Solved I need a little help with this forum

[Dead Canary]

Unable to repair MBR/BCD/BOOTMGR - Bootrec reports FS not found

((Edit: This thread was in a different section of the forum boards but since it developed further with new data and feedback, most of the accurate information is past the first post. Don't mind the FP I will not change anything in it however but this header. Can any mod/admin change the original name of the thread to the one I placed as title for the first post? Thanks in advance.))

Greetings. It might be a silly question to ask here in Offtopic, but since it would be even sillier to ask elsewhere of these well arranged forums (I don't want to tarnish it with my newbie questions), I'll ask here to try to avoid asking on the wrong place

So my question is as follows:

-I have a problem about a corrupted MBR/BCD and missing OS (floating partitions and other strange fauna), on which section of the forums I shall address my questions about these issues?

Forgive me for my bad spelling, I'm not English speaker Thanks for reading.

PS: I love Win7 rb: a lot, but I want to understand it better, hence I registered here because this place is awesome

 

[Thorsen]

You seem to have quite a few problems there. I will notify a mod to move this thread to the appropriate board. I am not sure if this is should be crashes/debugging or Hardware/drivers.

Are you getting BSoD's (blue screen of death) or is your computer completely dead?

Any error messages on startup?

Can you get to BIOS?

Also thank you for filling in Specs.

 

[Dead Canary]

You seem to have quite a few problems there. I will notify a mod to move this thread to the appropriate board. I am not sure if this is should be crashes/debugging or Hardware/drivers.

Are you getting BSoD's (blue screen of death) or is your computer completely dead?

Any error messages on startup?

Can you get to BIOS?

Also thank you for filling in Specs.

Err... I would fill you up with information about my problem after knowing where to toss my thread about the issue that is breaking a few heads over here. But since you asked, I'll do a small summary of events (ok it didn't turn out into a small summary ) here until I create a proper thread. Here is how it goes:

-The patient in question is a laptop, a SONY Vaio of those, with less than a few months out of the box, and being used as one of the main systems of invoicing and turnover for the small business ran by my associates. It was working fine and dandy up until this morning...

-When I was having my morning coffee at home I suddenly received a call from one of the "employees" asking me to run to the building because the laptop stopped recognizing the OS (error was "Unable to find Operating System" and pressing any key would make that message to echo over and over and over...).

-Went there, he vaguely explained me the story before this event error (apparently related to connecting and moving the cable while the laptop was running, and an alleged strange message he saw at the screen that made him to blindly press the Power Button plenty of times until it rebooted <<< I don't expect anyone to understand this explanation, I myself couldn't when I was listening to him).


At first I thought it was a typical MBR issue. That was fine since I am used to fix those thanks to the original Win7 CDs that I constantly ask the people to keep in a safe with a lock because, you will never know when you will need to use them The problem started after I asked him for the CD of it and he had no idea of where it was. He asked me to fix the problem before the owner (namely the boss of him) returns from a meeting with some customers on the other side of the island. I told him I could use my Win7 DVD but that I didn't know if it would work because I didn't know which kind of Win7 was installed in that certain laptop (boss' laptop by the way).


I went to BIOS (in a SONY Vaio is F2), flipped boot orders inside it, save it, ran the DVD and I proceeded to enter the WinRE tools
Thing is despite the BIOS recognizes the HDD and even DISKPART says all the partitions are healthy, the OS wasn't recognized at the list that appears after you set up your language before entering WinRE. Puzzled I followed steps here:
http://www.sevenforums.com/tutorials/105541-startup-repair-run-3-separate-times.html
http://www.sevenforums.com/tutorials/119713-diskpart-pc-startup.html
http://www.sevenforums.com/tutorials/3413-repair-install.html
All the links listed here too:
http://www.sevenforums.com/backup-r...indows-7-system-recovery-options-see-hdd.html

The list goes on as I checked other sites while I was with the laptop at the building, and now I'm checking again at home to see if I can repair it at least before Monday.

And, I'm stuck there. Despite I try to rebuild the BCD and MBR it goes to no avail. Currently I'm trying to apply all the options in all partitions:
Part 1 = Vol 3 E: Recovery Hidden NTFS
Part 2 = Vol 1 D: System Rese NTFS
Part 3 = Vol 2 C: ???? Raw
Thrice because one of the topics here says so. There is only one Disk 0 to choose.
Still unlucky to make the OS to pop at the menu, and on reboot it says something as uninformative as "A disk read error occurred, Press Ctrl+Alt+Delete to restart", and that's all I get before returning to run the Win7 DVD (the original of this laptop this time).

