Co-Workers laptop BSOD 0x7B

Kaktussoft · 05 Jun 2013

Loope said:

A Description of the Diskpart Command-Line Utility

clean [all]

Use the clean command to remove partition or volume formatting from the current in-focus disk by zeroing sectors. By default, only the MBR or GPT partitioning information and any hidden sector information on MBR disks is overwritten. If you specify the all parameter, each and every sector can be zeroed, and all data that is contained on the drive can be deleted.

"By default, only the MBR or GPT partitioning information and any hidden sector information on MBR disks is overwritten." So it only deletes the MBR sector of the disk, leaving the rest?

Use clean not "clean all".

"Clean" overrides first 1MB of disk with zeros. First 1 sector (512bytes) on disk is the MBR. It consists of:

Disk signature (unique number so windows knows what disk is what. So you can swap cables without issues).
partition table: where starts each partition and its size. alos filesystem type etc.
boot code: The code to run. Actually this code searches the first ACTIVE partition and loads that volume boot sector.

After "clean" first 1MB will be overwritten, so also the MBR. No boot code anymore, no partitions.
"clean all" is handy if you sell the disk... no traces of any files will be on disk

Kaktussoft · 05 Jun 2013

Loope said:

Rocking dude, thank you so very much, I'm going to copy all her files and do a fresh install now that I have the key.

OMG... you already told me to copy all her files

Loope · 05 Jun 2013

ok, just scared me a little, but that makes since. I am booting it up now and will let you know the results. What about that Rootkit, do I need to be closing this topic, and opening a thread in the proper forum?

Loope · 05 Jun 2013

Kaktussoft said:

Loope said:

I tried, but it resolved nothing, and I still received the 0x7B Error.

Very stange. Maybe still a virus(?)

In recovery environment

Code:

diskpart
list  disk (write down the number of internal disk)
select disk x (replace x with correct disk number)
clean
exit

Now everything is gone on internal disk, even mbr virus.

then clean install win7. No need to backup personal files?

Ok, so DiskPart succeeded in cleaning the disk. Now, are you telling me that I need to perform the clean install?

Loope · 05 Jun 2013

Why wouldn't BootRec.exe /fixmbr work to replace re-write the MBR?

Loope · 05 Jun 2013

MBR - Restore Windows 7 Master Boot Record

Kaktussoft · 05 Jun 2013

Loope said:

Why wouldn't BootRec.exe /fixmbr work to replace re-write the MBR?

It does in case you do it when booting from dvd or usb stick. When booting from F8->repair your computer... virus is already active (theoretically).

Maybe an automatic start program reinfected it again? Or an infected driver?
Don't make a new thread for it.... disk has been cleaned already anyway.

Maybe it wasn't a virus at all

Loope · 06 Jun 2013

Alright, the re-install went well, fresh Win7 Ultimate is up and running for her now! Thank you for all your help Kaktussoft!

Kaktussoft · 06 Jun 2013

Loope said:

Alright, the re-install went well, fresh Win7 Ultimate is up and running for her now! Thank you for all your help Kaktussoft!

Check "device manager" .... no exclamation marks/ "other devices"?

Glad you solved it

Loope · 06 Jun 2013

All drivers seem good, no exclamation marks! Now it's just the install hundreds of updates and SP1! Thanks a lot, I've made notes on some of the tools you've showed me, thank you.