How to fix MBR manually without recovery console?

[RegEdit]

It's still telling me that the MBR code is faked. : (

Yes. UBCD4WIN. That's what I have.
I tried this...Start > Programs > Disk Tools > Partition > MBR Fix > Fix / Update a W2K/XP/2005 type MBR code

This is bizarre that I can't even use a Windows CD to enter the recovery console. It's just loading from CD into RAM memory right? How would a virus interfere?

[tf76]

Can you run GMER?


Regards,

[tf76]

http://www.technibble.com/rootkit-de...removal-tools/

I would remove hd and scan externally with one of these tools.



Regards,

[RegEdit]

Originally Posted by tf76

http://www.technibble.com/rootkit-de...removal-tools/

I would remove hd and scan externally with one of these tools.



Regards,

I was unable to install Avast's anti rootkit.
GMER seems to work.
I need to get an adapter. This ThinkPad has a strange smaller SATA power connector. Not sure what these small SATA power connectors are called.

[tf76]

Well Kaspersky REscue CD is usually good as well.

Regards,

[RegEdit]

Originally Posted by tf76

Well Kaspersky REscue CD is usually good as well.

Regards,

Kaspersky did something. After running it I was able to install Avast's anti-rootkit tool. Instead of getting a warning about a fake MBR, MBR_Check now says that the MBR is "unknown". That's an improvement for now. I still can't load my Windows CD to run the recovery console though.

[732914TECH]

Since its XP you can boot to a 98 bootdisk and run "fdisk /mbr" and it will erase the MBR.

[jbartlett323]

Originally Posted by RegEdit

It's still telling me that the MBR code is faked. : (

This is bizarre that I can't even use a Windows CD to enter the recovery console. It's just loading from CD into RAM memory right? How would a virus interfere?

The Virus isnt interfering, there is something interfering with boot. Most likely it is an AHCI HDD setting, switch to compatibility and it will boot, just switch back before booting OS. This is the common setting for IBM/Lenovo's. You have to have an XP disk with Intel AHCI drivers slipstreamed to boot without changing that setting.
If not, pull the drive and boot the CD. Wont fix your problem, but will help rule out other hardware issues...

Oh, and unless its an SSD, that is an adapter that is removable on the drive, not a special interface....

[RegEdit]

Originally Posted by jbartlett323

The Virus isnt interfering, there is something interfering with boot. Most likely it is an AHCI HDD setting, switch to compatibility and it will boot, just switch back before booting OS. This is the common setting for IBM/Lenovo's. You have to have an XP disk with Intel AHCI drivers slipstreamed to boot without changing that setting.
If not, pull the drive and boot the CD. Wont fix your problem, but will help rule out other hardware issues...

Oh, and unless its an SSD, that is an adapter that is removable on the drive, not a special interface....

Good info to know! I gotta look into how to slip stream AHCI into XP. So I guess my regular XP disks would not install on this machine if I tried? For now I've got these rootkits eradicated. Kaspersky Live CD, Avast anti-rootkit, and ComboFix did the bulk of the work.

It is SSD. I gotta get me an adapter for the next time I encounter one of these...

[BCS Head Tech]

Originally Posted by RegEdit

Windows CD keeps blue screening out. MBR is infected. I know because MBR_Check said that the MBR is faked.

Refresh my memory on how to replace the MBR without using the recovery console. ??

try spotman software