Restoring MBR or GPT After Malware Damages the Boot Sector

When malware overwrites the boot sector, a Windows computer may show “Operating system not found”, “No bootable device”, a black screen, or repeated recovery attempts. The damage can affect the Master Boot Record (MBR), the GUID Partition Table (GPT), boot configuration data, or the small system partition used by UEFI firmware.

The repair method depends on how the machine starts. Older systems commonly use legacy BIOS with MBR disks, while most Windows 10 and Windows 11 computers sold in Australia use UEFI firmware with GPT. A wrong command applied to the wrong layout can make recovery harder, so identify the configuration before changing disk structures.

Do not assume that a boot failure proves the files are gone. Personal documents may still be intact, and a damaged boot record can sometimes be rebuilt from Windows Recovery Environment. However, repair should follow malware containment. Rebuilding startup files while a rootkit or ransomware loader remains active may restore access only temporarily.

The steps below focus on Windows systems. Keep another computer available to download official installation media, and use a reliable USB drive. If the device contains business records, tax files, health information, or irreplaceable photographs, consider professional forensic assistance before formatting anything.

Situation	Likely structure	Appropriate recovery approach	Main risk
Older PC using Legacy BIOS	MBR	Repair boot code with bootrec and rebuild BCD	Selecting the wrong disk
Modern PC using UEFI	GPT with an EFI System Partition	Recreate or refresh EFI boot files with bcdboot	Formatting the wrong partition
Partition map is missing or corrupted	MBR or GPT	Image the disk first, then use recovery software	Overwriting recoverable data
Malware still active	Either	Clean or isolate the system before normal boot	Reinfection after repair

Identify The Firmware And Disk Layout

Start the computer from a trusted Windows installer or recovery USB, not from the affected internal drive. Select the language, choose Repair your computer, then open Troubleshoot, Advanced options, and Command Prompt. Disconnect unnecessary external drives so DiskPart does not display several similar-looking disks.

Run diskpart, followed by list disk. A GPT disk normally has an asterisk in the GPT column. You can also run list volume to look for a small FAT32 EFI System Partition, often between 100 MB and 300 MB. An MBR installation generally boots through a small “System Reserved” partition or the main Windows partition in BIOS mode.

Write down the disk number, Windows volume letter, and any EFI partition letter. Recovery Environment can assign Windows a different letter, so check with dir C:\Windows, then try other letters until the correct installation is found. Exit DiskPart with exit before running boot repair commands.

Prepare The System Before Repair

If ransomware, a bootkit, or a trojan may have altered the startup process, disconnect Wi-Fi and Ethernet before repair. Do not reconnect the machine merely because Windows starts again. A clean rescue scan from trusted media is safer than relying on an infected desktop antivirus installation.

For encrypted files, avoid deleting ransom notes or wiping the drive. The guidance on Bitcoin ransomware guidance explains why payment decisions, decryptor claims, and evidence preservation require care. A boot-sector fix cannot decrypt files that ransomware has already locked.

If the disk is clicking, disappearing in firmware, or reporting read errors, create a sector-by-sector image before repeated repairs. On a healthy drive, copy essential files to an external disk using a live environment. Keep at least one copy disconnected from the computer, particularly if the device is used by a small business in Sydney, Perth, or regional Queensland.

Repair An MBR Installation

For a confirmed legacy BIOS and MBR setup, open Command Prompt in Windows Recovery and identify the Windows partition. The basic commands are:

bootrec /fixmbr
bootrec /fixboot
bootrec /scanos
bootrec /rebuildbcd

/fixmbr writes standard Windows-compatible MBR code without normally changing the partition table. /fixboot repairs the boot sector on the active system partition. If /rebuildbcd finds a Windows installation, accept it when prompted. An “Access is denied” response from /fixboot often means the partition is not correctly marked active or the environment is actually UEFI-based.

Use diskpart only after confirming the target. With the correct disk selected, list partition shows the layout; select partition N followed by active marks the intended BIOS system partition. Never mark an arbitrary data partition active, and do not use clean unless the disk is being deliberately erased.

Rebuild GPT And UEFI Startup

On a GPT computer, the important files are stored on the EFI System Partition rather than in an MBR boot sector. Assign that partition a temporary letter in DiskPart:

diskpart
list volume
select volume N
assign letter=S
exit

Replace N with the FAT32 EFI volume number. Confirm the Windows directory, such as D:\Windows, then rebuild the UEFI boot files:

bcdboot D:\Windows /s S: /f UEFI

If the EFI partition is missing but the Windows volume and GPT data remain healthy, create it only after making a backup and verifying unallocated space. Formatting an existing EFI partition removes its boot files, so never run format S: /FS:FAT32 until the selected volume has been positively identified. Firmware settings should remain in UEFI mode, with Secure Boot restored after malware checks.

Check The Partition Map And File System

A boot record repair does not fix damaged partitions or a failing file system. From recovery mode, run a read-oriented check first, such as chkdsk D: after confirming the Windows letter. If errors are reported, consider imaging the drive before using repair options that write extensively to it.

For GPT disks, diskpart can show whether the disk is online and whether its partitions are visible, but it is not a full data-recovery tool. Test the disk in the computer’s firmware diagnostics and inspect SMART health information where available. A GPT header problem, deleted partition, or overwritten volume may need specialist recovery software rather than repeated bootrec commands.

After Windows starts, run Microsoft Defender Offline or another trusted rescue scanner. Review newly installed applications, scheduled tasks, browser extensions, startup entries, and unfamiliar local accounts. A repaired boot chain is useful only when the code that damaged it has been removed.

Recover Files When Startup Still Fails

If Windows remains unbootable, use the recovery command prompt to copy important files to an external drive. External storage must have enough capacity, and the destination should be checked on a separate clean machine. Avoid saving recovered files back to the affected disk, as this can overwrite deleted data.

System Restore may help when boot configuration or drivers changed recently, but it does not guarantee removal of malware. Startup Repair can be attempted once after confirming the disk layout. If the partition map is severely damaged, stop experimenting and preserve an image for a data-recovery specialist.

Mac computers do not use Windows MBR or GPT startup repair commands in the same way. Apple silicon and Intel Macs have different recovery paths, so use macOS Recovery and Apple’s documented reinstall or disk-repair process rather than applying Windows instructions.

Prevent Another Boot-Sector Incident

Australian households often depend on an NBN connection for work, banking, school, and telehealth, so keep offline recovery media available before an outage or infection. Businesses should maintain tested backups rather than relying on a single USB disk stored beside the computer. The Australian Cyber Security Centre and Scamwatch also provide current advice about reporting and responding to online crime.

Use these practical safeguards:

• Keep Windows, browsers, firmware, and security software patched.
• Store at least one backup offline or in immutable cloud storage.
• Enable Secure Boot and UEFI unless a legitimate legacy requirement exists.
• Use a standard account for everyday work and a separate administrator account.
• Treat unexpected invoices, parcel notices, and cracked software as possible malware delivery methods.
• Review Trojan removal resources when suspicious processes, redirects, or credential theft appear.

Once the system is clean, test a full shutdown and restart, confirm the correct boot entry in firmware, and verify that personal files open normally. Record the disk layout and recovery steps for future support, especially when an office relies on a local technician during the busy end-of-financial-year period.