AumHa Forums

[Reference: http://www.bleepingcomputer.com/combofix/how-to-use-combofix ~Moderator]

Windows XP has a "Recovery Console" that albeit not rich in features, can often mean the difference between reinstalling XP or spending with some guidance a few minutes to be back up and running. You can use Recovery Console to repair most common boot failures; stop bad drivers or services that keep XP from starting; delete even stubborn rootkit malware infectors that cannot be removed in normal operations of XP; and, with proper pre-planning and the installation of a freeware utility such as ERUNT, restore completely a damaged registry that cannot be repaired with System Restore.

1. What is "Recovery Console"?
   When you use the Windows Recovery Console, you can obtain limited access to the NTFS file system, FAT, and FAT32 volumes without starting the Windows graphical user interface (GUI). In the Windows Recovery Console, you can perform the following actions:
   • Use, copy, rename, or replace operating system files and folders.
   • Enable or disable service or device startup the next time that you start your computer.
   • Repair the file system boot sector or the Master Boot Record (MBR).
   • Create and format partitions on drives.
   • Expand files from the compressed format in which they are stored on the installation CD-ROM
   • Perform a full CHKDSK scan to repair corrupted disks and files, especially if the computer cannot be started properly
   • You have access, with some limitations, to the following commands. These might have "look-alike" names to normal mode XP commands, but I assure you that are not identical:
   Quote:
   
   attrib del fixboot more set
   batch delete fixmbr mkdir systemroot
   bootcfg dir format more type
   cd disable help net
   chdir diskpart listsvc rd
   chkdsk enable logon ren
   cls exit map rename
   copy expand md rmdir
   
   See: http://support.microsoft.com/kb/314058
   .
2. Why Add the "Rcovery Console" to my Boot Menu -- Right now!
   Because you may not have a realistic option to do so when you really, really need it. It is often not included by OEMs in their copy of XP -- it saves them a few bucks. The option to run the Recovery Console is offered by Microsoft from floppy disks (only) as your only other option.
   See: http://support.microsoft.com/kb/307654
   .
3. So How Do I Add This Wonderful Boot Menu Feature?
   
   1. If you have a fully integrated installation CD of Windows XP with Service Pack 2, you can use that. It is a simple command line statement that you type:
      Quote:
      1. Insert the Windows XP CD into the CD-ROM drive.
      2. Click Start, and then click Run.
      3. In the Open box, type d:\i386\winnt32.exe /cmdcons where d is the drive letter for the CD-ROM drive.
      4. A Windows Setup Dialog Box appears. The Windows Setup Dialog Box describes the Recovery Console option. To confirm the installation, click Yes.
      5. Restart the computer. The next time that you start your computer, "Microsoft Windows Recovery Console" appears on the startup menu.
      
      .
   2. If you do not have a fully integrated "slipstream" installation CD for your flavor of XP, you used to be out of luck. Fortunately, there is help available due to the diligent and crafty programming skills of members of the Anti-malware Community.
   
   How-to Install the Recovery Console on All Flavors of Windows XP
   
   If you do not have an XP installation CD with your latest Service Pack level integrated into the installation, or you receive an error message that it could not be installed, you will have to use an alternative method to install the Recovery Console. The following is easy to do, there is no easier method, and special AumHa thanks to "sUBs" and others for this procedure.
   
   Step #1: Download Combofix.exe and the XP Setup Core Floppy Set
   Download Combofix.exe -- to your Desktop -- from either of these two sources:
   http://download.bleepingcomputer.com/sUBs/ComboFix.exe
   http://subs.geekstogo.com/ComboFix.exe
   
   Go to Microsoft's website Here ===>>> http://support.microsoft.com/kb/310994
   Select the download that's appropriate for your Operating System version.
   (There are downloads unique to each version and Service Pack level of XP):
   
   
   
   Step #2: Let Combofix Install Recovery Console
   Download the appropriate file from above to your Desktop, right next to Combofix.exe..
   Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it.
   
   
   
   Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. You should see this box if the process was successful:
   
   
   
   Click "No" in the box.
   
   Important. Now Delete both downloads you have made -- the Microsoft Setup download, and Combofix.exe.
   
   When complete, a log named CF_RC.txt will open. Please do not reboot your machine until you have reviewed the resulting log file. The log file should be nothing more than your original BOOT.INI file, with a single line added to support the Boot Menu Option for the Recovery Console.
   
   Original BOOT.INI wrote:
   [boot loader]
   timeout=2
   default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
   [operating systems]
   multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
   
   
   Recovery Console BOOT.INI wrote:
   WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
   [boot loader]
   timeout=2
   default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
   [operating systems]
   multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
   C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
   The two lines in Red were added by the procedure. The first line reports the Download you made from Microsoft earlier. The last line is the new "Recovery Console" boot option.
   
   While the procedure is nearly fool proof to do, I would be lying if I said any procedure was in fact fool proof.
   Therefore, please Read and Note, this critical item:
   ----------------------------------------------------------------
   IF your log from the above procedure does not look like or follow the example above
   exactly in shape and format (other than the filename in the first line)
   we have to bail out of the procedure prior to rebooting the computer.
   ----------------------------------------------------------------
   
   To Undo the Changes Made:
   
   1. Click Start, click Run, and enter into the command box that opens:
   CMD /c Copy C:\BOOT.bak BOOT.INI and press Enter.
   
   You are welcome to start a new Topic and ask for an explanation and resolution to getting the Recovery Console installed if the above did not work properly. In that new topic (not here in this Sticky Note) include the full text from the log file, CF_RC.txt on your Desktop.
   
   To Cleanup your Desktop After The Change Was Made:
   Simply delete both downloads you made, and the LOG.TXT file.[/strike]
   
   Reading List and Additional Resources:
   • All of the links above.
   
   • Guide to Windows XP Recovery Features
   http://www.bleepingcomputer.com/tutoria ... ial58.html
   
   • Complete Guide to Windows XP Recovery Console Commands
   http://www.michaelstevenstech.com/r_c_cmds.htm
   
   • Restoring the Registry -- the Hard way -- Recovery Console Alone
   http://support.microsoft.com/?kbid=307545
   http://www.digitalwebcast.com/2002/03_m ... t_toot.htm
   
   • Restoring the Registry -- the Easy way --ERUNT and the Recovery Console
   
   Quote:
   • Install ERUNT. At installation agree to let it perform automatic backups at bootup. http://aumha.org/freeware/freeware.php#erunt
   • If a complete registry replacement is necessary, log on to your now installed Recovery Console.
   • Type cd autobackup and press [Enter]. Type dir and press [Enter] to see a list of the folder's contents. They folders are dates of complete backups, in the Format: DD-MM-YYYY. Pick a suitable date, and then Type: cd DD-MM-YYYY (of your choice) and press [Enter].
   • Type: batch erdnt.con . After about 1 minute you are done.
   • Type Exit to quit the Recovery Console and restart XP in Normal mode.
4. Enhance File and Folder Access
   When you use the Windows Recovery Console, you can by default use only the following folders:
   • The root folder
   • The %SystemRoot% folder and the subfolders of the Windows installation that you are currently logged on to.
   • The Cmdcons folder.
   • Removable media drives such as CD-ROM or DVD-ROM drives.
   • You cannot copy a file from the local hard disk to a floppy disk.
   • (You can copy a file from a floppy disk or from a CD-ROM to a hard disk, and from one hard disk to another hard disk. )
   
   If you try to obtain access to other folders, you receive an "Access Denied" error message.
   You can, ahead of time, can relax these restrictions. This must be done ahead of time.
   
   Using Gpedit.msc (XP Pro only)
   Enable: Recovery Console: Allow Floppy Copy And Access To All Drives And Folders
   
   Or, By Making a Registry edit (All XP versions)
   Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines:
   
   Code:
   REGEDIT4
   
   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole]
   "SetCommand"=dword:00000001
   
   
   
   Open a new Notepad document. (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled.
   Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and enter (including quotation marks) as the filename: "RCFix.REG". Exit Notepad.
   
   Double click your new file and agree to the registry merge when asked. You can then delete this new file.
   
   ------------
   After you have enabled this Group Policy, when you enter the Recovery Console you can change the environment settings with the set command, by using the set variable = TRUE or FALSE syntax.
   You must manually enter the Set command for the feature you wish to use.
   (If you have not set ahead of time the registry policy entry, the Set command will be ignored.)
   
   Note: Be sure to use a space -- on each side -- of the equal sign. If you do not, the set command generates a "syntax error" error message and does not work.
   
   The following variables define the default environment. The variables, when set to TRUE, enlarge the scope of the environment setting and have the following meanings:
   
   • AllowWildCards = TRUE - Enable wildcard support for some commands (such as the del command).
   • AllowAllPaths = TRUE - Allows access to all files and folders on the computer.
   • AllowRemovableMedia = TRUE - Allow files to be copied to removable media, such as a floppy disk.
   • NoCopyPrompt = TRUE - Do not prompt when overwriting an existing file.
   .
5. Enable Autologon to the Recovery Console
   If you have problems remembering the original Administrator password (if set), then you might accept this security risk. A more common reason is that you have not applied a necessary Hotfix that might prevent Recovery Console from accepting any password you have set: http://support.microsoft.com/kb/308402/ The Administrator passwword requested is for the Username "Administrator", not any other Username that happens to have Administrator priviliges.
   
   Using Gpedit.msc (XP Pro only)
   Enable: Local Policy/Security Options: Recovery Console: Allow automatic administrative logon
   
   Or, By Making a Registry edit (All XP versions)
   Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines:
   
   Code:
   REGEDIT4
   
   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole]
   "SecurityLevel"=dword:00000001
   
   
   
   Open a new Notepad document. (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled.
   Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and enter (including quotation marks) as the filename: "RCFix.REG". Exit Notepad.
   
   Double click your new file and agree to the registry merge when asked. You can then delete this new file.
   .
6. What About Bart PE, Lunix "Live" CDs, "Ultimate Boot CDs" -- There are Alternatives to the Recovery Console.
   These all have a possible role they could play in recovering a non-booting system. Particuarly in Expert hands. They are, however, not alternatives. They are useful supplements.

Best wishes,
Bill Castner

Do you think this might do well put as a Sticky Bill it could help a lot more people if it stayed at the top instead of gradually disappearing down the list

Done.
(I was still correcting spulling and grammar errors).
The site unfortunately is hostile to long written posts, often timing out before you are done and losing all of your work effort. So, you do some intermediate posting and then cleanup if you are wise.

Best wishes to all, and I sincerely hope you do this Right Now!

Haven't finished reading it all properly yet, you probably know but you could always write it all up in Word then do the copy/paste into your post.
Mind you if your anything like me you don't remember that until you've actually started it
Joan

Bill,

I have been seeing this mentioned in some of the ComboFix
logs that go by and wondering if I need it or not. My Dell has the
"return to new" option but this sounds like something different/better.

It sounds like you are recommending this for all users. Can you think of
any reason not to?? Should "computer challenged" users partake??

My system is as follows:

Browser Name: Microsoft Internet Explorer ver. 7.0

Browser & OS: (Major & Minor Version Information)
4.0 (compatible; MSIE 7.0; AOL 9.1; AOLBuild 4334.34; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648)
0

Screen Resolution: 1024 x 768
Color Depth: undefined
Java Enabled: true

Please advise,

Roger

I recommend it to all users, as well as the installation of ERUNT. The latter is like seat belts for automobiles; you accept that there is not natively a better way to protect yourself, so the 6 seconds added to startup of your car are worthwhile.

Recovery Console has some uses that regular folks will find useful -- such as a somewhat importantly different CHKDSK functionality. More importantly, if you were to write (from a different computer) that XP was constantly restarting; or reported at boot that "HAL.DLL was not found" or a similar common missing file startup issue; or that when starting your computer you received a notice that the operating system could not be found, I could give you a three or four line set of command to enter into Recovery Console and you would be done.

You cannot do certain operations such as rebuild the MBR or BOOT.INI file, repair the registry, or certain other operations, any other way as easily and safely as you can using Recovery Console. You might not know what to type as commands, but being able to ask and then note that you do have access to Recovery Console, simplifies enormously a repair of a no-longer bootable XP workstation in many cases. Commands such as FIXBOOT, FIXMBR and BOOTCFG have no alternatives in Windows other than manual edits or third-party utilities.

Install it. Now!
(It is of very small size in terms of hard drive real estate used. It adds nothing to the default boot time delay of XP at startup; and the delay is in any case configurable through the Boot.in editor in System Properties or MSCONFIG.)

The only question many experienced hands with Windows is why it was not included by default. The answer is in most cases was because the OEMs did not want to pay a modest licensing fee to include it.

Bill,

Thanks for the reply. I will give it a go.

Where do I go to get ERUNT??

Regards,

Roger

AumHa, of course. The site hosts very little software, but one exception is ERUNT, for which we are an "official" mirror site: http://aumha.org/freeware/freeware.php#erunt

You can always uninstall it by the instructions I provided above, and then deleting the folder it creates: cmdcons.

Bill,

Thanks again.

{OT}Don't tell "BD" but I really like you and your efforts.
{Sorry, couldn't help myself!}

Best wishes,

Roger

Bill,

All installed with no problems. Now that I have all this,
should I open these programs and look around??

Please advise,

Roger

Absolutely.
You want to get a feel for things.

However, make the "Autologon" change I suggested in the full article first. This will avoid any issues with being able to logon into Recovery Console.

Do a DIR to see directories.
Do a CD to change directories to another folder.
Maybe it is time to do a CHKDSK? (Remember the syntax is slightly different than this command under Windows).
See if you can easily find the folders where your new ERUNT stores are being kept. (Do not run a restore, however, as a test.)

A complete guide to all of the Recovery Console commands can be found here: http://www.michaelstevenstech.com/r_c_cmds.htm

And the most important command: Exit
(To leave Recovery Console and have XP boot normally.)

Best wishes,
Bill Castner

Quite possibly the finest piece written on the Recovery Console--and why we need it NOW.

Bill,

I got into and exited the R C with no problems. Did the "DIR" and the
"CD" - with no problems. Did the "CHKDSK C: /p" with no problems.

However, was unable to find the folders for the ERUNT stores.
Would you please give me a clue.

Regards,

Roger

I am uncomfortable answering support questions in a Sticky topic.
As requested in the original article, I would be happy to answer any such questions as New Topics created in the Forum.

As the question above may have general applicability, I will answer it here. But I want it to be known that any support questions in this Sticky topic will be removed in the future, with no notice, at the discretion of the moderators.

When you enter the Recovery Console, it by default will place you in %SystemRoot%. For most installations of XP, this would be the folder:

C:\Windows

If you install ERUNT using its default settings, it will create the following storage area:

C:\Windows\ERDNT

Which would mean that starting from the beginning of your entrance to the Recovery Console, one would type:

CD ERDNT



The image shows a single archive, 19-04-2005.
To perform a complete registry Restore from this archive, you would then type:

CD 19-04-2005
(The following command should not be used for Testing)
batch erdnt.con

ERUNT would then restore your entire registry from the archive found in the folder.

If during the installation of ERUNT you specified any other path than the default, you will need to look at the Autostart entry for ERUNT to discover what is being used. Use MSCONFIG and examine the entry for ERUNT to see what path was specifed.

As I warned in the original article, do not be clever about the drive or path used to store ERUNT archives. Recovery Console has restrictions on which Folders are accessible. The most reasonable place to store these archives is in %SystemRoot%, which is why the default for ERUNT on most systems would show to be: C:\Windows\ERDNT. (Or if the AUTOBACK feature was used, C:\Windows\ERDNT\AUTOBACK). ERUNT allows you at installation to pick the storage location. Pick any name you wish, just remember that the best place to put such an archive is in a Windows folder that is accessible under Recovery Console.

I sincerely request that this not thread not be used as an ERUNT support subForum.
I am happy to answer any ERUNT questions or issues, but please ask them as new Topics in the Windows XP subForum and not here.

Bill,

Thanks for your indulgence. I had hoped to not have to ask any
thing else. ERDNT folder found!

Regards,

Roger