Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

startup repair loop. command prompt cant find c:


  • This topic is locked This topic is locked
45 replies to this topic

#1 fishe

fishe

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:10:37 PM

Posted 16 November 2012 - 10:22 PM

bought new desktop about a month ago. moved from xp pro to windows 7 64bit. Now windows starts to boot and get a start up repair error. when I go to command prompt, c: cannot be found.... I have a image of my old xp on partition f: windows is trying to boot from f:
I booted from cd drive, parted magic can see my c: partion and all the files are found. Thanks in advanced for your expertise.

BC AdBot (Login to Remove)

 


#2 fishe

fishe
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:10:37 PM

Posted 25 November 2012 - 04:09 PM

please help me...

#3 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:37 PM

Posted 25 November 2012 - 06:38 PM

I booted from cd drive, parted magic can see my c: partion and all the files are found.

You have PartedMagic already: Good! :thumbup2:

Please describe events leading up to this problem.
  • What was happening on the system immediately prior to this problem?
  • You posted in the Am I infected? What do I do? forum:
    • Do you have reason to suspect that the unbootable condition of the computer may have been caused by malware?
  • Were you aware of any signs that malware may have been present on the system?
=================
Let's have a look at the MBR (Master Boot Record) and see where we go from there.
  • Note: Skip the first step, assuming you already have the latest version of PartedMagic.
:step1: On a working computer, please download the latest version of PartedMagic:
Write (in the appropriate manner) the downloaded .iso file to either CD or USB/flashdrive:
Boot the problematic computer from the PartedMagic CD or flashdrive:
  • At the first menu with Default settings (Runs from RAM) selected, press <ENTER>.
    Be patient while PartedMagic loads into memory, and then displays its Desktop.
Success? Let me know if you can successfully boot to the Desktop of PartedMagic, and whether you are using a bootable CD or a flashdrive.

Posted Image
PartedMagic Desktop version 2012-08-09


:step2: At the PartedMagic Desktop, open a terminal window:
  • Locate the black screen/monitor icon (ROXTerm) along the bar at the bottom of the Desktop screen (third icon from the left-side edge).
  • Click on the ROXTerm icon to open a terminal window and at the prompt, type:

    fdisk -l

    Note: There is a space between "fdisk" and "-l".
    That is a lower case L as in Llama and not a ONE.

  • ... and press <ENTER>.
  • Drag your mouse over the output to select it all.
  • Right-click somewhere in the area selected > Copy
    (In the next step, you will paste this in a reply.)
Open Firefox (the Firefox icon is on the Desktop:
  • Hopefully you will have an internet connection already.
  • Go to www.bleepingcomputer.com/forums, sign in and find your topic.
  • Paste the output of fdisk -l in your reply.
Let me know if you have any problems.


:step3: At the PartedMagic Desktop, open a terminal window:
  • Click on the ROXTerm icon to open a terminal window and at the prompt, type:

    dd if=/dev/sda of=mbr.bin bs=512 count=1

  • Note: Leave a space between the following:
  • dd ... the executable application used to create the backup
  • if=/dev/sda ... the device the backup is created from (the hard drive when only one HDD exists)
  • of=mbr.bin ... the backup file to create - note the lack of a path - it will be created in the directory currently open in the Terminal
  • bs=512 ... the number of bytes in the backup
  • count=1 ... says to backup just 1 sector
  • It is extremely important that the if and of statements are correctly entered.
[*]... and press the <ENTER> key.
A file named mbr.bin will be saved to the system in the "root" directory.
Note: This file is saved in memory only and will no longer exist when PartedMagic is shut down.
[/list]At the PartedMagic Desktop, double-click the File Manager icon (on Desktop):
  • A new window will open.
  • In the "root" directory you will see the file that you just created called mbr.bin.
  • Right-click on the mbr.bin file > New > Archive.
  • Under "Archive Format", choose the format .zip from the drop-down menu.
  • Click Save.
  • You should now see the zipped file, mbr.bin.zip in the root directory along with mbr.bin.
Please attach the mbr.bin.zip file to a reply to this topic.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#4 fishe

fishe
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:10:37 PM

Posted 25 November 2012 - 08:27 PM

it has been a while. I believe I was surfing and saw a malware has been blocked screen.
then hours later one of my programs did a update and needed to reboot.. this is a few week old desktop so lots of new things are happening..
I am booting now from a cd of parted magic.

here is the fdisk -l
root@PartedMagic:~# fdisk -l

Disk /dev/sda: 2000.4 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders, total 3907029168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0xc7fb0c4b

Device Boot Start End Blocks Id System
/dev/sda1 * 2048 411647 204800 7 HPFS/NTFS/exFAT
/dev/sda2 417690 1958019247 978800779 7 HPFS/NTFS/exFAT
Partition 2 does not start on physical sector boundary.
/dev/sda3 1958021120 2572421119 307200000 7 HPFS/NTFS/exFAT
/dev/sda4 2572421120 3907026943 667302912 f W95 Ext'd (LBA)
/dev/sda5 2572423168 3238701055 333138944 7 HPFS/NTFS/exFAT
/dev/sda6 3238703104 3907026943 334161920 7 HPFS/NTFS/exFAT
root@PartedMagic:~#


I dont see a way to attach a file to this reply.