No BSODs at all (at least the employee didn't mention anything like a splash of blue and white letters before - he never experienced a BSOD in his life! :shock: ). My fairly guess is that at the morning the little niece appeared, messed with the laptop of his dad (the boss) and the employee is covering the kid, but be it as it may, the problem persists. It is a very hard nut to crack :huh:

Edit: I am believing that despite DISKPART says that C: is healthy, it is not accessible (it even lacks a label when I try to list partitions). On CMD.exe I tried to enter to C: by changing the letter from X: to C: and it says this:
"The volume does not contain a recognized file system.
Please make sure that all required file system drivers are loaded and that the volume is not corrupted."
If the partition is not corrupted, can the volume be corrupted instead and that's why I'm not seeing the OS at the WinRE Options? :sarc:

 

[Thorsen]

Do you have an external enclosure you could mount the HDD in? or another computer you could put it in?

It might be a failing HDD as you said it was only months into use, it could be a burn-in failure.

or corrupted partition or MBR as you stated. You seem to have done all the troubleshooting issues I would have tried as well.

You could also try to run Ubuntu from a disk to make sure all other computer components are working properly.

 

[Dead Canary]

Do you have an external enclosure you could mount the HDD in? or another computer you could put it in?

It might be a failing HDD as you said it was only months into use, it could be a burn-in failure.

or corrupted partition or MBR as you stated. You seem to have done all the troubleshooting issues I would have tried as well.

You could also try to run Ubuntu from a disk to make sure all other computer components are working properly.

Hmm, that's tricky, I would gladly dissect this laptop to check out the HDD in one of my sATA coffers but I can't do that without permission, and that will void the warranty of the Vaio (and the boss will behead me afterwards).

If apparently the HDD got damaged, I would expect BIOS to be unable to detect the device but it still does. I can check all its partitions and enter in all them but C: (which remains unlabelled, I suppose due to that corruption).
I used sfc /scannow but says:
"There is a system repair pending which requires reboot to complete. Restart Windows and run sfc again."
If I follow that and run sfc again it echoes the same. That's a dead end.

I must say that I currently switched the active partition to D: which contains the label System Reserve, all the rest are inactive (DISKPART).

Startup Repair drops these errors:

Startup Repair cannot repair this computer automatically.
Sending more information can help Microsoft create solutions.
-> Send information about this problem (will click this since the laptop has online access)
-> Don't send
V Show problem details
Problem signature:
Problem Event Name: StartupRepairOffline
Problem Signature 01: 6.1.7600.16385
""""""""""""""""""""""""""""""""""""""""""""""""""""
Problem Signature 03: Unknown
Problem Signature 04: -1
Problem Signature 05: ExternalMedia
Problem Signature 06: 1
Problem Signature 07: MissingBootManager
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033
Privacy statement blah blah blah

View diagnostic and repair details log
Number of repair attempts: 1
Session details:
System Disk = \Device\Harddisk0
Windows directory =
AutoChk Run = 0
Number of root causes = 1

Test Performed:
Check Updates (passed)
System Disk test (passed)
Disk Failure Diagnosis (passed)
Disk Metadata Test (passed)
Root cause found:
Boot manager is missing or corrupt.
Repair action: File Repair
Result: Failed. Error code = 0x15
Time taken = 0

I notice that last test lasted for 0 ms... This I think would mean it never ran that test, or tried to attempt to do it but it never loaded. I don't know what it means so far, apparently the HDD is healthy but that volume is not. Puzzling.

I'm still with System Reserve set as active. A full reinstall, despite being the easy way is out of question because the boss have sensible programs installed there that (I wish he would listen to me) cannot reinstall again unless he pays again a hefty amount of money to a person that installed that program a couple of weeks ago...

