Saturday, December 17, 2011

In which I fight bcdedit.exe for a week

I'm fixing a friend's HP Pavilion dv6928us laptop, which got infected with one of those fake system fix malwares. The malware pretended to find all kinds of horrible problems which were about to cause IMMINENT SYSTEM FAILURE and also by the way marked all of the files in her user directory hidden, making it seem like ALL HER FILES WERE GONE OH NO. Tried removing it with half a dozen different tools, no go.

So after doing some attrib -H C:\Users /S /D, backing everything up to an external drive, reformatting C:, restoring Vista from the HP Recovery partition, and installing Microsoft Security Essentials, everything should have been hunky-dory.

Except there was a little chunk of rootkit stuck somewhere in the Master Boot Record or BOOTMGR or something, and MSE kept detecting it and failing to remove it. So I did what anyone* would do and attempted surgery via LiveCD. I backed up the Master Boot Record and the Partition Boot Records, used sfdisk -d to make a text version of the partition table, dd to zero out the whole part of the disk before the start of the first partition, sfdisk to restore the partition layout, and BootICE to reinstall the Vista MBR. Problem solved! Or... not. Somehow, doing that screwed up the Boot Configuration Database so that the laptop would boot Vista but not boot the HP Recovery partition. Well, until that point I didn't know that the BCD existed so I hadn't made a backup of it before reformatting. This then set me off on about a week (I had a cold for much of it so a lot of that week was spent sleeping) of painful wrestling with bcdedit.exe and related tools, absolutely none of which resulted in a working recovery partition.

Then while poking around in the HP-specific areas of the disk, on the off-chance that there was a program named "FIX HP RECOVERY PARTITION BCD ENTRY" (yeah right) I found, against all odds [sfx: angelic chorus] C:\WINDOWS\SMINST\HPRM-BCDFix.cmd.bak.

Well, that was easy.

Of course, before running it I opened it up to see what it did, which seemed to be exactly what it said on the label. I made a copy without the .bak extension and ran it from an Administrator console.

And it worked.

TIL that the answer I'm searching for far and wide is sometimes right under my nose.

*Anyone insane.