China DOS Union

Recently, a friend of mine bought a new computer. I went to take a look and found that there was a Ghost in his computer that uses a bat to restore the system, and there were some things I couldn't understand.

The effect is that when you run One - Click Backup.bat, the computer will automatically restart, enter the DOS toolbox, and run the bf.bat file. (We all know that the content of this bf.bat file is the Ghost command.)

The problem is, how can it automatically run this batch file after restarting?

Now, the content of One - Click Backup.bat is posted here. Please help take a look.
@ color 9F
@ ECHO OFF
@ ECHO.
@ ECHO.
@ ECHO ┏━━━━━━━━━━━━━━━━━━━━━━┓
@ ECHO ┃ ┃
@ ECHO ┃ This command will make the system automatically restart and enter DOS to use GHOST to back up the C drive, and save it as d:\GHOST\WINXPSP2.gho. ┃
@ ECHO ┃ The target disk format can be either FAT32 or NTFS. ┃
@ ECHO ┃ ┃
@ ECHO ┃ If you continue, it will restart immediately. Otherwise, please close this window. ┃
@ ECHO ┃ ┃
@ ECHO ┗━━━━━━━━━━━━━━━━━━━━━━┛
@ ECHO.
@ ECHO.
PAUSE
C:\Ghost\replaced\boot2.exe
C:\Ghost\replaced\AUTOEXEC - bf.exe
md d:\Ghost
copy ghost.exe d:\Ghost /y
copy ghost.ini d:\Ghost /y
copy Ghost Image Browser v8.3.exe d:\Ghost /y
copy Do Not Delete This Folder.txt d:\Ghost /y
copy oeminfo.ini c:\windows\system32 /y
copy oemlogo.bmp c:\windows\system32 /y
c:\Ghost\QuickReboot.exe
===============================================

The file inside is for modifying the BOOT.INI file. I have seen it.
C:\Ghost\replaced\boot2.exe
This is the one that runs bf.bat.
C:\Ghost\replaced\AUTOEXEC - bf.exe

The content of bf.bat is as follows.
del c:\autoexec.bat
c:\ghost\attrib.exe -a -s -h c:\boot.ini
copy C:\Ghost\original\boot.ini c:\ /y
c:\ghost\attrib.exe +a +s +h c:\boot.ini
Ghost.exe -clone,mode=pdump,src=1:1,dst=1:2\Ghost\winxpsp2.gho -z3 -sure -rb

There are also some other exe files. Only one or two I don't know what they are for. The others are self - extracting files made with winrar. If needed, the content can also be posted here.

[ Last edited by 26933062 on 2007 - 5 - 29 at 01:29 AM ]

To 26933062:

You can send out the content of the modified boot.ini file of boot2.exe. The reason why bf.bat can run after the system restarts may be related to this. The content of autoexec.bat is also necessary to take a look at.

As for oeminfo.ini, you can right-click "My Computer", then "Properties" - "General" - "Technical Support Information (s)", and you can see that the content inside corresponds one by one with that in oeminfo.ini.

And oemlogo.bmp is the image on the left.

In addition, the attachment address after uploading is: http://zhenlove.com.cn/cndos/fileup/files/<file name>

Originally posted by 26933062 at 2007-5-29 01:31:
There is also an oeminfo.ini file inside. Who can tell me what it is for?

It is the content of "System Properties" - "General" - "Technical Support Information". As shown in the figure:

This is the content of AUTOEXEC.bat
cd\
cd ghost
bf.bat

This is the content of boot.ini in boot2.exe

timeout=1
default=C:\

C:\="DOS"
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect


This is the content of ghost\bf.bat
del c:\autoexec.bat
c:\ghost\attrib.exe -a -s -h c:\boot.ini
copy C:\Ghost\original\boot.ini c:\ /y
c:\ghost\attrib.exe +a +s +h c:\boot.ini
Ghost.exe -clone,mode=pdump,src=1:1,dst=1:2\Ghost\winxpsp2.gho -z3 -sure -rb

[ Last edited by 26933062 on 2007-5-29 at 12:46 PM ]

Here are the translations of the content you provided:

The following are the filenames in the ghost folder:
attrib.exe
bf.bat
fail.cmd
Ghost.exe
GHOST.INI
Ghost Mirror Browser v8.3.exe
hf.bat
mouse.exe
oeminfo.ini
oemlogo.bmp
QuickReboot.exe
Brief Introduction of One - Click Backup.txt
One - Click Backup System.cmd
One - Click Restore System.cmd
Do Not Delete This Folder.txt
replaced
original

The following are the filenames in the replaced folder:
AUTOEXEC - bf.exe
AUTOEXEC - hf.exe
boot2.exe
boot3.exe
It's Not a Virus or Trojan Horse.txt

The following are the filenames in the original folder:
boot.exe
boot.ini
It's Not a Virus or Trojan Horse.txt

Wow, I'm getting confused. Don't you just want to know why bf.bat runs after restart?

1. Replace boot.ini with C:\Ghost\replaced\boot2.exe to ensure that after restart, it enters DOS instead of Windows.
2. Replace the default autoexec.bat in the system with autoexec.bat from C:\Ghost\replaced\AUTOEXEC-bf.exe. The content of autoexec.bat in AUTOEXEC-bf.exe is the line that runs bf.bat.
3. Finally, use c:\Ghost\QuickReboot.exe to restart, and then it will enter the preferred "DOS" in boot.ini, and of course, autoexec.bat will be executed, so bf.bat will be executed too.

Oh. When booting DOS, is AUTOEXEC.bat necessarily run?
I saw that it doesn't run when XP boots, and I thought DOS didn't run it either?
Thank you,
Also, what is QuickReboot.exe?
Why not use the shutdown -s command to reboot? Does QuickReboot.exe have other uses???

Also want to ask
Since there is already ghost.exe,
Why do we still need Ghost Image Browser v8.3.exe?
What does Ghost Image Browser v8.3.exe do?
Can ghost.exe run normally without Ghost Image Browser v8.3.exe?

Originally posted by 26933062 at 2007-5-29 13:49:
Oh. When booting DOS, is AUTOEXEC.bat required to run?
I saw that it doesn't run when XP starts, so I thought DOS didn't run it either?
Thank you,
Also, what is QuickReboot.exe?
Why not use the shutdown -s command when restarting? Is there any other use for QuickReboot.exe???

QuickReboot.exe is a tool written in VB for quickly restarting XP. The reason why the computer company version does not consider using shutdown is probably because the waiting time is slow or sometimes it freezes, while QuickReboot.exe does not.

Originally posted by 26933062 at 2007-5-29 13:52:

I would also like to ask
Since there is already ghost.exe,
Why do we still need Ghost Image Browser v8.3.exe?
What does Ghost Image Browser v8.3.exe do?
Without Ghost Image Browser v8...

Without Ghost Image Browser v8.3.exe, ghost.exe can run normally!

Ghost Image Browser v8.3.exe is similar to Windows Explorer. With it, you can extract or edit the contents in .gho image files. Of course, if you just back up and restore, you don't need it. The author added it to provide it for "advanced" users.

Thanks, thank you everyone, I've learned a lot of things!!!!

Good post, good reply, thank you for sharing