If the Master Boot Record (MBR) or partition information has been damaged by a virus, Windows will not boot. Variants of the TDSS rootkit, for instance, will infect the MBR and remove the system and active flags on all partitions. The purpose of that is to make sure the boot process must active the TDSS rootkit. You’ll know this has happened when all you get is a flashing cursor when attempting to boot from the primary hard drive. It can be easily fixed with the Windows 7 DVD. This process is easier with the Windows 7 DVD than with the Windows 8 or Windows Vista DVD. This solution only works if the hard drive has a MBR. The MBR replacement, GUID Partition Table (GPT), requires a computer with the UEFI instead of the BIOS. GPT is more secure than the MBR.

  1. Boot into the Windows 7 DVD and choose Repair Your Computer.
  2. Startup Repair may run, if it does, let it fix the problem. If it doesn’t, then run startup repair immediately. Then immediately reboot back into the Windows 7 DVD.
  3. Open a command prompt.
  4. If using Windows Vista or later, run the following commands:
    chkdsk c: /f /x (NOTE: The Windows DVD may have the Windows partition another drive letter. Make sure you use that drive letter.)
    bootsect /nt60 sys /force /mbr

    bcdboot c:\windows /s c: (NOTE: The Windows DVD may have assigned the Windows partition another letter. Use the drive letter Windows assigned for c:\windows.)
    diskpart
    select disk # (use the list disk command to get a list of drives and use the # of the boot drive.)
    select partition # (use the list partition command to get a list of partitions on this drive and choose the partition with Windows on it, likely the largest.)
    active
    exit
  5. If using Windows XP or earlier, use the same commands except replace /nt60 with /nt52 in the bootsect command and do not use bcdboot.
  6. Reboot and run TDSSKiller.
Advertisements