Boot failure on XP, various errors, missing hal.dll etc...

Discussion in 'Computer Information' started by zaqxws@googlemail.com, Sep 27, 2013.

  1. Guest

    Bit of a long rambling story which I posted no elsewhere but perhaps unsurprisingly got no responses, I have posted here before and found guy called Paul to be extremely helpful and knowledgeable.

    I'm on a different account now I have posted under various ID's including
    Lord Turkey Cough, half_pint and R. Giggs.

    Anyway this is what I posted else where, well perhaps I can post a link to the forum!!!

    http://www.geekstogo.com/forum/topic/333701-xp-computer-not-booting/

    I will post the first long rambling post I made!!!

    Here it is!! (it nmight not displat too well unfortunately but you can see the link if
    interested.



    ************** start of post ******************

    Hello everybody!!! :)


    Well I almost do not know where to begin so I will start at the beginning (sort of).
    Recounting the story will help me get things straight in my head.

    My comp had been fine and then I kept getting "hard drive failure" or similar.
    This was not a drive failure, it was the SATA cable coming lose (was a cheap dodgy cable)
    and the drive was just laying in the base of the PC not secure, but it had been working fine like
    that. OK I know that's a bad idea, so no need to tell me!!!.

    Anyhow when I got that error I would just push the lose connector in better and it would boot fine.
    Then after a while it started running check disk at start-up, but I would quit it as it took ages.
    Then one day I decide to let it run over night to 'cure' the problem - bad move. The next morning
    I found the computer constantly rebooting and I could not boot it up.

    I since have a new PC by the way!! I'm on it now and it a lot faster :lol:

    I tried various options for booting but none worked (ie recover restore, boot to safe mode etc..)
    Oh well I thought, good job I have a back up drive (the machines old drive was cloned onto a new
    bigger drive, and I have been using the new clone for a while, I could in the past boot from either
    by swapping the cables). However that one didn't work with!! I had not used it for a while but I expected
    to work - it didn't.

    I though it might be a hardware error at that stage, however I managed to boot the machine on a Linux
    Mint DVD OK and was able to surf the net, pretty good really except for the very poor cursor control,
    but it was OK could surf, watch youtube etc..pretty cool really!!

    So does not seem to be hardware.

    Focusing on the newest drive which failed, I have had various error at various stages, I think when I try and do
    recoveries it might screw it up even further.

    However one error, which I have just had is:-

    Quote
    windows could not start
    as file is missing or corrupt
    root\system32\hal.dll
    (approx wording)

    However I can see from Linux that hal.dll is there!!

    Another error I have had is

    Quote
    stop:c000021a {Fatal Error} The windows logon process system process terminated unexpectedly with a status of 0xc0000034(0x00000000)(0x00000000)



    I read on Microsoft site


    Quote
    The STOP 0xC000021A error occurs when either Winlogon.exe or Csrss.exe fails. When the Windows NT kernel detects that either of these processes has stopped, it stops the system and raises the STOP 0xC000021A error.


    Both those files exist and indeed the drive seems to be fine, right size and linux told me
    that the disk was in good health, it said it's SMART status was OK.
    I am actually just running a quick SMART self test on it now. It says the disk is healthy.

    Then there is the older drive, and indeed one older than that, I started with a 60gig, cloned to a 250gig and finally to
    the 500gig drive I have been using most recently until it gave up the ghost.

    Actually the other drive in the machine is the 60gig drive and the 250gig one had errors, I still have it, might try booting
    from it but it's has a dodge surface, sometimes files are there, sometimes not so much lol. :lol:

    I put the 250gig drive in an enclosure and I have just copied the contents of windows to this machine. (reports a couple of files missing
    but it has 99.99%).

    I also tried and old XP recovery drive I made but that didn't work either.
    I don't think the cloning software copes with the recovery partition well .


    So................ where to from here??

    I guess I may have a number of option and things to try, but writing this out helps me get things clear in my own head
    and I can use this thread to document stuff I have done as I tend to forget what did what and when etc...

    I maybe able to get a Win XP boot (installation disk) disk from my brother, that is another option if he still has it.
    The PC came with no Windows disk, it was a HP machine with software pre-installed. AMD 3800X2

    It's not a major problem as I have a new PC and have various backups of data and I am copying the stuff I want onto
    this my new machine, but I would like to get the old one working as aback up PC. I might be able to put the 500meg
    (newest drive) into this machine to get the latest data if I need it (think it only has one bay though, have not looked yet!!)
    I could also put it into a hard drive enclosure and connect via USB.

    Might see if I can get a new Linux version too and see if it is any better.

    But the bottom line seems to be the drive is fine and all the files are there and it will not boot, the
    big problem occurred when I ran a check disk overnight, I guess that screwed something up, certainly seemed to.

    I imagine it may just have a corrupt file on it but which one???

    IF I try to boot into XP normally now I thing it will give the missing hal.dll error.

    However I can see the file from Linux, it says:-

    hal.dll size 134.4kB 134,400 bytes it also says accessed 12th Sept, however the I was using it 19th Sept for sure.

    So any help/ideas welcome :)


    ********************* end of post ****************

    At the moment I have booted to Linux and am backing the drive up to a USB
    drive, seems a sensible thing to do, I should have done it earlier but I
    didn't realise I could use the USB drive in LINUX, however you can
    I am pretty impressed with it considering it runs from a DVD!!!
     
    , Sep 27, 2013
    #1
    1. Advertising

  2. Paul Guest

    wrote:
    > Bit of a long rambling story which I posted no elsewhere but perhaps unsurprisingly got no responses, I have posted here before and found guy called Paul to be extremely helpful and knowledgeable.
    >
    > I'm on a different account now I have posted under various ID's including
    > Lord Turkey Cough, half_pint and R. Giggs.
    >
    > Anyway this is what I posted else where, well perhaps I can post a link to the forum!!!
    >
    > http://www.geekstogo.com/forum/topic/333701-xp-computer-not-booting/
    >
    > I will post the first long rambling post I made!!!
    >
    > Here it is!! (it nmight not displat too well unfortunately but you can see the link if
    > interested.
    >
    >
    >
    > ************** start of post ******************
    >
    > Hello everybody!!! :)
    >
    >
    > Well I almost do not know where to begin so I will start at the beginning (sort of).
    > Recounting the story will help me get things straight in my head.
    >
    > My comp had been fine and then I kept getting "hard drive failure" or similar.
    > This was not a drive failure, it was the SATA cable coming lose (was a cheap dodgy cable)
    > and the drive was just laying in the base of the PC not secure, but it had been working fine like
    > that. OK I know that's a bad idea, so no need to tell me!!!.
    >
    > Anyhow when I got that error I would just push the lose connector in better and it would boot fine.
    > Then after a while it started running check disk at start-up, but I would quit it as it took ages.
    > Then one day I decide to let it run over night to 'cure' the problem - bad move. The next morning
    > I found the computer constantly rebooting and I could not boot it up.
    >
    > I since have a new PC by the way!! I'm on it now and it a lot faster :lol:
    >
    > I tried various options for booting but none worked (ie recover restore, boot to safe mode etc..)
    > Oh well I thought, good job I have a back up drive (the machines old drive was cloned onto a new
    > bigger drive, and I have been using the new clone for a while, I could in the past boot from either
    > by swapping the cables). However that one didn't work with!! I had not used it for a while but I expected
    > to work - it didn't.
    >
    > I though it might be a hardware error at that stage, however I managed to boot the machine on a Linux
    > Mint DVD OK and was able to surf the net, pretty good really except for the very poor cursor control,
    > but it was OK could surf, watch youtube etc..pretty cool really!!
    >
    > So does not seem to be hardware.
    >
    > Focusing on the newest drive which failed, I have had various error at various stages, I think when I try and do
    > recoveries it might screw it up even further.
    >
    > However one error, which I have just had is:-
    >
    > Quote
    > windows could not start
    > as file is missing or corrupt
    > root\system32\hal.dll
    > (approx wording)
    >
    > However I can see from Linux that hal.dll is there!!
    >
    > Another error I have had is
    >
    > Quote
    > stop:c000021a {Fatal Error} The windows logon process system process terminated unexpectedly with a status of 0xc0000034(0x00000000)(0x00000000)
    >
    >
    >
    > I read on Microsoft site
    >
    >
    > Quote
    > The STOP 0xC000021A error occurs when either Winlogon.exe or Csrss.exe fails. When the Windows NT kernel detects that either of these processes has stopped, it stops the system and raises the STOP 0xC000021A error.
    >
    >
    > Both those files exist and indeed the drive seems to be fine, right size and linux told me
    > that the disk was in good health, it said it's SMART status was OK.
    > I am actually just running a quick SMART self test on it now. It says the disk is healthy.
    >
    > Then there is the older drive, and indeed one older than that, I started with a 60gig, cloned to a 250gig and finally to
    > the 500gig drive I have been using most recently until it gave up the ghost.
    >
    > Actually the other drive in the machine is the 60gig drive and the 250gig one had errors, I still have it, might try booting
    > from it but it's has a dodge surface, sometimes files are there, sometimes not so much lol. :lol:
    >
    > I put the 250gig drive in an enclosure and I have just copied the contents of windows to this machine. (reports a couple of files missing
    > but it has 99.99%).
    >
    > I also tried and old XP recovery drive I made but that didn't work either.
    > I don't think the cloning software copes with the recovery partition well .
    >
    >
    > So................ where to from here??
    >
    > I guess I may have a number of option and things to try, but writing this out helps me get things clear in my own head
    > and I can use this thread to document stuff I have done as I tend to forget what did what and when etc...
    >
    > I maybe able to get a Win XP boot (installation disk) disk from my brother, that is another option if he still has it.
    > The PC came with no Windows disk, it was a HP machine with software pre-installed. AMD 3800X2
    >
    > It's not a major problem as I have a new PC and have various backups of data and I am copying the stuff I want onto
    > this my new machine, but I would like to get the old one working as aback up PC. I might be able to put the 500meg
    > (newest drive) into this machine to get the latest data if I need it (think it only has one bay though, have not looked yet!!)
    > I could also put it into a hard drive enclosure and connect via USB.
    >
    > Might see if I can get a new Linux version too and see if it is any better.
    >
    > But the bottom line seems to be the drive is fine and all the files are there and it will not boot, the
    > big problem occurred when I ran a check disk overnight, I guess that screwed something up, certainly seemed to.
    >
    > I imagine it may just have a corrupt file on it but which one???
    >
    > IF I try to boot into XP normally now I thing it will give the missing hal.dll error.
    >
    > However I can see the file from Linux, it says:-
    >
    > hal.dll size 134.4kB 134,400 bytes it also says accessed 12th Sept, however the I was using it 19th Sept for sure.
    >
    > So any help/ideas welcome :)
    >
    >
    > ********************* end of post ****************
    >
    > At the moment I have booted to Linux and am backing the drive up to a USB
    > drive, seems a sensible thing to do, I should have done it earlier but I
    > didn't realise I could use the USB drive in LINUX, however you can
    > I am pretty impressed with it considering it runs from a DVD!!!
    >


    You could post your WinXP question here.

    microsoft.public.windowsxp.general

    *******

    There's probably several things you could do at this point,
    but the 0xC000021A sounds a bit like malware. As much as anything
    else.

    Since you've had good luck with Linux, you can use this disc to
    do an offline scan of a Windows C: partition.

    http://support.kaspersky.com/8092

    "Iso image of Kaspersky Rescue Disk 10 (237 MB)"

    It's not actually 237MB. The size varies as they add new AV definitions
    to the image. It'll be bigger than 237MB. The image is probably
    updated once a week, so they probably don't show up-to-date
    size info.

    You can burn a CD with that ISO9660 file. Or, if you want, load
    the stuff onto a USB flash stick, using the installer tool on that
    web page.

    Once you boot from that, it expects a working LAN connection at
    startup. It can download updates to the AV files on demand.
    If you have already configured your modem/router such that
    the Internet is working, that's all the CD needs to do its
    downloads. The disc doesn't know how to operate a dialup modem
    (using PPP), and that was a decision by the disc designer to
    not include it.

    The Windows disk letters are not properly reflected in the
    scan menu. On my machine, the Kaspersky "E:" is actually my C:
    drive. So I know from experience I should click E:. I keep
    an empty file on my WinXP partition - the file name helps
    me identify I have the right drive letter in other environments
    (when the label isn't visible).

    Another complication, is the disc will prompt you with questions
    such as whether you're running Windows 8 or not. I generally
    just have my WinXP disk connected at the time, and leave anything
    that might confuse the scanner disconnected.

    Anyway, give that much a try first. And then things like
    repair installs would be the next topic of discussion.
    A repair install saves programs and settings. But it
    does tend to screw up one or two settings (doesn't remember
    your old choices), so the process is only 99.5% accurate.

    If this is a Dell or HP, as the machines get more modern,
    the recovery options are more varied. Some modern machines
    can do the equivalent of a repair install from an image
    hidden on a partition, instead of the old fashioned "nuke and pave"
    option. At one time, computers only had a "purely destructive"
    option, and you were supposed to backup your data before using
    that. More modern machines now have several options, and nuking
    is now the last option rather than the first. Read the manual
    to see what these options are.

    Since I have retail OSes here, I just use the "real" Windows
    CD to repair install. On an OEM machine, you were supposed to
    make recovery media when the machine was new, and that can be
    used to start over again. The COA sticker on the machine,
    contains a key that can be used with a real Windows install
    CD, but the version of Windows CD may have to match the key.
    Perhaps a System builder version would work for example,
    as an "OEM" version.

    *******

    And doing a backup is not a bad idea, if you're concerned that
    one of your repair steps will make things worse. If you know how
    to do this from Linux, then that sounds like a good plan.

    *******

    I suspect your mistake long ago, was the difference between
    "CHKDSK" and "disk scan". Using HDTune (free) or similar, it's
    possible to just scan a disk for bad blocks. This is a means
    to determine disk health. If you saw bad blocks, your next
    step would *not* be to run a CHKDSK with repair option.
    Especially if the disk happened to freeze while the disk
    read scan was running. Because then you know CHKDSK is
    doomed to screw up. CHKDSK can multiply problems, if it
    doesn't have good media to work with to make repairs. If
    it gets half way through repairing something, several times
    in a row, you could then be in serious trouble. As now you
    have "error multiplication". So in a sense, keep in mind
    that CHKDSK is potentially destructive, and you won't be
    far from the troth.

    But at this point, I'm not convinced your problem is solely
    hard drive related. I think something else is going on,
    which is why I'm recommending an offline AV scan first.

    *******

    When CHKDSK runs, it moves orphan files to a folder
    under the root of C:. If you find a folder there with
    (unnamed) recovered files in it, and the number of
    files is large, that may give you some idea how much
    of a mess CHKDSK has made.

    Paul
     
    Paul, Sep 27, 2013
    #2
    1. Advertising

  3. Guest

    On Thursday, September 26, 2013 7:36:27 PM UTC-8, Paul wrote:
    > wrote:
    >
    > > Bit of a long rambling story which I posted no elsewhere but perhaps unsurprisingly got no responses, I have posted here before and found guy called Paul to be extremely helpful and knowledgeable.

    >
    > >

    >
    > > I'm on a different account now I have posted under various ID's including

    >
    > > Lord Turkey Cough, half_pint and R. Giggs.

    >
    > >

    >
    > > Anyway this is what I posted else where, well perhaps I can post a link to the forum!!!

    >
    > >

    >
    > > http://www.geekstogo.com/forum/topic/333701-xp-computer-not-booting/

    >
    > >

    >
    > > I will post the first long rambling post I made!!!

    >
    > >

    >
    > > Here it is!! (it nmight not displat too well unfortunately but you can see the link if

    >
    > > interested.

    >
    > >

    >
    > >

    >
    > >

    >
    > > ************** start of post ******************

    >
    > >

    >
    > > Hello everybody!!! :)

    >
    > >

    >
    > >

    >
    > > Well I almost do not know where to begin so I will start at the beginning (sort of).

    >
    > > Recounting the story will help me get things straight in my head.

    >
    > >

    >
    > > My comp had been fine and then I kept getting "hard drive failure" or similar.

    >
    > > This was not a drive failure, it was the SATA cable coming lose (was a cheap dodgy cable)

    >
    > > and the drive was just laying in the base of the PC not secure, but it had been working fine like

    >
    > > that. OK I know that's a bad idea, so no need to tell me!!!.

    >
    > >

    >
    > > Anyhow when I got that error I would just push the lose connector in better and it would boot fine.

    >
    > > Then after a while it started running check disk at start-up, but I would quit it as it took ages.

    >
    > > Then one day I decide to let it run over night to 'cure' the problem - bad move. The next morning

    >
    > > I found the computer constantly rebooting and I could not boot it up.

    >
    > >

    >
    > > I since have a new PC by the way!! I'm on it now and it a lot faster :lol:

    >
    > >

    >
    > > I tried various options for booting but none worked (ie recover restore, boot to safe mode etc..)

    >
    > > Oh well I thought, good job I have a back up drive (the machines old drive was cloned onto a new

    >
    > > bigger drive, and I have been using the new clone for a while, I could in the past boot from either

    >
    > > by swapping the cables). However that one didn't work with!! I had not used it for a while but I expected

    >
    > > to work - it didn't.

    >
    > >

    >
    > > I though it might be a hardware error at that stage, however I managed to boot the machine on a Linux

    >
    > > Mint DVD OK and was able to surf the net, pretty good really except for the very poor cursor control,

    >
    > > but it was OK could surf, watch youtube etc..pretty cool really!!

    >
    > >

    >
    > > So does not seem to be hardware.

    >
    > >

    >
    > > Focusing on the newest drive which failed, I have had various error at various stages, I think when I try and do

    >
    > > recoveries it might screw it up even further.

    >
    > >

    >
    > > However one error, which I have just had is:-

    >
    > >

    >
    > > Quote

    >
    > > windows could not start

    >
    > > as file is missing or corrupt

    >
    > > root\system32\hal.dll

    >
    > > (approx wording)

    >
    > >

    >
    > > However I can see from Linux that hal.dll is there!!

    >
    > >

    >
    > > Another error I have had is

    >
    > >

    >
    > > Quote

    >
    > > stop:c000021a {Fatal Error} The windows logon process system process terminated unexpectedly with a status of 0xc0000034(0x00000000)(0x00000000)

    >
    > >

    >
    > >

    >
    > >

    >
    > > I read on Microsoft site

    >
    > >

    >
    > >

    >
    > > Quote

    >
    > > The STOP 0xC000021A error occurs when either Winlogon.exe or Csrss.exe fails. When the Windows NT kernel detects that either of these processes has stopped, it stops the system and raises the STOP 0xC000021A error.

    >
    > >

    >
    > >

    >
    > > Both those files exist and indeed the drive seems to be fine, right size and linux told me

    >
    > > that the disk was in good health, it said it's SMART status was OK.

    >
    > > I am actually just running a quick SMART self test on it now. It says the disk is healthy.

    >
    > >

    >
    > > Then there is the older drive, and indeed one older than that, I started with a 60gig, cloned to a 250gig and finally to

    >
    > > the 500gig drive I have been using most recently until it gave up the ghost.

    >
    > >

    >
    > > Actually the other drive in the machine is the 60gig drive and the 250gig one had errors, I still have it, might try booting

    >
    > > from it but it's has a dodge surface, sometimes files are there, sometimes not so much lol. :lol:

    >
    > >

    >
    > > I put the 250gig drive in an enclosure and I have just copied the contents of windows to this machine. (reports a couple of files missing

    >
    > > but it has 99.99%).

    >
    > >

    >
    > > I also tried and old XP recovery drive I made but that didn't work either.

    >
    > > I don't think the cloning software copes with the recovery partition well .

    >
    > >

    >
    > >

    >
    > > So................ where to from here??

    >
    > >

    >
    > > I guess I may have a number of option and things to try, but writing this out helps me get things clear in my own head

    >
    > > and I can use this thread to document stuff I have done as I tend to forget what did what and when etc...

    >
    > >

    >
    > > I maybe able to get a Win XP boot (installation disk) disk from my brother, that is another option if he still has it.

    >
    > > The PC came with no Windows disk, it was a HP machine with software pre-installed. AMD 3800X2

    >
    > >

    >
    > > It's not a major problem as I have a new PC and have various backups of data and I am copying the stuff I want onto

    >
    > > this my new machine, but I would like to get the old one working as aback up PC. I might be able to put the 500meg

    >
    > > (newest drive) into this machine to get the latest data if I need it (think it only has one bay though, have not looked yet!!)

    >
    > > I could also put it into a hard drive enclosure and connect via USB.

    >
    > >

    >
    > > Might see if I can get a new Linux version too and see if it is any better.

    >
    > >

    >
    > > But the bottom line seems to be the drive is fine and all the files are there and it will not boot, the

    >
    > > big problem occurred when I ran a check disk overnight, I guess that screwed something up, certainly seemed to.

    >
    > >

    >
    > > I imagine it may just have a corrupt file on it but which one???

    >
    > >

    >
    > > IF I try to boot into XP normally now I thing it will give the missing hal.dll error.

    >
    > >

    >
    > > However I can see the file from Linux, it says:-

    >
    > >

    >
    > > hal.dll size 134.4kB 134,400 bytes it also says accessed 12th Sept, however the I was using it 19th Sept for sure.

    >
    > >

    >
    > > So any help/ideas welcome :)

    >
    > >

    >
    > >

    >
    > > ********************* end of post ****************

    >
    > >

    >
    > > At the moment I have booted to Linux and am backing the drive up to a USB

    >
    > > drive, seems a sensible thing to do, I should have done it earlier but I

    >
    > > didn't realise I could use the USB drive in LINUX, however you can

    >
    > > I am pretty impressed with it considering it runs from a DVD!!!

    >
    > >

    >
    >
    >
    > You could post your WinXP question here.
    >
    >
    >
    > microsoft.public.windowsxp.general
    >
    >
    >
    > *******
    >
    >
    >
    > There's probably several things you could do at this point,
    >
    > but the 0xC000021A sounds a bit like malware. As much as anything
    >
    > else.
    >
    >
    >
    > Since you've had good luck with Linux, you can use this disc to
    >
    > do an offline scan of a Windows C: partition.
    >
    >
    >
    > http://support.kaspersky.com/8092
    >
    >
    >
    > "Iso image of Kaspersky Rescue Disk 10 (237 MB)"
    >
    >
    >
    > It's not actually 237MB. The size varies as they add new AV definitions
    >
    > to the image. It'll be bigger than 237MB. The image is probably
    >
    > updated once a week, so they probably don't show up-to-date
    >
    > size info.
    >
    >
    >
    > You can burn a CD with that ISO9660 file. Or, if you want, load
    >
    > the stuff onto a USB flash stick, using the installer tool on that
    >
    > web page.
    >
    >
    >
    > Once you boot from that, it expects a working LAN connection at
    >
    > startup. It can download updates to the AV files on demand.
    >
    > If you have already configured your modem/router such that
    >
    > the Internet is working, that's all the CD needs to do its
    >
    > downloads. The disc doesn't know how to operate a dialup modem
    >
    > (using PPP), and that was a decision by the disc designer to
    >
    > not include it.
    >
    >
    >
    > The Windows disk letters are not properly reflected in the
    >
    > scan menu. On my machine, the Kaspersky "E:" is actually my C:
    >
    > drive. So I know from experience I should click E:. I keep
    >
    > an empty file on my WinXP partition - the file name helps
    >
    > me identify I have the right drive letter in other environments
    >
    > (when the label isn't visible).
    >
    >
    >
    > Another complication, is the disc will prompt you with questions
    >
    > such as whether you're running Windows 8 or not. I generally
    >
    > just have my WinXP disk connected at the time, and leave anything
    >
    > that might confuse the scanner disconnected.
    >
    >
    >
    > Anyway, give that much a try first. And then things like
    >
    > repair installs would be the next topic of discussion.
    >
    > A repair install saves programs and settings. But it
    >
    > does tend to screw up one or two settings (doesn't remember
    >
    > your old choices), so the process is only 99.5% accurate.
    >
    >
    >
    > If this is a Dell or HP, as the machines get more modern,
    >
    > the recovery options are more varied. Some modern machines
    >
    > can do the equivalent of a repair install from an image
    >
    > hidden on a partition, instead of the old fashioned "nuke and pave"
    >
    > option. At one time, computers only had a "purely destructive"
    >
    > option, and you were supposed to backup your data before using
    >
    > that. More modern machines now have several options, and nuking
    >
    > is now the last option rather than the first. Read the manual
    >
    > to see what these options are.
    >
    >
    >
    > Since I have retail OSes here, I just use the "real" Windows
    >
    > CD to repair install. On an OEM machine, you were supposed to
    >
    > make recovery media when the machine was new, and that can be
    >
    > used to start over again. The COA sticker on the machine,
    >
    > contains a key that can be used with a real Windows install
    >
    > CD, but the version of Windows CD may have to match the key.
    >
    > Perhaps a System builder version would work for example,
    >
    > as an "OEM" version.
    >
    >
    >
    > *******
    >
    >
    >
    > And doing a backup is not a bad idea, if you're concerned that
    >
    > one of your repair steps will make things worse. If you know how
    >
    > to do this from Linux, then that sounds like a good plan.
    >
    >
    >
    > *******
    >
    >
    >
    > I suspect your mistake long ago, was the difference between
    >
    > "CHKDSK" and "disk scan". Using HDTune (free) or similar, it's
    >
    > possible to just scan a disk for bad blocks. This is a means
    >
    > to determine disk health. If you saw bad blocks, your next
    >
    > step would *not* be to run a CHKDSK with repair option.
    >
    > Especially if the disk happened to freeze while the disk
    >
    > read scan was running. Because then you know CHKDSK is
    >
    > doomed to screw up. CHKDSK can multiply problems, if it
    >
    > doesn't have good media to work with to make repairs. If
    >
    > it gets half way through repairing something, several times
    >
    > in a row, you could then be in serious trouble. As now you
    >
    > have "error multiplication". So in a sense, keep in mind
    >
    > that CHKDSK is potentially destructive, and you won't be
    >
    > far from the troth.
    >
    >
    >
    > But at this point, I'm not convinced your problem is solely
    >
    > hard drive related. I think something else is going on,
    >
    > which is why I'm recommending an offline AV scan first.
    >
    >
    >
    > *******
    >
    >
    >
    > When CHKDSK runs, it moves orphan files to a folder
    >
    > under the root of C:. If you find a folder there with
    >
    > (unnamed) recovered files in it, and the number of
    >
    > files is large, that may give you some idea how much
    >
    > of a mess CHKDSK has made.
    >
    >
    >
    > Paul


    Thanks Paul!! Always a pleasure to talk to you!


    Regarding as to whether it is malware, I tend to doubt that as I have not
    had too many problems with that of late and have AVG anti-virus etc...
    It could still be malware but the way the problem started we me getting a
    "hard drive failure" message at start-up. However that was being caused by
    a lose SATA? cable, the connector was slightly broken so it had a tendency
    to work lose. Now I would expect that to cause some problems on the drive,
    I mean I can imagine if it is getting a poor signal all hell could break lose.
    I used to plug it back in securely and all would be well, however obviously
    running with a dodgy drive connection is going to end in tears eventually and it did!!

    So I am assuming it is not malware for the moment but not ruling it out.

    So I think the problem were mainly caused by the chkdsk and then further
    compounded by trying to run a restore because I have always had problem with that.

    I think the reason the restore made it worse is that it might have got the
    partitions mixed up and is looking on the wrong partition, but I am not sure,
    maybe it is just corrupt or some other problem.
    Thing is if I select the recovery console it does something before failing, and I think that means it found something in /cmdcons which is on the same partition. But I do not really understand boot.ini.

    Anyhow I think the Kaspersky Rescue Disk 10, looks like a good option at this
    stage so I will have a look at that.
    The broken machine is connected to the net via linux via my network hub so I guess that should be OK. It's a cable modem/hub, I have both my machines connect
    to the net via it, first time I ever did that was surprised I had no problems!

    My machine has always had a recovery partition on it as it came with no
    system disc, the OS was pre-installed, but the recovery no longer works!!

    I have backed up all the data now and I might be able to get hold of an
    XP disc which is unregistered, so I might be able to re-instal XP however
    I would like to try other things first, might be easier in the long run.

    And yes I seem to have backed up everything from LINUX.

    I also thought I had a full backup, but I just looked at it and there is
    some stuff missing, which is bad news. However I have the too older drives
    but neither of them seem to work now, one is dodgy, sometimes it find files
    other time they have disappeared!!

    It is not a huge loss if I can't restore the machine as I can connect to the
    net via linux with it, and that is the main thing I want it for, ie to
    have and internet connection if this, my new machine, fails to work.

    This is my new machine by the way:-

    http://www.pcworld.co.uk/gbuk/deskt...us-cm6730-uk021s-desktop-pc-21439451-pdt.html

    I bought it in a hurry as I could only connect via linux at the time, and the
    linux was not working too well, but it is miles better now, pretty good
    actually, I am impressed with it, I didn't think it would work with my USB drive but it does and it seems to work better than windows with it.

    I did want something more powerful but I had limited options in the store
    so it seemed the best by, I like it is is a low power CPU 35 watts, which means
    it is very quite, not heard the fan yet, also it is 4 time faster than the old machine, so more than I need in that respect!!

    Worst thing about it's windows 8!! Not too keen on that!!
    I also have some learning to do on that, I guess I should be making a recovery
    DVD or two for that ASAP.

    Anyway thanks for your help I have a lot of things to look into so I will report
    back later.

    Thanks once again!!
     
    , Sep 27, 2013
    #3
  4. Paul Guest

    wrote:
    > On Thursday, September 26, 2013 7:36:27 PM UTC-8, Paul wrote:
    >> wrote:
    >>
    >>> Bit of a long rambling story which I posted no elsewhere but perhaps unsurprisingly got no responses, I have posted here before and found guy called Paul to be extremely helpful and knowledgeable.
    >>> I'm on a different account now I have posted under various ID's including
    >>> Lord Turkey Cough, half_pint and R. Giggs.
    >>> Anyway this is what I posted else where, well perhaps I can post a link to the forum!!!
    >>> http://www.geekstogo.com/forum/topic/333701-xp-computer-not-booting/
    >>> I will post the first long rambling post I made!!!
    >>> Here it is!! (it nmight not displat too well unfortunately but you can see the link if
    >>> interested.
    >>> ************** start of post ******************
    >>> Hello everybody!!! :)
    >>> Well I almost do not know where to begin so I will start at the beginning (sort of).
    >>> Recounting the story will help me get things straight in my head.
    >>> My comp had been fine and then I kept getting "hard drive failure" or similar.
    >>> This was not a drive failure, it was the SATA cable coming lose (was a cheap dodgy cable)
    >>> and the drive was just laying in the base of the PC not secure, but it had been working fine like
    >>> that. OK I know that's a bad idea, so no need to tell me!!!.
    >>> Anyhow when I got that error I would just push the lose connector in better and it would boot fine.
    >>> Then after a while it started running check disk at start-up, but I would quit it as it took ages.
    >>> Then one day I decide to let it run over night to 'cure' the problem - bad move. The next morning
    >>> I found the computer constantly rebooting and I could not boot it up.
    >>> I since have a new PC by the way!! I'm on it now and it a lot faster :lol:
    >>> I tried various options for booting but none worked (ie recover restore, boot to safe mode etc..)
    >>> Oh well I thought, good job I have a back up drive (the machines old drive was cloned onto a new
    >>> bigger drive, and I have been using the new clone for a while, I could in the past boot from either
    >>> by swapping the cables). However that one didn't work with!! I had not used it for a while but I expected
    >>> to work - it didn't.
    >>> I though it might be a hardware error at that stage, however I managed to boot the machine on a Linux
    >>> Mint DVD OK and was able to surf the net, pretty good really except for the very poor cursor control,
    >>> but it was OK could surf, watch youtube etc..pretty cool really!!
    >>> So does not seem to be hardware.
    >>> Focusing on the newest drive which failed, I have had various error at various stages, I think when I try and do
    >>> recoveries it might screw it up even further.
    >>> However one error, which I have just had is:-
    >>> Quote
    >>> windows could not start
    >>> as file is missing or corrupt
    >>> root\system32\hal.dll
    >>> (approx wording)
    >>> However I can see from Linux that hal.dll is there!!
    >>> Another error I have had is
    >>> Quote
    >>> stop:c000021a {Fatal Error} The windows logon process system process terminated unexpectedly with a status of 0xc0000034(0x00000000)(0x00000000)
    >>> I read on Microsoft site
    >>> Quote
    >>> The STOP 0xC000021A error occurs when either Winlogon.exe or Csrss.exe fails. When the Windows NT kernel detects that either of these processes has stopped, it stops the system and raises the STOP 0xC000021A error.
    >>> Both those files exist and indeed the drive seems to be fine, right size and linux told me
    >>> that the disk was in good health, it said it's SMART status was OK.
    >>> I am actually just running a quick SMART self test on it now. It says the disk is healthy.
    >>> Then there is the older drive, and indeed one older than that, I started with a 60gig, cloned to a 250gig and finally to
    >>> the 500gig drive I have been using most recently until it gave up the ghost.
    >>> Actually the other drive in the machine is the 60gig drive and the 250gig one had errors, I still have it, might try booting
    >>> from it but it's has a dodge surface, sometimes files are there, sometimes not so much lol. :lol:
    >>> I put the 250gig drive in an enclosure and I have just copied the contents of windows to this machine. (reports a couple of files missing
    >>> but it has 99.99%).
    >>> I also tried and old XP recovery drive I made but that didn't work either.
    >>> I don't think the cloning software copes with the recovery partition well .
    >>> So................ where to from here??
    >>> I guess I may have a number of option and things to try, but writing this out helps me get things clear in my own head
    >>> and I can use this thread to document stuff I have done as I tend to forget what did what and when etc...
    >>> I maybe able to get a Win XP boot (installation disk) disk from my brother, that is another option if he still has it.
    >>> The PC came with no Windows disk, it was a HP machine with software pre-installed. AMD 3800X2
    >>> It's not a major problem as I have a new PC and have various backups of data and I am copying the stuff I want onto
    >>> this my new machine, but I would like to get the old one working as aback up PC. I might be able to put the 500meg
    >>> (newest drive) into this machine to get the latest data if I need it (think it only has one bay though, have not looked yet!!)
    >>> I could also put it into a hard drive enclosure and connect via USB.
    >>> Might see if I can get a new Linux version too and see if it is any better.
    >>> But the bottom line seems to be the drive is fine and all the files are there and it will not boot, the
    >>> big problem occurred when I ran a check disk overnight, I guess that screwed something up, certainly seemed to.
    >>> I imagine it may just have a corrupt file on it but which one???
    >>> IF I try to boot into XP normally now I thing it will give the missing hal.dll error.
    >>> However I can see the file from Linux, it says:-
    >>> hal.dll size 134.4kB 134,400 bytes it also says accessed 12th Sept, however the I was using it 19th Sept for sure.
    >>> So any help/ideas welcome :)
    >>> ********************* end of post ****************
    >>> At the moment I have booted to Linux and am backing the drive up to a USB
    >>> drive, seems a sensible thing to do, I should have done it earlier but I
    >>> didn't realise I could use the USB drive in LINUX, however you can
    >>> I am pretty impressed with it considering it runs from a DVD!!!

    >>
    >>
    >> You could post your WinXP question here.
    >>
    >>
    >>
    >> microsoft.public.windowsxp.general
    >>
    >>
    >>
    >> *******
    >>
    >>
    >>
    >> There's probably several things you could do at this point,
    >>
    >> but the 0xC000021A sounds a bit like malware. As much as anything
    >>
    >> else.
    >>
    >>
    >>
    >> Since you've had good luck with Linux, you can use this disc to
    >>
    >> do an offline scan of a Windows C: partition.
    >>
    >>
    >>
    >> http://support.kaspersky.com/8092
    >>
    >>
    >>
    >> "Iso image of Kaspersky Rescue Disk 10 (237 MB)"
    >>
    >>
    >>
    >> It's not actually 237MB. The size varies as they add new AV definitions
    >>
    >> to the image. It'll be bigger than 237MB. The image is probably
    >>
    >> updated once a week, so they probably don't show up-to-date
    >>
    >> size info.
    >>
    >>
    >>
    >> You can burn a CD with that ISO9660 file. Or, if you want, load
    >>
    >> the stuff onto a USB flash stick, using the installer tool on that
    >>
    >> web page.
    >>
    >>
    >>
    >> Once you boot from that, it expects a working LAN connection at
    >>
    >> startup. It can download updates to the AV files on demand.
    >>
    >> If you have already configured your modem/router such that
    >>
    >> the Internet is working, that's all the CD needs to do its
    >>
    >> downloads. The disc doesn't know how to operate a dialup modem
    >>
    >> (using PPP), and that was a decision by the disc designer to
    >>
    >> not include it.
    >>
    >>
    >>
    >> The Windows disk letters are not properly reflected in the
    >>
    >> scan menu. On my machine, the Kaspersky "E:" is actually my C:
    >>
    >> drive. So I know from experience I should click E:. I keep
    >>
    >> an empty file on my WinXP partition - the file name helps
    >>
    >> me identify I have the right drive letter in other environments
    >>
    >> (when the label isn't visible).
    >>
    >>
    >>
    >> Another complication, is the disc will prompt you with questions
    >>
    >> such as whether you're running Windows 8 or not. I generally
    >>
    >> just have my WinXP disk connected at the time, and leave anything
    >>
    >> that might confuse the scanner disconnected.
    >>
    >>
    >>
    >> Anyway, give that much a try first. And then things like
    >>
    >> repair installs would be the next topic of discussion.
    >>
    >> A repair install saves programs and settings. But it
    >>
    >> does tend to screw up one or two settings (doesn't remember
    >>
    >> your old choices), so the process is only 99.5% accurate.
    >>
    >>
    >>
    >> If this is a Dell or HP, as the machines get more modern,
    >>
    >> the recovery options are more varied. Some modern machines
    >>
    >> can do the equivalent of a repair install from an image
    >>
    >> hidden on a partition, instead of the old fashioned "nuke and pave"
    >>
    >> option. At one time, computers only had a "purely destructive"
    >>
    >> option, and you were supposed to backup your data before using
    >>
    >> that. More modern machines now have several options, and nuking
    >>
    >> is now the last option rather than the first. Read the manual
    >>
    >> to see what these options are.
    >>
    >>
    >>
    >> Since I have retail OSes here, I just use the "real" Windows
    >>
    >> CD to repair install. On an OEM machine, you were supposed to
    >>
    >> make recovery media when the machine was new, and that can be
    >>
    >> used to start over again. The COA sticker on the machine,
    >>
    >> contains a key that can be used with a real Windows install
    >>
    >> CD, but the version of Windows CD may have to match the key.
    >>
    >> Perhaps a System builder version would work for example,
    >>
    >> as an "OEM" version.
    >>
    >>
    >>
    >> *******
    >>
    >>
    >>
    >> And doing a backup is not a bad idea, if you're concerned that
    >>
    >> one of your repair steps will make things worse. If you know how
    >>
    >> to do this from Linux, then that sounds like a good plan.
    >>
    >>
    >>
    >> *******
    >>
    >>
    >>
    >> I suspect your mistake long ago, was the difference between
    >>
    >> "CHKDSK" and "disk scan". Using HDTune (free) or similar, it's
    >>
    >> possible to just scan a disk for bad blocks. This is a means
    >>
    >> to determine disk health. If you saw bad blocks, your next
    >>
    >> step would *not* be to run a CHKDSK with repair option.
    >>
    >> Especially if the disk happened to freeze while the disk
    >>
    >> read scan was running. Because then you know CHKDSK is
    >>
    >> doomed to screw up. CHKDSK can multiply problems, if it
    >>
    >> doesn't have good media to work with to make repairs. If
    >>
    >> it gets half way through repairing something, several times
    >>
    >> in a row, you could then be in serious trouble. As now you
    >>
    >> have "error multiplication". So in a sense, keep in mind
    >>
    >> that CHKDSK is potentially destructive, and you won't be
    >>
    >> far from the troth.
    >>
    >>
    >>
    >> But at this point, I'm not convinced your problem is solely
    >>
    >> hard drive related. I think something else is going on,
    >>
    >> which is why I'm recommending an offline AV scan first.
    >>
    >>
    >>
    >> *******
    >>
    >>
    >>
    >> When CHKDSK runs, it moves orphan files to a folder
    >>
    >> under the root of C:. If you find a folder there with
    >>
    >> (unnamed) recovered files in it, and the number of
    >>
    >> files is large, that may give you some idea how much
    >>
    >> of a mess CHKDSK has made.
    >>
    >>
    >>
    >> Paul

    >
    > Thanks Paul!! Always a pleasure to talk to you!
    >
    >
    > Regarding as to whether it is malware, I tend to doubt that as I have not
    > had too many problems with that of late and have AVG anti-virus etc...
    > It could still be malware but the way the problem started we me getting a
    > "hard drive failure" message at start-up. However that was being caused by
    > a lose SATA? cable, the connector was slightly broken so it had a tendency
    > to work lose. Now I would expect that to cause some problems on the drive,
    > I mean I can imagine if it is getting a poor signal all hell could break lose.
    > I used to plug it back in securely and all would be well, however obviously
    > running with a dodgy drive connection is going to end in tears eventually and it did!!
    >
    > So I am assuming it is not malware for the moment but not ruling it out.
    >
    > So I think the problem were mainly caused by the chkdsk and then further
    > compounded by trying to run a restore because I have always had problem with that.
    >
    > I think the reason the restore made it worse is that it might have got the
    > partitions mixed up and is looking on the wrong partition, but I am not sure,
    > maybe it is just corrupt or some other problem.
    > Thing is if I select the recovery console it does something before failing, and I think that means it found something in /cmdcons which is on the same partition. But I do not really understand boot.ini.
    >
    > Anyhow I think the Kaspersky Rescue Disk 10, looks like a good option at this
    > stage so I will have a look at that.
    > The broken machine is connected to the net via linux via my network hub so I guess that should be OK. It's a cable modem/hub, I have both my machines connect
    > to the net via it, first time I ever did that was surprised I had no problems!
    >
    > My machine has always had a recovery partition on it as it came with no
    > system disc, the OS was pre-installed, but the recovery no longer works!!
    >
    > I have backed up all the data now and I might be able to get hold of an
    > XP disc which is unregistered, so I might be able to re-instal XP however
    > I would like to try other things first, might be easier in the long run.
    >
    > And yes I seem to have backed up everything from LINUX.
    >
    > I also thought I had a full backup, but I just looked at it and there is
    > some stuff missing, which is bad news. However I have the too older drives
    > but neither of them seem to work now, one is dodgy, sometimes it find files
    > other time they have disappeared!!
    >
    > It is not a huge loss if I can't restore the machine as I can connect to the
    > net via linux with it, and that is the main thing I want it for, ie to
    > have and internet connection if this, my new machine, fails to work.
    >
    > This is my new machine by the way:-
    >
    > http://www.pcworld.co.uk/gbuk/deskt...us-cm6730-uk021s-desktop-pc-21439451-pdt.html
    >
    > I bought it in a hurry as I could only connect via linux at the time, and the
    > linux was not working too well, but it is miles better now, pretty good
    > actually, I am impressed with it, I didn't think it would work with my USB drive but it does and it seems to work better than windows with it.
    >
    > I did want something more powerful but I had limited options in the store
    > so it seemed the best by, I like it is is a low power CPU 35 watts, which means
    > it is very quite, not heard the fan yet, also it is 4 time faster than the old machine, so more than I need in that respect!!
    >
    > Worst thing about it's windows 8!! Not too keen on that!!
    > I also have some learning to do on that, I guess I should be making a recovery
    > DVD or two for that ASAP.
    >
    > Anyway thanks for your help I have a lot of things to look into so I will report
    > back later.
    >
    > Thanks once again!!


    Someone got your error number here.

    http://www.bleepingcomputer.com/for...-center-showing-automatic-updates-turned-off/

    And they had some evidence of TDSS being present.

    The article here mentions hijacking of msgina.dll as
    a possible cause.

    http://support.microsoft.com/default.aspx?scid=kb;en-us;156669

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    value = msgina.dll

    Something could be loaded in its place.

    But if you can't keep a machine running like that,
    it's not going to be easy to solve.

    If it was "just a CHKDSK problem", it would randomly affect
    files. Your damage seems to be to "interesting" files, which
    is why I am suspicious.

    Paul
     
    Paul, Sep 27, 2013
    #4
  5. Guest

    Well just a kind of update, well more of refreshing my memory really as I
    am trying to get clear what I did in the past.
    On the old machine I actually use 3 drives:-

    The original 80gig
    Then a 250 gig drive which I cloned from the 80gig drive and used as master..
    Then a 500 gig drive which was cloned form either the 80gig or 250 gig drive.

    The 250gig drive seemed to develop problems, yes I remember now, I booted up and found I could not login and then found a load of file missing. I thenrestored them, and used my 500gig drive I removed from a USB drive as the master.

    I am not sure if I cloned from the 60gig or the 250 gig, however I did get
    up and running.

    I put the 250 drive in the enclose and have not used it much but I am looking at it now, there is a chance it, might be boot-able, but I doubt it.

    However no harm in giving it a go!

    I was planning on getting all 3 drives onto my huge 3 gig USB drive, however when I tried to copy the 80drive from Linux it would not do it. It said
    something like "can't access system volume info".

    Now I had to look that ( sys vol info) up as I was not sure what it was,
    apparently it is where windows gets it's restores from or something like that.

    HP machines have a recovery partition too, which makes things rather confusing for me, I think it is the equivalent of Windows XP installation disc ora copy of the original factory set-up of XP.

    When I boot up I have the option of pressing F10 for recovery, however by the time I have decided what to do it has booted to windows start-up options,
    and I see the system restore thing and try that and it usually works, so I have
    rarely used the recovery, I have a vague memory of, when I used it, it seemed to crash half way through and reboot, however the reboot was usually a successful one, which was a relief but it always left me with the feeling I was really lucky it booted up so I have stayed well clear of using the recovery option.

    Well I had stayed well clear of using it until very recently, I did try it and I am fairly confident that that was when I began getting the missing hal.dll
    error and the other STOPPED error.


    Anyhow just to make more thing more complex as I was copying from the 250gig drive to this machine the anti-virus McAfee picked up a couple of dodgy files.

    One of them is detailed here, a Hewett Packard file.

    http://www.help2go.com/forum/computer-help/96146-c-hp-bin-killwind-exe.html

    Sounds really dodgy


    ""I was assisting someone with a problem with her computer and came across these files. I contacted HP and was told that the killwind, terminator, cloaker, spawn and fondlewindow executables are part of the Backweb program that HP installs on all Pavilion PC's. Backweb enables HP to connect directlyto a PC while it is online (simply connected to an ISP - doesn't matter ifthe browser is open or not) so that it can "push" content and program updates. "

    I mean it basically sounds like hp have a secret backdoor into your PC!!!

    It also found something in one of my Poker folders, which is kind of worrying,
    I remember winning for on that site and then one day I just could not win again!!

    I would add those files were on the drive which I was not using, because itwent faulty.... interesting, but it;s a slightly different thing in a way
    I think/hope it's unrelated to the current issues, more stuff to investigate!!!
    The names of the files sounds seriously hackerish!!!

    Also found this video describing boot-up process, might be useful for me.

    http://www.youtube.com/watch?v=WoNFNSM1gYI


    There maybe some other useful videos on you tube I can look at.

    I can't really do much else at the moment as I am backing up stuff with
    both my machines.


    Anyhow I will report back here later, it's nice to keep some kind of log
    here of what I am doing as my memory is not very reliable these days!
     
    , Sep 27, 2013
    #5
  6. Paul Guest

    wrote:
    > Well just a kind of update, well more of refreshing my memory really as I
    > am trying to get clear what I did in the past.
    > On the old machine I actually use 3 drives:-
    >
    > The original 80gig
    > Then a 250 gig drive which I cloned from the 80gig drive and used as master.
    > Then a 500 gig drive which was cloned form either the 80gig or 250 gig drive.
    >
    > The 250gig drive seemed to develop problems, yes I remember now, I booted up and found I could not login and then found a load of file missing. I then restored them, and used my 500gig drive I removed from a USB drive as the master.
    >
    > I am not sure if I cloned from the 60gig or the 250 gig, however I did get
    > up and running.
    >
    > I put the 250 drive in the enclose and have not used it much but I am looking at it now, there is a chance it, might be boot-able, but I doubt it.
    >
    > However no harm in giving it a go!
    >
    > I was planning on getting all 3 drives onto my huge 3 gig USB drive, however when I tried to copy the 80drive from Linux it would not do it. It said
    > something like "can't access system volume info".
    >
    > Now I had to look that ( sys vol info) up as I was not sure what it was,
    > apparently it is where windows gets it's restores from or something like that.
    >
    > HP machines have a recovery partition too, which makes things rather confusing for me, I think it is the equivalent of Windows XP installation disc or a copy of the original factory set-up of XP.
    >
    > When I boot up I have the option of pressing F10 for recovery, however by the time I have decided what to do it has booted to windows start-up options,
    > and I see the system restore thing and try that and it usually works, so I have
    > rarely used the recovery, I have a vague memory of, when I used it, it seemed to crash half way through and reboot, however the reboot was usually a successful one, which was a relief but it always left me with the feeling I was really lucky it booted up so I have stayed well clear of using the recovery option.
    >
    > Well I had stayed well clear of using it until very recently, I did try it and I am fairly confident that that was when I began getting the missing hal.dll
    > error and the other STOPPED error.
    >
    >
    > Anyhow just to make more thing more complex as I was copying from the 250gig drive to this machine the anti-virus McAfee picked up a couple of dodgy files.
    >
    > One of them is detailed here, a Hewett Packard file.
    >
    > http://www.help2go.com/forum/computer-help/96146-c-hp-bin-killwind-exe.html
    >
    > Sounds really dodgy
    >
    >
    > ""I was assisting someone with a problem with her computer and came across these files. I contacted HP and was told that the killwind, terminator, cloaker, spawn and fondlewindow executables are part of the Backweb program that HP installs on all Pavilion PC's. Backweb enables HP to connect directly to a PC while it is online (simply connected to an ISP - doesn't matter if the browser is open or not) so that it can "push" content and program updates. "
    >
    > I mean it basically sounds like hp have a secret backdoor into your PC!!!
    >
    > It also found something in one of my Poker folders, which is kind of worrying,
    > I remember winning for on that site and then one day I just could not win again!!
    >
    > I would add those files were on the drive which I was not using, because it went faulty.... interesting, but it;s a slightly different thing in a way
    > I think/hope it's unrelated to the current issues, more stuff to investigate!!!
    > The names of the files sounds seriously hackerish!!!
    >
    > Also found this video describing boot-up process, might be useful for me.
    >
    > http://www.youtube.com/watch?v=WoNFNSM1gYI
    >
    >
    > There maybe some other useful videos on you tube I can look at.
    >
    > I can't really do much else at the moment as I am backing up stuff with
    > both my machines.
    >
    >
    > Anyhow I will report back here later, it's nice to keep some kind of log
    > here of what I am doing as my memory is not very reliable these days!
    >
    >


    Linux does not care about permissions (on foreign partition).
    This may change some day, so this is not a given. It happens
    to be true at the moment.

    So when it comes to capturing files, it should be
    able to access just about any folder.

    And as it turns out, this isn't always a good thing.

    I've managed to break my copy of Windows 7, while poking around in SVI from Linux.
    I've not had a problem with WinXP. I use Robocopy for copying all the files
    off my FAT32 WinXP partition, and that works OK. Robocopy doesn't copy
    everything, and needs running of "fixboot" on a freshly prepared restoration
    to make things work. It just copies files and is not concerned with
    whether a partition is bootable or not. (Fixboot puts back the
    partition boot sector, which sits near the beginning of the partition,
    just before the file system storage area.)

    If you're doing backups from Linux, you want some assurance it can put
    things back the way they were originally.

    If you're getting Access Denied on SVI, then I'd want to understand
    what environment (and program) this happened in. It would be
    more likely with a Windows OS running than with Linux.

    Paul
     
    Paul, Sep 27, 2013
    #6
  7. Guest

    On Friday, September 27, 2013 2:09:47 AM UTC-8, Paul wrote:
    > wrote:
    >
    > > On Thursday, September 26, 2013 7:36:27 PM UTC-8, Paul wrote:

    >
    > >> wrote:

    >
    > >>

    >
    > >>> Bit of a long rambling story which I posted no elsewhere but perhaps unsurprisingly got no responses, I have posted here before and found guy called Paul to be extremely helpful and knowledgeable.

    >
    > >>> I'm on a different account now I have posted under various ID's including

    >
    > >>> Lord Turkey Cough, half_pint and R. Giggs.

    >
    > >>> Anyway this is what I posted else where, well perhaps I can post a link to the forum!!!

    >
    > >>> http://www.geekstogo.com/forum/topic/333701-xp-computer-not-booting/

    >
    > >>> I will post the first long rambling post I made!!!

    >
    > >>> Here it is!! (it nmight not displat too well unfortunately but you can see the link if

    >
    > >>> interested.

    >
    > >>> ************** start of post ******************

    >
    > >>> Hello everybody!!! :)

    >
    > >>> Well I almost do not know where to begin so I will start at the beginning (sort of).

    >
    > >>> Recounting the story will help me get things straight in my head.

    >
    > >>> My comp had been fine and then I kept getting "hard drive failure" or similar.

    >
    > >>> This was not a drive failure, it was the SATA cable coming lose (was a cheap dodgy cable)

    >
    > >>> and the drive was just laying in the base of the PC not secure, but it had been working fine like

    >
    > >>> that. OK I know that's a bad idea, so no need to tell me!!!.

    >
    > >>> Anyhow when I got that error I would just push the lose connector in better and it would boot fine.

    >
    > >>> Then after a while it started running check disk at start-up, but I would quit it as it took ages.

    >
    > >>> Then one day I decide to let it run over night to 'cure' the problem - bad move. The next morning

    >
    > >>> I found the computer constantly rebooting and I could not boot it up.

    >
    > >>> I since have a new PC by the way!! I'm on it now and it a lot faster :lol:

    >
    > >>> I tried various options for booting but none worked (ie recover restore, boot to safe mode etc..)

    >
    > >>> Oh well I thought, good job I have a back up drive (the machines old drive was cloned onto a new

    >
    > >>> bigger drive, and I have been using the new clone for a while, I could in the past boot from either

    >
    > >>> by swapping the cables). However that one didn't work with!! I had not used it for a while but I expected

    >
    > >>> to work - it didn't.

    >
    > >>> I though it might be a hardware error at that stage, however I managed to boot the machine on a Linux

    >
    > >>> Mint DVD OK and was able to surf the net, pretty good really except for the very poor cursor control,

    >
    > >>> but it was OK could surf, watch youtube etc..pretty cool really!!

    >
    > >>> So does not seem to be hardware.

    >
    > >>> Focusing on the newest drive which failed, I have had various error at various stages, I think when I try and do

    >
    > >>> recoveries it might screw it up even further.

    >
    > >>> However one error, which I have just had is:-

    >
    > >>> Quote

    >
    > >>> windows could not start

    >
    > >>> as file is missing or corrupt

    >
    > >>> root\system32\hal.dll

    >
    > >>> (approx wording)

    >
    > >>> However I can see from Linux that hal.dll is there!!

    >
    > >>> Another error I have had is

    >
    > >>> Quote

    >
    > >>> stop:c000021a {Fatal Error} The windows logon process system process terminated unexpectedly with a status of 0xc0000034(0x00000000)(0x00000000)

    >
    > >>> I read on Microsoft site

    >
    > >>> Quote

    >
    > >>> The STOP 0xC000021A error occurs when either Winlogon.exe or Csrss.exe fails. When the Windows NT kernel detects that either of these processes has stopped, it stops the system and raises the STOP 0xC000021A error.

    >
    > >>> Both those files exist and indeed the drive seems to be fine, right size and linux told me

    >
    > >>> that the disk was in good health, it said it's SMART status was OK.

    >
    > >>> I am actually just running a quick SMART self test on it now. It says the disk is healthy.

    >
    > >>> Then there is the older drive, and indeed one older than that, I started with a 60gig, cloned to a 250gig and finally to

    >
    > >>> the 500gig drive I have been using most recently until it gave up the ghost.

    >
    > >>> Actually the other drive in the machine is the 60gig drive and the 250gig one had errors, I still have it, might try booting

    >
    > >>> from it but it's has a dodge surface, sometimes files are there, sometimes not so much lol. :lol:

    >
    > >>> I put the 250gig drive in an enclosure and I have just copied the contents of windows to this machine. (reports a couple of files missing

    >
    > >>> but it has 99.99%).

    >
    > >>> I also tried and old XP recovery drive I made but that didn't work either.

    >
    > >>> I don't think the cloning software copes with the recovery partition well .

    >
    > >>> So................ where to from here??

    >
    > >>> I guess I may have a number of option and things to try, but writing this out helps me get things clear in my own head

    >
    > >>> and I can use this thread to document stuff I have done as I tend to forget what did what and when etc...

    >
    > >>> I maybe able to get a Win XP boot (installation disk) disk from my brother, that is another option if he still has it.

    >
    > >>> The PC came with no Windows disk, it was a HP machine with software pre-installed. AMD 3800X2

    >
    > >>> It's not a major problem as I have a new PC and have various backups of data and I am copying the stuff I want onto

    >
    > >>> this my new machine, but I would like to get the old one working as aback up PC. I might be able to put the 500meg

    >
    > >>> (newest drive) into this machine to get the latest data if I need it (think it only has one bay though, have not looked yet!!)

    >
    > >>> I could also put it into a hard drive enclosure and connect via USB.

    >
    > >>> Might see if I can get a new Linux version too and see if it is any better.

    >
    > >>> But the bottom line seems to be the drive is fine and all the files are there and it will not boot, the

    >
    > >>> big problem occurred when I ran a check disk overnight, I guess that screwed something up, certainly seemed to.

    >
    > >>> I imagine it may just have a corrupt file on it but which one???

    >
    > >>> IF I try to boot into XP normally now I thing it will give the missing hal.dll error.

    >
    > >>> However I can see the file from Linux, it says:-

    >
    > >>> hal.dll size 134.4kB 134,400 bytes it also says accessed 12th Sept, however the I was using it 19th Sept for sure.

    >
    > >>> So any help/ideas welcome :)

    >
    > >>> ********************* end of post ****************

    >
    > >>> At the moment I have booted to Linux and am backing the drive up to a USB

    >
    > >>> drive, seems a sensible thing to do, I should have done it earlier but I

    >
    > >>> didn't realise I could use the USB drive in LINUX, however you can

    >
    > >>> I am pretty impressed with it considering it runs from a DVD!!!

    >
    > >>

    >
    > >>

    >
    > >> You could post your WinXP question here.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> microsoft.public.windowsxp.general

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> *******

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> There's probably several things you could do at this point,

    >
    > >>

    >
    > >> but the 0xC000021A sounds a bit like malware. As much as anything

    >
    > >>

    >
    > >> else.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> Since you've had good luck with Linux, you can use this disc to

    >
    > >>

    >
    > >> do an offline scan of a Windows C: partition.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> http://support.kaspersky.com/8092

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> "Iso image of Kaspersky Rescue Disk 10 (237 MB)"

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> It's not actually 237MB. The size varies as they add new AV definitions

    >
    > >>

    >
    > >> to the image. It'll be bigger than 237MB. The image is probably

    >
    > >>

    >
    > >> updated once a week, so they probably don't show up-to-date

    >
    > >>

    >
    > >> size info.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> You can burn a CD with that ISO9660 file. Or, if you want, load

    >
    > >>

    >
    > >> the stuff onto a USB flash stick, using the installer tool on that

    >
    > >>

    >
    > >> web page.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> Once you boot from that, it expects a working LAN connection at

    >
    > >>

    >
    > >> startup. It can download updates to the AV files on demand.

    >
    > >>

    >
    > >> If you have already configured your modem/router such that

    >
    > >>

    >
    > >> the Internet is working, that's all the CD needs to do its

    >
    > >>

    >
    > >> downloads. The disc doesn't know how to operate a dialup modem

    >
    > >>

    >
    > >> (using PPP), and that was a decision by the disc designer to

    >
    > >>

    >
    > >> not include it.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> The Windows disk letters are not properly reflected in the

    >
    > >>

    >
    > >> scan menu. On my machine, the Kaspersky "E:" is actually my C:

    >
    > >>

    >
    > >> drive. So I know from experience I should click E:. I keep

    >
    > >>

    >
    > >> an empty file on my WinXP partition - the file name helps

    >
    > >>

    >
    > >> me identify I have the right drive letter in other environments

    >
    > >>

    >
    > >> (when the label isn't visible).

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> Another complication, is the disc will prompt you with questions

    >
    > >>

    >
    > >> such as whether you're running Windows 8 or not. I generally

    >
    > >>

    >
    > >> just have my WinXP disk connected at the time, and leave anything

    >
    > >>

    >
    > >> that might confuse the scanner disconnected.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> Anyway, give that much a try first. And then things like

    >
    > >>

    >
    > >> repair installs would be the next topic of discussion.

    >
    > >>

    >
    > >> A repair install saves programs and settings. But it

    >
    > >>

    >
    > >> does tend to screw up one or two settings (doesn't remember

    >
    > >>

    >
    > >> your old choices), so the process is only 99.5% accurate.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> If this is a Dell or HP, as the machines get more modern,

    >
    > >>

    >
    > >> the recovery options are more varied. Some modern machines

    >
    > >>

    >
    > >> can do the equivalent of a repair install from an image

    >
    > >>

    >
    > >> hidden on a partition, instead of the old fashioned "nuke and pave"

    >
    > >>

    >
    > >> option. At one time, computers only had a "purely destructive"

    >
    > >>

    >
    > >> option, and you were supposed to backup your data before using

    >
    > >>

    >
    > >> that. More modern machines now have several options, and nuking

    >
    > >>

    >
    > >> is now the last option rather than the first. Read the manual

    >
    > >>

    >
    > >> to see what these options are.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> Since I have retail OSes here, I just use the "real" Windows

    >
    > >>

    >
    > >> CD to repair install. On an OEM machine, you were supposed to

    >
    > >>

    >
    > >> make recovery media when the machine was new, and that can be

    >
    > >>

    >
    > >> used to start over again. The COA sticker on the machine,

    >
    > >>

    >
    > >> contains a key that can be used with a real Windows install

    >
    > >>

    >
    > >> CD, but the version of Windows CD may have to match the key.

    >
    > >>

    >
    > >> Perhaps a System builder version would work for example,

    >
    > >>

    >
    > >> as an "OEM" version.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> *******

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> And doing a backup is not a bad idea, if you're concerned that

    >
    > >>

    >
    > >> one of your repair steps will make things worse. If you know how

    >
    > >>

    >
    > >> to do this from Linux, then that sounds like a good plan.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> *******

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> I suspect your mistake long ago, was the difference between

    >
    > >>

    >
    > >> "CHKDSK" and "disk scan". Using HDTune (free) or similar, it's

    >
    > >>

    >
    > >> possible to just scan a disk for bad blocks. This is a means

    >
    > >>

    >
    > >> to determine disk health. If you saw bad blocks, your next

    >
    > >>

    >
    > >> step would *not* be to run a CHKDSK with repair option.

    >
    > >>

    >
    > >> Especially if the disk happened to freeze while the disk

    >
    > >>

    >
    > >> read scan was running. Because then you know CHKDSK is

    >
    > >>

    >
    > >> doomed to screw up. CHKDSK can multiply problems, if it

    >
    > >>

    >
    > >> doesn't have good media to work with to make repairs. If

    >
    > >>

    >
    > >> it gets half way through repairing something, several times

    >
    > >>

    >
    > >> in a row, you could then be in serious trouble. As now you

    >
    > >>

    >
    > >> have "error multiplication". So in a sense, keep in mind

    >
    > >>

    >
    > >> that CHKDSK is potentially destructive, and you won't be

    >
    > >>

    >
    > >> far from the troth.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> But at this point, I'm not convinced your problem is solely

    >
    > >>

    >
    > >> hard drive related. I think something else is going on,

    >
    > >>

    >
    > >> which is why I'm recommending an offline AV scan first.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> *******

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> When CHKDSK runs, it moves orphan files to a folder

    >
    > >>

    >
    > >> under the root of C:. If you find a folder there with

    >
    > >>

    >
    > >> (unnamed) recovered files in it, and the number of

    >
    > >>

    >
    > >> files is large, that may give you some idea how much

    >
    > >>

    >
    > >> of a mess CHKDSK has made.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> Paul

    >
    > >

    >
    > > Thanks Paul!! Always a pleasure to talk to you!

    >
    > >

    >
    > >

    >
    > > Regarding as to whether it is malware, I tend to doubt that as I have not

    >
    > > had too many problems with that of late and have AVG anti-virus etc...

    >
    > > It could still be malware but the way the problem started we me getting a

    >
    > > "hard drive failure" message at start-up. However that was being caused by

    >
    > > a lose SATA? cable, the connector was slightly broken so it had a tendency

    >
    > > to work lose. Now I would expect that to cause some problems on the drive,

    >
    > > I mean I can imagine if it is getting a poor signal all hell could break lose.

    >
    > > I used to plug it back in securely and all would be well, however obviously

    >
    > > running with a dodgy drive connection is going to end in tears eventually and it did!!

    >
    > >

    >
    > > So I am assuming it is not malware for the moment but not ruling it out.

    >
    > >

    >
    > > So I think the problem were mainly caused by the chkdsk and then further

    >
    > > compounded by trying to run a restore because I have always had problem with that.

    >
    > >

    >
    > > I think the reason the restore made it worse is that it might have got the

    >
    > > partitions mixed up and is looking on the wrong partition, but I am not sure,

    >
    > > maybe it is just corrupt or some other problem.

    >
    > > Thing is if I select the recovery console it does something before failing, and I think that means it found something in /cmdcons which is on the same partition. But I do not really understand boot.ini.

    >
    > >

    >
    > > Anyhow I think the Kaspersky Rescue Disk 10, looks like a good option at this

    >
    > > stage so I will have a look at that.

    >
    > > The broken machine is connected to the net via linux via my network hub so I guess that should be OK. It's a cable modem/hub, I have both my machines connect

    >
    > > to the net via it, first time I ever did that was surprised I had no problems!

    >
    > >

    >
    > > My machine has always had a recovery partition on it as it came with no

    >
    > > system disc, the OS was pre-installed, but the recovery no longer works!!

    >
    > >

    >
    > > I have backed up all the data now and I might be able to get hold of an

    >
    > > XP disc which is unregistered, so I might be able to re-instal XP however

    >
    > > I would like to try other things first, might be easier in the long run.

    >
    > >

    >
    > > And yes I seem to have backed up everything from LINUX.

    >
    > >

    >
    > > I also thought I had a full backup, but I just looked at it and there is

    >
    > > some stuff missing, which is bad news. However I have the too older drives

    >
    > > but neither of them seem to work now, one is dodgy, sometimes it find files

    >
    > > other time they have disappeared!!

    >
    > >

    >
    > > It is not a huge loss if I can't restore the machine as I can connect to the

    >
    > > net via linux with it, and that is the main thing I want it for, ie to

    >
    > > have and internet connection if this, my new machine, fails to work.

    >
    > >

    >
    > > This is my new machine by the way:-

    >
    > >

    >
    > > http://www.pcworld.co.uk/gbuk/deskt...us-cm6730-uk021s-desktop-pc-21439451-pdt.html

    >
    > >

    >
    > > I bought it in a hurry as I could only connect via linux at the time, and the

    >
    > > linux was not working too well, but it is miles better now, pretty good

    >
    > > actually, I am impressed with it, I didn't think it would work with my USB drive but it does and it seems to work better than windows with it.

    >
    > >

    >
    > > I did want something more powerful but I had limited options in the store

    >
    > > so it seemed the best by, I like it is is a low power CPU 35 watts, which means

    >
    > > it is very quite, not heard the fan yet, also it is 4 time faster than the old machine, so more than I need in that respect!!

    >
    > >

    >
    > > Worst thing about it's windows 8!! Not too keen on that!!

    >
    > > I also have some learning to do on that, I guess I should be making a recovery

    >
    > > DVD or two for that ASAP.

    >
    > >

    >
    > > Anyway thanks for your help I have a lot of things to look into so I will report

    >
    > > back later.

    >
    > >

    >
    > > Thanks once again!!

    >
    >
    >
    > Someone got your error number here.
    >
    >
    >
    > http://www.bleepingcomputer.com/for...-center-showing-automatic-updates-turned-off/
    >
    >
    >
    > And they had some evidence of TDSS being present.
    >
    >
    >
    > The article here mentions hijacking of msgina.dll as
    >
    > a possible cause.
    >
    >
    >
    > http://support.microsoft.com/default.aspx?scid=kb;en-us;156669
    >
    >
    >
    > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    >
    > value = msgina.dll
    >
    >
    >
    > Something could be loaded in its place.
    >
    >
    >
    > But if you can't keep a machine running like that,
    >
    > it's not going to be easy to solve.
    >
    >
    >
    > If it was "just a CHKDSK problem", it would randomly affect
    >
    > files. Your damage seems to be to "interesting" files, which
    >
    > is why I am suspicious.
    >
    >
    >
    > Paul


    Well there are a number of things here, that is one of the error I have got,
    I'm not 100% sure where and when I got it, there are at least 2 thing which
    fail, ie normal boot and an attempt at a restore or similar, plus I have
    2 drives, the drive which has been in use for some time until this recent incident and another drive which was in the machine as backup but never used,
    indeed it was not even connected until recently.
    I thought it might work when I connected it, as is was fine when I disconnected it, however the drive didn't sound to healthy sounded a bit 'rusty' and slow.
    However that did boot up further than the drive that was in, it got to the windows logo and then crashed, so it got past hal.dll to winlogin or near there.


    But Linux tell me that drive is in a bad way, I could not back it up. it gave an error about the system volume info.

    But it did see to boot further, might have changed now though. However with
    Linux not liking the drive I don't have much hope for it, however I do have some drive test software somewhere.

    I think there are two problems, I think trying the HP recovery option produced the hal.dll error, before I did that it did not occur.
    There might be a problem with the recovery because the drive was cloned, it might have made the partition the other way around. However system restore? Is on the same partition and that at least starts.

    So it's rather confusing. Going to require more investigation I think.

    If/when I finish backing up the 250 meg drive I will try booting form that
    it might work! It can't be any worse than what I have anyway!!!

    I am kind of spoil for choice of things to try.

    But the other drive, the one which wqasa in when it failed, that now does not get that far, it fails at hal.dll.

    Hal.dll is on the drive and the same size as one on a backup so I doubt it is corrupt, I could actually compare them byte for byte but I am pretty sure the file itself is fine, either the OS can't find it or the error is elsewhere.

    The error message itself is not good "missing or corrupt", really it should report if it is missing first. Then it could say it was corrupt.
    So it' not very helpful really.
     
    , Sep 27, 2013
    #7
  8. Guest

    On Friday, September 27, 2013 5:57:11 AM UTC-8, Paul wrote:
    > wrote:
    >
    > > Well just a kind of update, well more of refreshing my memory really asI

    >
    > > am trying to get clear what I did in the past.

    >
    > > On the old machine I actually use 3 drives:-

    >
    > >

    >
    > > The original 80gig

    >
    > > Then a 250 gig drive which I cloned from the 80gig drive and used as master.

    >
    > > Then a 500 gig drive which was cloned form either the 80gig or 250 gig drive.

    >
    > >

    >
    > > The 250gig drive seemed to develop problems, yes I remember now, I booted up and found I could not login and then found a load of file missing. I then restored them, and used my 500gig drive I removed from a USB drive as the master.

    >
    > >

    >
    > > I am not sure if I cloned from the 60gig or the 250 gig, however I did get

    >
    > > up and running.

    >
    > >

    >
    > > I put the 250 drive in the enclose and have not used it much but I am looking at it now, there is a chance it, might be boot-able, but I doubt it.

    >
    > >

    >
    > > However no harm in giving it a go!

    >
    > >

    >
    > > I was planning on getting all 3 drives onto my huge 3 gig USB drive, however when I tried to copy the 80drive from Linux it would not do it. It said

    >
    > > something like "can't access system volume info".

    >
    > >

    >
    > > Now I had to look that ( sys vol info) up as I was not sure what it was,

    >
    > > apparently it is where windows gets it's restores from or something like that.

    >
    > >

    >
    > > HP machines have a recovery partition too, which makes things rather confusing for me, I think it is the equivalent of Windows XP installation disc or a copy of the original factory set-up of XP.

    >
    > >

    >
    > > When I boot up I have the option of pressing F10 for recovery, however by the time I have decided what to do it has booted to windows start-up options,

    >
    > > and I see the system restore thing and try that and it usually works, so I have

    >
    > > rarely used the recovery, I have a vague memory of, when I used it, it seemed to crash half way through and reboot, however the reboot was usuallya successful one, which was a relief but it always left me with the feeling I was really lucky it booted up so I have stayed well clear of using the recovery option.

    >
    > >

    >
    > > Well I had stayed well clear of using it until very recently, I did tryit and I am fairly confident that that was when I began getting the missing hal.dll

    >
    > > error and the other STOPPED error.

    >
    > >

    >
    > >

    >
    > > Anyhow just to make more thing more complex as I was copying from the 250gig drive to this machine the anti-virus McAfee picked up a couple of dodgy files.

    >
    > >

    >
    > > One of them is detailed here, a Hewett Packard file.

    >
    > >

    >
    > > http://www.help2go.com/forum/computer-help/96146-c-hp-bin-killwind-exe.html

    >
    > >

    >
    > > Sounds really dodgy

    >
    > >

    >
    > >

    >
    > > ""I was assisting someone with a problem with her computer and came across these files. I contacted HP and was told that the killwind, terminator,cloaker, spawn and fondlewindow executables are part of the Backweb program that HP installs on all Pavilion PC's. Backweb enables HP to connect directly to a PC while it is online (simply connected to an ISP - doesn't matter if the browser is open or not) so that it can "push" content and program updates. "

    >
    > >

    >
    > > I mean it basically sounds like hp have a secret backdoor into your PC!!!

    >
    > >

    >
    > > It also found something in one of my Poker folders, which is kind of worrying,

    >
    > > I remember winning for on that site and then one day I just could not win again!!

    >
    > >

    >
    > > I would add those files were on the drive which I was not using, because it went faulty.... interesting, but it;s a slightly different thing in a way

    >
    > > I think/hope it's unrelated to the current issues, more stuff to investigate!!!

    >
    > > The names of the files sounds seriously hackerish!!!

    >
    > >

    >
    > > Also found this video describing boot-up process, might be useful for me.

    >
    > >

    >
    > > http://www.youtube.com/watch?v=WoNFNSM1gYI

    >
    > >

    >
    > >

    >
    > > There maybe some other useful videos on you tube I can look at.

    >
    > >

    >
    > > I can't really do much else at the moment as I am backing up stuff with

    >
    > > both my machines.

    >
    > >

    >
    > >

    >
    > > Anyhow I will report back here later, it's nice to keep some kind of log

    >
    > > here of what I am doing as my memory is not very reliable these days!

    >
    > >

    >
    > >

    >
    >
    >
    > Linux does not care about permissions (on foreign partition).
    >
    > This may change some day, so this is not a given. It happens
    >
    > to be true at the moment.
    >
    >
    >
    > So when it comes to capturing files, it should be
    >
    > able to access just about any folder.
    >
    >
    >
    > And as it turns out, this isn't always a good thing.
    >
    >
    >
    > I've managed to break my copy of Windows 7, while poking around in SVI from Linux.
    >
    > I've not had a problem with WinXP. I use Robocopy for copying all the files
    >
    > off my FAT32 WinXP partition, and that works OK. Robocopy doesn't copy
    >
    > everything, and needs running of "fixboot" on a freshly prepared restoration
    >
    > to make things work. It just copies files and is not concerned with
    >
    > whether a partition is bootable or not. (Fixboot puts back the
    >
    > partition boot sector, which sits near the beginning of the partition,
    >
    > just before the file system storage area.)
    >
    >
    >
    > If you're doing backups from Linux, you want some assurance it can put
    >
    > things back the way they were originally.
    >
    >
    >
    > If you're getting Access Denied on SVI, then I'd want to understand
    >
    > what environment (and program) this happened in. It would be
    >
    > more likely with a Windows OS running than with Linux.
    >
    >
    >
    > Paul


    Yes Linux just doesn't care what it copies, but that is fine for me,
    I have been copying stuff onto this windows 8 comp and it has been complaining about permissions, I would have been better off using Linux!!

    Indeed I can do it again with Linux assuming I can connect 2 USB drive, notreason why I should not be able to, apart from the fact it takes forever!


    Anyhow I just found a video on HP recovery

    http://www.bleepingcomputer.com/for...-center-showing-automatic-updates-turned-off/

    However mine never worked, I think it rebooted at 2.06 in the video, I havenever seen the "start hardware diagnostics" so that has not worked since the day
    I got the machine, no surprise it does not work now!!
    Especially so as HP seem to have a secret back door into everyone's machine..

    http://answers.yahoo.com/question/index?qid=20090922140139AAbWwiJ


    The sys vol info drive is a bad drive according to Linux, I could not copy it using Linux so not surprise, it will not boot however it gets surprisingly far!!!


    I may perhaps need something like fixboot or similar I wil have a look intoit.
     
    , Sep 27, 2013
    #8
  9. Guest

    ~Would not believe how hard it is to gain access to your own files in W8,
    in the end I got a utility to do it, hope it does not contain a virus!!!
     
    , Sep 27, 2013
    #9
  10. Guest

    Well!!!!!!!! Have I got news for you!!!

    But one weird thing of many weird things first, I was backing up the
    500gig drive via Linux, however wehn it got right to the end it game some
    error about something (which I could not see properly cos the screen went
    weird) it said something file is too big do you want to split it?

    I didn't respond just ignored it and it seemed to finish.

    Then I noticed the HP filesystem (the 500gb drive) had disappear off the desktop!!!??

    Not sure what that was all about. BUT.................


    HERE'S THE BIG NEWS!!!!!!!!

    I BOOTED UP ON THE 250GIG DRIVE!!!!!!!!!! (WHICH HAD BEEN IN THE ENCLOSURE
    BUT IS NOW CONNECTED).


    Bit weird though as it put me in a temporary desktop for some reason but my
    old desktop is there.

    Another thing I noticed is there is a file in start up in msconfig called
    c:\hp\bin\cloaker.exe

    Which is one of those dubious files, it didn't used to run at start up,
    not sure if I should disable it as at least the thing booted!
     
    , Sep 27, 2013
    #10
  11. Guest

    Well good news and bad news sort of, I see to be able to boot fine on the old 250
    meg drive, although I see a temporary desktop not the right one for HP_owner.

    Also there seem to be a problem with the 500gig drive, there is nothing on it.
    I think Linux must have screwed it or I managed to with the aid of Linux somehow.
    Either way it does not look good.

    However I had just backed it up but I do not see how I can get data back on it.

    I think if just comes up as size 0 data used 0, if it come up at all is this here?

    Also I do not think the 250 meg drive saves anything written to it.
    SO not good.

    I just connected the 500gig drive to the old hp machine alone, I could not
    get into the setup like that, or at least I didn't wait long enough press
    the key soon enough.
    I just managed to get into the boot menu and it ony showed the floppy

    I now managed to get into the set-up and it does show the drive,
    [wdc wd500aavs-]


    However i have just booted into Linux with it connected and it is back!!!

    I don't know it is a really confusing mess here!!

    Then I tried reconnecting the 250gig drive and it would not boot,
    disconnected, let it power right down and now it is booting.

    I am wondering why it does not seem to save data on the desktop?

    I am gonna try writing something to the root folder as a test,
    but I kind of think I am wasting time, so I will try that when I am
    feeling more optimistic, it seem to have stopped responding anyway!
     
    , Sep 28, 2013
    #11
  12. Paul Guest

    wrote:

    >
    > I am gonna try writing something to the root folder as a test,
    > but I kind of think I am wasting time, so I will try that when I am
    > feeling more optimistic, it seem to have stopped responding anyway!
    >


    I'm still waiting for a symptom to come along, that we can
    build on. (Like a failure pattern that I recognize :) )

    Linux and Windows need some of the same things, to be able to
    mount a partition. For NTFS, one of the differences is, that
    Linux doesn't know how to treat the Journal file, and that
    file is how Windows repairs stuff damaged in the last session.
    So that would be one aspect of NTFS, that differs between
    Linux and Windows. Using Linux can invalidate the journal,
    which normally isn't all that big a deal.

    Paul
     
    Paul, Sep 28, 2013
    #12
  13. Guest

    On Friday, September 27, 2013 6:00:16 PM UTC-8, Paul wrote:
    > wrote:
    >
    >
    >
    > >

    >
    > > I am gonna try writing something to the root folder as a test,

    >
    > > but I kind of think I am wasting time, so I will try that when I am

    >
    > > feeling more optimistic, it seem to have stopped responding anyway!

    >
    > >

    >
    >
    >
    > I'm still waiting for a symptom to come along, that we can
    >
    > build on. (Like a failure pattern that I recognize :) )
    >
    >
    >
    > Linux and Windows need some of the same things, to be able to
    >
    > mount a partition. For NTFS, one of the differences is, that
    >
    > Linux doesn't know how to treat the Journal file, and that
    >
    > file is how Windows repairs stuff damaged in the last session.
    >
    > So that would be one aspect of NTFS, that differs between
    >
    > Linux and Windows. Using Linux can invalidate the journal,
    >
    > which normally isn't all that big a deal.
    >
    >
    >
    > Paul


    Yes unfortunately it has all been rather confusing and inconsistent.
    I have managed to view the 500gb drive from Linux when it was connect
    directly by SATA, but I have not been able to USB it in the USB enclosure it originally came in, either on a machine running linux or windows.
    Maybe there is problem with the enclosure but that seems unlikely as it just
    kind of slots in.

    But maybe windows did repair the journal file when I tried to boot from the 500gb drive, I think the sata connectors on the drive may be a bit dodgy.
    I need to do some more tests really.
     
    , Sep 28, 2013
    #13
  14. Guest

    On Saturday, September 28, 2013 7:48:34 AM UTC-8, wrote:
    > On Friday, September 27, 2013 6:00:16 PM UTC-8, Paul wrote:
    >
    > > wrote:

    >
    > >

    >
    > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > I am gonna try writing something to the root folder as a test,

    >
    > >

    >
    > > > but I kind of think I am wasting time, so I will try that when I am

    >
    > >

    >
    > > > feeling more optimistic, it seem to have stopped responding anyway!

    >
    > >

    >
    > > >

    >
    > >

    >
    > >

    >
    > >

    >
    > > I'm still waiting for a symptom to come along, that we can

    >
    > >

    >
    > > build on. (Like a failure pattern that I recognize :) )

    >
    > >

    >
    > >

    >
    > >

    >
    > > Linux and Windows need some of the same things, to be able to

    >
    > >

    >
    > > mount a partition. For NTFS, one of the differences is, that

    >
    > >

    >
    > > Linux doesn't know how to treat the Journal file, and that

    >
    > >

    >
    > > file is how Windows repairs stuff damaged in the last session.

    >
    > >

    >
    > > So that would be one aspect of NTFS, that differs between

    >
    > >

    >
    > > Linux and Windows. Using Linux can invalidate the journal,

    >
    > >

    >
    > > which normally isn't all that big a deal.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Paul

    >
    >
    >
    > Yes unfortunately it has all been rather confusing and inconsistent.
    >
    > I have managed to view the 500gb drive from Linux when it was connect
    >
    > directly by SATA, but I have not been able to USB it in the USB enclosure it originally came in, either on a machine running linux or windows.
    >
    > Maybe there is problem with the enclosure but that seems unlikely as it just
    >
    > kind of slots in.
    >
    >
    >
    > But maybe windows did repair the journal file when I tried to boot from the 500gb drive, I think the sata connectors on the drive may be a bit dodgy.
    >
    > I need to do some more tests really.


    Right I have managed to view the 500GB when directly connected to Linux
    I could not see it connected in the external USB enclosure thought,

    However I have had it connected in the enclosure on my new machine earlier
    but then next time I tried I could not see it.

    Maybe a problem with the enclosure, I don't know.

    To sum up I can see the 500GB drive and all the windows data (about 300 GB)
    when directly connected to the old PC running Linux.

    However if I put the drive in the USB enclosure and connect it to the other
    machine, sometimes it is detected and I see a mainly empty drive, apart from
    some Linux files, ie wubuildr, wubildr.mbr and an empty folder. However recently
    it has not been detected at all, but it was definitely detected earlier today
    as that's when I saw the Linux files. However since then, when I powered down
    with the USB connected, I can't seem to detect it on either machine in the enclosure.


    It seems to me that Linux has done something to the drive, ie converted it to
    a Linux file system (against my wishes). I have a recent backup of the drives data though so no problems on the score. That would explain why none of the windows files appear under windows.

    So I seem to be going backwards at the moment, creating more problem than I solve!
     
    , Sep 28, 2013
    #14
  15. Paul Guest

    wrote:
    > On Saturday, September 28, 2013 7:48:34 AM UTC-8, wrote:
    >> On Friday, September 27, 2013 6:00:16 PM UTC-8, Paul wrote:
    >>
    >>> wrote:
    >>>> I am gonna try writing something to the root folder as a test,
    >>>> but I kind of think I am wasting time, so I will try that when I am
    >>>> feeling more optimistic, it seem to have stopped responding anyway!
    >>> I'm still waiting for a symptom to come along, that we can
    >>> build on. (Like a failure pattern that I recognize :) )
    >>> Linux and Windows need some of the same things, to be able to
    >>> mount a partition. For NTFS, one of the differences is, that
    >>> Linux doesn't know how to treat the Journal file, and that
    >>> file is how Windows repairs stuff damaged in the last session.
    >>> So that would be one aspect of NTFS, that differs between
    >>> Linux and Windows. Using Linux can invalidate the journal,
    >>> which normally isn't all that big a deal.
    >>> Paul

    >>
    >>
    >> Yes unfortunately it has all been rather confusing and inconsistent.
    >>
    >> I have managed to view the 500gb drive from Linux when it was connect
    >>
    >> directly by SATA, but I have not been able to USB it in the USB enclosure it originally came in, either on a machine running linux or windows.
    >>
    >> Maybe there is problem with the enclosure but that seems unlikely as it just
    >>
    >> kind of slots in.
    >>
    >>
    >>
    >> But maybe windows did repair the journal file when I tried to boot from
    >> the 500gb drive, I think the sata connectors on the drive may be a bit dodgy.
    >>
    >> I need to do some more tests really.

    >
    > Right I have managed to view the 500GB when directly connected to Linux
    > I could not see it connected in the external USB enclosure thought,
    >
    > However I have had it connected in the enclosure on my new machine earlier
    > but then next time I tried I could not see it.
    >
    > Maybe a problem with the enclosure, I don't know.
    >
    > To sum up I can see the 500GB drive and all the windows data (about 300 GB)
    > when directly connected to the old PC running Linux.
    >
    > However if I put the drive in the USB enclosure and connect it to the other
    > machine, sometimes it is detected and I see a mainly empty drive, apart from
    > some Linux files, ie wubuildr, wubildr.mbr and an empty folder. However recently
    > it has not been detected at all, but it was definitely detected earlier today
    > as that's when I saw the Linux files. However since then, when I powered down
    > with the USB connected, I can't seem to detect it on either machine in the enclosure.
    >
    >
    > It seems to me that Linux has done something to the drive, ie converted it to
    > a Linux file system (against my wishes). I have a recent backup of the drives
    > data though so no problems on the score. That would explain why none of the
    > windows files appear under windows.
    >
    > So I seem to be going backwards at the moment, creating more problem than I solve!


    I don't interpret the symptoms that way.

