Can't unhide type 17 (NTFS) partitions!!

[kanfive]

Someone please help me, thanks. At first I had virus(es) related to RPC which pops up a dialog saying RPC needs to reboot computer, then I had virus(es) that shuts down regedit and antivirus automatically after opening them for a moment. I decided to delete all the partitions and reinstall all my WinXP Pros. Now I have another virus(es) that turns my inactive partitions to type 17 (hidden NTFS) and I can't access those partitions at all. Partition Magic 8 can't unhide them. I booted using floppy to DOS and did scans with f-prot but found nothing. F-prot couldn't scan the hidden NTFS either. I wasted so much time trying to fix this but with no further progress. Please help! Thanks alot.

 

[bcastner]

TestDisk may do it:

http://www.cgsecurity.org/

 

[bcastner]

See also:

Knoppix
Discussion:

http://www.broadbandreports.com/forum/remark,7018905~root=winme~mode=flat

Download sources:

http://www.knoppix.net/get.php

Ultimate Boot CD

http://www.ultimatebootcd.com/

 

[bcastner]

Also, did you try dispart.exe?

delete partition [noerr] [override]

Use the delete partition command to delete the current in-focus partition.

Diskpart blocks the deletion of the current system, boot, or paging volume. To delete either an ESP, MSR, or a known OEM partition, you must specify the override parameter.

http://support.microsoft.com/?kbid=300415

 

[bcastner]

Last thought:

I have used this utility with success:

http://www.diydatarecovery.nl/~tkuurstra/DiskPatch.htm

There is a 'demo' download you can use to test. You might want to look at the Support site for the product, as the forum has several recoveries of partitions, including modifying the partition type. The product is reasonably priced at around $35 US.

 

[kanfive]

thanks alot

 

[bcastner]

The virus may well live in the boot sector.

Diskpart has a clean command that will completely rewrite the boot MBR.

Keeping the MBR sounds like not such a great idea in your case.