BSOD if secondary disk is not plugged in

[djcron]

I have a unique problem.

I have two disks, a primary one with Windows 7 installed on it and a 2TB disk that is supposed to contain data. It seems I was attacked by a rootkit or something and it created a 100MB partition on my secondary drive.

In order to get my computer to boot up again, I had to run windows repair. However, I kept on getting a BSOD on istor.sys when only the primary disk is connected. Mysteriously, the BSOD goes away when the secondary 2TB disk is connected as well. However, once I boot into Windows 7, the 2TB cannot be found anywhere, even in disk management or with partition wizard.

Can anyone explain what is going on?

 

[Arc]

The first part of your issue is obvious. As the boot partition is created on the 2 TB seagate HDD, windows will not boot if that HDD is not connected.

But, the second part of your issue is really interesting. Where are all your partitions. Let us see. Remove all the USB discs and the Canon printer, then do the following:

Download Partition wizard Bootable CD (the last one in the link). Burn it in a blank CD or in a USB flash stick.

Boot into Partition Wizards GUI following this instructions. When you are on the last screen, take a camera snap of the screen and upload the snap here.
Screenshots and Files - Upload and Post in Seven Forums

We need to see the partitions and parameters.

 

[djcron]

See attached screenshot.
I also have another question. I built this pc myself and definitely didn't put a boot partition on the secondary drive. What could have caused that to happen?

 

[Arc]

I also have another question. I built this pc myself and definitely didn't put a boot partition on the secondary drive. What could have caused that to happen?

The answer to the question is there in the screenshot.

Somehow (I dont know how, may be you know) the 100 MB partition on the SSD is a logical partition. Windows cannot boot from a logical partition. So an attempt to a startup repair restored the boot files to the only active partition, that is the HDD.

Do the following:

1. Open the computer, disconnect the HDD, let the SSD be the only connected disc.
2. Set the 100 MB partition as primary: How to Set Partition as Primary | MiniTool Partition Wizard Tutorial
3. Mark the 100 MB partition as active: How to Set Active/Inactive | MiniTool Partition Wizard Tutorial
4. Run Startup Repair for three separate times, with restarts after every single run.

It should add the boot records back to the SSD.

BTW, both the discs are pretty filled up. It looks like the SSD is entirely filled up. So some issue will continue there until and unless you free up at least 10% of the disc capacity.

On a more serious note, if you are sure that you got a rootkit attack (as you said in your first post), the infection may still there. So it would be the best that you format the entire SSD and install windows afresh. That is the best way to eliminate a rootkit successfully.