Classic Shell: Forum

You will need a Windows installation disk or USB flash drive. Preferably Windows 10, but older versions like 7, 8 or 8.1 will also work.
If you don’t have one, download it from here: https://www.microsoft.com/en-us/softwar ... /windows10
This is an official Microsoft website and you don't need a license key to use it for the recovery procedure that is described below.

Boot from the disk. The way you do that is different for each computer. You may have to press F9, Esc, or some other key that lets you select a boot device.

You will get a screen like this. Click Next.


Click "Repair your computer"


Click "Troubleshoot"


Click "Advanced options"


Click "Command Prompt"


Enter the commands
bootrec /fixmbr
exit


At this point remove the Windows 10 installation disk.
Click on “Troubleshoot”, then “Advanced Options”, then “Startup Repair”


You can also use Windows 8 or Windows 8.1 installer disk, following the same instructions.


If you only have a Windows 7 installer disk, the procedure is the same, but the screens look a little differently.

Boot from the Windows 7 disk


You will get a screen like this. Click Next.


Click "Repair your computer"


Select the first option "Use recovery tools...", click Next


Click "Command Prompt"


Enter the commands
bootrec /fixmbr
exit


Click on “Startup Repair”


When it is done, remove the Windows 7 disk and click "Finish"

Thank you for the easy-to-follow guide. I'm setting up my flash drive as I type this, and will check in when everything is done. Will I need my product key or anything for this?

You don't need the product key to run in recovery mode. Hold on a bit, as I'm perfecting the instructions. There may be some gotchas.

Standing by. I'm at 50% writing to my flash drive.

OK, I added an extra step that may or may not be necessary. Let me know how that works for you.

So far everything is working just like in your guide! After the last screenshot and an automatic restart though, I got this.

Obviously I will just click yes (haven't done anything yet because I wanted to post here and get a response first), but is this normal? The Windows Anniversary update fully installed before I had all this trouble, so what could it be referring to?

Did you remove the install disk after the fix?
I will add that step to my instructions.

I didn't. It's still in the computer with that message showing right now. Should I remove it and then click yes?

Yes, do that.

I'm now responding to you from my FIXED PC!

Ivo, I seriously cannot thank you enough. I really appreciate the time, effort, and responsiveness you displayed to fix this incredibly stressful issue.

Thanks also to everyone from the other related threads who posted their tutorials and their thoughts on how to remedy the situation. Speaking as someone who does not know a whole lot when it comes to this kind of stuff, it's great to be able to find such helpful people willing to lend a hand.

And with that, I'm off to bed!

Your fix worked for me except that the last step for Startup Repair said that it couldn't do the repair. I restarted my computer and it is saying that it is "Restoring your previous version of Windows...". I may have requested that earlier when I was looking for a fix.

By the way, wasted about 6 hours today trying to figure this out. Even resorted to installing a new drive I had on hand to reload Windows 10. That's when I found your note about the Malware. At least Classic Shell was one of the first things I tried to load so I got the message before re-configuring everything. And it was good I kept my original drive intact instead of wiping it.

Looks like all is in order now.

This doesnt work for me, I have spade logo (like the kind on playing cards) in the bottom left of the screen. Is there a fix for this?

Hi Guys. Thank you for the instructions and information on how to. I too got caught in that trap. I followed the instructions and I'm up and running again. smooth sailing now. Is it safe now to use classic shell?

>is it safe to use classic shell now
As long as you don't accidentally run the old installer likely still on your pc or download from fosshub
Also as a final/ultimate precaution check the files digital signature before running it should be signed by 'Ivaylow Beltchev' (right click the file and select properties, then the digital signature tab)

Thank you so much for this guide! I had really terrible timing and attempted to download Audacity right as the websites were compromised, so I was hit with the Spade symbol. I'm not up and running yet, but I think I'm making some progress to getting there thanks to your guide.

Stay cool!

I'm at the "Startup Repair" step in the guide. Do you know how long this usually takes? I've been at it for about 5 minutes or so and I'm wondering if there's a point where I should re-start and try again if it looks like it is hanging.

If it sits there for 5 minutes, then you should go ahead and restart and try a second time. If that fails, try re-burning the image, if possible (it may have been corrupted, or in the case of a cd scratched)

Hi thanks for the guide.

