F
FromTheRafters
Guest
"~BD~" <BoaterDave@nospam.invalid> wrote in message
news:%23SC2F8%23kIHA.1212@TK2MSFTNGP05.phx.gbl...<span style="color:blue">
>
> "FromTheRafters" <Erratic@ne.rr.com> wrote in message
> news:eyTQU$2kIHA.5088@TK2MSFTNGP02.phx.gbl...<span style="color:green">
>>
>> "~BD~" <BoaterDave@nospam.invalid> wrote in message
>> news:%23RzxTUrkIHA.4140@TK2MSFTNGP04.phx.gbl...<span style="color:darkred">
>>>
>>> "FromTheRafters" <Erratic@ne.rr.com> wrote in message
>>> news:OK6Sf$qkIHA.4480@TK2MSFTNGP03.phx.gbl...
>>>>
>>>>>> "~BD~" <BoaterDave@nospam.invalid> wrote in message
>>>>>> news:uY7fSHmkIHA.2396@TK2MSFTNGP02.phx.gbl...
>>>>> <snip>
>>>>> Have you any idea how one may remove a virus from the boot code? TIA.
>>>>
>>>> Sure, you overwrite/replace the correct code where it belongs. The
>>>> trouble
>>>> is that sometimes you need part of the malicious code to recover your
>>>> data
>>>> from the malware. Say for instance the virus encrypted some of your
>>>> files, and
>>>> you decide to overwrite the boot code (stomping on the virus) then
>>>> reboot only
>>>> to find the algorithm and 'key' to recovering your data was also
>>>> stomped on.
>>>>
>>>> ..also consider that some of your backups may have been affected if the
>>>> malware
>>>> was there long enough.
>>>>
>>>> The whole Fdisk/MBR thing just illustrates the old saw 'a little
>>>> knowledge is a dangerous thing'.
>>>>
>>> Thanks once again. You say "Sure, you overwrite/replace the correct code
>>> where it belongs". You didn't explain How . If you know, please advise.
>>> TIA</span>
>>
>> http://support.microsoft.com/kb/69013
>>
>> After reading this, you should see how it could be dangerous if the user
>> doesn't know what he or she is doing. I used to have a dual boot box
>> Linux/Win98 using 'grub' as the OS chooser. Fdisk/mbr would have
>> messed things up considerably on that box for instance.
>><span style="color:darkred">
>>> Data retention is not relevant to this exercise. The object is to have a
>>> 'clean sheet' so to speak! style_emoticons/</span>
>>
>> I can't tell you how to do it correctly for your system, because I don't
>> know
>> what correct is for your system.
>><span style="color:darkred">
>>> I do take on board, though, your point regarding backups possibly being
>>> contaminated.</span>
>>
>> The chances of you having the specific kind of virus that attaches to
>> boot code is extremely small.
>>
>> Formatting the drive will likely be sufficient for your purposes.
>></span>
> Thank you so much for your helpful comments. I have read all the
> information at the page to which your link carried me and then went on to
> explore Article ID : 255867 regarding 'How to Use the Fdisk Tool
> .........'
>
> All this information relates to systems before Windows XP. If one has been
> using a hard disk - and let us assume that (although unlikely, in your
> view) it has been infected by a Mebroot virus - if one simply boots from
> a retail copy of XP (Home in my case) with a view to reinstalling Windows
> XP, is the 'Format procedure' incorporated in the set-up programme
> sufficient to erradicate a virus attached to the code in the MBR?
>
> My intuition tells me that the virus will remain - ready to act again as
> soon as the machine is reconnected to the Internet.
>
> Maybe I am completely wrong about this, but it is why I wish to know how
> to ensure that everything is wiped off a disc before reinstalling Windows.
> FYI, I have also used a facility called Darik's Boot and Nuke to destroy
> all data on a disk - but remain uncertain if even this procedure will
> destroy MBR malware. I wonder if anyone reading here will know.</span>
Vista http://support.microsoft.com/kb/927392
Some others
http://www.datarecovery.com.sg/data_recove..._corruption.htm
Wanted to post a KB article - but this came to me first.
