Error during BART PE Spybot Scan - wininit.ini

S

snorkel

New member
Hi. I am using spybot regularly for malware removal via a BartPE plugin. I started noticing this happening recently. When the scan is finished and you press "fix selected problems", spybot thinks for a while and then comes back with the following message:

"Unexpected error in fixing problems. Cannot create file x:\i386\wininit.ini Access is denied."

I don't see this error message when running spybot from the OS in safe mode. Any thoughts as to why I might be getting this error?


Maybe this post would be better in a PE forum. Just thought I'd run it by everyone.
 
if you do not see this message in safe mode....

like you stated, i would suggest closing any open programs while running the spybot program and see if anything improves. You could also try a complete uninstall and then redownload spybot from the home page and install it again. Also, what are the threats that were selected by spybot to remove when this message occurred? What is your Operating system? (xp, vista, etc.?) thanks. :)
 
Last edited:
You missed something important - I'm running Spybot off a Bart PE boot disk, so nothing on the hard drive is loaded up. It's running from the Bart PE operating system.
 
sorry i did not notice that. :(

I really do not know that much about that, so i advise you wait for a team member to assist you. Sorry I can not help you any further......
 
THE WININIT.INI FILE

Another file, C:\Windows\WININIT.INI, also is loaded at each Windows normal mode startup. WININIT.INI is used to complete Windows and program installation steps that cannot be completed while Windows is running and, therefore, are deferred until after a reboot. During the boot process, Windows checks to see if there is a WININIT.INI file and, if it finds one, executes its instructions. (After its successful use, it is supposed to be automatically renamed to WININIT.BAK.) You can search for a copy of this file using the Find or Search feature on your Start Menu, and then examine and edit its contents with Notepad. You can temporarily suspend any line of this file by placing a semi-colon in front of the line.

In Windows 2000 and XP, the WININIT.INI file, if existing, will be executed. However it is usually replaced by the “PendingFileRenameOperations” sub-key in the Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager.

Probably some setting under advanced mode, might stop Spybot from trying to access this file (or maybe redirect it to another location like the B: drive).
 
I've been looking for an answer to this problem for a while myself, and I think I have finally solved it using INI file redirection as described in Microsoft KB #102889: Mapping .INI File Entries to the Registry. Basically, I just added the following lines to my Spybot plugin:

[Software.AddReg]
0x1, "Microsoft\Windows NT\CurrentVersion\IniFileMapping\wininit.ini",,"@SYS:Safer Networking Limited\SpybotSnD\WinInitIgnored"
​

Note that I haven't done a lot of testing yet, but early results are good. Any feedback would be appreciated.
 
Where did you put the patch for wininit

I ran Avast and had 330 errors with wininit and pressing the enter key on, oh maybe 250, was a bit tiring.
I would like to patch my bartpe for Avast but did not know where to put it.
Thanks

"It seemed" like a good solutiion
 
Unfortunately, "early results" are often misleading. As it turns out, this approach worked fine for my test data, but not so much on real systems. I'm still having to manually click the button a few hundred times with Spybot after all. :sad:
 
I think this will work, but I haven't tested it yet. I set the system variables to point to the windows installation on the c: drive instead of the x: drive and then set them back once spybot is finished.

set CDSystemDrive=%SystemDrive%
set CDSystemRoont=%SystemRoot%
set SystemDrive=C:
set SystemRoot=C:\Windows
start /min /w "" "SpybotSD.exe" /autocheck /autofix /allhives /autoclose /taskbarhide
set SystemDrive=%CDSystemDrive%
set SystemRoot=%CDSystemRoont%
 
You must log in or register to reply here.
Back
Top