[RESOLVED] Laptop boot sector messed up (I assume) - what can I do?

A few weeks ago, when I turned on my laptop again when XP was loading (it got past the initial screen with the progress bar) there was a black screen with the cursor and nothing happened. I've assumed it's because of a boot sector virus. Unfortunately, I don't have a spare XP disc lying around. (Or rather, I have no idea where it is.)

I downloaded Hiren's Boot CD 9.5 today and burnt it, and loaded it on my laptop. There were many master boot record tools. In fact, here's part of the full list of software on it.

Quote:

---

Partition Tools:
- Partition Magic Pro 8.05 - Best software to partition hard drive
- Acronis Disk Director Suite 9.0.554 - Popular disk management functions in a single suite
- Paragon Partition Manager 7.0.1274 - Universal tool for partitions
- Partition Commander 9.01 - The safe way to partition your hard drive,with undo feature
- Ranish Partition Manager 2.44 - a boot manager and hard disk partitioner.
- The Partition Resizer v1.3.4 - move and resize your partitions in one step and more.
- Smart Fdisk 2.05 - a simple harddisk partition manager
- SPecial Fdisk 2000.03t - SPFDISK a partition tool.
- eXtended Fdisk 0.9.3 - XFDISK allows easy partition creation and edition
- GDisk 1.1.1 - Complete replacement for the DOS FDISK utility and more.
- Super Fdisk 1.0 - Create, delete, format partitions drives without destroying data

Disk Clone Tools:
- ImageCenter 5.6 (Drive Image 2002) - Best software to clone hard drive
- Norton Ghost 11.0.1 - Similar to Drive Image (with usb/scsi support)
- Acronis True Image 8.1.945 - Create an exact disk image for complete system backup and disk cloning.
- Partition Saver 3.50 - A tool to backup/restore partitions.
- COPYR.DMA Build013 - A Tool for making copies of hard disks with bad sectors

Antivirus Tools:
- F-Prot Antivirus 3.16f (1410) - Very good virus scanner (with ntfs support and easy to use menu)
- McAfee Antivirus 4.4.50 (1410) - a virus scanner (with ntfs support and easy to use menu)

Recovery Tools:
- Active Partition Recovery 3.0 - To Recover a Deleted partition.
- Active Uneraser 3.0 - To recover deleted files and folders on FAT and NTFS systems.
- Ontrack Easy Recovery Pro 6.10 - To Recover data that has been deleted/virus attack
- Winternals Disk Commander 1.1 - more than just a standard deleted-file recovery utility
- TestDisk 6.9b - Tool to check and undelete partition.
- Lost & Found 1.06 - a good old data recovery software.
- DiyDataRecovery Diskpatch 2.1.100 - An excellent data recovery software.
- Prosoft Media Tools 5.0 v1.1.2.64 - Another excellent data recovery software with many other options.
- PhotoRec 6.9b - File and pictures recovery Tool.

Testing Tools:
- System Speed Test 4.78 - it tests CPU, harddrive, ect.
- PC-Check 6.0 - Easy to use hardware tests
- Ontrack Data Advisor 5.0 - Powerful diagnostic tool for assessing the condition of your computer
- The Troubleshooter 7.02 - all kind of hardware testing tool
- PC Doctor 2004 - a benchmarking and information tool
- Test Cpu/Video/Disk 5.6 - a tool to test cpu, video, and disk
- Test Hard Disk Drive 1.0 - a tool to test Hard Disk Drive

RAM (Memory) Testing Tools:
- DocMemory 3.1b - RAM Test utility
- GoldMemory 5.07 - RAM Test utility
- Memtest86+ 2.00 - PC Memory Test

