Laptop won't boot & Recovery partition corrupt... Rootkit?

Page 2 of 2 FirstFirst 12

  1. Posts : 17
    Windows 7 Home 64-bit
    Thread Starter
       #11

    okay, I've posted the logs as you suggested, under this Security thread: Recovery partition or MBR was damaged

    Thanks for your help!
    Last edited by wwjd; 06 Jun 2013 at 01:36.
      My Computer

  2.    #12

    If you have the System Reserved partition then it most likely had the System boot files and Active flag on it. The Active flag may have moved there once you tried to run Recovery, or during a repair attempt. It's not known viral activity.

    Once you have any infection cleaned up and the System Files checked, I'd move the Active back to System partition and run Startup Repair up to 3 separate times until Win7 starts.
      My Computer


  3. Posts : 17
    Windows 7 Home 64-bit
    Thread Starter
       #13

    gregrocker said:
    If you have the System Reserved partition then it most likely had the System boot files and Active flag on it. The Active flag may have moved there once you tried to run Recovery, or during a repair attempt. It's not known viral activity.
    When you write "moved there," do you mean the System partition, or the Recovery partition?

    My boot flag was originally on the System partition, but it apparently got moved somehow to the Recovery partition (which happened to be missing or corrupt, and thus the inability to boot on Saturday).

    I moved the boot flag back to System yesterday, so that we could boot again, to run the TDSS and FRST scans. I can attempt a reboot back into Recovery tomorrow (by pressing 0 during startup), to test if the boot flag will get moved from that action.
      My Computer

  4.    #14

    The Boot flag means different things in different environments. In Disk Mgmt it means the partition currently booted. In Partition Wizard which we rely most heavily upon here it means where the System boot files reside - which is signified by the System flag in Disk Mgmt. I'm not sure what it means in the Linux app you used but likely System boot files reside there and it is booting the OS.

    Active flag points which partition is to boot, and Recovery can be made to boot in some PC's by marking it Active. So the Active flag might have been moved there when you attempted to run Recovery.

    To repair Win7 once it's disinfected (if so) and system files checked, we mark the partition intended to boot Win7 Active and run Startup Repair - Run up to 3 Separate Times
    until Win7 starts and its boot partition holds the System flag meaning the System files are booting from there. It explains in the tutorial why it's run 3 times, and why this is the most comprehensive method to repair or rewrite the System boot files.
      My Computer


  5. Posts : 17
    Windows 7 Home 64-bit
    Thread Starter
       #15

    FYI, I tried booting from the Recovery partition again, and that still doesn't work. Nor did that action cause my boot flag to move from System to Recovery partition, which means that something else did.

    In summary, my Toshiba laptop does boot right now, from System partition, because I had manually moved the boot flag back to it. TDSS and MWB scans were negative but run from regular (not safe) mode.

    However, my Recovery partition is damaged/gone for whatever reason, and thus, I don't trust this hard drive anymore and feel compelled to run a 0-fill wipe and restore from my recovery DVDs (in order to re-install a clean OS).

    @gregrocker: Can you please clarify your suggestion that I run Startup Repair 3 times? On or from which partition? Do you still feel that is helpful in my situation, because it will at least provide some info on what exactly happened?

    What about the tutorial on Windows Failure to start? Do you still think I should go through those steps? Thanks.
      My Computer

  6.    #16

    Startup Repair will check for any problems and attempt to repair them if it finds any, so yes it is a good idea even if its booting.

    I would not be too worried about being hijacked since there isn't any infection known to move the Active flag. Do you have other symptoms more related to performance which make you think you've been infected?

    However if you are still running factory preinstalled Win7 that is a corrupt install to begin with, larded with smothering bloatware and useless duplicate utilities that have much better versions built into Win7. So I would unleash Win7's native performance by doing what most tech enthusiasts do to Clean Reinstall - Factory OEM Windows 7.

    Everything you need is in the link to get and keep a perfect install, as long as you stick with the tools and methods given.
      My Computer


 
Page 2 of 2 FirstFirst 12

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 05:19.
Find Us