    You've apparently installed Linux using WUBI. I've never tried that, for
    what it's worth. It installs Linux as a single file, contained within
    a Windows partition. And apparently messes around with boot.ini
    and interferes with normal operations.

    It's possible, the Windows partition will not be visible, as long as
    that Linux file is being used by WUBI.

    As an example, I'm not using WUBI. I have Linux on a USB stick. The
    USB stick has a single FAT32 partition on it. There is a single file
    within that partition, 4GB in size, and that is what Linux uses
    for the home directory. While Linux is running there, I cannot
    see the contents of the FAT32 partition. The 4GB file is loopback
    mounted on / (slash). Changes in Linux are stored there. Now if I boot
    back into Windows, I can see the entire contents of the FAT32 partition
    (a bunch of Linux related files as well as the 4GB file). I can actually
    store additional files if I want there (when using the USB stick for
    general purpose transfer, that's exactly what I'm doing). But when it
    runs as a Linux OS, the partition is no longer visible in Linux,
    the 4GB file can't be seen, but the 4GB file is loopback mounted.

    So such a behavior isn't a complete surprise.

    Hmmm. There's a WUBI tutorial here. It still doesn't
    explain how it works, but it does mention the possibility of
    seeing a "hal.dll is missing" type error.

    https://wiki.ubuntu.com/WubiGuide

    I have a suspicion much of what you've seen, is a side effect of
    WUBI. You never know.

    Paul
     
    Paul, Sep 29, 2013
    #15
  16. Guest

    On Saturday, September 28, 2013 1:36:47 PM UTC-8, wrote:
    > On Saturday, September 28, 2013 7:48:34 AM UTC-8, wrote:
    >
    > > On Friday, September 27, 2013 6:00:16 PM UTC-8, Paul wrote:

    >
    > >

    >
    > > > wrote:

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > I am gonna try writing something to the root folder as a test,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > but I kind of think I am wasting time, so I will try that when I am

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > > feeling more optimistic, it seem to have stopped responding anyway!

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > I'm still waiting for a symptom to come along, that we can

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > build on. (Like a failure pattern that I recognize :) )

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Linux and Windows need some of the same things, to be able to

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > mount a partition. For NTFS, one of the differences is, that

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Linux doesn't know how to treat the Journal file, and that

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > file is how Windows repairs stuff damaged in the last session.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > So that would be one aspect of NTFS, that differs between

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Linux and Windows. Using Linux can invalidate the journal,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > which normally isn't all that big a deal.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Paul

    >
    > >

    >
    > >

    >
    > >

    >
    > > Yes unfortunately it has all been rather confusing and inconsistent.

    >
    > >

    >
    > > I have managed to view the 500gb drive from Linux when it was connect

    >
    > >

    >
    > > directly by SATA, but I have not been able to USB it in the USB enclosure it originally came in, either on a machine running linux or windows.

    >
    > >

    >
    > > Maybe there is problem with the enclosure but that seems unlikely as it just

    >
    > >

    >
    > > kind of slots in.

    >
    > >

    >
    > >

    >
    > >

    >
    > > But maybe windows did repair the journal file when I tried to boot from the 500gb drive, I think the sata connectors on the drive may be a bit dodgy.

    >
    > >

    >
    > > I need to do some more tests really.

    >
    >
    >
    > Right I have managed to view the 500GB when directly connected to Linux
    >
    > I could not see it connected in the external USB enclosure thought,
    >
    >
    >
    > However I have had it connected in the enclosure on my new machine earlier
    >
    > but then next time I tried I could not see it.
    >
    >
    >
    > Maybe a problem with the enclosure, I don't know.
    >
    >
    >
    > To sum up I can see the 500GB drive and all the windows data (about 300 GB)
    >
    > when directly connected to the old PC running Linux.
    >
    >
    >
    > However if I put the drive in the USB enclosure and connect it to the other
    >
    > machine, sometimes it is detected and I see a mainly empty drive, apart from
    >
    > some Linux files, ie wubuildr, wubildr.mbr and an empty folder. However recently
    >
    > it has not been detected at all, but it was definitely detected earlier today
    >
    > as that's when I saw the Linux files. However since then, when I powered down
    >
    > with the USB connected, I can't seem to detect it on either machine in the enclosure.
    >
    >
    >
    >
    >
    > It seems to me that Linux has done something to the drive, ie converted it to
    >
    > a Linux file system (against my wishes). I have a recent backup of the drives data though so no problems on the score. That would explain why none of the windows files appear under windows.
    >
    >
    >
    > So I seem to be going backwards at the moment, creating more problem than I solve!



    OK I found some DVD I had what it did was show me
    what was on the drive, I could see two partitions, C: and D:
    One containing windows and one is the hp recovery partition I think,
    but basically the disc as I knew it.
    Linux does not show the recovery partition, so at least I know it is there.
     
    , Sep 29, 2013
    #16
  17. Paul Guest

    wrote:

    >
    >
    > OK I found some DVD I had what it did was show me
    > what was on the drive, I could see two partitions, C: and D:
    > One containing windows and one is the hp recovery partition I think,
    > but basically the disc as I knew it.
    > Linux does not show the recovery partition, so at least I know it is there.


    OK, you should be running Linux right off a Linux DVD.

    No more WUBI.

    If you run Linux by booting a Linux LiveCD or LiveDVD, or
    you boot using Linux installed on a USB key, then you will
    *stop* seeing side-effects of WUBI operation. Linux will
    see all the partitions on the hard drive - this assumes
    you use Linux utilities that work at a fairly low
    level.

    For example, if you use the Linux "fdisk", it can list the
    primary partitions. Even the HP recovery partition will
    be represented in there and assigned a partition type.

    sudo fdisk /dev/sda

    That's a basic fdisk command, to allow p)rinting the partitions
    and q)uitting. You don't need to make any changes in there,
    but if you need to list the partition table, that's where
    you do it.

    If you use gparted in Linux, that shows information in the
    same way that Windows Disk Management would, but it may not
    list every possible thing. As it still uses a Linux-centric
    approach. It might not recognize an HFS+ or FreeBSD partition,
    or many of the recovery partition types used by Dell or HP etc.

    Paul
     
    Paul, Sep 29, 2013
    #17
  18. Guest

    On Saturday, September 28, 2013 4:44:49 PM UTC-8, Paul wrote:
    > wrote:
    >
    > > On Saturday, September 28, 2013 7:48:34 AM UTC-8, wrote:

    >
    > >> On Friday, September 27, 2013 6:00:16 PM UTC-8, Paul wrote:

    >
    > >>

    >
    > >>> wrote:

    >
    > >>>> I am gonna try writing something to the root folder as a test,

    >
    > >>>> but I kind of think I am wasting time, so I will try that when I am

    >
    > >>>> feeling more optimistic, it seem to have stopped responding anyway!

    >
    > >>> I'm still waiting for a symptom to come along, that we can

    >
    > >>> build on. (Like a failure pattern that I recognize :) )

    >
    > >>> Linux and Windows need some of the same things, to be able to

    >
    > >>> mount a partition. For NTFS, one of the differences is, that

    >
    > >>> Linux doesn't know how to treat the Journal file, and that

    >
    > >>> file is how Windows repairs stuff damaged in the last session.

    >
    > >>> So that would be one aspect of NTFS, that differs between

    >
    > >>> Linux and Windows. Using Linux can invalidate the journal,

    >
    > >>> which normally isn't all that big a deal.

    >
    > >>> Paul

    >
    > >>

    >
    > >>

    >
    > >> Yes unfortunately it has all been rather confusing and inconsistent.

    >
    > >>

    >
    > >> I have managed to view the 500gb drive from Linux when it was connect

    >
    > >>

    >
    > >> directly by SATA, but I have not been able to USB it in the USB enclosure it originally came in, either on a machine running linux or windows.

    >
    > >>

    >
    > >> Maybe there is problem with the enclosure but that seems unlikely as it just

    >
    > >>

    >
    > >> kind of slots in.

    >
    > >>

    >
    > >>

    >
    > >>

    >
    > >> But maybe windows did repair the journal file when I tried to boot from

    >
    > >> the 500gb drive, I think the sata connectors on the drive may be a bit dodgy.

    >
    > >>

    >
    > >> I need to do some more tests really.

    >
    > >

    >
    > > Right I have managed to view the 500GB when directly connected to Linux

    >
    > > I could not see it connected in the external USB enclosure thought,

    >
    > >

    >
    > > However I have had it connected in the enclosure on my new machine earlier

    >
    > > but then next time I tried I could not see it.

    >
    > >

    >
    > > Maybe a problem with the enclosure, I don't know.

    >
    > >

    >
    > > To sum up I can see the 500GB drive and all the windows data (about 300 GB)

    >
    > > when directly connected to the old PC running Linux.

    >
    > >

    >
    > > However if I put the drive in the USB enclosure and connect it to the other

    >
    > > machine, sometimes it is detected and I see a mainly empty drive, apart from

    >
    > > some Linux files, ie wubuildr, wubildr.mbr and an empty folder. However recently

    >
    > > it has not been detected at all, but it was definitely detected earlier today

    >
    > > as that's when I saw the Linux files. However since then, when I powered down

    >
    > > with the USB connected, I can't seem to detect it on either machine in the enclosure.

    >
    > >

    >
    > >

    >
    > > It seems to me that Linux has done something to the drive, ie converted it to

    >
    > > a Linux file system (against my wishes). I have a recent backup of the drives

    >
    > > data though so no problems on the score. That would explain why none of the

    >
    > > windows files appear under windows.

    >
    > >

    >
    > > So I seem to be going backwards at the moment, creating more problem than I solve!

    >
    >
    >
    > I don't interpret the symptoms that way.
    >
    >
    >
    > You've apparently installed Linux using WUBI. I've never tried that, for
    >
    > what it's worth. It installs Linux as a single file, contained within
    >
    > a Windows partition. And apparently messes around with boot.ini
    >
    > and interferes with normal operations.
    >
    >
    >
    > It's possible, the Windows partition will not be visible, as long as
    >
    > that Linux file is being used by WUBI.
    >
    >
    >
    > As an example, I'm not using WUBI. I have Linux on a USB stick. The
    >
    > USB stick has a single FAT32 partition on it. There is a single file
    >
    > within that partition, 4GB in size, and that is what Linux uses
    >
    > for the home directory. While Linux is running there, I cannot
    >
    > see the contents of the FAT32 partition. The 4GB file is loopback
    >
    > mounted on / (slash). Changes in Linux are stored there. Now if I boot
    >
    > back into Windows, I can see the entire contents of the FAT32 partition
    >
    > (a bunch of Linux related files as well as the 4GB file). I can actually
    >
    > store additional files if I want there (when using the USB stick for
    >
    > general purpose transfer, that's exactly what I'm doing). But when it
    >
    > runs as a Linux OS, the partition is no longer visible in Linux,
    >
    > the 4GB file can't be seen, but the 4GB file is loopback mounted.
    >
    >
    >
    > So such a behavior isn't a complete surprise.
    >
    >
    >
    > Hmmm. There's a WUBI tutorial here. It still doesn't
    >
    > explain how it works, but it does mention the possibility of
    >
    > seeing a "hal.dll is missing" type error.
    >
    >
    >
    > https://wiki.ubuntu.com/WubiGuide
    >
    >
    >
    > I have a suspicion much of what you've seen, is a side effect of
    >
    > WUBI. You never know.
    >
    >
    >
    > Paul


    As ever it's a bit confusing, I am not sure if I installed
    Linux or not, I am tending to think I didn't now, as under Linux all I see
    on the drive as windows c: and d:.
    I also see a file system on the desktop with typical Linux folder but I
    think that is just the Linux DVD, in fact I am sure it is as I wrote
    a file to the desktop, rebooted and the file was gone, as it must have just been in memory. I also wrote a file to the windows folder and that was still there, I then deleted it.

    So I am note sure why nothing showed up under windows, maybe Linux changed the disc in some way.

    There is an "Install Linux Mint" button on the desktop, I thought I might
    have accidentally hit that when the desktop got screwed up.

    I am also using a new Linux version, only 10 months old, it's a lot better, and I have a better mouse too, one which does not tend to accidentally click the wrong thing.

    I'm not very familiar with Linux unfortunately, would help if I was.

    However if I try and boot from the 500GB drive it does seem the same as before, ie it gives a hal.dll error if I try a straight boot.

    But then the other thing is the 500GB drive does not show up in the
    USB enclosure, well it showed up a couple of time but was shown as mainly empty.

    I am going to try it in the USB enclosuree again and I am also going to burn that Kasperof DVD, I should have done that before but I am not sure how to burn a DVD on this new machine, OK I am burning it now!!
     
    , Sep 29, 2013
    #18
  19. Guest

    On Saturday, September 28, 2013 5:45:37 PM UTC-8, wrote:
    > On Saturday, September 28, 2013 4:44:49 PM UTC-8, Paul wrote:
    >
    > > wrote:

    >
    > >

    >
    > > > On Saturday, September 28, 2013 7:48:34 AM UTC-8, wrote:

    >
    > >

    >
    > > >> On Friday, September 27, 2013 6:00:16 PM UTC-8, Paul wrote:

    >
    > >

    >
    > > >>

    >
    > >

    >
    > > >>> wrote:

    >
    > >

    >
    > > >>>> I am gonna try writing something to the root folder as a test,

    >
    > >

    >
    > > >>>> but I kind of think I am wasting time, so I will try that when I am

    >
    > >

    >
    > > >>>> feeling more optimistic, it seem to have stopped responding anyway!

    >
    > >

    >
    > > >>> I'm still waiting for a symptom to come along, that we can

    >
    > >

    >
    > > >>> build on. (Like a failure pattern that I recognize :) )

    >
    > >

    >
    > > >>> Linux and Windows need some of the same things, to be able to

    >
    > >

    >
    > > >>> mount a partition. For NTFS, one of the differences is, that

    >
    > >

    >
    > > >>> Linux doesn't know how to treat the Journal file, and that

    >
    > >

    >
    > > >>> file is how Windows repairs stuff damaged in the last session.

    >
    > >

    >
    > > >>> So that would be one aspect of NTFS, that differs between

    >
    > >

    >
    > > >>> Linux and Windows. Using Linux can invalidate the journal,

    >
    > >

    >
    > > >>> which normally isn't all that big a deal.

    >
    > >

    >
    > > >>> Paul

    >
    > >

    >
    > > >>

    >
    > >

    >
    > > >>

    >
    > >

    >
    > > >> Yes unfortunately it has all been rather confusing and inconsistent.

    >
    > >

    >
    > > >>

    >
    > >

    >
    > > >> I have managed to view the 500gb drive from Linux when it was connect

    >
    > >

    >
    > > >>

    >
    > >

    >
    > > >> directly by SATA, but I have not been able to USB it in the USB enclosure it originally came in, either on a machine running linux or windows.

