Discussion » Boot sector help and all that

This is a read-only copy. The forum ran on iamcal.com from 2000 until its database was lost in 2016, and this topic was rebuilt from copies saved by the Internet Archive's Wayback Machine. Some replies may be missing, and its dates are approximate.
Posted by Brock, around 1st December 2005:
 
So then.

I have got all involved in someone's PC. It has a virus on it somewhere in the boot sector (according to the various virusy bits) and is in/something to do with the Partition Table.

AVG suggests I boot up with a floppy, start the OS from a Disk and try and sort it, but I don't have the accompanying Win98 CD to do that with. I only have a Win 2000 disk.

Is there some way I can sort this? Or is the best bet to get a 98 disk or just nuke it and put 2000 on. My feeling is the latter, but this is a Dell recovery disk copy of 2000 and I don't know if it will work. So I may be stuck.

Hmmm. So my options, as I see them, are this:

1: Nuke it, try and re-install 2000 and see where it goes. Worst case, I have to get a 98/2000 OS from somewhere

2: Slap the HD into my machine as a slave and try and sort it from there. That is a bit scary, and I have no idea if it will work, or if it will just fuck my machine up.

3: Just get a 98 disk and try and do the floppy+CD version.


Hmmmmm. Anyone have a spare 98 disk anywhere that they could post to me?

Any better ideas?
Posted by Saltation_DUPE1, 2nd December 2005:
 
given your CD constraints, 2 seems safest to me. bear in mind my skillset's more unix+mac rather than windows.

notes re 2. if it's going in as a Slave, then the boot sectors *should* not be touched. ie, you *should* have no fear of the virus being activated. the boot sectors literally should only be touched at boot time (startup). they contain the address of where on disk to jump execution to (ie, the OS normally, in your case the virus). they are otherwise outside the universe of normal apps since they are not part of the filesystem.

however, i can't actually *guarantee* that this is the precise behaviour of windows.

on that basis, you could mount the disk (fnarr), take a disk image of all the *files* --NOT the whole disk- this could potentially take the boot sectors with it, depending on how your diskcopy app works (check its doco)-- format the infected disk, reinstall the OS, then copy back all the files.

alternatively, some disk apps let you re-write the boot sectors. see if yours do.
Posted by Sul_DUPE1, 2nd December 2005:
 
For ease I'd say Burn a copy and boot the The Ultimate Boot CD and use any one of the AV products on it. It's a good CD to have lying around.

Been ages since I heard of a boot sector virus.
Posted by Sul_DUPE1, 2nd December 2005:
 
Even quicker: If I recall correctly the 98 boot floppy has fdisk on it so you could make a 98 boot floppy, boot from it and run FDISK /MBR.

I'd do that if I had any floppy disks.

edit: I am not suggesting you do this btw. It's an option but can go wrong as some viruses encrypt the partition table so it would fuck you bad.
Posted by ellipse, 2nd December 2005:
 
don't risk 2 dude