Deleted partition with MBR in! Thinkpad T410 won't boot
Hi Experts,
Following a virus infecting a hidden partition (4th, 1.33mb partition) on my Lenovo Thinkpad T410 I followed someone elses successful process of deleting the seemingly unused partition (in virtual disk management under windows it said 100% free space). It seems that partition contained the MBR master boot record, so after removal the laptop no longer boots at all!! Aghhh. There is a Windows7_OS (C:) partition unchanged and intact, also a Lenovo (D:) partition unchanged and intact and one other partition that was called SYSTEM something, also OK but no drive letter assigned.
Is there:
1). A way to rebuild/restore the MBR so it can work again?
2). A way to boot into it some other way temporarily so I can continue working until a solution is found? Some kind of boot disc that does the same thing as the intel boot device that it should be using?
The machine boots from boot CDs (I tried with Windows7 install DVD, but all i can do is reinstall, there's no repair feature. I don't have recovery discs, just the recovery partition, which I cannot get to without the MBR).
- Windows install screenshot attached so you can see drives are in tact.
- Boot screenshot 1 and 2 so you can see what's currently happening.
Please only confident answers not guess work, it's an urgent problem that needs confident, accurate answers - thanks so much experts!
/ Tobzzz
win-install-view.JPG
boot-shot-1.JPG
boot-shot-2.JPG
Following a virus infecting a hidden partition (4th, 1.33mb partition) on my Lenovo Thinkpad T410 I followed someone elses successful process of deleting the seemingly unused partition (in virtual disk management under windows it said 100% free space). It seems that partition contained the MBR master boot record, so after removal the laptop no longer boots at all!! Aghhh. There is a Windows7_OS (C:) partition unchanged and intact, also a Lenovo (D:) partition unchanged and intact and one other partition that was called SYSTEM something, also OK but no drive letter assigned.
Is there:
1). A way to rebuild/restore the MBR so it can work again?
2). A way to boot into it some other way temporarily so I can continue working until a solution is found? Some kind of boot disc that does the same thing as the intel boot device that it should be using?
The machine boots from boot CDs (I tried with Windows7 install DVD, but all i can do is reinstall, there's no repair feature. I don't have recovery discs, just the recovery partition, which I cannot get to without the MBR).
- Windows install screenshot attached so you can see drives are in tact.
- Boot screenshot 1 and 2 so you can see what's currently happening.
Please only confident answers not guess work, it's an urgent problem that needs confident, accurate answers - thanks so much experts!
/ Tobzzz
win-install-view.JPG
boot-shot-1.JPG
boot-shot-2.JPG
ASKER
Unfortunately i cannot get into recovery console to do that! Theres no repair option on my install disc and I don't know of another way.
Note to all: the screenshot i posted of Win7 wasn't of Win7 - in error it was the shot of just before I STUPIDLY deleted the 4th partition!
Note to all: the screenshot i posted of Win7 wasn't of Win7 - in error it was the shot of just before I STUPIDLY deleted the 4th partition!
Can you use your installation disk to create a recovery disk following these instructions?:
http://forums.techarena.in/guides-tutorials/1114725.htm
Bartender_1
http://forums.techarena.in/guides-tutorials/1114725.htm
Bartender_1
for windows 7 repair see here how to do it : http://www.sevenforums.com/tutorials/681-startup-repair.html
Actually you did not delete MBR and you could not delete it as it is located in sector 0 of HDD. To delete MBR you need to fix this sector with zeros.
What you did is delete partition that seemingly contained your BootMGR and Boot folder.
In Parted Magic CD that you are using on first screen shot - are you able to browse these partitions? If yes then check this System partition and see if you have there BootMGR file and Boot folder.
As soon as you provide the answer to this question I will help you to repair your system properly.
What you did is delete partition that seemingly contained your BootMGR and Boot folder.
In Parted Magic CD that you are using on first screen shot - are you able to browse these partitions? If yes then check this System partition and see if you have there BootMGR file and Boot folder.
As soon as you provide the answer to this question I will help you to repair your system properly.
ASKER
Hi Noxcho
I am using Ophcrack boot CD, I used it in the screen shot to delete the highlighted partition. I don't really know how the software works (hence making such a huge error!). Do I need a Parted Magic CD or can I try to browse these partitions using Ophcrack? When you say browse system partition, do you mean the partition labelled SYSTEM_DRV? What would a BootMGR file look like typically, would it be labelled as such?
Many thanks!
I am using Ophcrack boot CD, I used it in the screen shot to delete the highlighted partition. I don't really know how the software works (hence making such a huge error!). Do I need a Parted Magic CD or can I try to browse these partitions using Ophcrack? When you say browse system partition, do you mean the partition labelled SYSTEM_DRV? What would a BootMGR file look like typically, would it be labelled as such?
Many thanks!
ASKER
Ah OK, yes I found a way to browse and found those files/folders. See photo attached.
I'm starting to feel better already - thanks! What now?
ophcrack-boot.JPG
I'm starting to feel better already - thanks! What now?
ophcrack-boot.JPG
Ok, you need now Boot Corrector tools from Paragon Rescue Kit 11 Free CD: http://www.paragon-software.com/home/rk-express/download.html
Download it and execute - it will let you burn CD or USB.
Then boot from this media - select on the first screen - at the bottom find Find OS on local HDD. Does it find anything? If yes then try to boot from found OS. Does it boot?
If yes we go to next step:
Boot again from Rescue Kit - Normal Mode - Boot Corrector - Change Partition Parameters.
On the next screen if you click on partition which is SYSTEM_DRV, does the key active/inactive change to Set Inactive? This will let us check if this System_Drv partition is active. It must be active for successful boot.
If is active then one step back and select Find Windows Installations to correct. There Correct Partition Boot Record. Correct it.
Then again to the start screen of Boot Corrector - Correct Boot Parameters - Correct BCD on selected drive - apply.
Try to boot into Windows after that. Does it boot?
Download it and execute - it will let you burn CD or USB.
Then boot from this media - select on the first screen - at the bottom find Find OS on local HDD. Does it find anything? If yes then try to boot from found OS. Does it boot?
If yes we go to next step:
Boot again from Rescue Kit - Normal Mode - Boot Corrector - Change Partition Parameters.
On the next screen if you click on partition which is SYSTEM_DRV, does the key active/inactive change to Set Inactive? This will let us check if this System_Drv partition is active. It must be active for successful boot.
If is active then one step back and select Find Windows Installations to correct. There Correct Partition Boot Record. Correct it.
Then again to the start screen of Boot Corrector - Correct Boot Parameters - Correct BCD on selected drive - apply.
Try to boot into Windows after that. Does it boot?
ASKER
So far so good! I had to go out to find somewhere to burn the CD, thinkpad wouldnt boot from USB for whatever reason, I checked all bios and boot order putting USB first.
Anyway, made CD, brought it back and i'm up to here:
"Boot again from Rescue Kit - Normal Mode"
I just booted from OS and got into Windows. I'm VERY happy to see all my files and set up as previously!
Anyway, made CD, brought it back and i'm up to here:
"Boot again from Rescue Kit - Normal Mode"
I just booted from OS and got into Windows. I'm VERY happy to see all my files and set up as previously!
So if you use Find OS on HDD - it allows you booting from that. Correct?
ASKER
Yes, I'm in Windows now, backing up databases and outlook befoore I move to your next step :)
:) Ok. Let me know if you have questions.
ASKER
Hi - many thanks. I attach a screen shot of next step, whichever drive I hightlight all the options undernearth seem to be greyed-out/disabled? What does this mean, what is the next step? Thank again...
rescue-kit-partitions.JPG
rescue-kit-partitions.JPG
ASKER
Could I go into Windows virtual disk manager to see if SYSTEM_DRV drive is active if this way doesn't show it? Thanks
Interesting. On my machine it is active and I can change the active flag.
In Windows Disk Management it will show in any case that system_drv is active because Paragon CD forced it to use this CD.
Let's see if we can use trial version of Backup & Recovery 12 Home from Paragon www.drive-backup.com
Download it - install and start it. Change to Full Scale mode and there tools - Recovery media builder. Create the CD and boot machine from it. Select Normal mode - and follow my previous instructions.
In Windows Disk Management it will show in any case that system_drv is active because Paragon CD forced it to use this CD.
Let's see if we can use trial version of Backup & Recovery 12 Home from Paragon www.drive-backup.com
Download it - install and start it. Change to Full Scale mode and there tools - Recovery media builder. Create the CD and boot machine from it. Select Normal mode - and follow my previous instructions.
ASKER
I can only see trial/demo of version 11 here:
http://www.paragon-software.com/home/brh/
Will that work? Perhaps Ophcrack I was using previously would tell me if the drive is active?
Thanks
http://www.paragon-software.com/home/brh/
Will that work? Perhaps Ophcrack I was using previously would tell me if the drive is active?
Thanks
ASKER
By the way, for whatever reason, when I was in Windows and in My Computer, I saw the SYSTEM_DRV was showing as a drive, which is never previously did, it was just hidden away.
ASKER
Would the 'Undelete Partition' option in Rescue Kit 11 not be worth using? I know I would probably have the virus back but presumably I'd have the boot back too?
Yes, B&R11 Home trial will work. You can always undelete this partition but was it your aim originally?
Make the CD from B&R11 and go to it.
Make the CD from B&R11 and go to it.
ASKER
OK success with B&R11... screen shot attached, buttons no longer greyed over. I'm not 100% sure what I should do now, do you want me to click 'Set active' with SYSTEM_DRV highlighted? Please advise.
Re undeleting the partition, i'm very happy the virus has gone (why I removed it) and don't want it back, so I'm sticking with this as you advise. I'm at your command! ;-)
Thanks so much once again.
boot-corrector.JPG
Re undeleting the partition, i'm very happy the virus has gone (why I removed it) and don't want it back, so I'm sticking with this as you advise. I'm at your command! ;-)
Thanks so much once again.
boot-corrector.JPG
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
It worked perfectly, I followed your steps and restarted, it booted into Windows immediately.
I can't tell you how grateful I am, It's such a relief to go back to exactly where I was with my work - thank you so much.
Is there anything else I need do now, to clean up files or anything or that sort?
I can't tell you how grateful I am, It's such a relief to go back to exactly where I was with my work - thank you so much.
Is there anything else I need do now, to clean up files or anything or that sort?
No need to do anything else. But I would start using backup software and taking backups. So if you get virus next time - simply restore from backup and virus is gone.
ASKER
Will do. I assume I can use B&R11 to take a carbon copy of my C:\ to an external drive. I'll look into it or other ways if not. All work is kept externally and cautiously backed up already, just my O/S and software that isn't.
Many thanks once again.
Many thanks once again.
ASKER
Oh, I just noticed that in Windows and My Computer, I can see SYSTEM_DRV as a mounted drive, (F: drive). Should this be hidden?
Nope. Leave it as is. It does not harm your machine or way you work with it.
When you take backup you need to take backup of F: and C: both. You remember that your F: drive has boot data on it? =)
When you take backup you need to take backup of F: and C: both. You remember that your F: drive has boot data on it? =)
ASKER
Good point :-)
http://support.microsoft.com/kb/927392
Hope this helps!
:o)
Bartender_1