Boot error on Windows XP with Raid 1

[Martyn]

I have this error that some of you may of seen, I never have.

Windows NT has found only 511K of memory. 512K of low memory is required to run Windows NT. You may need to upgrade your computer or run a configuration program provided by the manufacturer.

It's a Dell Vostro running XP with 2 x 2GB of ram(seen in the bios) and raid 1. I have backed the data up so that is safe but I'm puzzled by the error. I've removed the graphics card and tried booting from a single hard drive. I've also tried separate memory modules and fresh memory, same issue. I've run a hardware test with PC Doctor and that checks ok. The client said he clicked on an email last night and all was well but this morning he got this error. I'm about to scan for viruses but I thought I would throw it out there in case anyone has seen this error.

 

[ComputerRepairTech]

check boot.ini perhaps a max memory parameter?

 

[Martyn]

OK just got one of the drives slaved on my bench computer and it's picked up a rootkit.boot.cidox.b virus

 

[ComputerRepairTech]

you beat me to it i was about to paste that i found this quote..

I just ran into this problem last night and fixed today on a DELL Precision T3500



1. I booted into Mini Windows XP using Hiren's boot disk.

2. I plugged in a USB with TDSS Killer on it.

3. Ran TDSS and it instantly found Rootkit.Boot.Cidox.b

 

[kpk1]

Sounded familiar, so I had a scout around...... http://www.bleepingcomputer.com/forums/t/506180/mbr-wacked/

 

[Martyn]

you beat me to it i was about to paste that i found this quote..

Thanks, already had TDSSKILLER downloaded ready to go. It's booting now so removing Norton and then doing some removal work with other tools.

 

[Martyn]

Another question on the raid 1, do I do a virus removal on the 2nd drive(raid 1), rebuild the mirror raid after formatting or what?

 

[AndyM]

As you have modified the hard drive that you have removed, I would:

1. Remove the 2nd drive from the XP machine
2. Boot from the modified drive to ensure that the drive and OS are ok.
3. Upon the successful boot using the modifed drive, run a FULL format of the other drive. Don't just plug it into your tech PC and format it - use the manufacturer tools to perform a full factory erase as you will need to remove the RAID bit on the drive.
4. After the erase, place the newly erased drive into the PC. RAID should detect it, and rebuild the array (with a small amount of intervention).

Andy