Boot Sector Virus??? - Windows 7 Black Screen

[goombawaho]

Got a PC that just starts up to a flashing cursor on a back screen (no windows logo at all). Tested memory and hard drive - all okay. Tried repairing the boot sector with various commands. Nearly ready to give up and reload Win 7. Suspecting malware but can't really tell. I don't really want to give in and reload this machine.

Any hints or tools that could be used to remove a boot sector virus/rootkit on a non-bootable PC. Like bootable tool CDs

Windows Defender Offline Tool
Norton Bootable Recovery Tool
??Specific bootable rootkit detector??

 

[sggaunt]

this might seem a bit obvious but as you haven't mentioned it..
Can access the BIOS set up?
Can you boot from CD/DVD/RAM Stick?

Steve: N.M.N.F.
If something is popular, it must be wrong: Mark Twain

 

[goombawaho]

BIOS is fine - checked all settings
Yes, I can boot to any CD/DVD I want, but my question is which one is going to help with the boot sector virus?

In other words, which weapon to choose.

 

[IPGuru]

you could install almost any linux distro as a dual boot setup
this will replace the windows boot loader with GRUB which will happily detect Windoze & allow you to select it form the boot menu (it can also be set as a default option)

booting to linux can also be useful for Virus removal as windoze viruses cannot operate on a linux system.


A Maintenance contract is essential, not a Luxury.
Do things on the cheap & it will cost you dear

 

[goombawaho]

I guess everyone is missing what I'm asking. Simply stated: What bootable anti-malware tool would you use? Must be bootable because Windows won't start. I gave two examples above and another is the Comodo Rescue Disk. But does anyone have any actual recommendations based on using one of these (or another) successfully?

 

[IPGuru]

Bitdefender has worked for me in the past if you just want a live antivirus system


A Maintenance contract is essential, not a Luxury.
Do things on the cheap & it will cost you dear

 

[sggaunt]

Er OK I have 3 disks. haven't had to try any of them so far, so I have no idea which is best or even if I should burn more.
The three 'Rescue discs' I have so far are:-

These were recommended..
Bit Defender Boot-able rescue disk
Karspersky Rescue disk 10

And this from when I had Avira Installed
Avira Rescue disc

I think most of the main line Anti-virus providers do this sort of thing. I don't know of a way a virus can 'hide' in the boot sector only mess it up, so any tool that re-creates the sector should do the trick.
provided that the virus is removed from the file system first of course.






Steve: N.M.N.F.
If something is popular, it must be wrong: Mark Twain

 

[goombawaho]

Ok great, that gives me some additional ones to think about. I only want to spend about 20 minutes on trying to get rid of the virus before I have to do a reload - time considerations/constraints.

 

[edfair]

I had success with Microsoft's offline scanner but seem to recall that it was sensitive to out of date signatures which required an offline updater program to run first.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[goombawaho]

I think that's the one I'm going to go with. I tried the Comodo Rescue Disk yesterday on my own computer and it didn't see the 500GB sata drive, so I guess it couldn't scan it very well in that case (sarcasm). Will update after real world test.

 

[BadBigBen]

For a BOOT sector reset, why not boot into an XP or Win7 DVD, and do a System Repair (Command prompt for XP)...

on XP:

log into the Windows that is installed, then issue FIXBOOT and FIXMBR one after another.

Win7: pretty much self-explanatory.

alternatively, you could boot with any Live Linux Distro, such as Parted Magic, then go into GParted and it will allow you to rewrite the boot sectors, and even will tell you that they non-standard (if I remember it correct)...



Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[goombawaho]

I tried every Bootrec, bootfix, etc. command I could find for Windows 7 and it wouldn't repair the boot sector to make the machine bootable. This is going around - had a neighbor ask me about it. Not sure which malware is doing this.

 

[smah]

Use [*insert favorite tool here] to look at the drive partitions. Nothing will help if the partition table is corrupt. If the drive shows that it is completely unallocated, then it's the partition table that is the problem, and might be easily repairable.

 

[sggaunt]

Cant believe you haven't thought of this but...

http://support.microsoft.com/kb/255867

Steve: N.M.N.F.
If something is popular, it must be wrong: Mark Twain

 

[goombawaho]

Dudes - it was too hosed to fix - case closed. Shouldn't have gotten any more responses after Nov. 29 since it was reloaded at that point. But thanks.