How to install and use the Windows XP Recovery Console

The Recovery Console is useful in situations such as removing malware, spyware and trojans, that start in both Safe mode and Standard Mode and thus not allowing you to delete the infection or to recover WindowsXP, when your computer does not start correctly or does not start at all. This method of system recovery for advanced users only! This method allows you to access the files, format drives, disable and enable services, and other tasks from a console prompt. Also, learn about the WindowsXP Recovery Console command prompt, command actions, rules, how to install, use and remove the WindowsXP Recovery Console. The Recovery Console is to only be used only after Safe mode and the other standard startup options do not work.

How to install Windows XP Recovery Console

• Insert the Windows XP CD into your CD-ROM drive.
• Click the Start button.
• Click the Run menu option.
• Type d:\i386\winnt32.exe /cmdcons , where d is the drive letter for your CD reader, and press the OK button.
• After pressing the OK button a setup window will appear. The dialog box describes the Recovery Console option. To confirm the installation, click Yes.
• After installing, press the OK button and remove the CD from your computer.
• Restart the computer. The next time that you start your computer, you will have an option (Microsoft Windows Recovery Console) to start the Recovery Console.

How to start the Recovery Console

• Reboot your computer and as Windows starts it will present the startup menu.
• Select the option listed as Microsoft Windows Recovery Console and press the Enter.
• The Recovery Console will start. If you have multiple Windows installations, select the installation that you must access from the Recovery Console, press a number of installation and press ENTER. If you have just one Windows installation, type 1 and press Enter.
• When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER. If you do not know your password then see below.
• When you see the prompt for %SystemRoot% (generally C:\Windows), you can start using Recovery Console.

How to start the Recovery Console directly from the Windows XP CD or Windows XP startup disks

• Insert the Windows XP CD into the CD-ROM drive or insert the Windows XP startup disk into the floppy disk drive.
• Restart your computer. Don`t forget select booting from CD or floppy drive. Read bios manual
• When the Welcome to Setup screen appears, press the R to start the Recovery Console.
• The Recovery Console will start. If you have multiple Windows installations, select the installation that you must access from the Recovery Console, press a number of installation and press ENTER. If you have just one Windows installation, type 1 and press Enter.
• When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER. If you do not know your password then see below.
• When you see the prompt for %SystemRoot% (generally C:\Windows), you can start using Recovery Console.

How to remove the prompting of a password

• Click Start -> Run and type regedit.exe in the open field. Press OK button.
• In the left panel navigate to the following keys by expanding the + at left of each key at left:
  

  HKEY_LOCAL_MACHINE
  SOFTWARE
  Microsoft
  WindowsNT
  CurrentVersion
  Setup
  RecoveryConsole

• In the right panel Right click SecurityLevel, choose “Edit”.Change the value of SecurityLevel value to 1.
• Close regedit.
• Reboot your computer.

How to use the Recovery Console

The following list describes the available commands for the Recovery Console:
Attrib

Changes attributes on a file or directory.

Batch

Executes commands that you specify in the text file, Inputfile. Outputfile holds the output of the commands. If you omit the Outputfile parameter, output appears on the screen.

Bootcfg

Allows you to modify the Boot.ini file for boot configuration and recovery.

CD

(Chdir) Change directory. Operates only in the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources.

Chkdsk

Checks a disk for drive problems or errors. The /p switch runs Chkdsk even if the drive is not flagged as dirty. The /r switch locates bad sectors and recovers readable information. This switch implies /p. Chkdsk requires Autochk. Chkdsk automatically looks for Autochk.exe in the startup folder. If Chkdsk cannot find the file in the startup folder, it looks for the Windows 2000 Setup CD-ROM. If Chkdsk cannot find the installation CD-ROM, Chkdsk prompts the user for the location of Autochk.exe.

Cls

Clears the screen

Copy

Copies one file to a target location. By default, the target cannot be removable media, and you cannot use wildcard characters. Copying a compressed file from the Windows 2000 Setup CD-ROM automatically decompresses the file.

Del

(Delete) Deletes one file. Operates within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources. By default, you cannot use wildcard characters.

Dir

Displays a list of all files, including hidden and system files.

Disable

Disables a Windows system service or driver. The variable service_or_driver is the name of the service or driver that you want to disable. When you use this command to disable a service, the command displays the service’s original startup type before it changes the type to SERVICE_DISABLED. Note the original startup type so that you can use the enable command to restart the service.

Diskpart

Manages partitions on hard disk volumes. The /add option creates a new partition. The /delete option deletes an existing partition. The variable device is the device name for a new partition (such as \device\harddisk0). The variable drive is the drive letter for a partition that you are deleting (for example, D). Partition is the partition-based name for a partition that you are deleting, (for example: \device\harddisk0\partition1) and can be used instead of the drive variable. The variable size is the size, in megabytes, of a new partition.

Enable

Enables a Windows system service or driver. The variable service_or_driver is the name of the service or driver that you want to enable, and start_type is the startup type for an enabled service. The startup type uses one of the following formats:
SERVICE_BOOT_START
SERVICE_SYSTEM_START
SERVICE_AUTO_START
SERVICE_DEMAND_START

Exit

Quits the Recovery Console, and then restarts the computer

Expand

Expands a compressed file. The variable source is the file that you want to expand. By default, you cannot use wildcard characters. The variable destination is the directory for the new file. By default, the destination cannot be removable media and cannot be read-only. You can use the attrib command to remove the read-only attribute from the destination directory. The option /f:filespec is required if the source contains more than one file. This option permits wildcard characters. The /y switch disables the overwrite confirmation prompt. The /d switch specifies that the files will not be expanded and displays a directory of the files in the source.

Fixboot

Writes a new startup sector on the system partition

Fixmbr

Repairs the startup partition’s master boot code. The variable device is an optional name that specifies the device that requires a new Master Boot Record. Omit this variable when the target is the startup device.

Format

Formats a disk. The /q switch performs a quick format. The /fs switch specifies the file system.

Help

If you do not use the command variable to specify a command, help lists all the commands that the Recovery Console supports.

Listsvc

Displays all available services and drivers on the computer.

Logon

Displays detected installations of Windows and requests the local Administrator password for those installations. Use this command to move to another installation or subdirectory.

Map

Displays currently active device mappings. Include the arc option to specify the use of Advanced RISC Computing (ARC) paths (the format for Boot.ini) instead of Windows device paths.

MD

(Mkdir) Creates a directory. Operates only within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources.

More/Type

Displays the specified text file on screen. More will display a text file one page at a time, while Type displays the entire text file at once.

Rd

(Rmdir) Removes a directory. Operates only within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources.

Ren

(Rename) Rename a file or directory. Operates only within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources. You cannot specify a new drive or path as the target.

Set

Displays and sets the Recovery Console environment variables.

Systemroot

Sets the current directory to %SystemRoot%.

Deleting the Recovery Console

Read the article How to remove/uninstall Microsoft Recovery Console or follow the instructions below.
Warning: For removing the Recovery Console you should modify the Boot.ini file. Modifying the file incorrectly can prevent your computer from starting properly. It is important to follow exactly.

• Click My Computer twice, then double-click on the drive you installed the Recovery Console (usually the C drive).
• Enable Show hidden files and folders. Read How to show hidden files in Windows.
• Open drive and delete the Cmdcons folder and the Cmldr file.
• Right-click the Boot.ini file and then click Properties option.
• Uncheck the Read-only check box and then click the OK button.
• Click Start -> Run, type notepad.exe c:\boot.ini and press the OK button.
• Remove the entry for the Recovery Console. It will look like to this:
  

  C:\cmdcons\bootsect.dat=”Microsoft Windows Recovery Console” /cmdcons

  Make sure you only delete that one entry.

• Save it(click File -> save) and close the notepad.
• Right click the boot.ini file and select Properties option.
• Put a checkmark back in the Read-only checkbox and then press the OK button.