Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Wont Boot - bsod - 0x6b


  • Please log in to reply
16 replies to this topic

#1 leachim

leachim

  • Members
  • 125 posts
  • OFFLINE
  •  
  • Local time:12:11 PM

Posted 10 May 2012 - 09:47 AM

BSOD 0x6b - Process1 initialization etc

64 bit machine

Tried to repair it countless times

I used this in rec consol

bcdedit /export c:\bcd_backup
ren c:\boot\bcd.old
bootrec /rebuildbcd

I also tried it with D instaed of C

I see that there are 4 partitions to this drive

system ?
system reserved which is C
OS which is D
Data which is E

The first time I tried it, it worked !
Then on reboot - it went back to bsod

getting fed up with it - am i doing something wrong, or is there another way

Safe mode stops on CLASSPNP.sys

BC AdBot (Login to Remove)

 


#2 PCCom

PCCom

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:11 AM

Posted 10 May 2012 - 12:14 PM

From partition with boot directory
C being that partition letter

bootrec /fixmbr
bcdedit /export c:\bcd_backup
cd boot
attrib bcd -s -h -r
ren bcd bcd.old
bootrec /rebuildbcd

If that doesn't work I'd do a dskchk on the OS partition
chkdsk d: /f /r

#3 leachim

leachim
  • Topic Starter

  • Members
  • 125 posts
  • OFFLINE
  •  
  • Local time:12:11 PM

Posted 10 May 2012 - 01:17 PM

Thankyou for your reply

Sadly no change on the first part

Will try part 2.....

#4 leachim

leachim
  • Topic Starter

  • Members
  • 125 posts
  • OFFLINE
  •  
  • Local time:12:11 PM

Posted 11 May 2012 - 05:39 AM

No joy with part 2

#5 Tek022

Tek022

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:PIke Creek, DE
  • Local time:06:11 AM

Posted 11 May 2012 - 11:19 PM

Since you can get into the Recovery Console, delete (Since you used D as the OS drive, if not, replace with your OS drive letter.) D:\Windows\system32\codeintegrity\bootcat.cache. See if that works. When this error occurs, usually this file is corrupted or the size changes.

Source: http://support.microsoft.com/kb/981833

Edited by Tek022, 11 May 2012 - 11:21 PM.


#6 leachim

leachim
  • Topic Starter

  • Members
  • 125 posts
  • OFFLINE
  •  
  • Local time:12:11 PM

Posted 12 May 2012 - 02:58 AM

Hi

Yes, deleted that one

That folder is still empty, as windows has not yet recreated it.....

#7 leachim

leachim
  • Topic Starter

  • Members
  • 125 posts
  • OFFLINE
  •  
  • Local time:12:11 PM

Posted 12 May 2012 - 03:10 AM

From partition with boot directory
C being that partition letter

bootrec /fixmbr
bcdedit /export c:\bcd_backup
cd boot
attrib bcd -s -h -r
ren bcd bcd.old
bootrec /rebuildbcd

If that doesn't work I'd do a dskchk on the OS partition
chkdsk d: /f /r


Tried this again

and noticed that when I did cd boot, it stayed on the X: directory

Should it have been changed to the C: drive

Anyway - it did that but no change

It blue screens to 0x6b after it says "Starting Windows" with the pulsating icon

Would a driver or rootkit be involved

Trouble is, I would need a bootable cd with utilities on to do this .....

#8 Tek022

Tek022

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:PIke Creek, DE
  • Local time:06:11 AM

Posted 12 May 2012 - 03:45 AM

In order for cd boot to work, you'll have to be on the OS partition. To change to that drive letter, just type D:.

Edited by Tek022, 12 May 2012 - 03:48 AM.


