Sean's Blog

Recently, I worked on a student’s computer, a Dell desktop of some kind, that had issues starting up. It could begin to load Windows XP (Professional I believe) but would hang prior to the login screen. After some malware cleaning and whatnot, I managed to get past that point, only to then hang at an empty desktop. After reviewing the system even more, I found plenty of remnants of previous malware infections (100s of files) and decided that a format/reinstall would be the best option to make sure everything was taken care of. The big issue, of course, was that the student couldn’t find the installation discs that came with their computer.

Previously, this hadn’t been much of a concern, as we would direct students to the bookstore to purchase a new copy of Windows XP Professional (if they hadn’t already purchased a copy) and then use that to reinstall the operating system. Now that Vista is out, there are either very few or no copies of XP to be found at the bookstore, and some computers come to us that installing Vista on is simply not an option.

I thought I was out of options, but then I recalled that the UBCD has a program that could be helpful, Windows XP Setup Launcher. What it does, is allow you to pick a path to install Windows XP from. You cannot pick the Windows directory itself, as these are the post-installation files, but the computer did have an I386 directory, which has the compressed files that are used in installing Windows. I copied that directory to an external hard drive and ran Windows XP Setup Launcher. Using another UBCD program, Keyfinder, I got the computer’s Windows product key, which I needed to complete the setup process.

There were some issues along the way of course.

At one point, I was getting an error message of some kind because mstask.ini could not be found in the I386 folder. Now, for creating the UBCD, I have the contents of a Windows XP installation CD stored on my computer, and it just so happened that mstask.ini was already there. The contents were simply:

[.ShellClassInfo]
CLSID={d6277990-4c6a-11cf-8d87-00aa0060f5bf}

However, in case this was a file that was or needed to be different per computer, I searched for the entire second line shown above. While there were a number of sites that came up, this was the first site listed, and the inline comment for that CLSID of “Makes the task folder work” was enough for me to assume that this was something standard that could be copied over. Sure, most of the information that initially comes up is for Windows prior to XP, but it my assumption was correct, as I was able to continue on to bigger and better errors.

The next error was a pain to deal with, as the installation would through the following message at me:

Windows cannot load internet configuration utility ICFGNT.DLL. The specified module could not be loaded.

This is where I, unfortunately, get forgetful. I wasn’t taking exact notes on this, and as the case was, there were multiple errors going on at the same time that I was trying to resolve. Always remember: fix one thing at a time. In regards to this, I’m sure I did the following, and as listed later, I tried some of these multiple times:

• I will say that this site/forum post offered the most assistance. I applied the edits to txtsetup.sif that are listed, even though I was not using the exact software listed. It didn’t appear to harm the system and I do believe it helped. These were as follows:All added to the [FileFlags] section of txtsetup.sif
  BNTS.DLL = 16
TSHOOT.DLL = 16
SNIFFPOL.DLL = 16
SSTUB.DLL = 16
SSDPSRV.DLL = 16
SSDPAPI.DLL = 16
UPNP.DLL = 16
UPNPHOST.DLL = 16
UPNPCONT.EXE = 16
UDHISAPI.DLL = 16
• I downloaded a copy of icfgnt.dll, as I could not really found a copy in the I386 folders I had access to.

Something there did the job, as I was able to get the computer up and running. I had also saved the drivers and dell directories to the external drive so that I would be able to install the hardware Windows couldn’t, and fortunately, everything was there as needed. You’d think that would be the end of it, but you would be wrong; so very, very wrong.

Sure, the computer was running, but one of the Windows Security Alert balloons that pops up after a fresh install caught my eye. If I’m correct, it may have been telling me that the computer did not have any antivirus software installed. I don’t know for sure, as the message was not in English; in fact, it was definitely a Middle Eastern language, but I’m not sure which. For the purpose of listing it, I’m going to say it was Arabic. I didn’t think this was going to be an issue, but then I started to use Windows. Here’s what I remember finding in Arabic:

• All of the Windows Security Center
• The Start menu item for setting default applications and settings
• The Hardware and Remote tabs of System Properties

So, I try the re-installation process again, making sure to do an attended install and not an unintended one, which of course, did not solve the problem. This was starting to bother me, as I could find no real reason why it was happening, then it hit me: everything that was showing up in Arabic was something that had been changed with Service Pack 2. I grabbed one of the SP2 discs we have from a couple years ago and “installed” it on the computer. One reboot later, and all but one item (default applications and settings) was in English. I connected to the Internet and initiated an update of 90-some items, and following that reboot, the computer was, as far as I could tell, all in English again.

Was this computer a pain to deal with? Yes. Did I enjoy working on it? You better believe it. It was nice to have a computer come in that was fubar and find a unique way to solve the problem, which I can now tuck away as an option for further issues I may face. Also, since nothing jumped out at me when I was searching for this, I’m more than glad to add it to the collective knowledge of the web. Just be sure to leave a comment if you find this useful.

At work, we use a tool called Ultimate Boot CD for Windows (UBCD). What this does is allows us to place the CD into a computer that isn’t booting, such as with malware issues, missing .dll files, etc, but not hardware issues, and boot up a version of Windows that is loaded into the system’s memory. By doing this, we can then edit the registry, even if there is malware that would hide the registry entry via a rootkit, delete problem causing files, such as worms that have a known file name, and even back up the files to an external USB HD, so that a client’s information can be saved prior to a format of an otherwise dead system.

I had been asked by my boss, as well as searching independently prior to his asking, for a way to laod the UBCD version of Windows off of a USB drive instead. I had found some sites that gave ways to attempt it, such as Windows In Your Pocket off of Tom’s Hardware, but for whatever reason, that method proved to not work. Earlier this week I decided to give it another go, and I managed to find a program that would make a USB drive bootable and then load a BartPE (Bart Preinstalled Environment) installation onto it. BartPE is what the UBCD is built around, with the UBCD adding many more plugins and other tools to BartPE.

In order to do this, you will need the items listed below. I’m am going to mention the items needed to create the UBCD build as well.

1. Follow the directions on how to build the UBCD4Win:
   1. A Windows XP CD, with at least Service Pack 1. I know that at BGSU, the bookstore is selling Windows XP on DVDs. I imagine that it really doesn’t affect the process, but don’t quote me on that. If your CD does not have Service Pack 1, you could the service pack and create a bootable CD.
   2. BartPE, UBCD4Win, and the UBCD4Win drivers, from the UBCD4Win download page.
2. Download PeToUSB and extract it to a folder on your hard drive.

Now that’s left is to follow the directions for building the UBCD4Win and then the readme file for Boot BartPE from USB, and eventually, you’ll have a bootable USB ready to go. I personally used a 512MB Cruzer Titanium. The only downside was that I ended up only having 70MB free once everything was said and done. As UBCD4Win has more on it than BartPE, you could remove items you don’t need from UBCD4Win, or just use BartPE, to get more available room on the USB. Prior to placing UBCD4Win on the USB drive, I had placed BartPE on it, and it worked no problem.

Yes, not every computer out there can boot from USB, but most computers made in the last couple years can. So, if you are going to be working on older computers, you should make sure you have a actual UBCD around.

Now I have a bootable version of Windows with me on my keychain where ever I go.