Reparing Windows XP on a dual boot setup

Fried Egg · 12-23-2009, 03:39 AM

Hi,

I have a KDE linux package dual booting with Windows XP.

Unfortuantely, my XP installation has a problem, I think I need to repair the installation by booting from the XP CD. However, when I boot from the CD, it cannot recognise the master partition and so it can't see the existing installation to repair.

Is it possible to add the Windows CD as a start option on the GRUB bootloader, so that when I select this option, it boots from the CD but can see my windows partitions?

Alternatively, I saw this article on how to uninstall the GRUB bootloader which would presuably allow the XP CD to see my windows partitions and repair XP? Afterwards I could restore the bootloader as before?

Or perhaps I am going about this entirely the wrong way?

Any help would be much appreciated, I am a Linux newbie!

syg00 · 12-23-2009, 04:03 AM

That will only work when/if you can boot the CD.
Before that, start a Linux terminal and run

Code:

su -c "/sbin/fdisk -l"

Put your distro in your profile to get decent/relevant answers.

ongte · 12-23-2009, 07:05 AM

KDE is not Linux distro. You gotta tell us what distro you're running.

The XP CD not seeing the XP partition should be nothing to do with grub or linux.(Unless you did something in linux to mess it up)

The partition/filesystem is probably broken in some way.
Boot into linux & check it out with fdisk -l. Posting the output here might help us.
See if you are able to access the Windows partition from Linux.

johnsfine · 12-23-2009, 07:21 AM

As the others implied, we can't give you good suggestions on how to repair it without better information on what is wrong.

The output of fdisk -l is the key first piece of that better information.

Quote:

Originally Posted by Fried Egg

my XP installation has a problem

A little explanation of what that means would also help. Can you still boot XP? If not, what error message do you get and/or at what step of the process does it hang?

Quote:

it cannot recognise the master partition and so it can't see the existing installation to repair.

Hopefully looking at the partition in Linux (with fdisk and maybe other tools) can tell us what the XP CD doesn't like about the partition.

Your Windows partition should be a primary partition and should be marked as bootable and should be the only primary partition marked as bootable (bootable Linux partitions have no reason to be marked as bootable in the partition table). Fdisk can be used to change which partition is marked as bootable.

Quote:

Is it possible to add the Windows CD as a start option on the GRUB bootloader, so that when I select this option, it boots from the CD but can see my windows partitions?

I don't think the version of GRUB normally installed on disk has the ability to chain load or otherwise transfer control to a CD. IIUC, that is a build time option in GRUB that is not normally built. I'd like that feature myself for other purposes (so if it is there and I just don't understand how to use it, hopefully some expert will tell me).

But in your situation, even if it could do so, it probably wouldn't help. The software on the CD probably still wouldn't like the Windows partition.

Quote:

I saw this article on how to uninstall the GRUB bootloader which would presuably allow the XP CD to see my windows partitions and repair XP?

Destroying Linux before finding out whether you can fix XP is generally unnecessary and foolish. In this case, after you destroyed Linux, whatever is wrong with the Windows partition to make it unrepairable by CD would still be there and make the fixmbr fail as well.

Skaperen · 12-23-2009, 08:00 AM

Yes, the output of "fdisk -l" could tell us a lot. It may be the case that the partition table has lost the XP partition, or changed it's starting point or size, from where it was originally installed. That would make XP unbootable as well as hide the XP installation from the CD. A change in geometry setting could also affect this. You may even see the XP partition listed, but the location information may now be wrong.

If the XP partition is affected, you will need to remember exactly what sectors it originally started on, and rebuild the partition table. If you don't know this information, it could take some work to scan the disk to discover just where it is (but it still could be less work than starting over and re-installing).

1. What distribution
2. Output of "fdisk -l"
3. Do you have a Linux Live CD/DVD handy?
4. Do you have backups of your data?

Fried Egg · 12-23-2009, 11:51 AM

Thanks for your help guys, sorry for the lack of info thus far. I shall attempt to remedy that.

I have Simply Mepis 6.5 (don't know how to ascertain the exact version) 32 bit.

The results of the command 'su -c "/sbin/fdisk -l"' are as follows:

Code:

Disk /dev/sda: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1        2550    20482843+   7  HPFS/NTFS
/dev/sda2            2551       60800   467893125    f  W95 Ext'd (LBA)
/dev/sda5            2551       59996   461434963+   7  HPFS/NTFS
/dev/sda6           59997       60761     6144831   83  Linux
/dev/sda7           60763       60800      305235   82  Linux swap / Solaris

I do have the live CD handy if I need it but I haven't got my essential data backed up yet!

Now, what exactly is the problem with WinXP someone asked? Basically, I got attacked by some kind of trojan virus that AVG Free Edition failed to fend off/deal with. It kept detecting the threat but was unable to kill it (due to either locked files or limitations of the free version?). Anyway, the next time I booted up to XP, as it's about to present the logon screen, it instead crashes out with the following message: "c000021a - Fatal System Error. Windows logon process terminated unexpectedly. 0xc000135. The system has been shut down." (paraphrasing slightly). I presume the virus has killed the logon process somehow. Anyway, I made a Kasperspki rescue disk and I believe I am now virus free. However I still can't get into XP.

My thinking is that if I boot with a Windows XP disk, I should be able to repair the system files and all will be well again. Unfortunately, when it lists the partitions, it only lists one and says that it is "unrecognized". I don't think it's shagged though because I followed the instructions in this article and was able to mount the windows drive in linux.

So, that's about it, I don't know what else to try other than removing the GRUB and seeing if the XP CD can then repair the install.

johnsfine · 12-23-2009, 12:07 PM

Quote:

Originally Posted by Fried Egg

I do have the live CD handy if I need it but I haven't got my essential data backed up yet!

The point of a liveCD is that it is a Linux environment you can boot and run without depending on the hard drive.

You could use the Mepis liveCD to reinstall Mepis, but that is not the reason you should be using it now.

At this point, you should boot into the Mepis liveCD and use fdisk or gparted to find out what the partition table really looks like.

I think you have a boot sector virus that makes the partition table look right when booted from the hard drive, but the partition table actually isn't right.

To see if that is correct and to fix it if it is correct, you must be booted from a CD. A Linux liveCD is best.

Quote:

I don't know what else to try other than removing the GRUB and seeing if the XP CD can then repair the install.

I think that is a very bad idea. It won't fix anything and it may corrupt things much further (if a boot sector virus really is playing games with your partition table) and it just takes away a resource that can be helpful during the repair (once you're really sure what is wrong).

What you see from the XP CD is not consistent with what you see in Linux fdisk. Until you know why those are different, you don't know what to repair.

Fried Egg · 12-23-2009, 01:04 PM

Ah...well I think you may be right about a boot sector virus.

I tried the XP CD again and it reports only the following unformatted partitions:

C:Partition 1 [Unknown] 131072 MB.

Then I tried booting up to linux again but I don't even get to the GRUB menu anymore, the screen just goes black with a motionless cursor in the top left of the screen.

I've now booted up with the Live CD and fdisk is now reporting this:

Code:

Disk /dev/sda: 500.1 GB, 500107862016 bytes
86 heads, 15 sectors/track, 757188 cylinders
Units = cylinders of 1290 * 512 = 660480 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1      208090   134217727+   4  FAT16 <32M

Disk /dev/sda1: 137.4 GB, 137438952960 bytes
86 heads, 15 sectors/track, 208089 cylinders
Units = cylinders of 1290 * 512 = 660480 bytes

     Device Boot      Start         End      Blocks   Id  System
/dev/sda1p1   *           1      208090   134217727+   4  FAT16 <32M

It seems like I'm going from bad to worse!

But if it's a boot sector virus, why didn't Kasperski rescue disc pick it up? Perhaps I should try a different rescue disc?

johnsfine · 12-23-2009, 01:11 PM

Hopefully the partition table you posted in post #6 represents the undamaged table.

I don't know the right tools myself. Probably some other expert here can give you better instructions, but working booted from the Mepis CD it is possible to patch the partition table back to what is shown in your post #6 without initializing or modify the contents of the partitions. Then you can verify that the Linux filesystem and Windows filesystems are OK, then the XP CD may be able to repair Windows, then using the Mepis CD again you can repair GRUB.

