Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Challenging Rootkit


  • Please log in to reply

#136
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,788 posts
  • MVP
You are replacing the good HAL with the one from the bad Windows right? Sounds like you might have done it the other way around.
  • 0

Advertisements


#137
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
No, I got it right. Should I re-do it to make sure? Lot of work. :-)
  • 0

#138
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
How about this theory- I did it right, but when I booted into bad windows accidentally, the newly made good hal got corrupted?
  • 0

#139
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
You are replacing the good HAL with the one from the bad Windows right? Sounds like you might have done it the other way around.


Wait a minute. I am supposed to copy the one from the good machine and put it in place of the one in the infected laptop right? Because that is what I tried to do.
  • 0

#140
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
Do you think it's odd that the error message is saying there is a corrupted file at "<Windows Root>System32\hal.dll" and not "C:\Windows\System32\hal.dll"?
  • 0

#141
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
Type:

copy E:\hal.dll c:\Windows\System32\hal.dll"

it came back with "The system cannot find the file specified".



Wait a minute......... is that case sensitive? Did it say it cannot find it because it was called "HAL.DLL" when it looked? What if I tried it now that it's there with small letters?
  • 0

#142
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,788 posts
  • MVP
It's a possibility. Can also be that the hal.dll from your working PC is not the right one. There are about 4 different versions out there depending on the number of processors and the type.

Too bad you don't have an XP CD.

You might try a chkdsk just to see if it's just hard drive corruption and not the virus.

In Recovery Console type:

CHKDSK /r

Ron
  • 0

#143
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
Does Hiram's have the file on their somewhere? Ah, but you say there are different versions.

And that could account for the different file sizes, no?
  • 0

#144
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
Should I really dig for the CD? I don't think I have it, but it's possible. I hate to think of the crap I would have to go dig through. What would it do if I had it? And what does it look like?
  • 0

#145
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
In Recovery Console type:

CHKDSK /r



Under "E" or "C"?
  • 0

Advertisements


#146
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
Hey! I think I found the disk! I got fooled because it's open. I think I opened it and tried to use it when..... eh-hem, "The good PC" got infected and I was going to try to fix it.

Anyway, there are two disks. One is the OS, and the other is the drivers specific to the laptop. It has to be the right disk, because there is a disk for the laptop with it.
  • 0

#147
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,788 posts
  • MVP
Stick it in and see if you can run a repair on C:
  • 0

#148
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
How does that work? Never done it before. Just boot from it and follow the prompts?
  • 0

#149
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,788 posts
  • MVP
http://www.geekstogo...air-windows-xp/

I'd repair both C and E
  • 0

#150
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
"have your CD-KEY ready if needed."

It's a legit disk, but there is no "key". Hope it doesn't ask for it.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP