An interesting call came in this week; I say interesting but in reality it is a call we all dread. A user that is reporting that the computer keeps displaying “Trying to recover Windows” followed by the inevitable “Unable to recover Windows”. Unable to remote on and look, there was no choice to bring it into the office.
On first inspection it was indeed booting to the recovery console, and displaying recovery choices including 4 restore points. These were the first port of call but were all unsuccessful. This machine has been in use by the user for many years, and so had many years of settings and obscure software installed, so there was a lot to gain from repairing the issue instead of a full Windows re-install.
A corrupt Windows install could be the result of a failing hard drive, S.M.A.R.T reporting on boot was giving a pass, so it may be worth rebuilding the Master Boot Record.
Repairing the MBR
So how to work on an operating system that refuses to load? The recovery DVD (Remember them) that came with this aging Fujitsu contains a heavily stripped down version of the Windows 7 operating system, giving you the basic tools to make changes to the system stored on the hard drive.
Boot the PC from the DVD and you are greeted with the Windows 7 installation menu, click Repair Your Computer to load the recovery console.
Select the OS on the drive, and click Next
This will attempt to repair the PC again, and ultimately fail, next it will show you the System Recovery Options
Click to open Command Prompt. In this window we can execute the commands to rebuild the MBR:
- bootrec /rebuildbcd
- bootrec /fixmbr
- bootrec /fixboot
Restart the PC from the main menu and cross your fingers.
Unfortunately, this did not fix the issue, and it loaded the Startup Repair again. Looking deeper into the details of the failed repair, I find this:
What stands of here is the word Rapport, this may refer to a piece of security software by the same name. Whereas I don’t use this software, I am familiar with this due to the well documented problems it causes many users, and have dealt with these many times.
As it is a 3rd party program to Windows, it’s likely that this is installed as a system service and set to start on boot. The next step is to disable this service, and get Windows to start.
Disabling a Service
As above, get the PC to boot from the Recovery DVD, and navigate to the System Recovery Options, and open the DOS window.
Enter regedit to load the registry editor
As the PC has booted from the DVD, the registry details displayed refer to the operating system loaded from the DVD, so we need to connect to the registry of the system’s hard drive.
Highlight HKEY_LOCAL_MACHINE on the left hand tree.
Click File on the menu bar and then Load Hive
Navigate to C:\Windows\System32\Config on the hard drive (Note the drive letter may be different from normal operation) and choose the SYSTEM file.
Give this registry an identifiable name, and click OK
In this tree, navigate to the Services folder at HKLM\SYSTEM\CurrentControlSet\Services
In this folder, each subsequent folder refers to a system installed on the system, in this example I looked for anything that relates to the Rapport software.
Navigate to the folder of a service, then double click the Start entry
The way the service starts depends on the following number in this field:
- 0 – Boot
- 1 – System
- 2 – Automatic
- 3 – Manual
- 4 – Disabled
Change the Value Data to 4, and click OK
Repeat this for every service you wish to disable,
When done with the registry, navigate to the identifiable name you give earlier, right click it and choose Unload Hive
Close regedit, then restart the PC from the min Recovery menu, another cross of the fingers will also help.
For me this was a success and a great relief.
The whole process took a lot of time to diagnose and resolve, but only a fraction of the time compared to a full system rebuild, restoring the software and files from its last known state, and not to mention the ongoing support to the user in re-creating the configuration they were originally happy with.