Fried Egg · 12-23-2009, 01:15 PM

I'm also wondering if the virus is still there as my problems seem to be getting worse...

I'll try another Kasperski scan on the boot sector.

[EDIT] Kasperski no longer detects my windows partitions. Scanning boot sector finds nothing.

I will try downloading BitDefender and see if that turns up anything...

Fried Egg · 12-23-2009, 04:48 PM

Ah...seem to have run into a problem; can't eject the cd drive because I've booted from a live CD. Therefore I can't burn BitDefender ... any way around that?

johnsfine · 12-23-2009, 05:09 PM

I don't even recall if the current version of Mepis liveCD has a boot time option to copy itself into ram to allow the CD to be used (some liveCDs have that, other don't). I never used a version of Mepis as old as your liveCD.

I doubt that BitDefender will be able to fix that, though having a way to download/burn other CDs would be useful anyway. You don't have access to a healthy computer? You are posting now from the browser in the Mepis liveCD?

I expected faster response from someone who knows whether fdisk can safely reconstruct a partition table to non destructively recover existing partitions when just the partition table was lost. And/Or what hex editors or other tools are available to put back a trashed partition table. I used to do that sort of thing a lot (from bootable floppies, not CDs, a long time ago) but I have forgotten too much to give usable instructions in a forum post.

jschiwal · 12-23-2009, 05:10 PM

You might consider whether your hard drive could coincidentally be going bad.

I would have used "fdisk -lu" as well. The first partition for XP probably starts on sector 63 (512 byte sectors).

From the live CD you could try using losetup to create a loop device starting on sector 63 and looking at that. It may contain your windows files.

Code:

losetup -fs /dev/sda -o $((63*512))

#command will return with the loop device used.  Assuming loop0.
# check if there is an ntfs filesystem here
file -s /dev/loop0

#if so, you can mount it
mount -t ntfs /dev/loop0 /mnt

Malware likes to modify windows system files, which is always loaded and which an anti-virus program can't delete because that would break windows. At this point, back up your data, delete the partition(s) and reinstall. If Windows will install into an empty space left from removing /dev/sda1, then you don't need to reinstall Linux as well. You will need to reinstall grub to be able to boot into linux after reinstalling XP.

Also look in your Linux partition. In the /boot/ directory you may find a backup of the initial MBR. It if is there, look at it with "file <mbrbackupfile>". The file command may provide you with the offsets to each partition. If the partitioning looks correct, you could overwrite the current mbr with the backup, deleting anything bad that might be in the mbr.

syg00 · 12-23-2009, 06:11 PM

Something has changed the geometry of that disk - can be done by software (nefarious or otherwise), or maybe flaky hardware (unlikely probably).
I wouldn't be screwing around with anything until that has been rectified. fdisk and its ilk can allegedly overwrite (as in fix) that as can grub. I've never had to do it, and posts here show something less than wonderful results from those that tried. Could be user error, could be something else. But I'd start there.

Fried Egg · 12-24-2009, 01:29 AM

Thanks again for all your help.

I am running off my liveCD but I have access to another machine for a few hours today. I could get a newer version of Mepis Live CD if that will be useful.

I tried running:

Code:

losetup -fs /dev/sda -o $((63*512))

But it didn't like something, see the result:

Code:

losetup: invalid option -- s
usage:
  losetup loop_device                                      # give info
  losetup -d loop_device                                   # delete
  losetup -f                                               # find unused
  losetup [ options ] {-f|loop_device} file                # setup
    where options include
    --offset <num>, -o <num>
        start at offset <num> into file.
    --pass-fd <num>, -p <num>
        read passphrase from file descriptor <num>
        instead of the terminal.
    --encryption <cipher>, -e <cipher>
        encrypt with <cipher>.
        Check /proc/crypto or /proc/crypto/cipher for available ciphers.
    --nohashpass, -N
        Don't hash the password given.  (previous versions hash, non-debian doesn't.
    --keybits <num>, -k <num>
        specify number of bits in the hashed key given
        to the cipher.  Some ciphers support several key
        sizes and might be more efficient with a smaller
        key size.  Key sizes < 128 are generally not
        recommended

I presume I just drop the "s"?