I've a slightly different problem in that it affected my "Disk 0", but that wasn't my boot disk.

How do I run your MBR repair on a secondary disk (it is internal)?

When I try these fixes (as well as other fixes in the original thread) I get an error screen that reads:



Pressing Enter of F8 both take me to the same screen, but with a slightly different error message:




Any explanation/solution for this behavior?

If it helps at all, I have two disks: an HDD with Windows 7, Windows 8, and Ubuntu; and an SSD with Windows 10 and Ubuntu. Only the SSD is affected and thus not bootable (except to the above error screens), while I can boot to the HDD and use the OSs there. I can read files from both disks from the OSs on the HDD but would strongly prefer to not perform a fresh install of the systems on the SSD.

For anyone who has multiple bootable internal disks, and only one of them is affected, before you boot into the command prompt to try the recovery, try to temporarily disconnect or disable from BIOS/UEFI, any secondary disk drives which are not affected/not used for booting. Once you fix the infected drive, you can enable them again. Windows Startup Repair might be successful with additional drives disabled.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

Hey, I have a whole long post here which details everything up this point (viewtopic.php?f=22&t=6434&p=28186#p28186)

But I'll give it you a short version here.

I have a C drive for Windows, D for everything else. I downloaded CS on the D, ran from D, now my D is missing.

I'm getting the spade and cursor on startup not the open letter.

I tried bootsec fix MBR as above, it says operation completed successfully but when I go back to Repair Installation it doesn't go forward.

Okay... Here's the thing. It recognizes my C drive and everything on it. But not my D. I tried doing the Windows installation again just to see if it would work and it says my D drive has full capacity. I certainly hope that it didn't remove all the data from my D drive.

Nonetheless, it looks like the instructions above for disconnecting the affected Drive is 4 drives that are affected that have Windows on it. My drive that is affected does not have Windows on it. Would it still work though, and should I try it, as in is it safe to try it, to disconnect my D drive, then try bootsec fix MBR, then try to repair the installation.

Now suppose that doesn't work, and this is where I need some crucial specificity, could I just format my C drive, reinstall Windows, then connect my D drive again and everything should be fine? Or does this virus hold itself onto the drive regardless, and when I reconnect my data will be gone?

Also one other thing would it help to disconnect physically or is that unnecessary?

Thanks for any of your help.

@TheFly, in your case you could try downloading and running TestDisk from a Live CD: http://www.cgsecurity.org/wiki/TestDisk_Livecd One of our forum members reported that using Testdisk they could fix the partition table on one compromised drive and restore the partition table completely with no issues. Do a quick scan using Testdisk and then add back the partition it finds and write it to disk. This should be doable with both drives connected since Testdisk shouldn't get confused between drives unlike Windows Startup Repair.

Windows might not give you a true reading of the drive even if the data is intact if the partition table (not the MBR) is deleted/corrupted. Running TestDisk can allow you to recover that partition and make it readable again.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

I'm a cord cutter... I don't have an optical drive.

Ughhhhhh.

But you think at least my data is untouched?

Where do I go from here? Should I just disable the D drive, format C reinstall windows and then reconnect my D.

Or is that also volatile? Like does the damage to the MBR not just go away if I format and reinstall?

@TheFly, Live CD ISOs can be written to USB flash drives using tools like Rufus (Google for it). Your data might be untouched. Download Rufus and burn that Live CD to USB. Boot from it and scan using Testdisk.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

Okay thanks for all that. So I'm going to have to go back to the internet cafe to do all this, as I'm on my Galaxy Note 3 at the moment. Rufus, check, USB, check, I just need to know which Testkit to download, there's like 20 on that page. If you can please just link the file I need to download or the page that the file I need to download is on, right here, then I can move forward.

Last thing, to the best of your knowledge, if this doesn't work, would it be safe for me to disconnect my D drive, reinstall Windows on the C drive, and then reconnect my D drive. To the best of your knowledge would that work also? Or if anyone else that is reading this wants to chime in, that would be fantastic.

Thanks again.

@TheFly, The MBR for each physical drive is stored on that drive only. If C and D are different physical disk drives, then formatting C will do nothing to D. However if C and D are only partitions of the same drive, then repairing the MBR and its partition table should rectify all partitions on it. Try http://www.bootmed.com/.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

I have been 2 separate drives.

