hadn't fixed the problem. I suspect that this is some as yet unnamed/undetected infection that gets placed in a tempfile somewhere and is executed either upon boot or immediately after.

[steenkh]

Thanks for your comments. I appreciate it.

It would be interesting to find out what kind of malware has caused this behaviour. I am unsure if it is actually malware, because I cannot see any benefit for the malware by advertising its existence in such coarse fashion, though it could be an unintended bug. I will take a look at that other thread.