Disappearing boot.ini file

[Packrat1947]

I just got a Dell tonight with the bootup message of Hal.dll missing. Booting a miniPE disc revealed that the hal.dll is fine, but the boot.ini was missing. I copied a generic Dell .ini, and it boots OK. Then at the next boot it is gone again, and the bootup error occurs.

The computer seems very clean with the owner using Malwarebytes, SuperAntiSpyware, Spybot, etc.

I just changed the .ini to a read only state. I’m done for tonight, so I don’t know if this will stick or not.

Has anyone seen this behavior before. Just wondering. Google searches reveal it is not a rare oc-curance.

[edit] The file is missing on the next reboot - even though it was "read only". I guess that is not a very powerful command. Any ideas here as to why boot.ini keeps disappearing?

Packrat1947

 

[LunchBox]

How about using a program like dang I can't remember which one from sysinternals.com (there are others like it) that look at pending registry deletion keys.

This is the link (I had to look for it cause it bothered me that I could not remember the name)
http://technet.microsoft.com/en-us/sysinternals/bb897556.aspx

I was reading it and it may work or may not depending if the OS sees the boot.ini as something that need to be listed. Its worth a shot.

Also, since this is an odd issue. I am not sure if the Boot.ini is locked after windows launches but perhaps looking at log on/off scripts.

 

[MrUnknown]

in the most recent podnutz podcast, the guest host said he found that the ask.com toolbar update service/program was actually deleting this file.

Its a long shot, but you can check it out.

 

[Packrat1947]

Hi,
Thanks for the tip on Ask Toolbar. I went to add/remove and uninstalled it. Then copied the boot.ini back one more time.

Now it is surviving reboots. That's a big relief.

I'll keep Mark's program to look at. But I don't think that I would know what to to with the info anyhow. Anyhow, I'm going to look at it. Maybe it is simple to use.

Cheers,
Packrat1947

 

[dhrandy]

in the most recent podnutz podcast, the guest host said he found that the ask.com toolbar update service/program was actually deleting this file.

Its a long shot, but you can check it out.

Wow. I would have never thought.

 

[Kenhelms]

Wow. I would have never thought.

ditto

"The message you have entered is too short. Please lengthen your message to at least 20 characters."

 

[MrUnknown]

I believe it was Simon Zerafa from the latest podnutz.

He disabled everything from starting and slowly added things until it disappeared.

Why a toolbar needs access to or to even delete boot.ini, I will never know. I might email them see if I get any sort of response.

 

[studiot]

I've not seen this particular horror, but thanks for the info.

I presume the bar was only tested on Vista/ 7 which do not use boot.ini

 

[dhrandy]

I say we murder the person with the idea to invent toolbars.

Or the person or persons that had the idea to install them with every piece of free software. I don't know how many times I work on computers that have multiple tool bars installed that they don't use.

 

[Packrat1947]

Can any of you possibly explain how a loading a toolbar could possibly remove a vital system file? I just cannot see how there could be any interaction. Can you?

Go ahead and stretch your imagination. Brainstorm if you will. What the heck is in the ‘bar that would delete the boot.ini. Obviously making it read only did nothing useful.

I know many of you are programmers/scripters, etc. I only dabbled with BASIC in the early ‘90s, so I’m clueless.

But the fact remains that after removing the Ask Toolbar, the boot.ini stayed fixed. Why, why, why?

I'll bet a lot of hal.dll missing errors are caused by this. Google searches reveal that this is an age old problem.

Packrat1947

 

[MrUnknown]

very bad programmer error or on purpose. If the user can delete it, then so can any program they are running.

I can't imagine how they were able to program this bug into their software. Maybe they store a temp file there and attempt to delete it.

 

[i.t-works]

Maybe you can trying tightening the ACL on the file - retrict deletion, and write access. Then whatever is trying to delete the file might fail and display an error message