C is my SSD
D is my HDD.

Wait. Shouldn't I just format and reinstall windows? Even if I get my PC to recognize my D drive again my C drive won't boot into windows. Like when I go into command prompt I can see my C drive. What's stopping me from booting into Windows, I don't get it.

@TheFly The MBR on drive C might have been overwritten and the BCD data destroyed. I haven't studied that malware but doing these steps on drive C should make it bootable again: viewtopic.php?f=22&t=6440

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

I made the testdisk USB. Made it with Rufus. It formatted, applied the iso I downloaded from Boot Med. It doesn't auto run like the windows 10 one does.

Now what? Can I run it from the command prompt?

I think I'm going to run Linux and fix the tables there... That'll work right? Move them to my external, then just reinstall Windows?

@TheFly You mean it does not boot? You may have chosen the incorrect partition scheme for the USB. Try switching between UEFI and BIOS in Rufus. Use FAT32 file system and see if it boots.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

Alright I'm in Gparted. What do I do. Cmooon I'm almost home.

My HDD is a500gb drive.

I see a long grey strip that goes from one side of the window to the other, in it says 465.76gb unallocated. This is the drive! What do I do??

Down below it says

Partition. File system. Size. Used. Unused. Flags.

Unallocated.. unallocated.. 465.75 GiB ... Blank, blank, blank.

As for the C drive, how would I fix that, I don't see it here.

Okay I can switch between devices, under Gparted > devices...

/Dev/SDA is the 500gb HDD
/Dev/SDB is the 250gb SSD

Under the SSD

http://imgur.com/0FrE1Ud

@TheFly, here's a guide for GParted: http://gparted.org/h2-fix-msdos-pt.php

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

Can you sign your packages to help users avoid all this?

https://www.gnupg.org/download/integrity_check.html

Thanks,
-dkw

All releases of Classic Shell are signed. People who got infected bypassed the UAC prompt warning about unsigned code.

I installed CS on an up to date Win 10 machine today and it froze the computer. I have tried this fix, and whether I put the listed MediaCreation Tool application for the Windows 10 boot disc file on a USB flash drive or a CD, and set the appropriate boot order thru BIOS or F9, it is clearly accessing whichever I use but the application does not launch to show the Windows 10 screen where I can choose Repair. It just keeps going into the Preparing Automatic Repair mode, then Diagnosing PC, then I get the 2 choices of Automatic Repair Restart of Advanced Options. Unfortunately even tho I enabled Restore Points and had some the latest Win 10 update disabled Restore and removed the restore points so have not option for restore points in Advanced Options Restore. Am I missing a step to get the MediaCreation Tool app to launch? Thank you!

The above steps are only if your PC was infected by malware during the extremely short period of time (a few hours on August 2nd, 2016) during which Classic Shell's installer was compromised. It was rectified within just a few hours so it is highly unlikely that the fake malware-infected installer is still in circulation. If your PC's booting broke recently, it is most definitely by some other reason and is not related to Classic Shell.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

Thanks for reply Gaurav. Obviously thought it was related because it happened upon installing CS. Could be coincidence. Have a 26 year experienced repair person checking it out. Malware may have loaded at same time, or more likely back sector on aging hard drive with CS installation caused boot corruption. Great forum.

This really helped me out thanks to everyone! :D:D:D:D:D

No you will not

I got infected August 2nd - minutes after installing the Windows 10 Anniversary Update - when I saw that the update caused the Classic Shell to not work any longer. Yes, I did ignore the warnings because this a new computer (DEC.) and the warnings were unfamiliar. I had previously installed this program, so I thought it was Windows trying to discourage me. Oops.

I ran my recovery flash drive and got into the Recovery screen and went to Advanced options; Command prompt; ran Chkdsk/F and got the message "Windows cannot run disk checking on this volume because it is write protected". I ran the bootrec /fixmbr and even though it showed "This operation completed successfully" it didn't work. So, I found a different website that gave me something else to try.

