Norton Internet Security / Norton AntiVirus

[mark_hinds]

I have recently been looking into setting up my Windows XP PC for dual boot with Linux.  In connection with this, I noticed several apparent anomalies which I wanted to follow up with the NIS community.  Since my PC has been protected by NIS since I last low-level formatted and reinstalled Windows in fall of 2010, it should have been in good shape.  Details:  My C: drive (which contains my system partition) doesn't have a copy of boot.ini, NTLDR, etc. visible in it (btw, I have hidden files set to be visible).  Instead, there is a binary file entitled "{811F5F00-E77E-4931-96B6-A18F066ED0AE}".  Despite the above, the PC boots up normally, and "msconfig" shows boot.ini content.  

Questions: 

1)  Does NIS replace the system boot files with something of its own (Meaning that the above is "supposed" to be this way)?

2)  If not, should I report this to Symantec, since this occured while their SW was installed and running?  How?

Thanks in advance,

[DaveH · Accepted solution]

NO, it doesn't touch those files at all.

In windows xp you need to also uncheck the view setting "hide protected system files" to see them.

Dave

[cgoldman]

Another way is to open a command/cmd window and from the root directory type "edit boot.ini"

It will edit even a hidden file.

another way is to run bootcfg in a command window.

if you type "bootcfg /?"  from a command window you will get the parameters to use with bootcfg which vary according to the operating system.

usually "bootcfg /query" or "bootcfg /list" will list the boot entries and thereby confirm the existence of boot.ini

[huwyngr Norton Fighter]

Mark,

I have a multiboot system of which XP was the first to be installed and I have no problem seeing boot.ini.

Here's mine FWIW:

---

; ;Warning: Boot.ini is used on Windows XP and earlier operating systems.

;Warning: Use BCDEDIT.exe to modify Windows Vista boot options.

; [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /NOEXECUTE=OPTIN /FASTDETECT /USEPMTIMER

---

Note that it does not refer to any of the subsequent Windows since they are all versions of WIndows 7 and don't use the boot.ini file

I've never dual booted with Linux but from what I see others say in other places I hang out, it is a very special case that you need to know the specifics of and that it is not easy to reverse. If so then a very strong case for making a system image before you try anything so that you can put everything back with your applications and data files installed.

[DaveH]

I actually added a line to mine so I can load Grub4DOS from the XP bootmenu

C:\grldr="Start GRUB4DOS"

You need the files grub.exe, grldr, and a menu.lst

Grub then lets me boot directly into ISO's for Ghost, Puppy, Ubuntu, and a couple windows PE disks I made.

But I imagine most prople would do it the other way around and use Grub as the boot loader and have Grub start XP.

Dave

[mark_hinds]

Thanks for the replies so far, guys.  :-)

So, with respect to my 2 questions in the OP,

1)  I would appear to have some sort of Malware on my PC, since the normal XP boot files aren't there.  Perhaps the malware simulates the existence of boot.ini when I run "msconfig", even though the boot files aren't visible (remember I have hidden files set to be visible) in their normal locations (i.e. in the root directory of C:). 

2)  Should I report this to Symantec, and how?

MH

(BTW, I am going to reformat and reinstall everything anyway.  Then I probably will use Acronis (which I already own) for cloning the entire newly formatted/installed disk image, including the Linux partitions, boot files, etc., to a second 500 GB SATA hard drive.   This will cost me $80. for the new duplicate HD, but will probably be worth it for the simplicity.  Then if anything goes wrong in future, I just copy the backup drive image back to the original 500 GB SATA HD to reset everything. )

[rocketscientist]

As was already mentioned, did you uncheck the "hide protected operating system files" line in the view options? That's a completely separate and independent option from the show/don't show hidden files radio button.

[mark_hinds]

Whoops...

I overlooked the "Tools -> Folder Options -> View -> Advanced settings -> Hide protected operating system files" menu item.  I had only checked "Show hidden files and folders".  Thanks for pointing that out; the boot files are now visible. 

I will still be reloading Windows for other reasons, but at least this takes care of one concern. 

Thanks for your help.  :-)