BSOD: STOP: 0x0000007B on win7 after removing virus

[gosssamer]

Hi, I have a win7 system on a Inspiron 1545 that a friend gave me to figure out why it wasn't working. I'm an experienced sysadmin and have been working with Windows systems for decades. After some hours, I removed a ton of viruses, including the svchost.exe rootkit.

After the final reboot, the system no longer boots. It fails with "STOP: 0x0000007B", inaccessible boot device.

I've gone through the whole "Troubleshooting Windows 7 Failure to Boot" document (http://www.sevenforums.com/tutorials/219533-troubleshooting-windows-7-failure-boot.html) without success.

I'm confident there are no more viruses and the hard disk passes smartctl and chkdsk.

I've also done Startup Recovery and tried restoring a restore point without success.

The system boots to where the window is assembled, then just keeps rebooting.

I have a Repair CDROM I made when the system did boot, and the Recovery DVDs created by the Dell software on the system, but neither boot and I don't understand why.

Could this be a registry corruption issue?

Could this be a bootrec issue, or has it passed that point in the boot process? I've run bootrec /fixmbr, /fixboot and /rebuildbcd and none worked.

Thanks for any ideas.

 

[Arc]

BSOD stop 0x7B does not allow the computer to boot up, even in safe mode.

A boot virus/bootkit may cause this issue. And, a removal of bootkit resulting to removal of boot files/sectors may also cause the issue (alongwith some other possible causes like a failing HDD, boot priority, or even storage controller mode).

Now please let us see a little more.Do you have access to another computer right now? If so, download Partition wizard Bootable CD (the last one in the link). Burn it in a blank CD or in a USB flash stick.
Boot into Partition Wizards GUI following this instructions. When you are on the last screen, take a camera snap of the screen and upload the snap here.
Screenshots and Files - Upload and Post in Seven Forums

We need to see the partitions and parameters.http://www.sevenforums.com/tutorials/71432-partition-mark-active.html

 

[gosssamer]

BSOD stop 0x7B does not allow the computer to boot up, even in safe mode.

A boot virus/bootkit may cause this issue. And, a removal of bootkit resulting to removal of boot files/sectors may also cause the issue (alongwith some other possible causes like a failing HDD, boot priority, or even storage controller mode).

Now please let us see a little more.Do you have access to another computer right now? If so, download Partition wizard Bootable CD (the last one in the link). Burn it in a blank CD or in a USB flash stick.
Boot into Partition Wizards GUI following this instructions. When you are on the last screen, take a camera snap of the screen and upload the snap here.
Screenshots and Files - Upload and Post in Seven Forums

We need to see the partitions and parameters.

Okay, thanks, please find image attached.

 

[Arc]

I see that the recovery partition is active, and it contains the boot files.

A common virus scan may not be enough for a boot sector virus scan, a bootkit, that is a frequent cause of this BSOD. Scan the computer using a bootable virus scanner. I would suggest Windows Defender Offline

Then Follow it:
Troubleshooting Windows 7 Failure to Start

Or, run Startup Repair for three separate times, with restarts after every single run.
Startup Repair: Run three separate times.

See how it goes. Let us know.

 

[gosssamer]

I see that the recovery partition is active, and it contains the boot files.

A common virus scan may not be enough for a boot sector virus scan, a bootkit, that is a frequent cause of this BSOD. Scan the computer using a bootable virus scanner. I would suggest Windows Defender Offline

That's exactly what I did just prior to this inability to boot. It said it found a virus (I assume the svchost.exe rootkit, since that's what other virus scanners repeatedly found), and prompted to reboot. After rebooting, it just BSOD.

Or, run Startup Repair for three separate times, with restarts after every single run.
Startup Repair: Run three separate times.

I also did this. The first time it said it fixed files preventing the system from booting, but even after at least two more times, it wouldn't boot. The times after the first it said it couldn't fix the system and prompted me to send in a report.

Then Follow it:
Troubleshooting Windows 7 Failure to Start

I've worked through most of this, but have one or two other things to try.

 

[Arc]

Then the remaining things are to back up the data externally and then to perform a clean install.

• For backup: http://www.sevenforums.com/tutorials/93347-copy-paste-windows-recovery-console.html
• For reinstall: http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

If the issue bounces back within reinstall, then we have to think about the HDD.

 

[gosssamer]

Then the remaining things are to back up the data externally and then to perform a clean install.

• For backup: http://www.sevenforums.com/tutorials/93347-copy-paste-windows-recovery-console.html
• For reinstall: http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

If the issue bounces back within reinstall, then we have to think about the HDD.

Do you think there's a possibility it's due to some kind of registry corruption? Should I investigate restoring a registry backup?

When I try to run "sfc /scannow" while in the recovery mode on the win7 install disc, it says it can't run because I was in recovery mode. Is there a way around this? Is there another boot mode where this will work?

 

[Arc]

If restoring the boot records (you are saying that you have already tried that) cannot make the system bootable, then a clean reinstall is the only way.

If you have read the earlier posts carefully, it is already stated that 0x7B will not let the computer to boot in any mode.

 

[gosssamer]

If restoring the boot records (you are saying that you have already tried that) cannot make the system bootable, then a clean reinstall is the only way.

If you have read the earlier posts carefully, it is already stated that 0x7B will not let the computer to boot in any mode.

I understand the system can't boot in any mode. Stop being so judgemental. There may just be someone who knows more than you one day. I was merely thinking there was another Rescue CD or Rescue Mode available from some other product or utility that would enable me to run SFC.

Thanks for your help.

 

[gosssamer]

Is there a way to recover the license number from an unbootable Windows system so I can perform a reinstall?

There used to be a utility for WinXP that I once used but don't remember its name.

 

[Arc]

Is there a way to recover the license number from an unbootable Windows system so I can perform a reinstall?