We need to work around trying to make that volume readeable and cooperative to make Windows 7 to take flight. It will be hard but I don't think it is impossible to do

Edit: OH, I forgot to mention, I already ran Hiren's Tool Mini-XP and my Slax (both USB boot). What should I check from there?
Edit 2: I retrieved the DVD from this laptop, is a Windows 7 Home Premium SP1 too. The POST says:
BOOTMGR is missing
Press CTRL + ALT + Del to restart
(that's an improvement from the message:
"The volume does not contain a recognized file system.
Please make sure that all required file system drivers are loaded and that the volume is not corrupted.")
EDIT 3: **censored** he gave me the WRONG DVD! This one is from the server desktop from the other office. BRB, need to call him and ask this guy to give me the friggen DVD of this laptop (IF he asked the shop for it; all vendors must give those CDs/DVDs for free bundled with the new laptops, right? *facepalm and strange urge to strangle certain person rising*)

 

[Dead Canary]

Hmm... I talked to the owner about the ordeal and he searched thoroughly from bow to aft to only find a plastic bag with user manuals for the Sony Vaio. Apparently Sony doesn't include any recovery CDs/DVDs but a partition called "Recovery", which my DISKPART research found on E: and in hidden mode.

I followed the instructions of those manuals, they say to open Vaio Care Rescue by pressing F10, I did and the same error prompt like this one image appears:

I follow the other instructions saying to press Assist Button while the laptop is powered off and the same error appears.


I don't think I will have any access to the "Recovery" partition any time soon (at least not by following what it is written on the user manual). I suppose I will need to access to cmd.exe from anything, maybe from my Slax or my Hiren's to fix all this.

I have one question though, does it matter if I use a different Win7 DVD to access to the WinRE Tools? Since this laptop lacks its own, I thought I could use mine again to fix things, but I'm not sure since I don't know which Win7 is on this laptop and I don't know if using a different Win7 DVD will be advisable :sarc:

PS: At this rate I wish I asked my FP question in a different section of these forums. Please move this one or address me to the proper section before I break something by accident :shock:

 

[DustSailor]

You can use the same Win dvd for repair or recovery, ie Win7 32bit ultimate for same installed OS; it won't work if you try a different DVD.

Why don't you just send it back and get it repaired/brand new?

 

[Dead Canary]

Hmm I see the thread hasn't moved to a different section yet.

You can use the same Win dvd for repair or recovery, ie Win7 32bit ultimate for same installed OS; it won't work if you try a different DVD.

Why don't you just send it back and get it repaired/brand new?

Thanks for answering my question. I am afraid that since I used 2 different DVDs to access the WinRE several times, probably both might have corrupted already something (if that's the effect of using a different DVD installation of Win7 - if not, I want to know the effects of it to see if part of the blame is derived from using those DVDs for fixing the MBR and such ).

On the other hand, I would gladly send the Vaio to Sony but they will just wipe the HDD clean and reinstall Win7, a thing I can do perfectly at home with my Win7 Enterprise DVD. The thing is to fix the current Win7 installation so that it can boot, and apparently I must also need to fix the volume C: if the thing is corrupted (if that part has a fix; if not, I can reinstall Windows from scratch since I can't virtually access any of the data stored inside that C: if it is corrupted and I will not be able to backup everything from it :sarc: ).

Anyway, 2nd day of repair. I'll look around trying to fix the corrupted volume C: and fix the MBR by forcing the code into it from command prompt. I like challenges If I manage to fix everything that way, I'll make you know because I'm sure it will help other people in the future with the same problem

PS: Move thread please, I'm a little in shame here

Edit: Thanks for moving the thread to a better location Right now I'm making use of Partition Wizard to fix the volume C: that morphed from NTFS to RAW by an unlucky series of unknown events. I managed to turn it into a NTFS one now, but I'm doing some surface analysis first to spot inconsistencies just in case it will not work if I reboot straight away I can access the old data in C: by the way, don't think I formatted it from RAW to NTFS. Partition Wizard fixed the error for me.

 

[Dead Canary]

Now it says:
"BOOTMGR is missing. Press CTRL + ALT + DEL to restart."

I'm prying further little by little as the hours passes

One question. I managed to know that this Vaio uses Win7 Home Premium, but it doesn't states if it is 32bits or 64bits. I have my original DVD of my own for Win7 HP but it is 64bits. My question is, will it matter if I use this DVD to access the Windows Recovery tools even if it is for a 64bits version? (chances are 50%~50% that the Vaio is either 32bits or 64bits).


