{"id":52,"date":"2011-08-01T02:44:05","date_gmt":"2011-08-01T02:44:05","guid":{"rendered":"http:\/\/triplescomputers.com\/blog\/?p=52"},"modified":"2011-12-15T09:47:35","modified_gmt":"2011-12-15T14:47:35","slug":"tdl4-removal-leads-to-windows-7-64-bit-stop-error-on-boot","status":"publish","type":"post","link":"https:\/\/www.triplescomputers.com\/blog\/casestudies\/tdl4-removal-leads-to-windows-7-64-bit-stop-error-on-boot\/","title":{"rendered":"TDL4 removal leads to Windows 7 64-bit stop error on boot"},"content":{"rendered":"

I’m proud to say that it’s been literally two years since I’ve reformatted a PC due to malware, and I’ve disinfected many hundreds in that time period. But yesterday, I encountered a PC infected with TDL4 (which I’ve dealt with many times), however this one was a Windows 7 64-bit machine. Following removal of the rootkit offline via TDSSKiller in WinPE (set to scan Boot Sectors only), the PC began crashing on every boot, even when Safe Mode was attempted. The typical invasive offline procedures I use to rectify these issues — such as the disabling of nearly all third-party filesystem and NDIS filter drivers — did nothing to correct the issue. Restoring a previous System Restore point and even manually restoring the registry hives from the RegBack folder also accomplished nothing.<\/p>\n

Finally, I decided to backup\/restore the BCD. To do this, I used a Windows 7 recovery disc (in my case, ERD\/MS DART) and opened a command prompt. From there, I (mostly) just followed the Microsoft guidelines for restoring a corrupted BCD:<\/p>\n

\n

c:
\nbcdedit \/export C:\\BCD_Backup
\nattrib -s -h c:\\boot\\bcd
\nren c:\\boot\\bcd bcd.old
\nbootrec \/fixmbr
\nC:\\boot\\bootsect.exe \/nt60 all \/force
\nbootrec \/RebuildBcd
\nbootrec \/FixBoot<\/p><\/blockquote>\n<\/div>\n

(Note that C: must be replaced with the relevant Windows drive.)<\/p>\n

This corrected the issue on this PC. I hope this helps someone in the future!<\/p>\n","protected":false},"excerpt":{"rendered":"

I’m proud to say that it’s been literally two years since I’ve reformatted a PC due to malware, and I’ve disinfected many hundreds in that time period. But yesterday, I encountered a PC infected with TDL4 (which I’ve dealt with … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[27,28,29,11,32,47,26,15,45,16,46,48],"class_list":["post-52","post","type-post","status-publish","format-standard","hentry","category-casestudies","category-security","tag-blue-screen","tag-blue-screen-of-death","tag-bsod","tag-malware","tag-rootkit","tag-rootkit-removal","tag-stop-error","tag-tdl","tag-tdl4","tag-tdss","tag-virus-removal","tag-windows-7"],"_links":{"self":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/posts\/52","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/comments?post=52"}],"version-history":[{"count":0,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/posts\/52\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/media?parent=52"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/categories?post=52"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.triplescomputers.com\/blog\/wp-json\/wp\/v2\/tags?post=52"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}