    >
    > >

    >
    > > >>

    >
    > >

    >
    > > >> Maybe there is problem with the enclosure but that seems unlikely as it just

    >
    > >

    >
    > > >>

    >
    > >

    >
    > > >> kind of slots in.

    >
    > >

    >
    > > >>

    >
    > >

    >
    > > >>

    >
    > >

    >
    > > >>

    >
    > >

    >
    > > >> But maybe windows did repair the journal file when I tried to boot from

    >
    > >

    >
    > > >> the 500gb drive, I think the sata connectors on the drive may be a bit dodgy.

    >
    > >

    >
    > > >>

    >
    > >

    >
    > > >> I need to do some more tests really.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Right I have managed to view the 500GB when directly connected to Linux

    >
    > >

    >
    > > > I could not see it connected in the external USB enclosure thought,

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > However I have had it connected in the enclosure on my new machine earlier

    >
    > >

    >
    > > > but then next time I tried I could not see it.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > Maybe a problem with the enclosure, I don't know.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > To sum up I can see the 500GB drive and all the windows data (about 300 GB)

    >
    > >

    >
    > > > when directly connected to the old PC running Linux.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > However if I put the drive in the USB enclosure and connect it to the other

    >
    > >

    >
    > > > machine, sometimes it is detected and I see a mainly empty drive, apart from

    >
    > >

    >
    > > > some Linux files, ie wubuildr, wubildr.mbr and an empty folder. However recently

    >
    > >

    >
    > > > it has not been detected at all, but it was definitely detected earlier today

    >
    > >

    >
    > > > as that's when I saw the Linux files. However since then, when I powered down

    >
    > >

    >
    > > > with the USB connected, I can't seem to detect it on either machine in the enclosure.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > It seems to me that Linux has done something to the drive, ie converted it to

    >
    > >

    >
    > > > a Linux file system (against my wishes). I have a recent backup of the drives

    >
    > >

    >
    > > > data though so no problems on the score. That would explain why none of the

    >
    > >

    >
    > > > windows files appear under windows.

    >
    > >

    >
    > > >

    >
    > >

    >
    > > > So I seem to be going backwards at the moment, creating more problem than I solve!

    >
    > >

    >
    > >

    >
    > >

    >
    > > I don't interpret the symptoms that way.

    >
    > >

    >
    > >

    >
    > >

    >
    > > You've apparently installed Linux using WUBI. I've never tried that, for

    >
    > >

    >
    > > what it's worth. It installs Linux as a single file, contained within

    >
    > >

    >
    > > a Windows partition. And apparently messes around with boot.ini

    >
    > >

    >
    > > and interferes with normal operations.

    >
    > >

    >
    > >

    >
    > >

    >
    > > It's possible, the Windows partition will not be visible, as long as

    >
    > >

    >
    > > that Linux file is being used by WUBI.

    >
    > >

    >
    > >

    >
    > >

    >
    > > As an example, I'm not using WUBI. I have Linux on a USB stick. The

    >
    > >

    >
    > > USB stick has a single FAT32 partition on it. There is a single file

    >
    > >

    >
    > > within that partition, 4GB in size, and that is what Linux uses

    >
    > >

    >
    > > for the home directory. While Linux is running there, I cannot

    >
    > >

    >
    > > see the contents of the FAT32 partition. The 4GB file is loopback

    >
    > >

    >
    > > mounted on / (slash). Changes in Linux are stored there. Now if I boot

    >
    > >

    >
    > > back into Windows, I can see the entire contents of the FAT32 partition

    >
    > >

    >
    > > (a bunch of Linux related files as well as the 4GB file). I can actually

    >
    > >

    >
    > > store additional files if I want there (when using the USB stick for

    >
    > >

    >
    > > general purpose transfer, that's exactly what I'm doing). But when it

    >
    > >

    >
    > > runs as a Linux OS, the partition is no longer visible in Linux,

    >
    > >

    >
    > > the 4GB file can't be seen, but the 4GB file is loopback mounted.

    >
    > >

    >
    > >

    >
    > >

    >
    > > So such a behavior isn't a complete surprise.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Hmmm. There's a WUBI tutorial here. It still doesn't

    >
    > >

    >
    > > explain how it works, but it does mention the possibility of

    >
    > >

    >
    > > seeing a "hal.dll is missing" type error.

    >
    > >

    >
    > >

    >
    > >

    >
    > > https://wiki.ubuntu.com/WubiGuide

    >
    > >

    >
    > >

    >
    > >

    >
    > > I have a suspicion much of what you've seen, is a side effect of

    >
    > >

    >
    > > WUBI. You never know.

    >
    > >

    >
    > >

    >
    > >

    >
    > > Paul

    >
    >
    >
    > As ever it's a bit confusing, I am not sure if I installed
    >
    > Linux or not, I am tending to think I didn't now, as under Linux all I see
    >
    > on the drive as windows c: and d:.
    >
    > I also see a file system on the desktop with typical Linux folder but I
    >
    > think that is just the Linux DVD, in fact I am sure it is as I wrote
    >
    > a file to the desktop, rebooted and the file was gone, as it must have just been in memory. I also wrote a file to the windows folder and that was still there, I then deleted it.
    >
    >
    >
    > So I am note sure why nothing showed up under windows, maybe Linux changed the disc in some way.
    >
    >
    >
    > There is an "Install Linux Mint" button on the desktop, I thought I might
    >
    > have accidentally hit that when the desktop got screwed up.
    >
    >
    >
    > I am also using a new Linux version, only 10 months old, it's a lot better, and I have a better mouse too, one which does not tend to accidentally click the wrong thing.
    >
    >
    >
    > I'm not very familiar with Linux unfortunately, would help if I was.
    >
    >
    >
    > However if I try and boot from the 500GB drive it does seem the same as before, ie it gives a hal.dll error if I try a straight boot.
    >
    >
    >
    > But then the other thing is the 500GB drive does not show up in the
    >
    > USB enclosure, well it showed up a couple of time but was shown as mainly empty.
    >
    >
    >
    > I am going to try it in the USB enclosure again and I am also going to burn that Kaspersky DVD, I should have done that before but I am not sure how to burn a DVD on this new machine, OK I am burning it now!!


    OK running the Kaspersky scan, looks like ti will take forever scanning c: and d: but it found nothing on boot sector and hidden start-up objects.

    Yes I see it says it will take 16 hours so I might have to stop it if I want to try other things and start it later when I can let it run to completion.
    But even if it does find something I expect any damage has already been done so it will not cure it.
     
    , Sep 29, 2013
    #19
  20. Paul Guest

    wrote:
    > On Saturday, September 28, 2013 4:44:49 PM UTC-8, Paul wrote:
    >> wrote:
    >>
    >>> On Saturday, September 28, 2013 7:48:34 AM UTC-8, wrote:
    >>>> On Friday, September 27, 2013 6:00:16 PM UTC-8, Paul wrote:
    >>>>> wrote:
    >>>>>> I am gonna try writing something to the root folder as a test,
    >>>>>> but I kind of think I am wasting time, so I will try that when I am
    >>>>>> feeling more optimistic, it seem to have stopped responding anyway!
    >>>>> I'm still waiting for a symptom to come along, that we can
    >>>>> build on. (Like a failure pattern that I recognize :) )
    >>>>> Linux and Windows need some of the same things, to be able to
    >>>>> mount a partition. For NTFS, one of the differences is, that
    >>>>> Linux doesn't know how to treat the Journal file, and that
    >>>>> file is how Windows repairs stuff damaged in the last session.
    >>>>> So that would be one aspect of NTFS, that differs between
    >>>>> Linux and Windows. Using Linux can invalidate the journal,
    >>>>> which normally isn't all that big a deal.
    >>>>> Paul
    >>>> Yes unfortunately it has all been rather confusing and inconsistent.
    >>>> I have managed to view the 500gb drive from Linux when it was connect
    >>>> directly by SATA, but I have not been able to USB it in the USB enclosure it originally came in, either on a machine running linux or windows.
    >>>> Maybe there is problem with the enclosure but that seems unlikely as it just
    >>>> kind of slots in.
    >>>> But maybe windows did repair the journal file when I tried to boot from
    >>>> the 500gb drive, I think the sata connectors on the drive may be a bit dodgy.
    >>>> I need to do some more tests really.
    >>> Right I have managed to view the 500GB when directly connected to Linux
    >>> I could not see it connected in the external USB enclosure thought,
    >>> However I have had it connected in the enclosure on my new machine earlier
    >>> but then next time I tried I could not see it.
    >>> Maybe a problem with the enclosure, I don't know.
    >>> To sum up I can see the 500GB drive and all the windows data (about 300 GB)
    >>> when directly connected to the old PC running Linux.
    >>> However if I put the drive in the USB enclosure and connect it to the other
    >>> machine, sometimes it is detected and I see a mainly empty drive, apart from
    >>> some Linux files, ie wubuildr, wubildr.mbr and an empty folder. However recently
    >>> it has not been detected at all, but it was definitely detected earlier today
    >>> as that's when I saw the Linux files. However since then, when I powered down
    >>> with the USB connected, I can't seem to detect it on either machine in the enclosure.
    >>> It seems to me that Linux has done something to the drive, ie converted it to
    >>> a Linux file system (against my wishes). I have a recent backup of the drives
    >>> data though so no problems on the score. That would explain why none of the
    >>> windows files appear under windows.
    >>> So I seem to be going backwards at the moment, creating more problem than I solve!

    >>
    >>
    >> I don't interpret the symptoms that way.
    >>
    >>
    >>
    >> You've apparently installed Linux using WUBI. I've never tried that, for
    >>
    >> what it's worth. It installs Linux as a single file, contained within
    >>
    >> a Windows partition. And apparently messes around with boot.ini
    >>
    >> and interferes with normal operations.
    >>
    >>
    >>
    >> It's possible, the Windows partition will not be visible, as long as
    >>
    >> that Linux file is being used by WUBI.
    >>
    >>
    >>
    >> As an example, I'm not using WUBI. I have Linux on a USB stick. The
    >>
    >> USB stick has a single FAT32 partition on it. There is a single file
    >>
    >> within that partition, 4GB in size, and that is what Linux uses
    >>
    >> for the home directory. While Linux is running there, I cannot
    >>
    >> see the contents of the FAT32 partition. The 4GB file is loopback
    >>
    >> mounted on / (slash). Changes in Linux are stored there. Now if I boot
    >>
    >> back into Windows, I can see the entire contents of the FAT32 partition
    >>
    >> (a bunch of Linux related files as well as the 4GB file). I can actually
    >>
    >> store additional files if I want there (when using the USB stick for
    >>
    >> general purpose transfer, that's exactly what I'm doing). But when it
    >>
    >> runs as a Linux OS, the partition is no longer visible in Linux,
    >>
    >> the 4GB file can't be seen, but the 4GB file is loopback mounted.
    >>
    >>
    >>
    >> So such a behavior isn't a complete surprise.
    >>
    >>
    >>
    >> Hmmm. There's a WUBI tutorial here. It still doesn't
    >>
    >> explain how it works, but it does mention the possibility of
    >>
    >> seeing a "hal.dll is missing" type error.
    >>
    >>
    >>
    >> https://wiki.ubuntu.com/WubiGuide
    >>
    >>
    >>
    >> I have a suspicion much of what you've seen, is a side effect of
    >>
    >> WUBI. You never know.
    >>
    >>
    >>
    >> Paul

    >
    > As ever it's a bit confusing, I am not sure if I installed
    > Linux or not, I am tending to think I didn't now, as under Linux all I see
    > on the drive as windows c: and d:.
    > I also see a file system on the desktop with typical Linux folder but I
    > think that is just the Linux DVD, in fact I am sure it is as I wrote
    > a file to the desktop, rebooted and the file was gone, as it must have just been in memory. I also wrote a file to the windows folder and that was still there, I then deleted it.
    >
    > So I am note sure why nothing showed up under windows, maybe Linux changed the disc in some way.
    >
    > There is an "Install Linux Mint" button on the desktop, I thought I might
    > have accidentally hit that when the desktop got screwed up.
    >
    > I am also using a new Linux version, only 10 months old, it's a lot better, and I have a better mouse too, one which does not tend to accidentally click the wrong thing.
    >
    > I'm not very familiar with Linux unfortunately, would help if I was.
    >
    > However if I try and boot from the 500GB drive it does seem the same as before, ie it gives a hal.dll error if I try a straight boot.
    >
    > But then the other thing is the 500GB drive does not show up in the
    > USB enclosure, well it showed up a couple of time but was shown as mainly empty.
    >
    > I am going to try it in the USB enclosuree again and I am also going to burn that Kasperof DVD, I should have done that before but I am not sure how to burn a DVD on this new machine, OK I am burning it now!!


    You did find some WUBI files. And you can't just go around
    deleting those at random. The web page I was looking at,
    claimed it could result in Windows not booting. So you
    have three symptoms of WUBI.

    wubuildr, wubildr.mbr, "missing hal.dll"

    If you could look in boot.ini (which could be difficult
    without fooling around), you'd probably see something in
    there as well (that didn't come standard with WinXP).

    If instead of WUBI, you try "install Linux Mint", that
    should start by asking questions about what partition to
    use. (That method would want partition(s) of its very own.)
    So you might have had a chance to stop that. WUBI, I'm
    not so sure it needs to prompt for choices. As long as it
    finds C:, and there is enough space (5GB min), it'll
    probably run. WUBI should also have left a big file on there
    somewhere.

    The WUBI page suggests going to Windows "Add/Remove" control
    panel, to remove it, rather than removing it by deleting the
    files involved one at a time. WUBI apparently doesn't clean up
    after itself entirely, so the boot.ini might still need to be
    edited later (with Notepad).

    Paul
     
    Paul, Sep 29, 2013
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. mark  mandell

    Missing or corrupt hal.dll

    mark mandell, Nov 15, 2003, in forum: Computer Support
    Replies:
    3
    Views:
    5,021
    mark mandel
    Nov 15, 2003
  2. John

    Ghost restore and HAL.DLL is missing?

    John, Oct 2, 2005, in forum: Computer Support
    Replies:
    4
    Views:
    6,031
    FullName
    Oct 3, 2005
  3. mark  mandel

    re: Missing or corrupt hal.dll file

    mark mandel, Nov 14, 2003, in forum: Computer Information
    Replies:
    0
    Views:
    552
    mark mandel
    Nov 14, 2003
  4. Rubix

    Missing or Corrupt...\systems32\hal.dll

    Rubix, Jan 16, 2006, in forum: Computer Support
    Replies:
    4
    Views:
    3,128
    Tony B
    Jan 16, 2006
  5. Dennis Gordon

    OT: Missing hal.dll and C unreadable

    Dennis Gordon, Apr 27, 2006, in forum: Windows 64bit
    Replies:
    6
    Views:
    525
    Charlie Russel - MVP
    Apr 28, 2006
Loading...

Share This Page