Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Trojan - Windows 7


  • Please log in to reply

#61
noahdfear

noahdfear

    Malware Expert

  • Expert
  • 1,316 posts
  • MVP
Thanks! Now, I need to make certain all of the files we need are in the sda1 partition of the problem computer. Please boot it back into xPUD and open a Terminal window from the usb device folder (sdb1).
Type the following command and hit Enter (case sensitive).

ls -R /mnt/sda1>log.txt

The command will create log.txt on the flash drive, which can be attached to a reply here or zipped and uploaded to my submission site.
http://noahdfear.net/max/upload.php
  • 0

Advertisements


#62
J_Mac

J_Mac

    Member

  • Topic Starter
  • Member
  • PipPip
  • 82 posts
"log.zip" has been successfully uploaded!
  • 0

#63
noahdfear

noahdfear

    Malware Expert

  • Expert
  • 1,316 posts
  • MVP
Hi J-Mac,

The Recovery partition structure is a bit different than I'd hoped, which means a modified direction than I had planned, however, it does contain another bcd store that I'd like to have a look at before going any further. It may be that it can be used, which would make the recovery process much easier. Please remove any bcd file(s) on your flash drive then navigate to mnt>sda1>ACERBOOT>BOOT and copy the BCD file there to the flash drive, zip and upload to my submissions site.
  • 0

#64
J_Mac

J_Mac

    Member

  • Topic Starter
  • Member
  • PipPip
  • 82 posts
BCD.zip has been uploaded.
  • 0

#65
noahdfear

noahdfear

    Malware Expert

  • Expert
  • 1,316 posts
  • MVP
Hi J_Mac,

Sorry for the delay - I've been busy with flooding here.

Let's see if using that bcd will give us a different result. The aim is to get to the Recovery Environment.
Boot into xPUD and delete the mnt>sda1>boot>bcd file, then copy the mnt>sda1>acerboot>boot file and paste it into the mnt>sda1>boot folder.
Reboot normally and see if you can reach the Repair your computer option by pressing F8 repeatedly upon restart.
  • 0

#66
J_Mac

J_Mac

    Member

  • Topic Starter
  • Member
  • PipPip
  • 82 posts
Nope, still no positive result from that step.

I wasn't sure if you wanted me to copy the single bcd file from acer boot or the whole boot folder from acer boot ?

However, I tried both options and still came to the same screen I have been getting.
  • 0

#67
noahdfear

noahdfear

    Malware Expert

  • Expert
  • 1,316 posts
  • MVP
Apologies on the previous instructions. I meant for only the bcd file to be copied.

Let's move on and prepare for creating a bootable Windows Recovery Environment (RE) USB. The file we need from the ailing computer may be upwards of 187 MB - I hope you have a flash drive with enough space. Navigate to mnt>sda1>SOURCES and copy the file BOOT.WIM to the flash drive.
Now move the flash drive to your working computer and copy the BOOT.WIM file to the root of the hard drive (Local Disk C: ).

It is required that the MSXML 6.0 Parser and Microsoft .Net Framework 2.0 (or higher) be installed on your working computer.
If not listed in your Add/Remove programs, download and install them from the following links.
(msxml6.msi) http://www.microsoft...&displaylang=en
http://www.microsoft...&displaylang=en

Next you need to install the WAIK (Windows Automated Installation Kit) on your working computer. It has the tools required to build the RE image. We'll be using the WAIK for Windows 7 since that is the RE image we need to build. The download is quite large, and I have compiled a little app that will speed things up for you. Rather than downloading the whole 1700+ MB image that contains installers for a number of systems, and a host of other things, my app will create a virtual drive on your computer, mount the remote WAIK image, then download and install only the image needed. This method will take about 1/4th the time it would if downloading the entire image.

Download Remote_WAIK32 on your working computer and save it to the desktop.
Double click the file to run it.
When prompted, type 2 then press Enter to select the WAIK for Windows 7.
Once all preparations are made the remote image will be mounted and a Windows Installer dialog will open.
Proceed through any installation prompts, leaving everything at default settings.
Please be patient - it might take upwards of an hour to download and install the package, depending on your connection speed.
Once installed you will be left with a command window open (from my app) - press any key to exit (do NOT close the command window in any other fashion!).

Verify the WAIK was successfully installed by click Start>All Programs>Microsoft Windows AIK - you should have several items to select from under this menu item.


Let me know when you've completed these tasks and we will proceed.
  • 0

#68
J_Mac

J_Mac

    Member

  • Topic Starter
  • Member
  • PipPip
  • 82 posts
Ok, successfully followed all steps :D
  • 0

#69
noahdfear

noahdfear

    Malware Expert

  • Expert
  • 1,316 posts
  • MVP
Great! Now we need to know a bit about the boot.wim file.
Click Start>All Programs>Microsoft Windows AIK>Deployment Tools Command Prompt
A command window should open and display the following:

Updating path to include dism, oscdimg, imagex

C:\Program Files\Windows AIK\Tools\PETools\
C:\Program Files\Windows AIK\Tools\PETools\..\x86
C:\Program Files\Windows AIK\Tools\PETools\..\x86\Servicing;


C:\Program Files\Windows AIK\Tools\PETools>


Highlight and copy the following bolded text, right click in the command window and select Paste, then press Enter.

Dism /Get-WimInfo /WimFile:%systemdrive%\boot.wim >"%userprofile%\desktop\wiminfo.txt"

A text file named wiminfo.txt should be created on the desktop. Post it's contents or attach the file here.
You can close the command window for now.
  • 0

#70
J_Mac

J_Mac

    Member

  • Topic Starter
  • Member
  • PipPip
  • 82 posts
Deployment Image Servicing and Management tool
Version: 6.1.7600.16385

Details for image : C:\boot.wim

Index : 1
Name : AcerWinPE30
Description : <undefined>
Size : 1,185,249,410 bytes

The operation completed successfully.
  • 0

Advertisements


#71
noahdfear

noahdfear

    Malware Expert

  • Expert
  • 1,316 posts
  • MVP
Now we need to have a look inside the boot.wim file and verify it contains all of the necessary files.
Download wimlook.exe and save it to the desktop, then double click to execute.
It will create a directory structure in which to mount the image, then mount the image, create a list of files in the mounted image, and finally unmount the image and close.
A file named wimlook.txt will be created on the desktop.
Please zip wimlook.txt and upload it to my submissions site for review.

Please note - my web host is doing maintenance between 10 PM, March 8th and 5 AM March 9th (MST) which might cause my site to be inaccessible during that time.
  • 0

#72
J_Mac

J_Mac

    Member

  • Topic Starter
  • Member
  • PipPip
  • 82 posts
wimlook.zip has been uploaded thank you (:
  • 0

#73
noahdfear

noahdfear

    Malware Expert

  • Expert
  • 1,316 posts
  • MVP
As I'd hoped, the image contains all of the files for building a fully functional Recovery Environment iso.
I first want to point out, if you hadn't already figured it out, that I am customizing scripts I previously wrote on the fly. Though I am attempting to test along the way, I do not have the same wim file to test with. That said, we may not hit a home run on the first attempt - do not despair if we are not successful - we will get there.

First, lets' build the bootable iso.
Download boot_wim_PEiso.exe and save it to the desktop.
Double click to execute.
When complete it will notify you that a winpe_x86.iso was created and should be located in the drive root (Local Disk C: ).

Now we'll need 2 more tools.
Download the Microsoft Virtual CD-ROM Control Panel self extracting exe and save it to the desktop.
Download the BootSage Flash Drive Builder from FireSage and save it to the desktop (Download button is on the right at the bottom of the Product Details table).

Double click the winxpvirtualcdcontrolpanel_21.exe file and extract it to a customized path, such as C:\VCDControlTool (you can type that path in then click Unzip)
Open the C:\VCDControlTool folder and double click the VCDControlTool.exe file.
In the Virtual CDRom Control Panel, click Driver Control
Click Install Driver
Browse to and select the C:\VCDControlTool\VCDRom.sys file then click Open
Click Start then OK
Again in the Virtual CDRom Control Panel, click Add Drive ( generally this will add a drive with the letter Z )
Select the Z: drive shown in the Control Panel window then click Mount
Browse to and select the C:\winpe_x86.iso file then click Open
Leave the Mount Options unchecked then click OK

Right click the fsBootSage_v1_47.zip (BootSage zip you downloaded) and select Extract All
Once you've extracted the files, open the new folder and double click BootSage.exe
Insert the flash drive you wish to make a bootable RE, then select it in the Select from the following removable disks: field using the drop down menu.
In the Specify a Windows 7 setup DVD or WinPE project ISO folder: field click the Browse button (folder icon to the right) then navigate to and select the virtual Z: drive with the mounted ISO. It should report The WinPE project files have been located
On the BootSage menu click File>Preferences
Click the Browse button then navigate to and select C:\Program Files\Windows AIK\Tools\PETools\x86\BootSect.exe
Leave or set the File format at NTFS then click Save
Now click Start.
You should be prompted by the BootSage utility to remove the flash drive - do so.
It will then prompt you to re-insert the drive - again, do so.
The flash drive will then be formatted (ALL DATA ON THE FLASH DRIVE WILL BE ERASED!!) and the RE image will be written to it.
When complete, you should be notified if successful and you can close the BootSage utility.

Now open the Virtual CDRom Control Panel again and select the Z: drive, then click Eject
Click Remove Drive then click OK to close.

If all was successful, you will now have a bootable Windows Recovery Environment USB.
Remove the USB and see if the ailing computer will boot to the flash drive and load the Recovery Environment.

Let me know the outcome and we'll proceed from there.
  • 0

#74
J_Mac

J_Mac

    Member

  • Topic Starter
  • Member
  • PipPip
  • 82 posts
Hi Dave, I've followed all steps and the USB allowed me to get to the Acer recovery environment :D
  • 0

#75
noahdfear

noahdfear

    Malware Expert

  • Expert
  • 1,316 posts
  • MVP
Cool! Boot into the Recovery environment and open a command prompt.
Normally we would back up the bcd file before doing anything else, but since it's already borked we'll just remove it.
Type the following bolded commands, one line at a time, pressing Enter after each.

c:
cd boot
attrib bcd -s -h -r
del bcd
bootrec /RebuildBcd


If the Bootrec.exe tool runs successfully, it presents you with an installation path of a Windows directory. To add the entry to the BCD store, type Yes. A confirmation message appears that indicates the entry was added successfully.

When complete, exit the command window and restart, allowing the computer to boot normally.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP