Devastating MBV

Discussion in 'Malware Help (A Specialist Will Reply)' started by quorumangelorum, Mar 12, 2008.

  1. quorumangelorum

    quorumangelorum Private E-2

    I believe I had a particularly nasty MBV. For a few days, all I could do was boot up halfway, then watch the screen go blank and start to boot up halfway again. The BIOS could see the floppy, CD/DVD drive, and two IDE hard drives, but only the floppy drive would actually function, and I could not access any of my drives from DOS. Well, I could use "dir" & look at the contents of my XP CD; but the system would not run setup; it wouldn't spin up at all. Then the floppy drive stopped working too.

    Through an exceedingly arcane set of maneuvers, I got my PC to finally see the CD/DVD drive long enough to get my XP CD to start. Recovery console didn't help, and I had to reinstall. Originally, I had a 30-odd gig drive,which was the system drive, and a 160-gig slave drive. Both, however, were bootable, because I had cloned the small drive onto the big one.

    The system installed XP on the slave drive, because it says the system drive is "FAT 12" (WTF???) and inaccessible. NO utility will even look at it. I had so much critical stuff on there... anyway, the BIOS still sees it.

    The slave drive still has all my music & video files; but the clone of the system drive is gone. It has apparently acquired the 30-gig limitation issue because that's how the BIOS is reporting it now. I re-enabled large disk support to no avail. It is also impossibly slow doing anything & seems to hang for long periods of time. I still haven't got my floppy drive back online, so DOS-based utilities won't work for now.

    Right after it happened, I came back to my PC after having gone out, & noticed my AVG icon was greyed-out. The #%@$&&*! thing disabled my prophylactic before attacking! That is just not cool.

    So, voices of experience, is the system drive redeemable? I have not the remotest idea which MBV it was, because I'd never had one before, and rebooted unwittingly; evidently, that's the worst thing to do. I haven't been able to find any kind of malware-scanning software that will even examine the system drive (including HiJackThis). Tell me what you need to know next. I have great faith in your collective expertise.

    Thanks.
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Actually I'm not sure this is a MBR virus. It sounds more like hardware/software issues. You may want to pursue posting in the hardware or software forums and looking into possible data recovery methods if you really need the information on the harddisks. Otherwise I suggest that you delete your partitions, repartition, format and reinstall.

    A program like Recover My Files may be of use since it is suppose to support all FAT types.
     
  3. quorumangelorum

    quorumangelorum Private E-2

    Thanks, chaslang; I was beginning to think no one loved me!

    The reason I think it was a boot sector virus is the fact that it happened right after a peer-to-peer movie download. (quack! Yes, I knew better.) And the fact that the movie size was listed as much larger than it actually was. And the fact that my pc froze up entirely after that; which is why I did the fatal reboot, all unawares.

    Plus, what diagnostic and recovery software I have used have told me that my disks were unreadable and deeply damaged. Also I saw a reference in another forum to a sequence of events with a virus which closely matched my own.

    I do think it's odd that hijack this! hasn't found any viral activity. But what else would have deactivated my AVG? I mean, there was actually a warning on the monitor when I came back in telling me that it had been deactivated. Not out-of-date or anything, but turned off.

    The other thing is that it apparently infected the memory card from my camera as well, which happened to be in the card reader at the time. (I didn't know that my system considers the card reader a boot device!)
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    HijackThis is not a virus or malware scanner. It does not detect anything. It just reports a running process list and a handful of registry keys out of the many tens of thousands that exist and then it is up to an experienced person to interpret if anything in there is of interest.

    Things like this happen all the time. Yes it can often be due to malware but it could also happen if necessary files are deleted/corrupted by mistake.

    If you cannot boot your PC to run our READ & RUN ME procedure or run any other scans, there is not much we can do for you.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds