Re: [Full-Disclosure] Virus Problem

From: lsi (stuart_at_cyberdelix.net)
Date: 08/03/04

  • Next message: SGI Security Coordinator: "[Full-Disclosure] CDE libDtHelp and dtlogin vulnerabilities on IRIX" 
    To: "Jay R ajaldas Makhija" <jay_makhija@iitb.ac.in>
Date: Tue, 03 Aug 2004 21:36:20 +0100

    > 1) Error message coming after login - "No Paging file found or paging file
    > too small"

    To quote from the M$ KB article here:

    http://support.microsoft.com/default.aspx?scid=http://support.microsof
    t.com:80/support/kb/articles/Q249/3/21.ASP&NoWebContent=1

    Unable to Log on if the Boot Partition Drive Letter Has Changed

    SYMPTOMS
    After you try to log on to your Windows 2000-based computer by using a
    valid user name and password, the Loading your personal settings dialog
    box is displayed, followed by the Saving your settings dialog box.
    However, the desktop does not appear, and the Welcome to Windows logon
    screen is displayed again.

    NOTE: If the paging file is located on the system or boot partition, you
    may also receive the following warning message before returning to the
    "Welcome to Windows" logon screen:

    [Limited Virtual Memory]
    Your system has no paging file, or the paging file is too small.

    CAUSE
    This problem can occur if your Windows 2000 boot partition drive
    letter does not match the drive letter assigned during the initial
    Windows 2000 Setup. Windows 2000 maintains a record of drive letters in a
    registry based database and re-assigns drive letters based on Globally
    Unique Identifiers (GUID) recorded for each volume. Should the volume GUID
    change or be duplicated (by hard drive cloning software), the original
    drive letter may not be re-assigned to the boot volume.

    This may also occur if you break a system/boot mirror, and then
    attempt to boot to the old shadow drive if the original primary drive is
    missing or inaccessible. This is because the volume GUID for the shadow
    drive is different than that of the original primary drive and does not
    get the same drive letter assigned.

    RESOLUTION
    ... [continues at length] ...

    5. With only the system/boot drive in the system, or powered on, boot to a
    DOS or Windows 9X Start-up diskette that contains fdisk.exe and run the
    following command:

    FDISK /MBR

    This re-writes the Master Boot Record and erase the disk signature
    associated with volume GUID. Windows 2000 should assign default drive
    letters and allow you logon. Click the article number below for more
    information about FDISK:

    69013 FDISK /MBR Rewrites the Master Boot Record 

    ---
Stuart Udall
stuart at@cyberdelix.dot net - http://www.cyberdelix.net/
--- 
 * Origin: lsi: revolution through evolution (192.168.0.2)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: SGI Security Coordinator: "[Full-Disclosure] CDE libDtHelp and dtlogin vulnerabilities on IRIX"

    Relevant Pages

    • Re: Virtual Memory Error ... No Paging File
      ... it on a few partitions, some were able to stay in tact as I ... Windows 2000/XP machine and use Regedt32 to do the changes. ... How to restore the system/boot drive letter in Windows ... Some report that simply booting the computer with a Windows 98 Boot Disk ...
      (microsoft.public.win2000.general)
    • Re: changing boot drive letter???
      ... > changed the drive letter.. ... boot drive as the system drive]. ... you could create a Windows ... Since you didn't post the error message, ...
      (microsoft.public.win2000.security)
    • Re: Can I boot of an XP System disk, nested in a logical volume
      ... I'll boot of Partition Magic or some other kind of magic and fix it that-a-way. ... It's been a long time since I messed with partitions like this, but in the back of my head I have this fragment about boring registry hands-on editing, 'derived Disk ID's' and the 'Master Boot Sector' -- that's S as in 'Senile'. ... One reason for the drive letter change on cloned drives is to keep the parent drive hooked up the first time the clone is booted, being that the clone has the same Mount Manager database, and being that the Mount Manager *always* respects drive letter assignments, it will see the parent drive and its valid disk signature and assign the C: drive letter to the original C: drive, so there will be no C: letter available for the clone. ...
      (microsoft.public.windowsxp.basics)
    • Re: login then log out upon boot
      ... You can create a Bart's PE disk and include a registry editor plug-in with it or you can use the Ultimate Boot CD for Windows: ... Now that you have created the boot cd just boot the computer with it and use the registry plug-in utility to edit the offline registry. ... If the user still cannot logon after ensuring that the file is present and in its proper location and that the registry entry is correct, then another possibility is that the boot partition drive letter has been changed. ...
      (microsoft.public.windowsxp.general)
    • RE: April 13 Critical Updates for Windows 2000 Server - corrupted
      ... The Drive Letter associated with my active Windows 2000 Server ... completely yet (i.e a multi boot system). ...
      (microsoft.public.windowsupdate)