Member Avatar for Chubbymouse

I cannot boot into my Windows version due to a virus, I was able to boot into another partitioned copy of Windows and access msconfig, which I then selected the virus ridden partitioned and checked "safeboot minimal" but DID NOT select "make change permanant". However now when I boot up it always boots to the Windows 8 partition with the virus, and doesn't even give me the option of selelcted a different partition (boot manager).
So I stuck in a Windows 7 installation disk and hit, Repair you computer, selected the virus'ed parition and opened up command prompt.
I tried:

bcdedit {default} /deletevalue safeboot

but no avail, and I'm not sure why.

full output of bcdedit is below.
F:/ is the virus ridden im trying to remove safeboot from.

identifier        {bootmgr}
device            partition=C:
inherit           {globasettings}
desc              windows boot manager
bit and pieces irelevant


identifier        {default}
device            partition=F:
path              \Windows\system32\winload.exe
desc              windows 8
inherit           {bootloadersettings}
recoveryenabled   yes
osdevice          partition=F:
systemroot        \Windoiws
safeboot          Minimal
safebootalternatshell    No

so {default} safeboot is registered and bcdedit is found and runs ok.
what would be the command to remove the safeboot value as the above didnt work?

Cheers

  • 2 Contributors
  • 1 Reply
  • 635 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by rubberman

Dani AI

Generated

Quick diagnosis and a safe-first checklist. The symptoms show a safeboot flag set in the BCD for the problem entry and the boot manager delivering only that entry (no menu). The usual cause for the delete attempt failing is a command syntax issue or editing the wrong BCD store. From a recovery command prompt verify which entry has the safeboot flag, then remove that specific value.

bcdedit /enum all
bcdedit /deletevalue {identifier} safeboot

Use the exact identifier shown by the first command (it may be a GUID or {default}). If the BCD store lives on a different volume (System Reserved or EFI partition), point bcdedit at that file:

bcdedit /store X:\Boot\BCD /enum
bcdedit /store X:\Boot\BCD /deletevalue {identifier} safeboot

If the boot menu never appears, check the boot manager settings and re-enable the menu/timeout so alternate OS entries can be chosen:

bcdedit /enum {bootmgr}
bcdedit /timeout 10
bcdedit /displayorder {GUID-of-other-windows} /addlast

Replace placeholders with the GUIDs shown by the enum output.

If edits fail, or the machine remains redirected to the infected partition, treat the boot code as suspect. As noted, a boot-sector/MBR infection can hijack startup and persist. From WinRE the standard repair commands are:

bootrec /fixmbr
bootrec /fixboot
bootrec /rebuildbcd

Always back up user data before rewriting boot code. For persistent or unclear infections, remove the drive and scan it with up-to-date rescue media (offline AV rescue disk) or image the drive and clean from a known-good environment. If recovery partitions look compromised, a clean reinstall after data rescue is the safest long-term fix.

Member Avatar for rubberman

It sounds like this virus has also infected the boot loader. You will need to reinstall a clean MBR to this system drive. You can do that with EasyBCD (a bootable CD/DVD drive). Look here for more details: http://www.linuxbsdos.com/2012/03/10/restore-the-windows-bootloader-to-mbr-after-dual-booting-with-linux/

Once you restore the Windows MBR (Master Boot Record - or boot loader), you should be able to boot into the recovery partition. One word of warning however; I have seen some of these viruses also infect the recovery partition, so it will happily reinfect your system if you run it... :-(

When a client of mine gets this badly munged, then I take the drive out of the system, and scan it with about 3 different professional grade A/V/Malware scanners running on a Security Enhanced enterprise class Linux system and manually clean up the broken parts of the Windows system, restoring broken system files, dlls, etc. from a known-good Windows image. I also backup their user files in case we decide that a clean system re-installation is called for. I suspect that may be the case in your situation.

If that is the case, and we decide to reinstall from scratch, then we first do a complete wipe of the system disc, and reinstall from a Windows DVD. Sometimes we have to order the disc from the system manufacturer, or we install from a commercial DVD and download drivers from the system manufacturer after it is back running. The last thing we do is reinstall their user files from the backup.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.