virus on MBR of disk

Vigilante said:

NTFS doesn't use an MBR anyway, it uses MFT.

Click to expand...

The file system has nothing to do whatsoever with the MBR. The MBR ("Master Boot Record") sits on the very first sector (512 bytes) of your boot disk, and gets loaded well before the computer has even looked at any file system. In fact, the computer must look at the MBR to find out what partitions there are on the disk, since the MBR includes the partition table; and only after it finds out what partitions there are on the disk, can it begin to look at the file systems that they hold.

The actual function of the MBR, then (apart from keeping the partition table), is to execute a small (very small) piece of code that will decide which partition will be booted; the MBR code that gets installed by Windows, e.g., will simply boot the "active" disk partition (which is flagged in the partition table).

A friend of mine once had an MBR virus, too. He tried to get rid of it by deleting all partitions with FDISK, but that didn't work. (We subsequently found out that FDISK simply won't touch the MBR sector code.) We found only one way to remove the virus: Boot a Linux Live CD, and use the "dd" command to destroy the MBR (including the partition table)--"dd" is the "dump data" command in Linux, but when used in this way, it is often referred to as "destroy disk," since you effectively lose all data from the disk.

In case you want to give it a try, the command is something like the following:
(where "count" is the number of sectors to zap; you could specify a count of 1, but an MBR virus will likely carry its payload in the next few sectors immediately following the MBR, so it's probably a good idea to zap a few more).

Also, after this operation, the partition table will be invalid; you may want to rewrite a valid (albeit empty) partition before continuing, using something like the following command:
You will be told that the partition table is corrupted; just use the "w" command to correct it, then quit the fdisk command using the "q" command.

After this, your disk will look like an new, empty disk to the computer.

Yes you're right about MBR, I was thinking about FAT itself, which the MFT did away with. Not the MBR. My bad.

In Windows/DOS "fdisk /mbr" should replace the bootloader code in the MBR with the Microsoft standard one, effectively replacing the virus. "fixmbr" in the Recovery Console.

Nodsu said:

In Windows/DOS "fdisk /mbr" should replace the bootloader code in the MBR with the Microsoft standard one, effectively replacing the virus. "fixmbr" in the Recovery Console.

Click to expand...

True... We did try that, but it somehow didn't solve our problem; I guess it actually did fix the MBR, but that some malware code had gotten installed onto the Windows system, so that the bootloader virus would get reinstalled as soon as we restarted Windows.

Cannot think of a better explanation, really...

Standard virus removing procedures need to apply here. Using the right tools, using Safe Mode and Recovery Console if needed. Remove the executable parts of the virus from within Windows. Then when the timing is right, fix the MBR.

However, for XP and the Recovery Console, you don't use fdisk /mbr, you just use the command fixmbr. Often you also need to use the next command fixboot to make sure the bootloader is correct.

Incidentally, exactly WHAT details can you give as to why you think it's a boot sector virus? What exactly is NOD32 and/or your firewall telling you? Post some of those results, name of virus, etc...
Tell us all what you've tried, and what's happening.

I cannot tell you what NOD32 says because Windows just boot up and then the computer suddenly restarts and then is shutting down.

I cannot make the antivirus clean the computer, the time is also to short and beside that the antivirus is not finishing the cleaning.

Do you have an XP CD? If not, get one or borrow one.

Stick that in your drive and boot to it. Once in, go to Recovery Console.

Once logged in to RC, type chkdsk /r /p. Let that finish and give us the results.
If it finds and fixes errors, type exit to restart the system, and then go BACK into RC again, and run that again.

See if that helps. It could be a hard drive problem causing restarts and not virus.

Can you get in Safe Mode without restarts? As the system boots up, BEFORE you ever see the XP logo, start pressing F8 on the keyboard once a second until you get a menu. Then choose Safe Mode. If you can get in, run your "anti" software from there.
If Safe Mode doesn't work, reboot back to this menu again with F8, and try the "Last Known Good" configuration. See if that works.

If none of that does the trick, you may have to take the hard drive out and scan it for viruses from another computer. Be sure to put your drive as SLAVE so the other computer does NOT try to boot from it! Put it on the channel with their CD-ROM and not the other hard drive perhaps.

Lastly, does Windows give any errors when it shuts down? Does it show a timer saying shutdown in 30 seconds? Does anything at all happen before or during that time?
Do you use the Welcome screen? That is, you have to click on your name to get in? Does that Welcome Screen stay on indefinitely?

Do you have more than one user account? Do they all fail?
If you only have 20 seconds, that may be enough time to go into Control Panel really quick and create a new user account, then try to log in with the new user account.

That should give you some homework. Good luck!

Yes, I have a XP CD, on which I have tried what you said Vigilante but the problem perisists.

No, I have onlu one user.
Thanks for your advises

I will try to go with the drive to another friend to try there the cleaning.

Thanks to you all

i don't think is not virus.. i believe is system problem....

system problem

No, is not a system problem because I have tried another HDD and is working fine.

Thanks anyway