SAM dump problems

[marc]

I cant seem to get my SAM dump working with PWdump or even FGdump.

Here is the error I seem to get:

************************************ 
***********[Dump SAM]*************** 
************************************ 
Service start failed: 2

pwdump6 Version 1.4.3 by fizzgig and the mighty group at foofus.net
Copyright 2006 foofus.net

This program is free software under the GNU
General Public License Version 2 (GNU GPL), you can redistribute it and/or
modify it under the terms of the GNU GPL, as published by the Free Software
Foundation.  NO WARRANTY, EXPRESSED OR IMPLIED, IS GRANTED WITH THIS
PROGRAM.  Please see the COPYING file included with this program
and the GNU GPL for further details.

************************************ 
***********[Dump SAM1]*************** 
************************************ 
fgDump 1.5.0 - fizzgig and the mighty group at foofus.net
*** THIS IS A BETA VERSION, YOU HAVE BEEN WARNED ***
Written to make j0m0kun's life just a bit easier
Copyright(C) 2007 fizzgig and foofus.net
fgdump comes with ABSOLUTELY NO WARRANTY!
This is free software, and you are welcome to redistribute it
under certain conditions; see the COPYING and README files for
more information.

Could not connect to service manager: this may be a Win95, 98, SNAP or other non-NT-based system.
Could not connect to service manager: this may be a Win95, 98, SNAP or other non-NT-based system.
Could not connect to service manager: this may be a Win95, 98, SNAP or other non-NT-based system.
Could not connect to service manager: this may be a Win95, 98, SNAP or other non-NT-based system.
Could not connect to service manager: this may be a Win95, 98, SNAP or other non-NT-based system.
Could not connect to service manager: this may be a Win95, 98, SNAP or other non-NT-based system.
Could not connect to service manager: this may be a Win95, 98, SNAP or other non-NT-based system.
Could not connect to service manager: this may be a Win95, 98, SNAP or other non-NT-based system.
Could not connect to service manager: this may be a Win95, 98, SNAP or other non-NT-based system.
Starting dump on 127.0.0.1
ERROR GetOSVersion: 53 - The network path was not found.


** Beginning local dump **
Unable to determine OS version, see previous error for details
Could not connect to service manager: this may be a Win95, 98, SNAP or other non-NT-based system.
CRITICAL: Error retrieving remote service information. Remote registry may not be running, simple file sharing may be enabled, or the account may not have 'Log On as Batch Job' permission. Skipping this host.
Error dumping server 127.0.0.1, see previous messages for details

-----Summary-----

Failed servers:
127.0.0.1

Successful servers:
NONE

Total failed: 1
Total successful:

[GonZor]

I had the same "Service start failed: 2" error... make sure you have these three files and your AV hasn't deleted them...

• PwDump.exe (I use Version 1.4.2.0 I have had problems with other versions)

PwService.exe

LsaExt.dll

If your AV is deleting these files put the payload onto your CD partition - you will need to modify the code

[marc]

Yes, I do have the files, in the WIPCMD folder, along with pwdump. Still getting the error. I will show you how I am calling it:

Echo ************************************ >> ....Documentslogfiles%computername%.log 2>&1

echo ***********[Dump SAM]*************** >> ....Documentslogfiles%computername%.log 2>&1

Echo ************************************ >> ....Documentslogfiles%computername%.log 2>&1

   ..WIPCMDpwdump 127.0.0.1 >> ....Documentslogfiles%computername%.log 2>&1


Echo ************************************ >> ....Documentslogfiles%computername%.log 2>&1

echo ***********[Dump SAM1]*************** >> ....Documentslogfiles%computername%.log 2>&1

Echo ************************************ >> ....Documentslogfiles%computername%.log 2>&1

   ..WIPCMDfgdump 127.0.0.1 >> ....Documentslogfiles%computername%.log 2>&1

[GonZor]

I just tested PwDump.exe Version 1.4.2.0 and the error Service start failed: 2 is caused by not having PwService.exe

You have PwDump Version 1.4.3 i've had problems with some versions so i just stick to what i know works. try disabling your AV completely, it is possible that your AV is blocking pwservice in realtime

[marc]

Sorry, I forgot to mention. I have tried this on multiple machines, all with the same error. Some have AV's, some don't. All give the same error.

[GonZor]

I've been trying to get the same error another way but the only way i can seem to get this error is without pwservice.exe have you tried using version 1.4.2 rather than 1.4.3?

[marc]

My stupidity. I kept the other files in the same DIR as the pwdump.exe, not in the calling directory.