Edit: Accessed DISKPART from F10 before language selection. I gave a look at the current partitions that WinRE observes:
Part 1 - Vol 1 - C: - System Reserve - NTFS - 100 MB Active (Principal type)
Part 2 - Vol 2 - D: - ??????????????? - NTFS - 582 GB Inactive (Logical type)
Part 0 - No Volume - 582 GB Inactive (Extended type)

Tried by switching the active partitions from C: to D: It gave me the following error at trying to activate D:
"Virtual Disk Service Error: the specified partition type is not valid for this operation."

Beating blindly with the cane to see if I reach the solution to the problem. Further research ensues.

Edit2: A bootrec /scanOS says that D:\Windows is a verified windows installation :shock: If so, why all this BOOTMGR missing issue?

Edit3 Third question. I was wondering if I should try to change the logical partition in Vol 2 to a primary one. I don't know if that will fix anything, just thinking that because it is a logical drive I am not able to mark that one as active. Will that change wipe all the data inside D: ?

Edit4: Nevermind, I found myself the answer to question 3. I used Partition Wizard once more from my Hiren's Boot USB, it was a safe bet and now my Logical turned into Primary with no data loss. Now my partitions in DISKPART looks as follows:
Part 1 - Vol 1 - C: - System Reserve - NTFS - 100 MB Active (Principal type)
Part 2 - Vol 2 - D: - ??????????????? - NTFS - 582 GB Unactive (Principal type)

I switched D: to active... What I don't know if I should switch off C: too but since it is a System Reserve, I think I will leave it active for now. Now rebooting to see if it works or if different error messages appear.

Edit 5: (and hopefully the last one) BOOTMGR is still marked as missing, with or without C: active or not. My guess is to fix it with a proper Win7 build... but I don't know if it is 32bits or 64bits... Will try with both after I get my hands at a 32bits one. Fins tomorrow I guess.

 

[gregrocker]

Work through these steps for Troubleshooting Windows 7 Failure to Boot.

Note that the 100mb System Reserved boot partition or Win7 partition must be marked Active for WinRe to know where to repair or rewrite the System boot files. The tutorial shows how to try both, disinfect first, test System Files, try System Restore, or if necessary copy out your files to clean reinstall or run Recovery.

If your OS HD went RAW then the data is unrecoverable and you should test the HD as given, possibly replace it. Your laptop is covered by a one year parts and support warranty.

 

[ICIT2LOL]

Hum just a suggestion but if this is a manufacturer / factory installed OS if you have an image - why not try the factory default settings key? I see from a quick Google the keys at boot are Alt + F10.

But not a good idea if you have load of stuff already loaded and if you haven't got it all imaged or backed up your boss might be a tad erm annoyed.

 

[Dead Canary]

Work through these steps for Troubleshooting Windows 7 Failure to Boot.

Note that the 100mb System Reserved boot partition or Win7 partition must be marked Active for WinRe to know where to repair or rewrite the System boot files. The tutorial shows how to try both, disinfect first, test System Files, try System Restore, or if necessary copy out your files to clean reinstall or run Recovery.

If your OS HD went RAW then the data is unrecoverable and you should test the HD as given, possibly replace it. Your laptop is covered by a one year parts and support warranty.

Hum just a suggestion but if this is a manufacturer / factory installed OS if you have an image - why not try the factory default settings key? I see from a quick Google the keys at boot are Alt + F10.

But not a good idea if you have load of stuff already loaded and if you haven't got it all imaged or backed up your boss might be a tad erm annoyed.

Good morning. Third day of repairing for this unlucky bird.

@gregrocker - Thanks man, I'll make sure to have a look at that thread, I think I haven't browsed that one yet from all the pile of threads I was checking yesterday in these forums. One thing, I already said that I managed to transform the RAW partition to NTFS thanks to Partition Wizard (from my Hiren's Boot USB), and all the data inside that partition is safe and sound. Then I switched it from Logical to Primary afterwards by using Partition Wizard again. Windows installation is in that particular partition by the way (as D:\Windows as stated by SFC /scanOS). I believe I fully tested that the partition is OK in all sense and only the BOOTMGR error is in need of a swat System Reserve and the "Main" one are both active right now.

@ICit2lol - Suggestion noted. As I said in a previous post, before fixing the RAW partition, I tried to use Vaio Care Rescue, a built in utility by SONY that apparently has plenty of tools for data recovery and what not. Problem is that when I tried that (by pressing the Assist button with the laptop powered off and by pressing F10 which is for the models that lack said Assist button), and error like this appeared in both cases:

Which in context was a dead end for me.