#5 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:37 PM

Posted 25 November 2012 - 08:38 PM

I dont see a way to attach a file to this reply.

Click Add Reply under this post, and you will see under the text box the facility to create an attachment.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#6 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:37 PM

Posted 25 November 2012 - 08:53 PM

Sorry, sorry sorry! My mistake! I forgot we are in the Am I Infected forum and we cannot use attachments in this forum!!!

Wait a sec and I will ask that this topic be moved to the XP forum, where you will be able to attach the file.

Sorry about that!
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,026 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:12:37 AM

Posted 25 November 2012 - 08:57 PM

Moved to XP...
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:37 PM

Posted 25 November 2012 - 08:58 PM

Thanks boop!
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#9 fishe

fishe
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:10:37 PM

Posted 25 November 2012 - 09:01 PM

here is mbr.bin.zip

Attached Files



#10 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:37 PM

Posted 25 November 2012 - 09:30 PM

The MBR appears to be fine: No problem there. :thumbup2:

I believe I was surfing and saw a malware has been blocked screen.
then hours later one of my programs did a update and needed to reboot..

Fair enough! It is likely a malware-induced issue, I would think. If that is the case, I will need to hand you over to someone who specialises in dealing with such situations.

Before I do that however, there are a couple of things I would like to ask you about that you stated in your first post:

Now windows starts to boot and get a start up repair error. when I go to command prompt, c: cannot be found.... I have a image of my old xp on partition f: windows is trying to boot from f:

  • Please elaborate on what makes you think the system is trying to boot from F: drive (your old Windows XP image).
  • Please elaborate on what makes you think "c: cannot be found" in the command prompt.
    • What about D:, E: F: ? Can they be found?
    • Use dir to list the contents of any partition that you are in at the command prompt.
  • Please describe what happens when you attempt to get to the Windows Advanced Boot Options menu by tapping F8 on startup: Can you successfully get to that menu?
    • Do you see the option to Repair in that menu list?
    • Please describe what you see happening when you choose to start the computer normally from the Advanced Options Menu.
    • Please describe what you see happening when you attempt to start Windows in Safe Mode (what is the last driver you see loaded?)?
MBR Analyzer v1.1.0

File : C:\Documents and Settings\GEOFF\Desktop\fishe_BC\mbr.bin\mbr.bin

--------------------------------------------------------------

--OFFSET--  0-1-2-3-4-5-6-7-8-9-A-B-C-D-E-F-  0123456789ABCDEF

0x00000000  33C08ED0BC007C8EC08ED8BE007CBF00  3.м.|..ؾ.|.
0x00000010  06B90002FCF3A450681C06CBFBB90400  ...Ph....
0x00000020  BDBE07807E00007C0B0F850E0183C510  ..~..|.......
0x00000030  E2F1CD1888560055C6461105C6461000  ..V.UF..F..
0x00000040  B441BBAA55CD135D720F81FB55AA7509  AU.]r..Uu.
0x00000050  F7C101007403FE46106660807E100074  ..t.F.f`.~..t
0x00000060  2666680000000066FF76086800006800  &fh....f.v.h..h.
0x00000070  7C680100681000B4428A56008BF4CD13  |h..h..B.V...
0x00000080  9F83C4109EEB14B80102BB007C8A5600  ........|.V.
0x00000090  8A76018A4E028A6E03CD136661731CFE  .v..N..n..fas.
0x000000A0  4E11750C807E00800F848A00B280EB84  N.u..~........
0x000000B0  5532E48A5600CD135DEB9E813EFE7D55  U2.V..]..>}U
0x000000C0  AA756EFF7600E88D007517FAB0D1E664  un.v...u.d
0x000000D0  E88300B0DFE660E87C00B0FFE664E875  ..`|..du
0x000000E0  00FBB800BBCD1A6623C0753B6681FB54  ...f#u;f.T
0x000000F0  435041753281F90201722C666807BB00  CPAu2...r,fh..
0x00000100  00666800020000666808000000665366  .fh....fh....fSf
0x00000110  5366556668000000006668007C000066  SfUfh....fh.|..f
0x00000120  6168000007CD1A5A32F6EA007C0000CD  ah....Z2.|..
0x00000130  18A0B707EB08A0B607EB03A0B50732E4  .........2
0x00000140  0500078BF0AC3C007409BB0700B40ECD  ....<.t....
0x00000150  10EBF2F4EBFD2BC9E464EB002402E0F8  .+d.$.
0x00000160  2402C3496E76616C6964207061727469  $.Invalid parti
0x00000170  74696F6E207461626C65004572726F72  tion table.Error
0x00000180  206C6F6164696E67206F706572617469   loading operati
0x00000190  6E672073797374656D004D697373696E  ng system.Missin
0x000001A0  67206F7065726174696E672073797374  g operating syst
0x000001B0  656D000000637B9A4B0CFBC700008020  em...c{.K.... 
0x000001C0  2100079F061900080000004006000000  !..........@....
0x000001D0  011A07FEFFFF9A5F060016A1AE7400FE  ......_...t.
0x000001E0  FFFF07FEFFFF0008B57400009F2400FE  .......t...$.
0x000001F0  FFFF0FFEFFFF0008549900788C4F55AA  .......T..x.OU

