How to fix MBR manually without recovery console?

[RegEdit]

Windows CD keeps blue screening out. MBR is infected. I know because MBR_Check said that the MBR is faked.

Refresh my memory on how to replace the MBR without using the recovery console. ??

 

[tf76]

UBCD4WIN


Regards,

 

[RegEdit]

Yeah I know that. I just need to know what file to extract from my windows CD, etc.

 

[tf76]

So what OS are we talking about here?

Regards,

 

[RegEdit]

XP

I'm going to try this with Ult Boot CD. Not sure if it has this MBRTool.

Step 3
Highlight the "Filesystem Tools" choice and press "Enter."

Step 4
Highlight the "MBRTool" selection and press "Enter."

Step 5
Select the "Restore" option and press "Enter" to renovate your Master Boot Record.

 

[ComputerRepairTech]

the command from the disc is fixmbr im not sure what file it is. may also be able to do fdisk /mbr but i can't say for sure as its been many years since ive used fdisk. I suppose I would simply try for aswmbr from a boot disc if I couldnt get the windows cd working.

 

[RegEdit]

Nope. No MBR Tool. Aghhhhhhhhh!!!

 

[tf76]

I said UBCD4WIN. NOT UBCD.

MBRFIX and MBR WIZARD should do the job

Oh and there are MBR tools on UBCD as well.



Regards,

 

[RegEdit]

I said UBCD4WIN. NOT UBCD.

MBRFIX and MBR WIZARD should do the job

Oh and there are MBR tools on UBCD as well.



Regards,

Yes. UBCD4WIN. That's what I have.
I tried this...Start > Programs > Disk Tools > Partition > MBR Fix > Fix / Update a W2K/XP/2005 type MBR code

 

[tf76]

Another way is use GParted live.


Regards,

 

[RegEdit]

It's still telling me that the MBR code is faked. : (

Yes. UBCD4WIN. That's what I have.
I tried this...Start > Programs > Disk Tools > Partition > MBR Fix > Fix / Update a W2K/XP/2005 type MBR code

This is bizarre that I can't even use a Windows CD to enter the recovery console. It's just loading from CD into RAM memory right? How would a virus interfere?

 

[tf76]

Can you run GMER?


Regards,

 

[tf76]

http://www.technibble.com/rootkit-detection-and-removal-tools/

I would remove hd and scan externally with one of these tools.



Regards,

 

[RegEdit]

http://www.technibble.com/rootkit-detection-and-removal-tools/

I would remove hd and scan externally with one of these tools.



Regards,

I was unable to install Avast's anti rootkit.
GMER seems to work.
I need to get an adapter. This ThinkPad has a strange smaller SATA power connector. Not sure what these small SATA power connectors are called.

 

[tf76]

Well Kaspersky REscue CD is usually good as well.

Regards,

 

[RegEdit]

Well Kaspersky REscue CD is usually good as well.

Regards,

Kaspersky did something. After running it I was able to install Avast's anti-rootkit tool. Instead of getting a warning about a fake MBR, MBR_Check now says that the MBR is "unknown". That's an improvement for now. I still can't load my Windows CD to run the recovery console though.

 

[732914TECH]

Since its XP you can boot to a 98 bootdisk and run "fdisk /mbr" and it will erase the MBR.

 

[jbartlett323]

It's still telling me that the MBR code is faked. : (

This is bizarre that I can't even use a Windows CD to enter the recovery console. It's just loading from CD into RAM memory right? How would a virus interfere?

The Virus isnt interfering, there is something interfering with boot. Most likely it is an AHCI HDD setting, switch to compatibility and it will boot, just switch back before booting OS. This is the common setting for IBM/Lenovo's. You have to have an XP disk with Intel AHCI drivers slipstreamed to boot without changing that setting.
If not, pull the drive and boot the CD. Wont fix your problem, but will help rule out other hardware issues...

Oh, and unless its an SSD, that is an adapter that is removable on the drive, not a special interface....

 

[RegEdit]

The Virus isnt interfering, there is something interfering with boot. Most likely it is an AHCI HDD setting, switch to compatibility and it will boot, just switch back before booting OS. This is the common setting for IBM/Lenovo's. You have to have an XP disk with Intel AHCI drivers slipstreamed to boot without changing that setting.
If not, pull the drive and boot the CD. Wont fix your problem, but will help rule out other hardware issues...

Oh, and unless its an SSD, that is an adapter that is removable on the drive, not a special interface....

Good info to know! I gotta look into how to slip stream AHCI into XP. So I guess my regular XP disks would not install on this machine if I tried? For now I've got these rootkits eradicated. Kaspersky Live CD, Avast anti-rootkit, and ComboFix did the bulk of the work.

It is SSD. I gotta get me an adapter for the next time I encounter one of these...

 

[BCS Head Tech]

Windows CD keeps blue screening out. MBR is infected. I know because MBR_Check said that the MBR is faked.

Refresh my memory on how to replace the MBR without using the recovery console. ??

try spotman software