Desperate - MBR corruption on wifes system!
 

Anyone who's had to deal with this kind of thing, PLEASE help.

Was using her system to browse while mine was doing a backup and it was taking a lot (more than normal) of virus hits (AVG and Sophos came up with a lot of boxes)

In the AM, I found it had re-booted and had an error message "Error loading OS"

Just after post it comes up with this error.

Tried updating MBR with fixmbr and with Maxblast, not sure if they actually replaced it though? No joy. When I installed another master and look at that drive, I can see all the partitions and files except for the C drive. Then Icopies files from the bad drive partitions that I could see (D and E) and this NEW drive did the same thing last night.

Woke up today and it had re-booted with a start up error "Error loading OS".

Must be a mem resident that came into this drive when I copied the D and E files onto it from the original infected drive.

This machine is Win2k pro, sp4. Have broadband cable conn.

BTW, am looking at the drive with a dos program that allegedly repairs MBR's (seems that is the problem, a mem resident virus that screws with the MBR?)

This program lists my C drive as Fat32 (it's not, it's NTFS) and named "My Big Dog" (not my naming, probably a virus name or something that the virus wrote, but can't find any info on a "My Big Dog" virus?)

Did try win2k recov console. When I try to restore with an older ERD, I get a BSOD with setupdd.sys as the stop file.

This happens with the old orig drive and with the brand new drive I setup and copied D and E drive files to.

Just found this on M$ website: "If a virus has infected the Master Boot Record (MBR), you cannot run the Emergency Repair Disk until the virus is cleaned."

This is killing me to have both systems down right now, any help is appreciated and if it actually gets my data back, it's worth parts or injector work!

Take the hard drive out of the computer and put it in another computer as a slave drive. Assuming the rest of the hard drive is not corrupted it will then be accessible from windows. If it is corrupted use PC Inspector File Recovery to copy your files onto your other good hard drive.
http://www.pcworld.com/downloads/file_description/0,fid,23069,00.asp

Don't worry about it infecting that computer. Nothing on the hard drive will be executed if you install it as a slave drive. I assume there are windows tools that will repair your MBR or you could try running MS Antispyware, norton or AVG on that disk but I would save all my files, re-format and start over. You will need to use a special utility that writes 0s to the entire disk. Either from the manufacturer or one online. FDISK,format etc. do not re-write the MBR. Also make sure that you are in fact going to still be booting from your main hard drive in your good pc. Also make sure to pull the power cord from the infected PC and let it sit for 15-20 minutes.

I would agree with laurancekarl on the backup procedure. I would get the data off the disk ASAP so that in the event that the disk is failing. You'll hear clicking or starting and stopping of the motor. I too am recovering a few failing drives for other clients using Ontrack's Easy Recovery which is short of amazing.

Once the data is backed up run the Maxtor utility (I presume is is a Maxtor) and run the full disk test for errors before you reinstall the operating system to rule out the possibility of a failing drive.

I am a staunch supporter of Spintrite 6............it will go through the disk with exhaustive testing every sector including those tags and removed from service.....any that pass its testing is put in service....

If the drive is good this will tell you...if its bad it will find it....

There will not be any question when its done.

But back it up first.......by the ways sugested already.