---------------------------[ MBR ]----------------------------

MBR_CODE        : 7 MBR Code
MD5             : 60ACE3647B1AEDB757CB947061871BA9
SHA1            : 069BB1DFD571ECBF6AEA98ACF9AE2DA36EEC9913
PARTITIONS      : 4
DISK_SIGNATURE  : 4B0CFBC7
SIGNATURE_ID    : AA55h

-----------------------[ PARTITION 1 ]------------------------

BOOTABLE        : YES
PARTITION_TYPE  : 0x07 ( NTFS / HPFS)
PARTITION_SIZE  : 200 Mo
STARTING_SECTOR : 2048
ENDING_SECTOR   : 411648
TOTAL_SECTORS   : 409600

-----------------------[ PARTITION 2 ]------------------------

BOOTABLE        : NO
PARTITION_TYPE  : 0x07 ( NTFS / HPFS)
PARTITION_SIZE  : 933 Go
STARTING_SECTOR : 417690
ENDING_SECTOR   : 1958019248
TOTAL_SECTORS   : 1957601558

-----------------------[ PARTITION 3 ]------------------------

BOOTABLE        : NO
PARTITION_TYPE  : 0x07 ( NTFS / HPFS)
PARTITION_SIZE  : 292 Go
STARTING_SECTOR : 1958021120
ENDING_SECTOR   : 2572421120
TOTAL_SECTORS   : 614400000

-----------------------[ PARTITION 4 ]------------------------

BOOTABLE        : NO
PARTITION_TYPE  : 0x0F ( Extended [LBA] )
PARTITION_SIZE  : 636 Go
STARTING_SECTOR : 2572421120
ENDING_SECTOR   : 3907026944
TOTAL_SECTORS   : 1334605824

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#11 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:37 PM

Posted 25 November 2012 - 09:34 PM

One more question I forgot. You wrote:

when I go to command prompt

Do you have the Win7 installation disk (DVD), and is that how you are accessing the Recovery Environment (Command Prompt) or are you accessing the RE on the hard drive (F8 > Repair > Command Prompt)?
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#12 fishe

fishe
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:10:37 PM

Posted 25 November 2012 - 09:40 PM

I have been using the command prompt from recovery environment. I think. I can get to it when boot up fails and brings me to startup repair and then maybe advanced..? its been a few days.

I also have a windows 7 profesional dvd 64 bit that came with my pc. and a windows7 drivers and updates dvd

#13 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:37 PM

Posted 25 November 2012 - 09:48 PM

... recovery environment. I think. I can get to it when boot up fails and brings me to startup repair and then maybe advanced..? ............. I also have a windows 7 profesional dvd 64 bit that came with my pc ...

Excellent! That should make things relatively easy for your helper.

Providing information about the other things I asked about may or may not be useful to your helper, but I will await your reply to those matters before requesting assistance for you ... just in case something unexpected crops up.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#14 fishe

fishe
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:10:37 PM

Posted 25 November 2012 - 09:56 PM

when I boot machine it says starting windows. then a start up repair window opens and tries to do repairs.
start up repair cannot repair this computer automatically...
problem signature -- startuprepairoffline 6.1.7600.16385

I dont send error

I click advanced options
recovery tool opens
"opperatin system: window 7 on (f:) windows

which is a old directory moved from my previous computer with xp..

when I click command prompt
console opens x:\windows\system32>
if I c:
dir

it only shows boot
bootmgr
newfolder
bootsect.bak
system volume information

BUT in parted magic I can see all the "normal" windows dirrectiories and files on c:

other partitions show up fine..


f8 I try to boot in safe mode with networking
last driver msrpc.sys

then says starting windows
green scolling loading bar.
blue desktop with small flowers/stems fron right botttom corner..
then start up repair window pops
advanced to recovery still says windows from f:

#15 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:37 PM

Posted 25 November 2012 - 10:03 PM

Excellent! I will now request some specialised assistance for you.

The only comment I would like to make is in relation to what you wrote:

when I click command prompt
console opens x:\windows\system32>
if I c:
dir

it only shows boot
bootmgr
newfolder
bootsect.bak
system volume information

That is normal and to be expected. In the RE, the Win7 System Reserved partition will be referred to as C: and your normal Windows system drive (usually denoted C: when running Windows and the partition where all your personal files will be) will be represented as D:

Please sit tight and be patient for now:
  • I have requested that an experienced helper who specialises in malware-related un-bootable computers respond to your topic.
  • A suitably experienced helper will respond when they are available.

Edited by AustrAlien, 25 November 2012 - 10:03 PM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users