Windows 7: 3 Boot records detected. Is this ok?

mrirondream · 03 Dec 2012

I have had this problem on numerous occasions.

I have occasionally noticed before (1 or two times far apart) that Mcafee showed 3 boot records, but put it down to fluke or possibly having a form of harddrive present - but I noticed yesterday that this had happened again, but didn't worry in the hope it would go away. Since then Mcafee has shown 3 boot records on at least 2 other occasions.

After the last scan I restarted the laptop and ran a scan again, with the same result. The only equipment connected to my laptop is a wireless USB mouse I have always used.

Please help?
Should I be worried? No items have been detected in recent scans with the exception of 1 Trojan (W32/sality!dam) which was lurking on a memory stick my friend lent me - an old virus that was successfully removed.

If memory serves correctly I had seen a mysterious 3rd boot record before I connected the USB this morning, although naturally I am now doubting myself.

With thanks, MID

Ztruker · 03 Dec 2012

What do you mean by boot records?

Are you talking about selectable boot entries at startup?

Run bcdedit (no parameters) from an Elevated Command Prompt. What does it show you?

mrirondream · 04 Dec 2012

When McAfee runs a full scan it shows a list of results at the end. One of the fields is "boot records", which usually reads 2. Previous research suggests it's affiliated with master boots and whatnot - ensuring they aren't infected. Am i right in saying all harddrives will contain a "boot record" basically containing startup instructions?

I called up cmd and ran bcdedit, with the following return:

Code:

 
 
Windows Boot Manager
Identifier: {bootmgr}
Device: partition=\Device\HarddiskVolume1
Description: Windows Boot Manager
Lacale: en-US
Inherit: {globalsettings}
Extended input: Yes
Default: {current}
resume object: {(string of numbers)}
display order: {current}
tooldisplayorder: {memdiag}
timeout: 30
customactions: 0x1000085000001
0x5400000f
custom: 5400000f   (string of numbers)
 
Windows Boot Loader
identifier: {current}
device: partition=C:
path: \windows\system32\winload.exe
description: windows 7
locale: en-US
inherit: {bootloadersettings}
recoverysequence: {(string of numbers)}
recoverenabled: yes
osdevice: partition=C:
systemroot: \windows
resumeobject: (string of numbers)
nx: OptIn

MID

mrirondream · 04 Dec 2012

"A Master Boot Record (MBR) is a special type of boot sector at the very beginning of partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond."

This quote from wikipedia suggests each partition would have it's own "boot record" - hence the usual reading of 2. One for the C drive and one for the recovery drive D.

Given that I don't have any mass storage devices connected to my computer, and nothing in the CD tray, the logical conclusion is that perhaps I have another partition on my laptops harddrive.

Unfortunately there are currently no signs of this illusive third partition, and I know not of a way to search for it.

MID

mrirondream · 04 Dec 2012

I just typed partition into the start menu and opened a Disk management program

Here i see 4 subheadings, 3 of which are NTFS:

[C:]
RECOVERY [D:]
SYSTEM

and one of which is FAT32:

HP_TOOLS

Not sure if this helps or not. There are 3 NTFS headings (which I presume are partitions) but none of them look like they would have been made recently.

gregrocker · 04 Dec 2012

Please post back a screenshot of your maximized Disk Management drive map and listings:

1. Type Disk Management in Start

Search box.
2. Open Disk Mgmt. window and maximize it.
3. Type Snipping Tool in Start Search box.
4. Open Snipping Tool, choose Rectangular Snip, click New, draw a box around full drive map and all listings.
5, Save Snip, attach using paper clip in Reply Box.

Tell us what is on each partition.

As you have HP, have you gotten the Clean Reinstall - Factory OEM Windows 7? If not I would strongly consider it since HP has the worst load of preinstalled crapware of any brand which no tech enthuiasts would impose on Windows 7. At least Clean Up Factory Bloatware .

Further, one of the worst problems we see here is MucAfee. I would immediately uninstall it to replace with lean mean Microsoft Security Essentials and keep the Windows 7 firewall and all other Important and optional Windows Updates current.

mrirondream · 05 Dec 2012

Here is my maximised screenshot of the disk management screen:

As for McAfee, I have never had any problems - in fact It's always done a more than adequet job of protecting my PC without glitches so far, so forgive me if I don't immediately change the software I have become accustomed to.

What's on the partitions:

C: All my personal files etc
HP_TOOLS: I have no idea, probably some HP tools
Recovery D: The recovery drive
SYSTEM: presumably system files

MID

gregrocker · 05 Dec 2012

The configuration is correct for an HP preinstall.

Most tech enthusiasts will not run the HP preinstall which has the worst load of sponsored crapware in the industry. Look over these steps involved to get a perfect Clean Reinstall - Factory OEM Windows 7
with Special Notes for HP Owners. There is a minimal Recovery option on newer HP's which is nearly the same.

At the minimum I'd Clean Up Factory Bloatware and Optimize Windows 7 - Windows 7 Forums which should improve performance some.

mrirondream · 05 Dec 2012

Thank you for the advice on increasing performance, but can I please redirect your attention to the problem at hand?

The HP pre-installs should not be the source of my third boot record because I have always had them installed, and yet the scan previously read 2 boot records (with the bloatware).

MID

gregrocker · 05 Dec 2012

I looked at your boot manager output and it looks normal, so I didn't comment upon it but instead - since you mentioned unrelated performance problems - focused on why someone so knowledegable would be running the corrupt factory preinstall which affects all aspects of the OS and boot negatively.

Code:

 
 
Windows Boot Manager
Identifier: {bootmgr}
Device: partition=\Device\HarddiskVolume1
Description: Windows Boot Manager
Lacale: en-US
Inherit: {globalsettings}
Extended input: Yes
Default: {current}
resume object: {(string of numbers)}
display order: {current}
tooldisplayorder: {memdiag}
timeout: 30
customactions: 0x1000085000001
0x5400000f
custom: 5400000f   (string of numbers)
 
Windows Boot Loader
identifier: {current}
device: partition=C:
path: \windows\system32\winload.exe
description: windows 7
locale: en-US
inherit: {bootloadersettings}
recoverysequence: {(string of numbers)}
recoverenabled: yes
osdevice: partition=C:
systemroot: \windows
resumeobject: (string of numbers)
nx: OptIn

Windows 7: 3 Boot records detected. Is this ok?

3 Boot records detected. Is this ok? problems?