HTH
news:%23SC2F8%23kIHA.1212@TK2MSFTNGP05.phx.gbl...<span style="color:blue">
>
> "FromTheRafters" <Erratic@ne.rr.com> wrote in message
> news:eyTQU$2kIHA.5088@TK2MSFTNGP02.phx.gbl...<span style="color:green">
>>
>> "~BD~" <BoaterDave@nospam.invalid> wrote in message
>> news:%23RzxTUrkIHA.4140@TK2MSFTNGP04.phx.gbl...<span style="color:darkred">
>>>
>>> "FromTheRafters" <Erratic@ne.rr.com> wrote in message
>>> news:OK6Sf$qkIHA.4480@TK2MSFTNGP03.phx.gbl...
>>>>
>>>>>> "~BD~" <BoaterDave@nospam.invalid> wrote in message
>>>>>> news:uY7fSHmkIHA.2396@TK2MSFTNGP02.phx.gbl...
>>>>> <snip>
>>>>> Have you any idea how one may remove a virus from the boot code? TIA.
>>>>
>>>> Sure, you overwrite/replace the correct code where it belongs. The
>>>> trouble
>>>> is that sometimes you need part of the malicious code to recover your
>>>> data
>>>> from the malware. Say for instance the virus encrypted some of your
>>>> files, and
>>>> you decide to overwrite the boot code (stomping on the virus) then
>>>> reboot only
>>>> to find the algorithm and 'key' to recovering your data was also
>>>> stomped on.
>>>>
>>>> ..also consider that some of your backups may have been affected if the
>>>> malware
>>>> was there long enough.
>>>>
>>>> The whole Fdisk/MBR thing just illustrates the old saw 'a little
>>>> knowledge is a dangerous thing'.
>>>>
>>> Thanks once again. You say "Sure, you overwrite/replace the correct code
>>> where it belongs". You didn't explain How . If you know, please advise.
>>> TIA</span>
>>
>> http://support.microsoft.com/kb/69013
>>
>> After reading this, you should see how it could be dangerous if the user
>> doesn't know what he or she is doing. I used to have a dual boot box
>> Linux/Win98 using 'grub' as the OS chooser. Fdisk/mbr would have
>> messed things up considerably on that box for instance.
>><span style="color:darkred">
>>> Data retention is not relevant to this exercise. The object is to have a
>>> 'clean sheet' so to speak! style_emoticons/</span>
>>
>> I can't tell you how to do it correctly for your system, because I don't
>> know
>> what correct is for your system.
>><span style="color:darkred">
>>> I do take on board, though, your point regarding backups possibly being
>>> contaminated.</span>
>>
>> The chances of you having the specific kind of virus that attaches to
>> boot code is extremely small.
>>
>> Formatting the drive will likely be sufficient for your purposes.
>></span>
> Thank you so much for your helpful comments. I have read all the
> information at the page to which your link carried me and then went on to
> explore Article ID : 255867 regarding 'How to Use the Fdisk Tool
> .........'
>
> All this information relates to systems before Windows XP. If one has been
> using a hard disk - and let us assume that (although unlikely, in your
> view) it has been infected by a Mebroot virus - if one simply boots from
> a retail copy of XP (Home in my case) with a view to reinstalling Windows
> XP, is the 'Format procedure' incorporated in the set-up programme
> sufficient to erradicate a virus attached to the code in the MBR?
>
> My intuition tells me that the virus will remain - ready to act again as
> soon as the machine is reconnected to the Internet.
>
> Maybe I am completely wrong about this, but it is why I wish to know how
> to ensure that everything is wiped off a disc before reinstalling Windows.
> FYI, I have also used a facility called Darik's Boot and Nuke to destroy
> all data on a disk - but remain uncertain if even this procedure will
> destroy MBR malware. I wonder if anyone reading here will know.</span>
Vista http://support.microsoft.com/kb/927392
Some others
http://www.datarecovery.com.sg/data_recove..._corruption.htm
Wanted to post a KB article - but this came to me first.
HTH