Boot Sector virus

Boot Sector virus
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Boot Sector virus Marek Kalisz 09-22-2006
Posted by Runlevel0 on September 24, 2006, 6:01 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Marek Kalisz wrote:

> Recently during booting I discovered a momentary message: MBR Error 2.

First of all try repairing the MBR from the recovery console:

FIXMBR

This will repair the MBR.
YOu can also use FIXBOOT first, so that you ensure the MBR is actually
erased and rewritten.

Regards.


Posted by cquirke (MVP Windows shell/use on September 25, 2006, 3:04 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
>Marek Kalisz wrote:

>> Recently during booting I discovered a momentary message: MBR Error 2.

>First of all try repairing the MBR from the recovery console:

> FIXMBR

>This will repair the MBR.

Yes... as long as you don't need a non-standard MBR to live...

>YOu can also use FIXBOOT first, so that you ensure the MBR is actually
>erased and rewritten.

No, that's not what FixBoot does.

MBR = Master Boot Record, which is system- rather than OS-level code
(i.e. it's an extension of the BIOS, rather than part of any OS). It
contains the partition table, and is expected to locate an active
primary partition and jump into it to start that OS.

PBR = Partition Boot Record, which is the start of the OS. It is
this, not the MBR, that FixBoot will rebuild.

MBR should be the same for a given system, irrespective of what OS you
use. Most systems use standard MBR code, but some may not - e.g. boot
managers, code that replaces capacity-limited BIOS HD code, etc.

PBR should be the same for a given OS, irrespective of the system,
save for some data values. The PBR for NT-based OSs will look for and
load NTLDR from FATxx or NTFS; the PBR for DOS and Win9x will look for
and load IO.SYS from the FATxx file systems it can understand.



>------------ ----- --- -- - - - -
Drugs are usually safe. Inject? (Y/n)
>------------ ----- --- -- - - - -

Posted by Marek Kalisz on September 25, 2006, 3:21 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks and I'm sorry to all of you for taking your time. I have installed
Acronis True Image 9. One of its option is Acronis Startup Recovery Manager
which I activated. Just now I founded in the manual as follow:
"When Acronis Startup Recovery manager is activated, it overwrites the
master boot record (MBR) with its own boot code. If you have any
third-party boot managers installed, you will have to reactivate them after
activating the Startup Recovery Manager."
So I reactivated. It was VIA RAID driver that system was looking for (F6
key during repair)
Thanks.
Marek Kalisz

>>Marek Kalisz wrote:
>
>>> Recently during booting I discovered a momentary message: MBR Error 2.
>
>>First of all try repairing the MBR from the recovery console:
>
>> FIXMBR
>
>>This will repair the MBR.
>
> Yes... as long as you don't need a non-standard MBR to live...
>
>>YOu can also use FIXBOOT first, so that you ensure the MBR is actually
>>erased and rewritten.
>
> No, that's not what FixBoot does.
>
> MBR = Master Boot Record, which is system- rather than OS-level code
> (i.e. it's an extension of the BIOS, rather than part of any OS). It
> contains the partition table, and is expected to locate an active
> primary partition and jump into it to start that OS.
>
> PBR = Partition Boot Record, which is the start of the OS. It is
> this, not the MBR, that FixBoot will rebuild.
>
> MBR should be the same for a given system, irrespective of what OS you
> use. Most systems use standard MBR code, but some may not - e.g. boot
> managers, code that replaces capacity-limited BIOS HD code, etc.
>
> PBR should be the same for a given OS, irrespective of the system,
> save for some data values. The PBR for NT-based OSs will look for and
> load NTLDR from FATxx or NTFS; the PBR for DOS and Win9x will look for
> and load IO.SYS from the FATxx file systems it can understand.
>
>
>
>>------------ ----- --- -- - - - -
> Drugs are usually safe. Inject? (Y/n)
>>------------ ----- --- -- - - - -



Posted by Marek Kalisz on September 22, 2006, 10:45 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Then now I discovered that in a tray I have two Windows Messenger icons,
both clear blue (like when signed in) but when I move mouse over them one
says "Signed In" and other says "Not Signed In."
It's strange/ Right?
Marek Kalisz

>
> | I suspect that there is some virus in the Boot Sector. I have already a
> few
> | A/V - Anti-spy gadgets on my system but I'm not sure that they are
> checking
> | boot sector. What's your suggestion? What tools to use to check boot
> | sector and clean up it eventually?
> | Marek Kalisz
> |
>
> On what basis do you "suspect" a Boot Sector Infector ?
>
> This is a very small class of viruses that are not found on Today's
> systems using NTFS
> partitions and mere conjecture is not enough.
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>



Similar ThreadsPosted
recusive folder usb boot sector... virus March 14, 2008, 6:45 pm
Free virus scanning tool for boot sector and CMOS July 4, 2007, 1:28 am
Boot Virus Help June 22, 2006, 12:50 pm
Please help!! Boot Virus?? May 10, 2008, 11:46 am
Anti Virus Solutions That Use Their Own Boot CD? July 2, 2008, 1:47 pm
Virus-like Activity after a boot-time Scandisc November 11, 2007, 12:32 pm
Possilbe Virus, Computer Reboots, Can't Boot any Options November 19, 2006, 10:33 pm
Boot Malmo on my USB Mem!! Help October 20, 2005, 9:18 am
boot problem November 24, 2007, 12:59 pm
Question(s) about VBS/Petik-V & boot.ini December 14, 2005, 3:41 am

The site map in XML format XML site map

Contact Us | Privacy Policy