Hard Disk Tools:
- Hard Disk Diagnostic Utilities
- Seagate Seatools Desktop Edition 3.02
- Western Digital Data Lifeguard Tools
- Western Digital Diagnostics (DLGDIAG) 5.04f
- Maxtor PowerMax 4.23
- Maxtor amset utility 4.0
- Maxtor(or any Hdd) Low Level Formatter 1.1
- Fujitsu HDD Diagnostic Tool 7.00
- Fujitsu IDE Low Level Format 1.0
- Samsung HDD Utility(HUTIL) 2.04
- Samsung Disk Diagnose (SHDIAG) 1.28
- IBM/Hitachi Drive Fitness Test 4.11
- IBM/Hitachi Feature Tool 2.08
- Gateway GwScan 5.12
- ExcelStor's ESTest 4.20
- MHDD 4.6
- WDClear 1.30
- Toshiba Hard Disk Diagnostic 2.00b
- SeaTools for Dos 1.09
- HDD Regenerator 1.51 - to recover a bad hard drive
- Ontrack Disk Manager 9.57 - Disk Test/Format/Maintenance tool.
- Norton Disk Doctor 2002 - a tool to repair a damaged disk, or to diagnose your hard drive.
- Norton Disk Editor 2002 - a powerful disk editing, manual data recovery tool.
- Hard Disk Sentinel 0.01 - Hard Disk health, performance and temperature monitoring tool.
- Active Kill Disk 4.1 - Securely overwrites and destroys all data on physical drive.
- HDAT2 4.6b - main function is testing and repair (regenerates) bad sectors for devices
- SmartUDM 2.00 - Hard Disk Drive S.M.A.R.T. Viewer.
- Victoria 3.33e and 3.52rus - a freeware program for low-level HDD diagnostics
- HDD Eraser 1.0 - Secure erase using a special feature built into most newer hard drives

System Information Tools:
- Aida16 2.14 - a system information tool, extracts details of all components of the PC
- PCI and AGP info Tool (1410) - The PCI System information & Exploration tool.
- System Analyser version 5.3t - View extensive information about your hardware
- Navratil Software System Information 0.59.16 - High-end professional system information tool
- Astra 5.34 - Advanced System info Tool and Reporting Assistant
- HwInfo 5.1.0 - a powerful system information utility
- PC-Config 9.33 - Complete hardware detection of your computer
- SysChk 2.46- Find out exactly what is under the hood of your PC
- CPU Identification utility v1.12 - Detailed information on CPU (CHKCPU.EXE)
- CTIA CPU Information - another CPU information tool

MBR (Master Boot Record) Tools:
- MBR Work 1.07b - a utility to perform some common and uncommon MBR functions
- MBR Tool 2.2.100 - backup, verify, restore, edit, refresh, remove, display, re-write...
- DiskMan4 - all in one tool for cmos, bios, bootrecord and more
- BootFix Utility - Run this utility if you get 'Invalid system disk'
- MBR SAVE / RESTORE 2.1 - BootSave and BootRest tools to save / restore MBR
- Boot Partition 2.60 - add Partition in the Windows NT/2000/XP Multi-boot loader
- Partition Table Doctor 3.5 - a tool to repair/modify mbr, bootsector, partition table
- Smart Boot Manager 3.7.1 - a multi boot manager
- Bootmagic 8.0 - This tool is for multi boot operating systems
- MBRWizard 2.0b - Directly update and modify the MBR (Master Boot Record)

BIOS / CMOS Tools:
- CMOS 0.93 - CMOS Save / Restore Tool
- BIOS Cracker 4.8 - BIOS password remover (cmospwd)
- BIOS Cracker 1.4 - BIOS password remover (cmospwc)
- BIOS Utility 1.35.0 - BIOS Informations, password, beep codes and more.
- !BIOS 3.20 - a powerfull utility for bios and cmos
- DISKMAN4 - a powerful all in one utility
- UniFlash 1.40 - bios flash utility
- Kill CMOS - a tiny utility to wipe cmos
- Award DMI Configuration Utility 2.43 - DMI Configuration utility for modifying/viewing the MIDF contents.

---

The only one that seemed to have what I require was Partition Table Doctor. I wrote a new MBR with it. At first I got a message saying something like, "VIRUS: PROCEED (Y/N)?", but I assumed that was a built-in BIOS protection. I continued, though I wonder if it even applied the changes because of the BIOS' virus protection being enabled. Anyway, I booted back to XP again, and the same thing happens. I don't feel like downloading a 700MB XP torrent to fix the MBR, so what do you recommend?

Quote:

---

I don't feel like downloading a 700MB XP torrent to fix the MBR, so what do you recommend?

---

And we won't even suggest you doing it in this forum... ;)

What's wrong with the original XP CD that you have? Have you stored any recovery disk that came with the laptop?

I've lost it. That's the problem. I have a valid license, so I see no problem with getting a torrent if that's the case - but of course, it is not allowed here.

I will try disabling BIOS virus protection and writing a new MBR again. I'll get back to you on it in about an hour. In the meantime, if anyone has any alternatives, they're more than welcome.

If you have your XP license (which you should) then you can ask MS to send you the XP disk (which they will when you provide proof). If you find your disk and the recovery console is not present you can download it from Microsoft.

In any case you do not need to download a pirated copy of Windows which may cause you even more problems than you started out with. I suggest, if you do not have the original XP CD and a license; you get a new CD from MS so future problems don't cause you so much jip.

As a side note boot sector viruses are quite rare now. You can usually only infect the boot sector from a bootable disk like a USB disk / floppy or CD ROM which is infected. If indeed there is a virus in the boot sector then to ensure you don't fall victim again set boot sector virus protection on in your BIOS to prevent overwrites of the boot sector and remove all boot devices except your hard disk from your boot list.

And I assume there's a charge for a replacement disc. Thanks for the suggestion, but I'm a skint student who has 10p in his wallet. Also, there's a problem with my laptop. Only about 5% of the time it actually boots from CDs. I have to constantly reboot many times to boot from a disc which is frustrating.

Also, I've changed my opinion. I've decided it is probably not a bootsector virus, but rather, logonui.exe and/or explorer.exe are likely corrupted or missing, for some reason. I've copied the ones from my PC onto a USB drive as well as Linux NTFS-3G drives to write to NTFS with Ubuntu. Now I just need to get the damn thing to boot from the disc.

I'd use some of the programs on Hiren's Boot CD to copy them from the USB, and the file managers are pretty cool - but I highly doubt they support USB, sadly.

This should solve your problems. I use it a lot on clients computers to fix them.

http://www.sysresccd.org/Main_Page

most likely cause is a driver or hardware issue. If your bootsector was invalid, you would get an "OS Not Found" error or something similar. Just the fact you got xp's loading screen tells me that that's not the problem.

Quite right, Most likely it is the partition tables being corrupted. Using the utility I posted the link to will search and recreate the partition table and even the MBR if it does not match the backup copy.

Thanks, but it wasn't very successful. Got the disc to boot after ten attempts, and it loaded. Then...

>> Activating mdev
>> Making tmpfs for /newroot
>> Making tmpfs for /cdrom
>> Attempting to mount media:- /dev/sr0
>> Attempting to mount media:- /dev/sda
>> Attempting to mount media:- /dev/sda1
!! Media not found
>> No bootable medium found. Waiting for new devices...
>> Attempting to mount media:- /dev/sr0
>> Attempting to mount media:- /dev/sda
>> Attempting to mount meda:- /dev/sda1
!! Media not found
!! Could not find CD to boot, something else needed!
!! Running a mini shell (cannot complete the boot process)

I'll keep trying.

Okay, I got it to work, but I thought the thing would have a graphical interface. How on earth am I supposed to copy over the replacement files from my USB using this? I forced mounting of the drive as it otherwise denied access, and now I have...

root@sysreccd /root %

What do I type? I honestly have no idea.

Edit: Never mind, I should have read the manual earlier. :P I found out. I should be okay from here but I'll report back soon.

Wait, how do I copy files from a USB disk to my mounted HD? Midnight Commander isn't very good - or at least, I have no idea how to use it...

Well, NTFS-3G doesn't want to work, and Midnight Commander's just the same as what I have on Hiren's Boot CD. Thanks for the link, but I shouldn't have expected anything better from Lunix. :rolleyes:

can't you do a "repair" install from the xp disk? It recopies all system files again without destroying any data, although you will probably have to reinstall installed programs. Your other choice is to do an "upgrade" install but i think you might have to do that from within windows itself.

Have you tried booting with the debugging output? It should give you a list of all files as they load, and the very last one on the list will most likely be the problem driver.

Quote:

---

Originally Posted by ShaunC193

Well, NTFS-3G doesn't want to work, and Midnight Commander's just the same as what I have on Hiren's Boot CD. Thanks for the link, but I shouldn't have expected anything better from Lunix. :rolleyes:

---

What on earth are are you doing? The link randem gave you is a recovery CD and is likely to mount all your partitions as read only (if it can) and what has drawn you to this opinion?

Quote:

---

Also, I've changed my opinion. I've decided it is probably not a bootsector virus, but rather, logonui.exe and/or explorer.exe are likely corrupted or missing, for some reason. I've copied the ones from my PC onto a USB drive as well as Linux NTFS-3G drives to write to NTFS with Ubuntu. Now I just need to get the damn thing to boot from the disc.

