[Tha Sneak]

How to Recover Windows Using FRST (Farbar Recovery Scan Tool)

What is FRST?
Farbar Recovery Scan Tool (FRST) is a powerful Windows diagnostic and repair tool. It can be used to fix boot issues, remove malware, and restore missing system files.

Step 1: Boot into Windows Recovery Mode (WinRE)
If your system does not boot normally, you need to access the Windows Recovery Environment:

• Turn off your computer.
  


• Turn it back on and as soon as you see the manufacturer’s logo, repeatedly press F8, F11, ESC, or Shift + F10 (depending on your system).
  


• Select Advanced Options > Command Prompt.
  

If you can boot into Windows normally, you can run FRST directly from within Windows.

Step 2: Download and Run FRST

• Download FRST from: BleepingComputer.
  


• Save the file to a USB drive if using WinRE.
  


• Insert the USB into the affected computer.
  


• In the Command Prompt, type:
  
  Code

  notepad


• In Notepad, go to File > Open and locate the USB drive.
  


• Run `FRST64.exe` or `FRST.exe`.
  

Step 3: Perform a Scan

• Once FRST opens, click the Scan button.
  


• Wait for the scan to complete.
  


• A log file (`FRST.txt`) will be created in the same location where FRST is running.
  

Step 4: Fix Common Boot Issues
Method 1: Restoring the Registry

• Click on Fixlist.txt if you already have a repair script.
  


• If no Fixlist exists, manually restore the registry by typing:
  
  Code

  restore


• Select the most recent registry backup.
  


• Click Yes to confirm.
  

Method 2: Rebuilding the Boot Configuration Data (BCD)
If the system does not boot properly, you can rebuild the boot records:

• Open Command Prompt and type:
  
  Code

  bootrec /fixmbr
bootrec /fixboot
bootrec /scanos
bootrec /rebuildbcd


• Restart your PC and check if it boots normally.
  

Method 3: Fixing Missing or Corrupt System Files

• Run the following command in Command Prompt:
  
  Code

  sfc /scannow


• If errors are found but not fixed, run:
  
  Code

  DISM /Online /Cleanup-Image /RestoreHealth


• Restart your PC.
  

Step 5: Restoring Windows System Files
If you suspect system files are missing or corrupted, use FRST to restore them:

• Create a Fixlist.txt file with the following content:
  
  Code

  Start
Replace: C:\Windows\System32\config\SYSTEM C:\Windows\System32\config\RegBack\SYSTEM
Replace: C:\Windows\System32\config\SOFTWARE C:\Windows\System32\config\RegBack\SOFTWARE
Replace: C:\Windows\System32\config\SAM C:\Windows\System32\config\RegBack\SAM
Replace: C:\Windows\System32\config\SECURITY C:\Windows\System32\config\RegBack\SECURITY
Replace: C:\Windows\System32\config\DEFAULT C:\Windows\System32\config\RegBack\DEFAULT
End


• Save this file in the same location as FRST.
  


• Click Fix in FRST and wait for the process to complete.
  


• Restart your computer.
  

Step 6: Removing Malware with FRST
If the scan detects malware, you can remove it:

• Generate a `Fixlist.txt` file containing the malicious entries found in the FRST scan log.
  


• Click Fix to remove unwanted files, services, or registry entries.
  


• Restart your PC.
  

Step 7: Restart and Verify

• Close FRST and exit Command Prompt.
  


• Restart your computer.
  


• If Windows boots successfully, run a full system scan using an antivirus program.
  

[Tha Sneak]

Please do NOT reply to this thread in case information needs to be added or edited.

If you have a questions about the contents of the thread or other tutorials please go to this thread and post your question in this thread: https://hackforums.net/showthread.php?tid=6293473

Thanks,

Tha Sneak