Windows – Right sequence for hardening Windows 10 against vulnerabilities that persist after reinstall

bootlenovo-desktop-computerSecuritywindows 10

I have a Lenovo Ideacenter H50-55 PC desktop (2 years old, Windows 10 Home, 1x AMD A10-7800 Processor) which stopped booting after the last Windows update. I removed the HD, ran check disk from another latop on the HD, no issues. I backed up files successfully.

After I reinstalled Win 10 from the Lenovo service partition, I quickly installed Norton and began downloading Win updates. I moved some old files (mainly music files) from the backed up files, downloaded some applications. Windows had about a dozen Win updates to run; it seems to have completed about 9 or 10 of them and was getting stuck on one in particular. I gave it about 2 or 3 hours to complete (it didn't), then decided to restart the machine. To my surprise, Windows 10 wouldn't boot. I tried to do a system restore but it failed there too.

So I'm ready to begin the process again. Perhaps it is a coincidence that Windows update caused the system to not boot on two separate occasions. But I have to consider the possibility that some issue is persisting after the Windows reinstall.

My current suspects are:

  1. Some hardware security issue on my Athlon processor related to Spectre. My bios is dated 2014, and I have to believe that it has been updated since this time.
  2. some hard ware corruption of the master boot record
  3. that I may have accidentally exposed or retriggered a Windows virus
  4. Windows update process for my hardware is just defective.

I have 3 basic questions:

  1. what should be my sequence for hardening my PC after reinstalling
    Windows 10 again from the Service Partition. I.e., should I focus
    first on Lenovo-related updates (like BIOS, etc) rather than Windows
    updates? Should I try to install all the Windows updates at one time
    or perform them one at a time (or at least restart numerous times to
    provide multiple restore points).
  2. I have a commercial version of Norton AV. Are these sufficient for
    scanning the master boot record or identifying boot sector issues?
  3. Are there any third party tools for identifying whether my hard
    drive or processor is permanently damaged? Before I chose to
    restart, Windows was working practically perfectly.

Thanks for your help.

Best Answer

Well, I did not arrive at a satisfactory answer.

I reinstalled Windows from the service partition, updated the bios and Lenovo drivers. Then I updated Windows, separating the updates between restarts for extra margin of safety.

During my 2nd reinstall, one of the updates broke my Comcast-provided Norton antivirus program, so I had to remove and reinstall.

I don't think that updating the bios and drivers immediately made any difference (the bios was last updated in 2017). but who knows! I do think that isolating the Win updates contributed to solving my problem -- although I have no way of knowing for sure. I'm guessing that the Spectre vulnerabilities is probably what caused the most recent Win updates to be so complicated and brittle. But I could be totally wrong!

Related Question