---

How can you be sure? And how can you be sure these files are your problem? I would proceed with caution and do a little more investigation before overwriting files if I were you. In addition the command line is the most powerful tool available in Linux which is probably why the disk boots into it.

This is what I suggest you do:

1. Boot from the CD that randem pointed you toward.
   
2. From the command line type parted or fdisk. Both will show you the partitions on disk (i prefer fdisk though). If the partitions look aright and your Windows partition has the boot flag set then your MBR is ok. If it is not then you can use these utilities to rebuild them.
   
3. Second, check that your Windows partition has been mounted (the drivers for NTFS are already included and at any rate putting a file on a USB disk won't help because it will most probably require recompiling the Kernel too).
   
   If it is not mounted you need to mount it (mount command will help you); if it shows an error you may need to run disk checking utilities on it fsck is the Linux disk check but the disc does include others. If that fails then you may need to look into a lower level recovery.
   
   If you can mount your Windows then BACK UP ALL THE DATA YOU WANT TO KEEP ON A SEPARATE DEVICE (cp command) or take an image of the entire device using the dd command.
   
   Now you have salvaged the data you need you can relax and take your time investigating the problem or waiting for the replacement CD which will probably cost in the region of £16.

As a final note; try booting your PC into safe mode and get some more details of the errors you are receiving. If you PC is not reaching safe mode and displaying no error then re installation is the best of option as there could be 17,000 odd files prevent your computer from starting normally.

The graphical portion can be start using STARTX


You can then use the TESTDISK program (Right click on the desktop) to correct problems. It can scan your disk and recreate partitions if needed.

i also can't stress enough that if you had any kind of partition error (and all the evidence says you don't) then your OS wouldn't even attempt to load, let alone give you the loading screen. You probably wouldn't even get the OS choices menu. If your partition info is messed up, then windows simply doesn't know where it is on the hard drive and can't boot AT ALL. you will get an Inaccessible_Boot_Volume error, or even an "Operating System Not Found" error, or a blinking cursor before the boot screen.

That loading screen isn't stored in the boot sector. It's IN the partition. If the partition is invalid, how on earth could it show it?

Plus, if you've re-written the MBR and have less than four partitions on your main drive, it's already been verified as correct anyway.

Your ONLY options here are to insert the OS disk and do a system repair, or boot to the command prompt and view the error log you create on a bad load with boot logging turned on. It doesn't even have to be your install disk. I just had to make a new install disk myself and i got one off of bittorrent because mine had a scratch on it, which messed up the readability of two critical files (input.dll and fp40ext.cab)

You are incorrect... You can have a bad partition and file system and still get the Windows Welcome screen. That is why that is the first thing he should do is to

1 - Make sure the partition is good.
2 - Make sure the file system is good (Run Checkdsk).

I do this in the computer repair shop so I do know a little about these things...

Unfortunately, the only discs I could find were cut down versions of XP such as Tiny XP. In the process of being cut down, it seems they've had the repair function removed. I know my XP disc is somewhere. I'll try to keep looking. I did try to run a CheckDsk utility that can on Hiren's Boot CD, but it had about 5% done in half an hour. I don't want to be waiting ten hours for such a check.

visualAd, I'm fully aware that it is a recovery disc. And what do you mean, read-only? NTFS-3G has full read and write support for NTFS partitions. I just found the fact that it didn't even have a file browser with a GUI (rather, a DOS-like one that's hard to use) annoying. I am fairly confident that it is explorer or logonui, as I've researched my problem and that has been the solution in many cases. Nonetheless, I will back up my data. As for my comment on Linux, let's just say I'm not particularly fond of it, but that's mainly because there's a kid at my college who goes on about Linux all the time and how it's open-source; of course, you must be cool if you support open-source.

Anyway, I think my neighbour has an XP disc, and he'll probably be up late so I'll go over later or tomorrow and see if I can finally resolve this using the disc. Otherwise, I'll try all of your other suggested solutions. Keep in mind that I can't test your solutions quickly, as it takes literally about thirty reboots until it decides to read a disc.

If your Checkdsk /R or Checkdsk /F is taking a really long time then you definitely have hard disk problems. The new SMART disks will continually swap out bad sectors until it's reserve supply is exhausted then crash. If you were not paying close attention by this time most all is lost.

Quote:

---

Originally Posted by randem

You are incorrect... You can have a bad partition and file system and still get the Windows Welcome screen. That is why that is the first thing he should do is to

1 - Make sure the partition is good.
2 - Make sure the file system is good (Run Checkdsk).

I do this in the computer repair shop so I do know a little about these things...

---

Agreed, and for Christ sake backup your data. :D

I think this is the utility I used: http://www.dposoft.net/#b_hddhid Sorry that I said CheckDsk as it may not work the same way as CheckDsk does. I think the only way to really find out whether it's faulty is to use the CheckDsk utility in the recovery console, which I'll try and do in an hour's time.

Oh, and most of the data on the laptop isn't critical. If I wanted to back it up, I could just use Ubuntu and copy to my USB drive. I just want to get it back to its original state. If that appears to not be an option soon though, I will back up what's worth salvaging.

A check disk can in some cases destroy your partition which is why it is important to backup the data first ;)

I wasn't aware it could do that! Okay, I'll back it up beforehand. ;)

yes i will definitely agree the filesystem can be corrupted or the partition itself. I don't know how clear i was. my point was that i am 100% positive that your boot sector's partition data can't be wrong and still get that screen. I was concerned he was focusing on the boot sector. I in fact have repaired a system myself that showed the loading screen but had a sector error in the MFT. I had to install the hard drive in a different computer to run chkdisk on it. It's a common issue with Hewlett Packards.

I'm running CheckDsk now, but it's annoying as hell. This is the third time it's gotten to 75% and gone back down to 50%. It had better hurry itself up; I have college tomorrow.

Okay, it finally finished, but... nothing. :( I also fixed the boot sector/master boot record. CheckDsk ran fine, so I must assume that I was correct. It's not the boot sector or the hard disk, but rather, a corrupted/delete winlogon/explorer.

Could anyone could recommend a Linux distro that's not too big in size (to download), has full NTFS-3G support and actually has a file browser. (Like Windows' explorer.)

I already gave you one...

evidently chkdisk found errors. When it finds an error, it fixes that error, and then restarts that part of the check again, and in some cases restarts altogether. Example: It finds a MFT sector error. It fixes it. Then it rescans for broken files. The fact it took so long and kept restarting certain parts was very telling.
Since it did a bunch of work, have you tried booting into safe mode afterwards?

Quote:

---

Originally Posted by ShaunC193

I must assume that I was correct. It's not the boot sector or the hard disk, but rather, a corrupted/delete winlogon/explorer

---

Explorer doesn't start until you logon so its not Explorer. Like I have already said, you need to investigate the problem further. Windows uses about 1700 files during its boot process and saying "I assume it is winlogon.exe" is like glancing at a someone who says he is sick and saying "I think it is your heart".

why i was saying to start with bootlogging... Would narrow it down...

I think all but one of us is singing the same song here. Get me a mallet :D

Tried safe mode again, no luck.

randem: I couldn't figure out Midnight Commander. There's no explanation of the controls. :S

Oh, and trust me guys, I wish I had a mallet right now. I'm sorry I can't test everything out at once because this laptop takes fifty reboots to read a disc! ;) However, I have now enabled bootlogging, and I will retrieve the log...

By the amount of times it says, "Did not load driver", is the laptop pretty much screwed?

What controls????? After complete boot type StartX and when the graphical User Interface starts, left click to bring up the menu then select TestDisk...

Everything after that should be a cake walk...

I've done that before. I previously typed Wizard and then selected the graphical interface, and then used testdisk. I've already rewritten the partition tables with it and it hasn't changed anything.

I guess even though it was the perfect setup, I've got no choice but to reformat it now. Not sure what could've corrupted it in the first place. (Oh, and that's if I CAN reformat it. It has extreme difficulty reading from CDs.)

try a repair install first.

I'm afraid the repair option is unavailable. I've tried with a few XP CDs I've located.

As a last resort, I might give BartPE a try.

Did you take a look at the files on the partition to see if you could see them. If you could then you may only need to do a Chechdsk /f or /r to regain access. If Linux can see the files and Windows cannot it is a file system problem.

Yes, I looked and could see the files. And, my apologies, I wasn't aware that chkdsk /f was very different to /r - I only performed chkdsk /r last night. I'll give chkdsk /f a try now.

Okay, I just ran chkdsk again but when I try and do BOOTCFG /SCAN in the recovery console, it says it can't find a Windows installation and it may have been caused by a corrupt filesystem. Yet, it lets me log into the recovery console and do most other things.