Tripredacus

Ah the reason why I made a separate post was mainly to inquire why putting this image (from a .wim) onto a notebook with 1 HDD installed would end up reporting that the Card Reader was the second drive in the mirror. As far as the "Setup" it involved making the "ISO" (its not an ISO truly, we have the pressed disc from MS) boot from a USB key. This let us then put the iaStore.inf (and related files) into the appropriate folders as directed by our instructions. This only bypasses the "F6" method (which is just a button similar to selecting drivers in a Vista setup) which also ends up doing the same thing as well. The underlying "idea" before about needing to erase the MBR to test deploying the image was done (after my above post) using Terrabyte Lab's MBR.EXE which has a /Zero option. Anyways, after zeroing the MBR, i was able to deploy the RAID image onto the notebook, and booting resulted in the 0x7B again. But I got sidetracked... When I found I can set the notebook to RAID mode, which ended up that I could boot into this XP image... Which then resulted in a one hour crusade to determine a way to connect a second HDD to this notebook... But I haven't figured that out yet... A project for later.

Here is a strange situation that I've found, and so far have only found it in WinPE v2.1 (x86) and WinPE v3.0 (x64). Other versions may be affected as well. First a little story of what I am dealing with here. Or to sum it up. It appears that Windows XP Embedded POSReady2009, while it does support RAID drivers, it doesn't write the MBR if you install it with those drivers. It does write the MBR if you install using a default (IDE mode) driver, which is a problem entirely on its own. The end result is I have captured a POSReady2009 (RAID) image to my WDS. Since it is known that Imagex does not capture MBR code when creating an image, it is entirely possible deploying this image on a brand new (blank) HDD will result in the client not booting. To test this theory out, I deployed the image onto a notebook, which is currently set for AHCI. i was hoping for a 0x7b error, which I was able to get. HOWEVER, this HDD previously had an OS on it, so its MBR would have data in it already. I was about to test out erasing the MBR so that I can test the RAID image on it, when I found this oddity. Even though there is only 1 HDD in this system, WinPE (and Diskpart) is reporting that there are two HDDs in the system. Is this normal? My Gimagex HTA is showing them as such: C:\system (Hard Disk) NTFS Size: 2GB / 466GB E: (Usb-Drive) Size: 2GB / 466GB C: is accessable and I can see the files, but E: is not accessable. Upon attempting to access it, I receive: Diskpart is even fooled to believe there are two physical disks in the system as well. A LIST DISK returns: Disk 0 Online 465 GB 0 B Disk 1 No Media 0 B 0B When I do a LIST VOL, I can see that E: is of type "Removable" which is certainly correct, as the E: is a card reader! However, once having this RAID enabled image on it, portions of WinPE seem to want to attribute the second portion of the "broken mirror" to the card reader?

I'd expect (presuming Microsoft was telling the truth) that I'd still be using Windows 8 x128 by 2038. Only because the "idea" of having a PC with an exabyte of RAM is such a mind-boggling yet fascinating idea. And to add in the fact that it would likely take me 25 years to save up enough money to buy that much RAM... Or at least a motherboard with 1 billion RAM slots on it.

IIRC, the password in AutoIT is only for their decompiler that is meant for AutoIT v2 executables. It was this entire purpose (they lock topics over there if you ask about it) that this function was removed in v3, although you can still put a password in it. But this password does nothing for other decompilers.

bphlpt, your avatar now has an optical illusion to it. It would appear that the "data sphere" is not a circle, especially where the man overlaps it. However, it is a proper circle.

I was reading about this on Sophos, but they seem to be saying there is more talk about this than actual reported infections. Although that may be related to most scanners' inability to detect it.

CurrentControlSet isn't available in an offline hive. Its typically going to be the 001 that you want to edit but you'll have to do some testing. I've sometimes have had to change 002 or 003 to get settings to "work". EDIT: beat me to it.

I'll add in here that the original RenderWare works in Win98FE. I want to say Lightwave as well, which I used to have on my Win98 to assist in building RenderWare objects, since the original RW wasn't very intuitive.

There is a good possibility that whatever computers are around in 2038 (or 2099 for that matter) may not even be able to run something like Windows XP.

We certainly do have a lot of info about Win9x here.

Would it be wise to block RDP ports on systems that aren't configured to use it, at least until a common fix is available for this worm?

A blank MBR makes sense. I do understand the "simple" reasons why you get a flashing cursor. As I explained it to my compatriot, the system sees the HDD (or the volume) but doesn't know what to do with it. Otherwise it would go to the "insert a disk" type message. I'm just curious as to why installing it on IDE mode works fine, but installing it on RAID mode with iaStor.inf wouldn't write the MBR data. Perhaps it is a bug with this version of Windows?

Can you use Chr(34) in the unattend? What about unicode characters? Did you try <CommandLine>cmd /c start /wait '%systemdrive%\TEMP\SystemUpdate.exe -s -a /s /v"/qn"'</CommandLine>

We don't need to close if you post in the wrong place. We just move it to the right place!

You should be able to set permissions recursively, but you have left out some valuable information for us. 1. What folders are you trying to change permissions on? Is it a foreign disk or a network share? 2. What is your version of Windows 7? 3. What kind of network are you on, or are these "users" local users?

Welcome to the MSFN!

My options for boot are WinPE v1.5, 3.0 (x86 and x64) or DOS 7.1 (which has NTFSDOS). However I thought about this for a moment, while I can boot to DOS I won't be able to load a RAID driver to see the volume... I also have the ability to boot to our test server which has a PXELINUX rom if gives any other options. UPDATE: ran a program called MBRFix from the WinPE 2.0 (x86) which fixed it. However the same program (and commands) did not work from the WinPE 1.5 that XPe installs from. It seems to working now.

Here's the situation. We are trying to install POSReady 2009 (for all intents and purposes, this is XP) on a RAID1 on an Intel desktop controller. Setup is normal (either provide iastor driver via click or putting in drivers folder) it detects the HDD, we can format it and install the OS. Checking the OS after setup (in the PE it goes back to command prompt) we can change to C: and see that there are files there. After a restart, it will not boot off the RAID volume, all we get is a flashing cursor. I have also tried using bootsect on the volume after setup. Boot.ini is correct. You can probably ignore the fact that this is POSReady, as I am just looking for other things to try or other possible reasons why this would happen on XP. The RAID driver is in the "image" already and we are not getting a 0x7b... just a flashing cursor. Booting this into our WDS (WinPE 3.0) we can see the volume has an OS on it, however running Diskpart it shows that the volume is active, but it also shows "Boot Disk: NO" Any ideas? PS: no problem on this hardware using IDE mode instead of RAID.

Verify that the time in the BIOS is set correctly. Check the time-zone in Windows.

Can you post either a screenshot of this message or exactly what the text says?

What OS is in the server and what is the method of PXE (WDS or PXELinux) ?

Billy Joel - Honesty

Ah there was one other thing I failed to mention, and that is handling both MSPs (the new and old) and the company itself. I have seen that "worst case scenario" before where the two MSPs refused to work with one another. And that may end up being a problem when you talk to the MSP to get specifics on what they do. They may not want to help in the transition, or may require to be paid extra for that work. I don't know if they need to be onsite. It would be handy if the new company sent someone there to get details on what they have, and how they do business, etc.

Turn hidden files on first to make sure they truly aren't there. There was a recent strain of virus that would set entire folders or volumes to hidden, causing many people to think their data was erased.