
Challenging Rootkit
Started by
rootkits-r-evil
, Aug 20 2011 04:03 PM
#106
Posted 22 August 2011 - 07:47 PM

#107
Posted 22 August 2011 - 07:49 PM

I pretty sure I do not. And the whole point here was to not have to reinstall. I want to try for "lucky". I'm a lucky guy.
Call me "Lucky", and what is the next step?
Call me "Lucky", and what is the next step?
#108
Posted 22 August 2011 - 08:08 PM

I looked, and there is no CD. Which is OK, because I really, REALLY don't want to give up and re-install the OS and lose years of work setting it all up. That would be admitting defeat.
Reinstalling the OS = Disaster.
Reinstalling the OS = Disaster.
#109
Posted 22 August 2011 - 08:21 PM

Looking at the boot.ini I see something funny. It says:
multi(0)disk(0)rdisk(0)partition(2)\
Seems to me that is the hidden partition it is calling for. I would think the regular partition would be 1 and not 2.
Open boot.ini in notepad as you did before and make it say
[boot loader]
timeout=10
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Good Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
Then next to the last line is a copy of the original last line with the partition number changed to 1 and the word Good added before Microsoft. Otherwise it's the same.
File, Save. (This is a read only file so you have to tell it you want to write it.) If it won't let you, open up a command prompt as before and type:
Ron
multi(0)disk(0)rdisk(0)partition(2)\
Seems to me that is the hidden partition it is calling for. I would think the regular partition would be 1 and not 2.
Open boot.ini in notepad as you did before and make it say
[boot loader]
timeout=10
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Good Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
Then next to the last line is a copy of the original last line with the partition number changed to 1 and the word Good added before Microsoft. Otherwise it's the same.
File, Save. (This is a read only file so you have to tell it you want to write it.) If it won't let you, open up a command prompt as before and type:
attrib -r \boot.iniThen try to save it. Reboot and you should have three choices. Pick the one that says Good Microsoft Windows XP Home Edition. I want to see if that boots.
Ron
#110
Posted 22 August 2011 - 08:34 PM

Then next to the last line is a copy of the original last line with the partition number changed to 1 and the word Good added before Microsoft. Otherwise it's the same.
File, Save. (This is a read only file so you have to tell it you want to write it.) If it won't let you,
It wouldn't.
open up a command prompt as before and type:
attrib -r \boot.ini
Then try to save it.
It said, "Not resetting hidden file -C:\boot.ini"
Because I have to go back and forth with a thumb drive, I didn't cut and paste the text. Does it matter how many spaces between "attrib" and "-r"? or anything like that?
File, Save. (This is a read only file so you have to tell it you want to write it.) If it won't let you,
It wouldn't.
open up a command prompt as before and type:
attrib -r \boot.ini
Then try to save it.
It said, "Not resetting hidden file -C:\boot.ini"
Because I have to go back and forth with a thumb drive, I didn't cut and paste the text. Does it matter how many spaces between "attrib" and "-r"? or anything like that?
#111
Posted 22 August 2011 - 08:38 PM

I typed it exact. That is two spaces. Same thing.
#112
Posted 22 August 2011 - 08:46 PM

Try
one space should be enough. I use two in the code box so that you can see where the space goes.
attrib -r -h -s \boot.ini
one space should be enough. I use two in the code box so that you can see where the space goes.
#113
Posted 22 August 2011 - 08:51 PM

#114
Posted 22 August 2011 - 08:57 PM

If that doesn't work then try the official MS way:
http://support.microsoft.com/kb/289022
I read it three times and it made no sense to me.
http://support.microsoft.com/kb/289022
I read it three times and it made no sense to me.
#115
Posted 22 August 2011 - 09:02 PM

I think that worked! I'm going to try to reboot.
#116
Posted 22 August 2011 - 09:06 PM

OK, as you said, it gave me three choices. (Four actually, including, "don't chose this.")
BUT....
I selected "Windows Good", and it gives me a black screen that says,,.,
"windows could not start because the following file is missing or corrupt:
<Windows Root>\system32\hal.dll
please re-install a copy of the above file.
BUT....
I selected "Windows Good", and it gives me a black screen that says,,.,
"windows could not start because the following file is missing or corrupt:
<Windows Root>\system32\hal.dll
please re-install a copy of the above file.
#117
Posted 22 August 2011 - 09:16 PM

Is the PC that works also an XP? You can try copying the file from C:\Windows\System32\hal.dll on the good PC to the bad PC. Problem I see is getting it onto the C:\ drive. I suppose you can boot into the bad Windows and copy it to C:\ then boot into the Recovery Console, log on to the C: drive and type:
copy E:\hal.dll c:\Windows\System32\hal.dll
copy E:\hal.dll c:\Windows\System32\hal.dll
#118
Posted 22 August 2011 - 09:21 PM

or just try the one in E
copy E:\Windows\System32\hal.dll c:\Windows\System32\hal.dll
copy E:\Windows\System32\hal.dll c:\Windows\System32\hal.dll
#119
Posted 22 August 2011 - 09:21 PM

"Is the PC that works also an XP?"
Yes.
"You can try copying the file from C:\Windows\System32\hal.dll on the good PC to the bad PC."
Not sure how to do that.
"Problem I see is getting it onto the C:\ drive. I suppose you can boot into the bad Windows and copy it to C:\ then boot into the Recovery Console, log on to the C: drive and type:
copy E:\hal.dll c:\Windows\System32\hal.dll "
I don't understand. You're over my head here.
Yes.
"You can try copying the file from C:\Windows\System32\hal.dll on the good PC to the bad PC."
Not sure how to do that.
"Problem I see is getting it onto the C:\ drive. I suppose you can boot into the bad Windows and copy it to C:\ then boot into the Recovery Console, log on to the C: drive and type:
copy E:\hal.dll c:\Windows\System32\hal.dll "
I don't understand. You're over my head here.
#120
Posted 22 August 2011 - 09:25 PM

Find the hal.dll file on the good PC.
Copy it to the USB drive.
Move it to the bad.
Copy from the usb drive to C:\hal.dll
Boot into the Recovery console. Select C:
Type:
copy E:\hal.dll c:\Windows\System32\hal.dll
Copy it to the USB drive.
Move it to the bad.
Copy from the usb drive to C:\hal.dll
Boot into the Recovery console. Select C:
Type:
copy E:\hal.dll c:\Windows\System32\hal.dll
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
As Featured On:






