Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 7 failing to boot and startup repair doesn't work - MBR infection?


  • Please log in to reply
5 replies to this topic

#1 Scoff123

Scoff123

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:03:32 PM

Posted 17 September 2015 - 09:40 AM

Hello. I am having problems with a Toshiba Satellite laptop that I have been asked to look at by a friend as it started to fail to boot into windows around 2 weeks ago apparently. The OS is Windows 7 Professional.

I am able to access the BIOS fine and the hard drive and memory are recognised correctly, the Toshiba boot screen comes up fine, then the starting windows logo appears very briefly before startup repair launches. Every time I try to repair I get the message saying that Windows was unable to repair the problems automatically. I have tried using the Windows installation dvd for the repair attempt also and then same happens. There are no specific error messages indicating what is wrong, however the following information is given.

 

Root cause found: startup repair has tried several times but still cannot determine the case of the problem.

 

Problem signature:

Problem event name = StartupRepairOffline

Problem signature 01 = 6.1.7600.16385

Problem signature 01 = 6.1.7600.16385

Problem signature 03 = unknown

Problem signature 04 = 21200026

Problem signature 05 = AutoFailover

Problem signature 06 = 18

Problem signature 07 = NoRootCause

OS version = 6.1.7601.2.1.0.256.1

Locale ID = 1033

 

I then tried the recovery console to restore the system to an earlier restore point, however the list of restore points was very short, and the laptop is approx. 3.5 years old, there were only a handful of restore points listed for points in 2014 even after ticking the 'show more restore point' box. I discussed with the owner who said it's fine to try restoring to one of these points, however towards the end of the restore process the restore failed and advised the restore process could not complete. I tried an alternative restore point and the same happened.

 

I have since booted into my comodo rescue cd and run a complete scan on the laptop and it returned completely clear with nothing detected - I had internet connection so definitions were up to date also.

I ran memtest and hard drive checking tools and both returned absolutely fine so it doesn't appear to be hardware related either.

 

I have tried F8 at boot and tried every option available, starting in safe mode, with networking, last known good configuration, and all attempts results in the same where I see the windows log briefly then the repair/recovery launches and fails.

 

I have used the windows RE cmd prompt to run checkdisk which returns fine with no issues. I have also tried running bootrec as explained on the MS knowledge base article and that failed to make any difference.

 

I unplugged the drive and connected it to my pc with sata cables and ran a complete avast scan, and malwarebytes scan, and both scan returned with zero detections. I included scans for rootkits.

The drive is recognised in my pc windows explorer fine, and I can browse all files and folders on there no problem and it all has the structure I would expect, so it would appear to be a boot problem and I am starting to wonder if it could be a virus/malware in the MBR possibly? I can see you can get tools that specifically scan the mbr but some actions after the scan can cause you to lose the manufacturers recovery options and would mean a clean basic windows installation instead, which would then need all the relevant drivers etc, but I could do with some advice here as I've not come across an MBR virus/malware before so no idea if this is indeed what the problem is.

 

The only information I can get as to the last thing done on the laptop before it started doing this was that the owner tried to install either software/drivers for a exercise monitor (you know those wrist bands that hook up to smart phone/pc apps). They had AVG and malwarebytes running on the laptop since they owned it and has been fine with no detections or previous problems of any kind.

 

Is this an MBR infection and if so can anybody help me out please? Thanks in advance.



BC AdBot (Login to Remove)

 


#2 BenjaminGordonT

BenjaminGordonT

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:32 AM

Posted 17 September 2015 - 01:18 PM

I don't think this is a virus... If this was a virus in the MBR or really anywhere on the computer it would be very different... Simply put: it just has a boot issue... I would suggest you contact the owner of the computer and see if you can transfer off all the files and/or make a list of the programs on the computer so you can transfer those off as well... Then reinstall Windows to factory and just reinstall the files and programs as need be... There's always the option of trying to boot from the hard drive on your computer... If it boots then there may actually be a legitimate virus on the computer but if it doesn't then it's safe to say you've just got a corrupted OS...



#3 Scoff123

Scoff123
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:03:32 PM

Posted 17 September 2015 - 03:31 PM

Thank you for your reply. I hope you are right, I'll give booting that drive from my pc a go just to rule it out in that case. I've backed up everything onto another external drive now so can blow the previous OS install away and start from scratch, should the Toshiba recovery partition not work for whatever reason. I've just not come across a boot up problem quite this bad before so started to question if something was lurking in the depths that's all. Will report back either way.



#4 BenjaminGordonT

BenjaminGordonT

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:32 AM

Posted 17 September 2015 - 09:43 PM

Cool let me know...



#5 Scoff123

Scoff123
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:03:32 PM

Posted 25 September 2015 - 06:02 AM

OK so I tried to boot the drive from my own pc and the same behaviour happened. Thankfully the Toshiba recovery partition on the drive was functioning fine so I ran the recovery and returned the drive back to factory defaults. The drive was then able to boot up normally and allowed me to do all udpates and get everything setup properly and the laptop is as good as new again now! Still don't know how it go into that unrecoverable boot state, but I did notice in the users appdata folder there were some CCleaner files so wondering if the owner or someone else had been trying to 'clean/speed up their pc' and somehow royally screwed it up. Anyway all sorted and thankfully no viruses/malware involved.

Thanks again for your reassurance.



#6 BenjaminGordonT

BenjaminGordonT

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:32 AM

Posted 27 September 2015 - 11:07 AM

Anything is possible! With Windows there are about 12 billion ways to screw up the boot and the fact is that it is very common to have that happen... I had to restore my Windows 7 PC the other day because it was royally screwed up... Glad it's fixed for ya!






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users