Well, I dont know, but I will see if anyone knows.

 

[gosssamer]

Is there a way to recover the license number from an unbootable Windows system so I can perform a reinstall?

Well, I dont know, but I will see if anyone knows.

I'm also now considering following these instructions to perform a Dell Recovery since the Recovery DVDs I made with the Dell software don't boot:

Dell 1545 Will Not Boot Into Recovery Partition - General Hardware - Laptop - Dell Community

I'm so annoyed that the recovery media and Windows Rescue disc that I created don't boot. I even tried it on another computer and it also doesn't boot there. It just reports winload.exe is missing.

 

[Arc]

gregrocker suggests these two methods to to attempt a recovery of the product key:

• ProduKey - Recover lost product key (CD-Key) of Windows/MS-Office/SQL Server
• How To Recover Windows 7/8 Product Key From Unbootable Drive

Hopefully you can go for a clean install now.

 

[BorisTheAnimal]

Have you tried using the last known good configuration or are you unable to get to the F8 menu?

If not, do these steps:

1. Restart the PC
2. Press F8 during boot, if you see the Windows logo you'll need to reboot again.
3. On the Advanced Boot Options screen use the arrow-keys and choose Last Known Good Configuration.
4. It should now boot normally.

 

[gosssamer]

gregrocker suggests these two methods to to attempt a recovery of the product key:

• ProduKey - Recover lost product key (CD-Key) of Windows/MS-Office/SQL Server
• How To Recover Windows 7/8 Product Key From Unbootable Drive

Hopefully you can go for a clean install now.

Thanks very much. That's exactly what I remember. Suppose I also could have googled it, so I appreciate it.

 

[gosssamer]

Okay, so I've figured out how to do a full Recovery using the images on the recovery partition instead of the DVD method.

It has the same boot problem that it did previously.

Could this now be an actual bootsector virus? Or perhaps it is a defective hard disk? Or the partition table/MBR is somehow screwed up?

I've searched for a util to check a Toshiba hard disk, but haven't found one. I believe it's the same as the HGST/Hitachi utility?

 

[Arc]

Okay, so I've figured out how to do a full Recovery using the images on the recovery partition instead of the DVD method.

It has the same boot problem that it did previously.

Could this now be an actual bootsector virus? Or perhaps it is a defective hard disk? Or the partition table/MBR is somehow screwed up?

I've searched for a util to check a Toshiba hard disk, but haven't found one. I believe it's the same as the HGST/Hitachi utility?

Image recovery will not help you anyhow in this issue.

We cannot have a crash dump in case of stop 0x7B, so we cannot say what is the actual reason behind it. But my experience says that if it is an infected computer having stop 0x7B, the most feasible solution is a wipe up and start afresh.

I have taken this line because you wanted it in this line. Otherwise the starting place of a stop 0x7B troubleshooting is Seatools for DOS.

 

[gosssamer]

Okay, so I've figured out how to do a full Recovery using the images on the recovery partition instead of the DVD method.

It has the same boot problem that it did previously.

Could this now be an actual bootsector virus? Or perhaps it is a defective hard disk? Or the partition table/MBR is somehow screwed up?

I've searched for a util to check a Toshiba hard disk, but haven't found one. I believe it's the same as the HGST/Hitachi utility?

Image recovery will not help you anyhow in this issue.

We cannot have a crash dump in case of stop 0x7B, so we cannot say what is the actual reason behind it. But my experience says that if it is an infected computer having stop 0x7B, the most feasible solution is a wipe up and start afresh.

I have taken this line because you wanted it in this line. Otherwise the starting place of a stop 0x7B troubleshooting is Seatools for DOS.

So "wipe and start afresh" you mean reinstall from the original media? You seem to know it would work compared with just doing a Recovery. What is the problem that a fresh install would fix and Recovery would not?

I've tested the hard disk and it is fine.

 

[Arc]

So "wipe and start afresh" you mean reinstall from the original media? You seem to know it would work compared with just doing a Recovery. What is the problem that a fresh install would fix and Recovery would not?

I've tested the hard disk and it is fine.

For any problem of things in C drive, recovery is sort of ok (though still not suggested, as it contains factory bloatware and old drivers); but for any problem of the system reserved partition that is beyond repair after trying all known ways to replace teh bootloader there, a clean reinstall is the way.

But at the end, it is your computer, you will decide what you will do. And my action will be conditional of yours. I hope you understand what I am saying.

 

[gosssamer]

So "wipe and start afresh" you mean reinstall from the original media? You seem to know it would work compared with just doing a Recovery. What is the problem that a fresh install would fix and Recovery would not?

I've tested the hard disk and it is fine.

For any problem of things in C drive, recovery is sort of ok (though still not suggested, as it contains factory bloatware and old drivers); but for any problem of the system reserved partition that is beyond repair after trying all known ways to replace teh bootloader there, a clean reinstall is the way.

But at the end, it is your computer, you will decide what you will do. And my action will be conditional of yours. I hope you understand what I am saying.

I figured it out. After performing a Recovery and the system not working, and after thoroughly checking the hard disk for virus and consistency (surface check, etc), I figured I would try and determine the OEM license number from the system to use during a clean install. I even used bootrec from the command-line during a repair session, it still didn't work. It would just blue-screen with 0x7B.

I downloaded this program:

[crap software link removed by admin]

It creates a bootable image (DVD, CDROM, USB key) that can be used to do all sorts of cool things, including recovering license key information. It also has a boot recovery app built into it. Clicking the icons to rebuild the BCD, boot sector, and MBR fixed it, and now it boots successfully.

Using this from the working system before I performed the Recovery probably would have worked as well.

I'd encourage you guys to direct your users to this product page as part of your "Troubleshooting windows booting" document.