I went through the same steps and when I got the command prompt I ran the following commands:
bootrec/fixboot
bcdedit/export c:\bcdbackup
bootrec/rebuildbcd

I got this: "Scanning all disks for Windows installations".
Then: "Successfully scanned all Windows installations. Total identified Windows installations: 0"

I ran other commands, which I didn't copy so in order to tell you what they were I would have to reconnect the computer I was using in the hopes I saved the page in Favorites. It is running Vista 64bit and I got so frustrated with it I bought an HP notebook for $239 that isn't a bad piece of equipment thus far...

Anyway, I ran all of it and this is what I got:

DISKPART> list volume

Volume ### Ltr Label Fs Type Size Status Info
-------------- --- ----- -- ---- ---- ------ ----
Volume 0 E DVD-ROM 304 MB Healthy
Volume 1 C OS NTSF Partition 918 GB Healty
Volume 2 ESP FAT32 Partition 200 MB Healthy Hidden
Volume 3 WINRETOOLS NTSF Partition 855 MB Healthy Hidden
Volume 4 Image NTSF Partition 11 GB Healty Hidden
Volume 5 D Recovery FAT32 Removable 29 GB Healthy

DISKPART> select volume 2

Volume 2 is the selected volume.

DISKPART> assign letter-z

Diskpart successfully assigned the drive letter or mount point

DISKPART> exit

Leaving Diskpart...

x:\windows\system32>bcdboot C:\windows/s Z:f UEFI

Bcdboot - boot file creation and repair tool.

The bcdboot.exe command-line tool is used to copy critical boot files to the
system partition and to create a new system BCD store.

bcdboot <source> [/l <locale>] [/s <volume -letter> [/f <firmware.]] [/v]
[/m [{OS Loader ID}]] [/addlast] [/p] [/c]


That is as far as the instructions took me.
What did I get?

"Windows failed to start."

That's where I'm at.

I put in a new hard drive and installed Windows 10 Restore Media from a flash drive I got from Dell. I connected the original hard drive hoping it would act like a slave drive, but just like when I connected the original hard drive to the computer with Vista using a USB to IDE/SATA adapter: the hard drive isn't found.

It has been 25 years since my days as a student at Control Data Institute and I've only worked with dos a few times since then. I can pull up the directory of disk X and see all the files, so it is all still there, of course, but the infection seems to have carried with some root files and I feel like I didn't go in depth enough to isolate the boot record and change it, or changing it didn't work because the infection is inside any file I'm using to change the boot record.

If nobody has any suggestions for going forward from where I've presently gotten the hard drive to, I might try to revert it back to the original file structure in the original drive partition: if I can find the instructions I used and reverse the command directions. Then I'll probably try the Rufus or maybe Testdisk.

I'm okay with messing with it for a while since I can't do much worse than the unusable condition it is already in.

Should all my tinkering fail to restore the disk to bootable condition, does anybody have any suggestions on how to find my documents and photos and transfer them to a flash drive? I suppose the data isn't damaged--only the MBR--so it would be safe to extract if I can find a method for doing so.

Thank you in advance for any legitimate replies!

I think you should try running Troubleshoot -> Advanced Options -> Startup Repair from the Recovery Environment of the same disk as the Windows version you have installed. If you have Windows 10, run the Startup Repair from a Windows 10 bootable USB disk. You didn't say you tried that already.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and did Classic Shell's testing and usability/UX feedback.

Thank you, Gaurav, for your reply.

I spend 2-1/2 hours on the phone with tech support from Dell (in the Philippines) on August 3rd, and we tried every one of the troubleshooting methods available on the bootable Windows 10 rescue disk I created shortly after purchasing the computer. They advised me to create a different one with the computer I was using that purportedly contained more sophisticated tools but even though the Windows Vista program downloaded the file, it couldn't open it so I couldn't do what the technicians wanted me to do before copying the files to a Flash drive. They submitted a request to have me sent a Windows 10 Recovery flash drive which I used to install Windows 10 on a blank 1TB hard drive.

There is a very powerful set of tools that can possibly help with MBR problems. It is very powerful and does require a modicum of knowledge to use it safely. Its called DFSee ( http://www.dfsee.com/dfsee/download.php ) Again, it is extremely powerful and if improperly used can destroy the data on the disk you're trying to resurrect. It is normally burned to a CDROM or a USB flash drive and booted from. RTFM!!