8 Replies Latest reply: Nov 11, 2009 1:27 PM by peter_eepc RSS

    "SafeBoot has been corrupted (error 92h)

      Upon boot up I get: "SafeBoot has been corrupted (error 92h)"

       

      This is how I got there.

      I had a dual boot machine: a SafeBooted Windows partition and a Linux partition.

      I then re-installed Linux, and it clobbered the MasterBootRecord, specifically the first 446 bytes of this 512 byte MBR.

      Booting the machine would boot successfully into Linux.

       

      Knowing that I erroneously clobbered the MBR, I got clever and took the 446 byte MBR of another SafeBooted machine

      and clobbered my MBR with it.

      (hoping the first 446 bytes is just a SafeBoot boot loader program with no

      association with the computer that it was on or anything else.)

       

      Now when I boot up, I get a black screen with the above message of:

         "SafeBoot has been corrupted (error 92h)"

       

      Regardless how I got here, what are the exact instructions that i can relay to

      my HelpDesk people (who have all the SafeBoot repair disks, code of the day, etc.)

      so that i can "repair" the first 446 bytes of my MBR.

       

      (the partition table is intact and correct. The encrypted Windows partition, & the Linux partitions

      are also intact)

       

      Thank you.

        • 1. Re: "SafeBoot has been corrupted (error 92h)
          peter_eepc

          Provide SafeBoot error code (92h), they know that Emergency Boot procedure needs to follow.

          • 2. Re: "SafeBoot has been corrupted (error 92h)

            I would be wary of mentioning that error code, since it didn't get that way from "normal"

            corruption methods. I caused it by stealing the first 446 bytes of some other machines MBR

            and plopped it down. Would the "normal" steps that McAfee would follow to fix the "error 92h"

            fix my artificially created situation?

            You know what I mean, Vern?

            • 3. Re: "SafeBoot has been corrupted (error 92h)
              HS3

              Here you go..

               

              Refer the KB article (ERROR: Corrupted error 92h (reported during pre-boot start up) (KB61116) ) for instrustions to perform the emergency boot.  Open this article from mcafee knowledge base at https://kc.mcafee.com

              • 4. Re: "SafeBoot has been corrupted (error 92h)

                I will pass on that chain of links to our IT department.

                (although I think they did something like that yesterday unsuccessfully with McAfee tech support)

                 

                Additional question:

                Can anyone tell me exactly what is in the first 446 bytes of a SafeBooted MasterBootRecord?

                Is there a byte by byte breakdown anywhere?

                 

                I surmise, most of it is just a program/loader, that I can steal from any SafeBooted MasterBootRecord

                from any of our computers.

                What is the rest of it? The Mac address of the computer? The location of where SafeBoot copied off

                the previous MasterBootRecord?

                 

                I'm asking to get a better understanding of the mechanics of the MBR and what happens at boot up.

                 

                The instructions in the knowledge base seem to assume that the Windows partition got corrupted

                and the theme of a lot of cases is to move files around in the Windows partition. But that isn't the

                problem here. I just need the first 446 bytes of the MBR fixed, and since most of it is just

                a boot loader, I really only need probably a couple dozen bytes altered in the MBR.

                • 5. Re: "SafeBoot has been corrupted (error 92h)
                  peter_eepc

                  Using SafeTech utility and exported machine object SDB file is possible to rewrite MBR completely. You can either place EEPC MBR or original MBR. There are choices for both.

                  • 6. Re: "SafeBoot has been corrupted (error 92h)
                    SafeBoot

                    It's as you say the partition table, and a boot loader with the unique sector address of the next phase of the boot process.

                     

                    it's not possible to work that sector address out - you have to know what it is, and it will be unique for every activation.

                    • 7. Re: "SafeBoot has been corrupted (error 92h)

                      I got a"SafeTech Boot CD" from my IT department, the "code of the day" and the .SDB file for the computer I was working on.

                       

                      Booted the CD up and had the SafeBoot utility program in front of me.

                      I chose:  Disk --> "Restore SafeBoot MBR"

                      and rebooted.

                      This did not "fix" the MBR. Same error.

                      I have to assume that this menu item, "Restore SafeBoot MBR",

                      only lays down the SafeBoot loader but does lay down anything unique.

                      (like the boot sector of the next thing SafeBoot needs to find)

                       

                      I'm also assuming it does not touch the PartitionTable in the MBR.

                      (Otherwise I would run into a problem later with Linux)

                       

                      I booted the SafeTech Boot CD again, then chose "Emergency Boot"

                          Got this error along the way:

                           EndPoint Encryption Error 0xe0050043 Unable to open client data store attribute.

                       

                      Windows booted up.

                       

                      I then clicked the SafeBoot icon, chose Status, then chose Synchronize.

                       

                      Rebooted machine and got the SafeBoot login splash screen. So all is well.

                       

                      Evidently the MBR got fixed once Windows was booted up.(possibily during the Synchronize step)

                       

                      SafeBoot, while Windows is up, must copy that secret glue piece to its respective slot in the MBR

                      This is probably the only point that SafeBoot could possibly do this fixing of the MBR.

                      It can't really fix the MBR, with just the SafeBoot utility program running. (as nothing is decrypted at that point)

                       

                      Comments?

                       

                      and thanks for the activity on my thread.

                       

                      I now have a SafeBooted/encrypted Windows partition and a Crypto-encrypted Linux partition

                      that gets booted via the command in Windows C:\boot.ini file that points to the boot record gotten from partition 3 of the hard drive

                      • 8. Re: "SafeBoot has been corrupted (error 92h)
                        peter_eepc

                        Evidently the MBR got fixed once Windows was booted up.(possibily during the Synchronize step)

                         

                        SafeBoot, while Windows is up, must copy that secret glue piece to its respective slot in the MBR

                        This is probably the only point that SafeBoot could possibly do this fixing of the MBR.

                        It can't really fix the MBR, with just the SafeBoot utility program running. (as nothing is decrypted at that point)

                         

                        Comments?

                        This is exactly the way Emergency Boot works. In addition to MBR, there is also SBFS file in partition file system. That is where most of code, configuration and audit is stored. Obviously SBFS is so much easier to be manipulated when OS and network are running.

                         

                         

                        Message was edited by: peter_eepc on 11/11/09 12:27 PM