win 7 security 2012

Okay then goto the C:\MGtools folder and locate the GetNetInf.bat file and right click it and select Run As Administrator. When it finishes, it will update the C:\MGlogs.zip file. Attach this new log. Do this now before continuing since we will be overwriting this log down below.

I figured out why the resetperm.cmd file just quickly flashed for you. This is the version will only work on 32 bit PCs and you have a 64 bit PC. Download and save the below to your Desktop:

resetperm-x86.cmd


Now right click onresetperm.cmd and select Run As Administrator to run this script. Be patient as this may take awhile to run. Also it is imperative that you Run As Administrator. This is not the same thing as your user account having administrator priviledges.

Once it finishes, reboot your PC.

After reboot, right click on the C:\MGtools\FixWFW.bat file and select Run As Administrator. This will run very fast.

Now download another new version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• C:\MGlogs.zip

 

No. The free versions do not provide any protection and would not get in the way.

Potentially don't know for sure. But don't plug it in right now if it is out unless we ask you to do so. If it is already plugged in, then leave it in.

 

It did. Your BFE registry key has now been added back into the registry.

 

I assume you meant resetperm-x86.cmd ??

Your BFE service is not running but the Windows Firewall service is not. What happens if you try to start the Windows Firewall service by running services.msc from the Run box. Then scroll down in the Services windows to the Windows Firewall and double click on it. Then click Start.

 

What happens if you open a Command Prompt window ( As Administrator like we did earlier ) end then run the below command at the commad prompt

net start mpssvc

 

Also one more thing I need info from. Also run the below two commands from the command prompt window and copy back here what the output is:

sc queryex mpsdrv

sc queryex mpssvc

 

No. You need to have a command prompt window open for all these last requests so that you can see what is printed.

Click Start, All Programs, and then scoll as nessary until you see he Accessories folder and select it. You see something like below.



Right click on the little black icon saying Command Prompt and select Run As Administrator.

A command prompt window should open with a title of Administrator:Command Prompt. Do you get this?? If yes, continue with previous instructions. If not, stop and tell me.

 

That looks like they are running. Let's find out.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip

 

Yes the Windows Firewall service is running properly now.

Are you having any remaining problems?

 

You're welcome.

Is it possible? Yes. But it does not have to be. There are however massive amounts of attacks going on the modify Master Boot Records ( MBR ) on hard disks both internal and external. These are very malicious in nature.

My suggestion is to plug it in and run the TDSSkiller and MBRcheck scans while it is plugged in. I had you run this scans way back in message # 15. Attach the new logs.

Also you could run both Malwarebytes and SUPERAntiSpyware scans on it.

 

Yes what it found is what I was saying about MBR infections.

Code:

    931 GB  [URL="file://\\.\PhysicalDrive1"]\\.\PhysicalDrive1[/URL]   MBR Code Faked!

The MBR on this drive is infected and needs to be repaired.

Do you have your Win 7 Boot DVD? How much data is on this drive and is it backed up to permanent media? Hard disks are not permanent!!!! And they can go bad or get trashed by infections without warning. If the data is important, you need to back it up to DVD if you want to be more secure.

 

No I tend to doubt it. It would have to have a label about Windows 7 installation disk of some type. More than likely Dell hosed you like every vendor does and they did not provide you with a REAL Windows 7 Bootable DVD which is an absolute necessity to have these days. Otherwise you cannot repair Windows problems that are just due to Windows or due to malware.

Since you have so little on it, you should either back this up to your main hard disk which had plenty of free space or you should burn to a DVD. Once you have done this, you can look into ways to repair your MBR which is getting hard and harder to do without an original Windows boot disk because Microsoft keeps shutting down sights that are offering recovery environment only ISO files.


But perhaps you can do the below.


Create a Windows 7 System Repair Disc



Note: the below can only be done if your machine has a a type of CD/R or DVD/R optical drive installed. Also depending on the exact type of OEM your machine has you may be unable to actually create a SRD. The recdisc.exe program just may not even do anything. This link http://windows.microsoft.com/en-us/windows7/Create-a-system-repair-disc maybe useful.

• Click on Start(Windows 7 Orb) >> Run...(or the Windows key and R together) to bring up the Run box, then copy/paste the following command into the box and click on OK:
  • recdisc.exe
• Allow the UAC(User Account Control) prompt via selecting Yes.
• You should now see a menu like the below:-

http://i280.photobucket.com/albums/kk173/Dakeyras_album2/WTSRD1.gif

• Put a blank rewritable CD/DVD in your optical(CD/DVD) drive and then click on Create disc.
• Note: If a AutoPlay window pops up, just close it.
• When the SRD has been created you will see the below:-

http://i280.photobucket.com/albums/kk173/Dakeyras_album2/WTSRD2.gif

• Now click on Close >> OK. Leave the disc in the drive as we will be using it shortly.
• You now have a Windows 7 System Repair Disc.

 

Okay this is excellent however, now just realized that I have never had to repair the MBR on a secondary and also external drive in Win 7. In Win XP you could just tell it which drive to write the new MBR onto, but the Win 7 bootrec /fixmbr command does not appear to have this option and seems to only repair the drive that conains the active Windows partition.

Let's check to see if we can do this another way and possibly simplier if it works. We are going to try using the MBRcheck program that we used previously which showed the below

Code:

\\.\C: --> [URL="file://\\.\PhysicalDrive0"]\\.\PhysicalDrive0[/URL] at offset 0x00000004`67738a00  (NTFS)
[URL="file://\\.\E"]\\.\E[/URL]: --> [URL="file://\\.\PhysicalDrive1"]\\.\PhysicalDrive1[/URL] at offset 0x00000000`00007e00  (NTFS)
[URL="file://\\.\Y"]\\.\Y[/URL]: --> [URL="file://\\.\PhysicalDrive0"]\\.\PhysicalDrive0[/URL] at offset 0x00000000`02738a00  (NTFS)
 
PhysicalDrive0 Model Number: ST9500420AS, Rev: D005SDM1
PhysicalDrive1 Model Number: Iomega External HD, Rev: 
 
      Size  Device Name          MBR Status
  --------------------------------------------
    465 GB  [URL="file://\\.\PhysicalDrive0"]\\.\PhysicalDrive0[/URL]   Windows 2008 MBR code detected
            SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979
    931 GB  [URL="file://\\.\PhysicalDrive1"]\\.\PhysicalDrive1[/URL]   MBR Code Faked!
            SHA1: 2304C4ED1EF1DDA892596B72547B8425078CAFE0

According to this, we want to fix PhysicalDrive1





Please do the following:

• Run MBRCheck.exe
• Wait until you see the following lines:
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
  • Options:
    [1] Dump the MBR of a physical disk to file.
    [2] Restore the MBR of a physical disk with a standard boot code.
    [3] Exit.
    Enter your choice:

• Please push the 'Y' key and then press Enter
• When the program asks you to Enter your choice: enter 2 to Restore the MBR and press the Enter key
• Now the program will ask you to "Enter the physical disk number to fix (0-99, -1 to cancel):"
  • Enter 1 and press the Enter key.
• The program will show Available MBR codes as below

• You need to select your version of Windows frrom the list. So you needto select 5 for Windows 7 and then press Enter.
• The program will prompt for confirmation. Type 'YES' and hit Enter.
• Left click on the title bar (where program name and path is written).
• Restart your PC.
• Now run a new scan with MBRcheck and attach the new log.

 

If MBRcheck does not fix the infected MBR, it may be possible to use a command like below after determining the drive letter of your external drive when you are in the System Recovery Environment. You would just replace the x with your drive letter for the external drive.

bootsect.exe /nt60 x: /mbr


I found this info here >> http://technet.microsoft.com/en-us/library/dd744577(WS.10).aspx

The /nt60 option makes the MBR compatible with Windows® 7, Windows Vista, Windows Server® 2008 or Windows Server® 2008 R2. If you need to use this drive to boot older Windows versions, you would use the /nt52 option which is compatible with Windows versions older than Vista ( like Windows XP ). Since you use Win 7, you really should be using /nt60

 

This is correct and why I was saying to find the drive letter earlier from the System Recovery Environment.

 

Using notepad is too complicated. All you have to do is enter drive letters to change to and then do a dir command until you find the right drive.

For example a sequence like below:

c:\
dir
d:\
dir
e:\
dir
f:\
dir
etc

You should be able to recognize the drive by the contents shown in the dir command output

 

Back in message # 75 you said you made the repair disk. This should be bootable. Perhaps you need to go into your BIOS and change the boot order so that the CD is chosed first. See: http://windows.microsoft.com/en-US/windows7/Create-a-system-repair-disc

 

Then the drive is not drive F. Or somethings was wrong with the command you entered.

Did you use notepad while in the Recovery Console or from normal Windows? I still suggest that you use the DOS dir command to look for the correct drive from the Recovery Console.

 

Interesting! I'm at a loss to explain why it is not working. Let's get a new set of logs from a new version of MGtools to see if we missed anything. Make sure this external drive is still plugged in while running the below.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


Now attach the below log:

• C:\MGlogs.zip

 

Now I'm noticing something not seen earlier and also there has been a change.

When you first posted and even in your previous MGlogs.zip file, the below was seen

Code:

Get Logical Disk Info From WMI                                  
==============================================================  
Description       DeviceID  FileSystem  Size          VolumeName  
Local Fixed Disk  C:        NTFS        481191317504  OS          
CD-ROM Disc       D:                                              

Get Disk Drive Info From WMI                                    
==============================================================  
Model                   Name                Size          
ST9500420AS ATA Device  [URL="file://\\.\PHYSICALDRIVE0"]\\.\PHYSICALDRIVE0[/URL]  500105249280  

Get Partition Info From WMI in K-bytes                          
==============================================================  
Bootable  Name                   Size          Type                     
FALSE     Disk #0, Partition #0  41094144      Unknown                  
TRUE      Disk #0, Partition #1  18874368000   Installable File System  
FALSE     Disk #0, Partition #2  481191319040  Installable File System  

This showed only a C drive on hard disk, but the partition info showed 3 partitions on the hard disk and partition #1 was shown to be the active partition which means that is what you are booting from.

However your new log now shows the below

Code:

Get Logical Disk Info From WMI                                  
==============================================================  
Description       DeviceID  FileSystem  Size           VolumeName  
Local Fixed Disk  C:        NTFS        481191317504   OS          
CD-ROM Disc       D:                                               
Local Fixed Disk  E:        NTFS        1000202240000  Iomega HDD  
Local Fixed Disk  Y:        NTFS        18874363904    RECOVERY    

Get Disk Drive Info From WMI                                    
==============================================================  
Model                           Name                Size           
ST9500420AS ATA Device          [URL="file://\\.\PHYSICALDRIVE0"]\\.\PHYSICALDRIVE0[/URL]  500105249280   
Iomega E xternal HD USB Device  [URL="file://\\.\PHYSICALDRIVE1"]\\.\PHYSICALDRIVE1[/URL]  1000202273280  

Get Partition Info From WMI in K-bytes                          
==============================================================  
Bootable  Name                   Size           Type                     
FALSE     Disk #0, Partition #0  41094144       Unknown                  
TRUE      Disk #0, Partition #1  18874368000    Installable File System  
FALSE     Disk #0, Partition #2  481191319040   Installable File System  
FALSE     Disk #1, Partition #0  1000202241024  Installable File System  

This does show the second hard disk ( the external drive ) as expected, but notice that a Local Fixed Disk Y has shown up now which is partition # 1 which I mentioned above. And it still shows as bootable and it also indicates that this is your Recovery partition from the PC vendor. This did not show earlier. So something in the last fixes has made this show. It almost seems like the fix you did is being applied to this drive and not the external drive which shows here as Local Fixed Disk E.

I also don't like the fact that your Recovery partition is marked as the active partition. This has to be fixed.

Did you backup all important data earlier?

 

Consider doing this.

That's my point. It was always there but it was not showing up with a drive letter before. Only the partition info showed.

Okay but I don't think this explains why it is the active partition which is what I want to change back to your Windows boot partition. This is way I asked about the backups. I would recommend doing that before making any changes.

 

Okay then let's see if we can setup the correct partition to boot from.



First, download gparted-live-0.11.0-7.iso (114 MB)
You will need a blank CD to burn this ISO to. You can burn the .ISO using software like ImgBurn. You can see info on how to do this here >>
Using ImageBurn to Burn an ISO image

Now boot off of this newly created CD.

http://img829.imageshack.us/img829/5772/gpartedsplash.th.png
You should be here...
Press ENTER

http://img5.imageshack.us/img5/7286/gpartedkeymaps.th.png
By default, "do not touch keymap" is highlighted. Leave this setting alone and just press ENTER.

http://img404.imageshack.us/img404/9840/gpartedlanguage.th.png
Choose your language and press ENTER. English is default [33]

http://img140.imageshack.us/img140/7958/gpartedgui.th.png
Once again, at this prompt, press ENTER

Now you should be here:

http://img194.imageshack.us/img194/7753/gpartedboot.th.png
See the column to the far right labeled Flags. We wan to get "boot" put next to your Windows partition instead of your Recovery partition. According to your logs, your OS drive is the 402.06 GB size partition and the Recovery partition is 17.58 GB

If "boot" is not next to your OS drive under "Flags", right-mouse click the OS drive while in Gparted and select Manage Flags

In the menu that pops up, place a checkmark in boot like the picture below:
http://img196.imageshack.us/img196/3483/gpartedmanageflagsboot.th.png

Now double-click the http://img822.imageshack.us/img822/641/gpartedexit.png button.

You should receive a small pop up like this:
http://img88.imageshack.us/img88/8986/gpartedexitreboot.png
Choose reboot and then press OK.

Now reboot into the Windows 7 System Recovery Environment command prompt as you previously did using your CD. And in the command prompt, execute the following commands. Notice the dir command in the list. I want you to take note of what results return for these and which one if either shows your external drive.

• bootrec /fixmbr
• bootrec /fixboot
• dir E:\
• dir F:\
• exit

Now after rebooting normally, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip