Repairing Windows Boot Configuration After a BCD-Tampering Attack

Modern Windows depends on a Boot Configuration Data file to locate the bootloader, the kernel, and the recovery environment. When malware blanks that database, the operating system refuses to start, surfacing "Bootmgr is missing" or looping inside Automatic Repair. Australian households and small offices on the National Broadband Network encounter this more than expected, usually after opening a dodgy Outlook attachment or a corrupted advertisement on a free streaming site.

Suburban IT shops in Brisbane and Melbourne's inner west regularly log black-screen tickets caused by ransomware-style reboot loops, and the Australian Cyber Security Centre has documented cases where financially motivated actors use BCD tampering as leverage before demanding payment. Even when no ransom is paid, the consequences range from a wasted arvo at a café to days of downtime while a contractor sources a recovery USB.

Below is a complete walkthrough for restoring the boot loader after a malware incident. You will need a blank USB drive and ideally a secondary device that is not compromised.

Understanding what the BCD store actually does

Boot Configuration Data is a registry-style hive stored on the EFI System Partition for UEFI machines or on the active NTFS partition for legacy BIOS hardware. It records the location of winload.exe, the recovery environment, and the order in which boot entries appear.

Malware targets this database by deleting the BCD file, editing its permissions, or altering path strings so the firmware points to blank or attacker-controlled locations. Tradies in Sydney describe the symptom as "it boots to the splash and then dies".

Recovery method	When to choose it	Tools required	Risk level
Automatic Startup Repair from the recovery USB	First attempt after a recent firmware or patch change	Bootable USB, official Windows ISO	Low
Manual bootrec and bcdedit commands	Automatic repair loops or reports missing Bootmgr	Bootable USB, command-line access	Medium
Full BCD rebuild after marking partitions active	The EFI partition has been wiped or relocated	Bootable USB, diskpart familiarity	Medium-high
Clean install preserving the data partition	Boot partition is encrypted or unrecognisable	Bootable USB, full backup destination	High

Recognising the symptoms before anything else

Before reaching for the recovery USB, confirm the failure really is bootloader-related rather than a graphics driver crash or a failing storage drive. Listen for the fan, the keyboard backlight, and any repeated clicking. A clicking noise under load usually points to hardware, while a silent machine that drops into recovery almost always indicates BCD trouble.

Watch for "Bootmgr is missing", a failure to find any boot device, or Automatic Repair that loops. JB Hi-Fi and Officeworks sell pre-built diagnostic sticks that boot into a triage dashboard, handy for non-technical callers.

Preparing a recovery environment on an empty USB drive

Build a bootable Windows installer USB on an unaffected machine using Microsoft's Media Creation Tool. Select the English (Australian) installation language and burn the ISO to a USB stick of at least 8 GB. Most chemists in suburban shopping strips now stock USB drives, and JB Hi-Fi, Harvey Norman, and Officeworks carry them in every state capital.

Once ready, plug the USB into the broken machine and press the correct function key during power-on. Common keys include F12 for Dell, F2 for HP, F12 for Lenovo, and Escape on older ASUS. Choose "Repair your computer" rather than "Install now" from the boot menu, then open Command Prompt. If the prompt refuses to open, fall back to the Safe Mode tutorial on a second device.

Rebuilding the BCD store manually from the recovery prompt

The most reliable path is a four-command sequence. Start with bootrec /scanos so Windows scans every partition. If it finds a compatible installation, run bootrec /fixmbr to rewrite the master boot record on legacy systems, then bootrec /fixboot to replace the boot sector. Finally, issue bootrec /rebuildbcd to enumerate installations, answering "Yes" only to your actual Windows drive.

On UEFI systems, the boot files live on a hidden EFI System Partition. Open diskpart, list volumes, and select the small FAT32 partition (usually 100 to 500 MB). Assign it a temporary drive letter, then run bcdboot C:\Windows /s S: /f UEFI /l en-au where C is Windows and S is the EFI volume. This single command recreates the boot path with the Australian English locale.

Using automated repair tools when the manual steps fail

When the bootloader is too damaged for bootrec, third-party utilities such as Hiren's BootCD PE, SystemRescue USB, or EasyBCD project are common in Brisbane and Adelaide repair shops. They mount the EFI partition and regenerate BCD with a graphical front end.

Run any such tool offline from a clean environment. Reusing the infected machine to download a repair tool simply reinfects the fresh bootloader.

Salvaging user files before considering a clean install

A failed BCD does not automatically destroy personal data. Mount the Windows partition from the recovery prompt and copy documents, Outlook PST files, and OneDrive caches onto an external drive. Australian small businesses often rely on OneDrive for Business, but local snapshots under C:\Recovery\Customisations are worth grabbing too.

If the partition is encrypted by ransomware, skip the bootloader rebuild until decryption is sorted. Running bootrec on an encrypted volume fails outright. Isolate the disk and image it to a second drive with ddrescue, then work on the image. The lab notes covering how to recover files after a Jigsaw ransomware attack apply to most BCD payloads that also encrypt user data.

Defensive habits that keep the bootloader healthy

Most BCD-tampering infections succeed because everyday prevention has slipped. A short quarterly review cuts the likelihood of a repeat incident to almost nothing. Treat the bootloader like any other critical file: protect it, monitor it, and back it up before there is a crisis.

These small changes pay off for years. Once healthy, lock down the firmware, the recovery partition, and staff email habits so the next sample has no easy surface to attack.

• Set a firmware password on any laptop used for travel across the country.
• Schedule quarterly full-image backups to an offline drive, a routine endorsed by the Australian Cyber Security Centre for SMBs.
• Patch Windows monthly during the maintenance window so updates never pile against a fragile loader.
• Audit autorun entries with Autoruns before resuming normal use, since BCD families often drop tasks that undo repairs.
• Subscribe to Scamwatch alerts from the ACCC to stay ahead of phishing lures that drop these payloads.
• Disable legacy boot only after consulting your IT provider, since reverting without a backup creates headaches.
• Contact a local technician through the security resource centre if the steps feel overwhelming.