TSGL: Fixing an Infected MBR

[David Goldstein]

Also, fixmbr is saying I have a "non-standard or invalid master boot
record".  This is true since Dell put a 'rescue' partition on the
drive.  Will fixmbr cause any issue there?



On Mon, Nov 23, 2009 at 3:37 PM, David Goldstein <golddave at gmail.com> wrote:
> Will I need to do fixboot too?  Will fix mbr actually fix the issue?
> Will my Ghost thoughts (in the original post) work in place of fixmbr?
>
> On Mon, Nov 23, 2009 at 3:14 PM, The Computer Whisperer
> <justin at whisperer.com.au> wrote:
>> using fixmbr from the recovery console, generally, 99% of the time
>> will not cause any data loss, if it does screw things up your data
>> will still be there, just not bootable.
>>
>> On 24/11/2009, David Goldstein <golddave at gmail.com> wrote:
>>> I'm trying to fix a machine that (according to Norton) is infected
>>> with boot.mebroot.  Most of what I've read about this malware points
>>> to the Master Boot Record (MBR) of the infected drive.  Most people
>>> say to use fixmbr from the recovery console but that it's very likely
>>> that the existing data on the machine would be lost.  I'm trying to
>>> think of ways to fix the machine without that.
>>>
>>> I have some old Ghost (2003) images of the infected machine. I believe
>>> Ghost backs up the MBR of a machine.  Is it possible for it to restore
>>> an MBR only (so it overwrites the infected one)?
>>>
>>> Another thought: if I restore an old image could I back up the MBR in
>>> another way and restore it to the infected machine (overwriting the
>>> infected MBR)?
>>>
>>> Any thoughts, suggestions and ideas would be appreciated.
>>>
>>> Thanks,
>>> Dave
>>>
>>> _______________________________________________
>>> Tech Support Guy Mailing List
>>> http://www.tsgserver.com/list/
>>>
>>
>>
>> --
>> http://www.whisperer.com.au
>>
>> The Computer Whisperer - Gets you where you want to be.
>>
>> Friendly on-site technical support - Home and Small Business Specialist.
>>
>> Telephone: (03) 5979 1122
>> Mobile 0406 467 701
>>
>> Servicing the Mornington Peninsula (Victoria, Australia)
>>
>> _______________________________________________
>> Tech Support Guy Mailing List
>> http://www.tsgserver.com/list/
>>
>