Rajib's Blog

HAL.DLL Missing error on Windows XP MCE SP2 with IE8

If you are the proud owner of a Sony Vaio VGN-N130G (PCG-7T1L) or similar laptop, you are probably facing this issue right now. The malady also infects laptop of other makes.

Recently a laptop was submitted to me for diagnosis and rectification of this error. What I assumed incorrectly to be a 5 minute job turned out to be a 10 hour job. The error reported was simple – laptop running Windows XP Media Center Edition refuses to start with HAL.DLL Corrupt or Missing error message.

Simplest solution is to ask the user to start the computer with a Windows XP installation disc and press F2 when prompted for ‘Automated System Recovery‘. As it generally turns out, the customer did not have Recovery discs. Sony did not supply any and the customer never bothered to create them using the ‘Vaio Recovery – Create Discs’ option present on his laptop. The laptop was also running Windows XP Media Center Edition for which installations discs are not easily available with neighbors.

I requested the laptop to be brought over to my place so that I could manually replace the missing file. Since Windows XP acts completely dead if HAL.DLL goes for a toss, I generally start the offending computer with Hiren’s Boot CD, Load Mini Windows XP (if present) or go-to Command Prompt and load NTFS4DOS. To replace the offending file, I either search of the I386 folder already exists on the computer and use the EXPAND computer to decompress and replace the corrupted file with the original. If I386 folder is not present, then I either copy the file from another machine using USB Pendrive or Microsoft Networking for DOS.

As it turned out, in this case, neither helped. Replacing HAL.DLL from it’s archived version found in I386 folder present on the laptop did not help. Nor did copying a file from my computer and downloaded from Internet help. The error message re-appeared dutifully on every boot.

What I did notice is message about BOOT.INI that appeared and was replaced so quickly, that I only caught a ghostly image of it. Since I was already at command prompt, a simple DIR & DIR /AH revealed that the critical BOOT.INI file was missing! In Windows 2000/XP, the BOOT.INI file lists the Operating Systems that are installed on the computer and allows the Windows Boot Loader to selectively boot among them.

I copied the BOOT.INI file from my computer and restarted the laptop to be faced with the same missing HAL.DLL error. On a hunch, I used GDISK to list the partitions present on the hard-disk and sure enough: the first partition on the disk was not the partition on which Windows was installed on this computer. The first partition on this computer was actually a hidden partition with Sony Recovery Disc contents stored on it. It is a general practice to create this partition as the second partition but whatever. If Sony can install Root-Kit software on it’s paying customer’s computers, it can very well designate a recovery partition as the first partition.

Since the Windows partition was the second partition, I had to change the BOOT.INI file slightly. More specifically:
where-ever multi(0)disk(0)rdisk(0)partition(1)\WINDOWS appeared, I had to change it to multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

Saving the Boot.ini and restarting the computer worked! Windows loaded up and started just fine. This led me to conclude that the problem all along was NOT about missing/Corrupt HAL.DLL. Since Boot.INI was missing, The boot loader present on the first partition (Vaio Recovery) started up and assumed that Windows was installed on the recovery partition. When it didn’t find it there, it generated a missing HAL.DLL error.

The problem could now be explained, Windows was demonstrated to be working well, albeit the laptop took it’s own sweet time to boot up completely. As is the practice, I restarted the laptop to assure myself and was slapped in the face with yet another ‘Missing HAL.DLL’ error for my efforts.

Starting the computer with Hiren’s Boot CD again revealed that the BOOT.INI was missing. I started wondering about virus infection. I re-created the BOOT.INI with the appropriate changes, made copies of the BOOT.INI file for good measure and restart the computer. Immediately after Windows loaded up, I fired up Windows Explorer to have a peek at the Root of C drive. No surprise! BOOT.INI was missing. The file was deleted by something immediately after boot. Even more amazing was that the backup copies I had made were also missing. This could either be due to corruption in the File Allocation Table or sinister programs (virus).

I connected the laptop to my home-network using a 10/100 Mbps Ethernet cable, restarted it using Kaspersky Live CD and allowed Kaspersky to download updates from the Internet. 15 minutes later, Kaspersky was ready to scan and kill any critter it found on the laptop. 3 hours and 240+ infected file deletions later, Kaspersky declared the laptop free of pests.

I recreated BOOT.INI, made a copy of it and renamed the copy to RAJIB.001 and restarted the machine. Upon Windows start-up, I noticed that BOOT.INI had again been deleted though RAJIB.001 file remained. I copied and renamed the backup to BOOT.INI. Clearly the pestilence was far from gone. I proceed to install Avast Anti-virus on the laptop, Register it, Update it, Configure Boot-time scan and then actually reboot the computer for Avast Boot-time scan to get to work. 2 hours and a couple of infected files deletions later, Windows started up and promptly deleted BOOT.INI

This had me totally flummoxed and clearly, I had run out of conventional methods to fix this problem.

Hunting around on the Internet revealed something that seemed improbable but worth investigating. Someone was facing this problem and he had narrowed it down-to Automatic Up-gradation of Internet Explorer to version 8 on his laptop. The user reported that as long as he stayed with Internet Explorer 7, the problem did not re-appear. Another user reported that the problem was caused due to spyware tool-bars such as MyWebSearch.

Since I plain desist tool-bars and find them to be obnoxious (now that Search bars are present by default in browsers), I discovered to my horror the sheer number of tool-bars that were installed on this laptop. Including MyWebSearch. I proceeded to un-install the tool-bars and chose to keep only the toolbar by Ask.com (the laptop owner had set the home page and default search engine to Ask). I generally like Ask.com and have found their search results to be very relevant . Downgrading to IE 8 was not an option. I have upgraded countless computers to IE 8 and have found the browser to be an excellent alternative to the superior Mozilla Firefox. I know for a fact that IE 8 does not delete BOOT.INI files.

A restart later BOOT.INI was gone again. This time more hunting revealed that users were suspecting the combination of IE 8 & Ask.com toolbar. I un-installed Ask.com quite incredulously, restored BOOT.INI and lo-behold – 3 restarts later, Boot.INI was still intact.

It turns out that due to reasons unknown, previously installed versions of Ask.com tool-bars act cranky when the browser is upgraded from IE 6/7 to IE 8. If the toolbar is uninstalled prior to up-gradation of IE 8, things go lot more smoothly.

Next question was how did Ask.com toolbar get on the system. Turns out, my laptop user does not like Ask.com search. He in fact does not have any browser/search engine preferences. Ask.com toolbar came in through over-loading by some other software.

There are numerous software now that foist the Ask.com tool-bar. It could have come in via any one of them. Though perfectly legit, the tool-bar did cause all the havoc that my laptop user faced.

10 hours, 1/2 night sleep sacrifice later, I present the info that will allow you to fix your computer in 5 minutes flat!