#9 leachim

leachim
  • Topic Starter

  • Members
  • 125 posts
  • OFFLINE
  •  
  • Local time:12:11 PM

Posted 12 May 2012 - 05:37 AM

I tried it all with the D switch, but on cd boot, it said directory not found

I think the boot is on the C drive

Here are some screen shots

T= C drive
U= D drive

Attached Files



#10 leachim

leachim
  • Topic Starter

  • Members
  • 125 posts
  • OFFLINE
  •  
  • Local time:12:11 PM

Posted 13 May 2012 - 04:01 AM

Time is going on, tried loads of things, so I am considering doing a repair reinstall using the Wins 7 disk

Three more things I want to try is


1/ to determine whether there is a rootkit virus - where would i go to find a bootable disk to find this out

2/ Also, how do I check if there is a bad driver involved if i can't boot the damn thing to find out

3/ Would there be errors in the Partition Structure, and how do I determine this


Won't boot into safe mode either - last on the list is CLASSPNP.sys - then BSOD 0x6b error

#11 Tek022

Tek022

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:PIke Creek, DE
  • Local time:06:11 AM

Posted 13 May 2012 - 04:21 AM

  • Using a working computer, download UBCD.
  • Burn the .ISO image file to a CD.
    Follow these instructions if you are not familiar with burning an .ISO image file to disk.
    You may need to configure the BIOS or use the Boot Menu to boot first from the CD.


#12 leachim

leachim
  • Topic Starter

  • Members
  • 125 posts
  • OFFLINE
  •  
  • Local time:12:11 PM

Posted 13 May 2012 - 09:15 AM

Splendid

Done that

How do you use it. Are the any Rootkit utils on there ?

#13 Tek022

Tek022

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:PIke Creek, DE
  • Local time:06:11 AM

Posted 13 May 2012 - 07:53 PM

If you want Rootkit help, post in the Malware Logs board with a DSS log and they'll get started.

#14 leachim

leachim
  • Topic Starter

  • Members
  • 125 posts
  • OFFLINE
  •  
  • Local time:12:11 PM

Posted 14 May 2012 - 02:17 AM

Is DSS on the UBCD ?

#15 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:09:11 PM

Posted 14 May 2012 - 02:27 AM

No it is not. I am not sure why you were asked to create a bootable UBCD CD, but since you have, I can check the MBR and partition table for you.

Please try the following: You will need a USB drive/flashdrive and a new blank writable CD.

:step1: Please do the following on a working computer:

Download UBCD ..... and burn to CD <<<DONE>>>


:step2: Boot the ailing computer with the UBCD CD.
  • (You may have to configure the Boot Menu or BIOS Setup Menu to boot first from the optical/CD/DVD drive.)
  • At the first menu screen, select Parted Magic and press <ENTER>.
    Use Default settings ...
  • At the Parted Magic Desktop, double-click File Manager.
    A new window will open.
  • In the left window pane, click on the folder that represents your flashdrive.
  • Click Tool on the top menu, and choose Open Terminal.
  • Type the following at the hash prompt:

    dd if=/dev/sda of=mbr.bin bs=512 count=1


    Note: Leave a space between the following:
  • dd ... the executable application used to create the backup
  • if=/dev/sda ... the device the backup is created from (the hard drive when only one HDD exists)
  • of=mbr.bin ... the backup file to create - note the lack of a path - it will be created in the directory currently open in the Terminal
  • bs=512 ... the number of bytes in the backup
  • count=1 ... says to backup just 1 sector
    It is extremely important that the if and of statements are correctly entered.
[*]Press the <ENTER> key.
After it has finished a file will be located on your USB drive named mbr.bin.
[*]Remove the USB drive from the ailing computer.
[/list]
:step3: On the working computer:
  • Insert the USB drive, and navigate to the file mbr.bin
  • Zip-up the mbr.bin file:
    • Right-click on the file and choose Send to .. > Compressed (zipped) Folder.
      A zipped folder will appear in the same location as the mbr.bin file.
  • Please attach the zipped file to your next reply.
    This will allow the MasterBootRecord of your drive to be checked to see whether or not it is infected.

Edited by AustrAlien, 14 May 2012 - 02:29 AM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users