As a sidenote, when I tried to repair the RAW partition, apparently the Recovery partition was damaged as well (which might explain why it never loaded because I NEEDED TO ACCESS IT but it would never boot). In essence, when I fixed the RAW and turned it into a full working NTFS with all its data intact, the Recovery partition was wiped out. Now it has no volume nor format asigned, 13GB of floating partition demanding to be merged to something, but I think I will not do it just yet.


Anyway, proceeding to what I gonna attempt to do today in order to make that Win7 installation to boot and fix that dreaded missing BOOTMGR, I have now 2 Win7 HP DVDs, one of 64bits, and the other one... no clue. It is a genuine DVD for recovery issues for the server desktop, same Win7 HP but it doesn't says if it is 32bits or 64bits My last resort is to try to call WinRE from the unknown DVD and pray it is a 32bits one and that it can fix the also unknown ??bits installed in the laptop.

I don't like to place DVDs blindly expecting to guess by luck the correct one. I will carefully follow the tutorials in these forums to try to fix the BOOTMGR missing bit and see if it works with any of the DVDs. It will take hours but, it is better to give it a shot instead of sitting here doing nothing.

Will add data here is there is any progress. Thanks for lending me a hand for this odd ordeal

Edit: After squinting at the little letters and number around the inner ring of the unknown DVD, it is in fact another Win7 HP of 64bits. If odds are like this, my last resort is "witchcraft", but will not surrender yet.

 

[gregrocker]

Everything you need is in Troubleshooting Windows 7 Failure to Boot.

Please explain exactly how your recovered a RAW partition which normally means it is unrecoverable?

With the mess you have your best course of all would be to copy out your data and Clean Reinstall - Factory OEM Windows 7 sticking with the methods given there to maintain a perfect Win7 install.

 

[Dead Canary]

Everything you need is in Troubleshooting Windows 7 Failure to Boot.

Please explain exactly how your recovered a RAW partition which normally means it is unrecoverable?

With the mess you have your best course of all would be to copy out your data and Clean Reinstall - Factory OEM Windows 7 sticking with the methods given there to maintain a perfect Win7 install.

Hmm... Honestly, I have no clue. Confirmed that the partition was in RAW fs, I readed yesterday in another site that someone managed to fix that by using Acronis, and another person answered some posts below that he managed the same results with Partition Magic. Hmm... *checking the list of URLs browsed yesterday*
Oh, right here, in this 881 days old thread I found the tip it moved me to use my Partition Wizard Mini-Tool inside Hiren's:
http://www.sevenforums.com/hardware-devices/48029-help-my-hard-disk-raw-not-ntfs.html

Would love to go the short route and clean reinstall everything, but a sword against my neck is telling me to don't do it, plus, this challenge is something that one must endure, for the sake of experience and to understand Windows better

Edit 1: I'm closer to something...
http://www.sony.es/support/es/product/VPCEH2Q1E_W/specifications

Looks like the 3 models related to the one I have on my desk all use Windows® 7 Home Premium original Service Pack 1 64 bits! Good news, now I don't need to insert DVDs blindly (nor resorting to "witchcraft" to summon a 32bits one). Thanks to a Twitter user for pointing me how to recognize the model of the laptop (they must have a sticker fetish, this one has almost all its belly covered by stickers with numbers, letters, symbols and Elvis' heads :sarc: ).

Edit 2: System Recovery Options recognized the installed OS at last *tears of joy*

Sorry, I couldn't resist my joy. Now the OS is working like the moment before it went haywire on the employee. I'm doing a quick scan and Autoruns.exe to check out if there is anything else to do and spot another problem, but for now, Win7 is flying again I needed to run twice the System Repair before it said he couldn't find anything else wrong. Oh, I'm so glad I found these forums boards, all the gurus camped here rocks me socks, woohoo

 

[gregrocker]

I see from the link that you used Partition Wizard Partition Recovery Wizard which is not the same as formatting over the drive in NTFS to recover a RAW partition. But it's nice to know PW Recovery Wizard which we use all of the time here can do this. Thank you.

 

[ICIT2LOL]

Hey Greg I suppose if DC has a non functioning machine and I know the warranty creeps in here if there is a back up what about slipping in a new HDD and belt an OEM on it then try and get back the data using one of those little gadgets I use for accessing drives while they are outside of the machine.

Anyway DC I suppose that depends on your boss and the importance of the data you had on the original drive.

I am also wondering if you could sweep the offending drive for malware using another machine via the gadget? But it would mean taking out the drive and the warranty issue.

 

[gregrocker]

Either way: one can rescue stranded data by slaving the HD to another system, or using the Win7 DVD or Repair CD to Copy & Paste - in Windows Recovery Console, or a boot CD like Hiren’s BootCD 15.1 or Paragon rescue disk to recover data.

Good reminder to go ahead and run virus scan using your AV and full scan with updated Malwarebytes. I'd also proactively test your system files with SFC -SCANNOW Command

 

[Dead Canary]

Hey Greg I suppose if DC has a non functioning machine and I know the warranty creeps in here if there is a back up what about slipping in a new HDD and belt an OEM on it then try and get back the data using one of those little gadgets I use for accessing drives while they are outside of the machine.

Anyway DC I suppose that depends on your boss and the importance of the data you had on the original drive.

I am also wondering if you could sweep the offending drive for malware using another machine via the gadget? But it would mean taking out the drive and the warranty issue.

Either way: one can rescue stranded data by slaving the HD to another system, or using the Win7 DVD or Repair CD to Copy & Paste - in Windows Recovery Console, or a boot CD like Hiren’s BootCD 15.1 or Paragon rescue disk to recover data.

Good reminder to go ahead and run virus scan using your AV and full scan with updated Malwarebytes. I'd also proactively test your system files with SFC -SCANNOW Command

I am aware about how to retrieve data from a failing HDD, either by entomb it inside one of my coffers or enslaving it to another machine and using either Hiren's or my SlaxOS copy to work around it.
I'm able to retrieve data from brick'd SEAGATEs as well, with the help of some homebrew "device" (I have cute pics about it) to make the bricks to spin past their firmware bug that this kind of model still has (sadly a very widespread model). However I ignore how to pry out a HDD without voiding the warranty or how to "belt" an OEM; sounds fun to try though!

@gregrocker - Just so you can have some laughs, this man bought Panda 2012 a little while ago, and despite I asked him to switch to a better one, he said that until his license permits, he will not switch to another more "capable" AV. Before delivering today the laptop, past night I made a little clean up with CCleaner, his Panda and Malwarebytes I freshly downloaded for the occasion. A little summary of it:
-CCleaner results = 125 GB in trash data
-Panda (after running a full scan for 2 hours!) = 27 cookie virus variants
-Malwarebytes = A troyan tuck inside a CorelDrawX crack (I suppose Panda whitelisted this one?)

(now that I recall it, I ran SCANNOW after using DISKPART to enable both working partitions, said it needed to reboot to apply repairs though and that's what I did with the correct DVD - I'll use SCANNOW right now to double check just in case

Edit: It is curious, I'm doing SCANNOW from WinRE and it still says that there are pending repairs. I reboot and rerun SFC but keeps saying the same. What will that mean? Startup Repair can't find anything strange. Now I'm left puzzled again, but I suppose it is not a serious issue because the computer works fine anyway :huh.

After updating with WU for whatever was slacking behind, I rebooted the system like 4 or 5 times, each time booted faster and faster... With Autoruns I found nothing out of the ordinary, but I suppose his Cobian copy working in the background and asking every time it reboots to allow it to modify files in the system, is making his laptop way slower than it is supposed to be :huh: Either way, the system is healthy after all the work of these past 3 days, and I'm still happy to have found these forums so helpful with all those handy tutorials and gurus

Again, cheers and thanks a lot for the help

 

[richnrockville]

FWIW: I had a friend with a windows XP machine with almost the same symptums (sic...)

I bought and ran Steve Gibson's Spinrite product and it took almost 4 hours but It all worked fine after that and the first thing I did was to make an acronis image....

Rich

 

[gregrocker]

If he has a trojan from cracked software then it's likely there are more and some will not be cleaned up without dedicated searches for the exact tool which cleans it best.

In badly infected systems with dodgy software the best course is a Clean Reinstall after wiping the HD, then after setup capturing a backup image in case the owner can't help his bad self.