Help! MBR infection on win XP Pro SP3 now 'No Boot Device Available' !?
Hi this is my first post so please bear with me!
I run a stock Dell Dimension E520 from around 2007 with Win XP Pro fully patched to sp3 and up-to-date. I've never had any major problems with it and nothing customised except adding 2GB of additional RAM.
Everything was working fine until the system just rebooted itself!?
I appear to have contracted the MBR virus discussed in this forum http://www.overclock.net/intel-cpus/486062-windows-xp-freezes-1-continuous-beep.html
I tried to run Malwarebytes but the system kept on freezing and wouldn't allow me to connect to the internet. I had to keep forcing shut down from the power button.
All of a sudden Ii turn it on again and now it won't even boot! At BIOS screen it says 'No boot device available'
Does this mean the hard-drive is dead and the data unrecoverable? I have original Dell OS Reinstallation CD (XP Pro SP 2) - can this fix anything or is the system dead?
Any help would be greatly appreciated.
Many thanks
I run a stock Dell Dimension E520 from around 2007 with Win XP Pro fully patched to sp3 and up-to-date. I've never had any major problems with it and nothing customised except adding 2GB of additional RAM.
Everything was working fine until the system just rebooted itself!?
I appear to have contracted the MBR virus discussed in this forum http://www.overclock.net/intel-cpus/486062-windows-xp-freezes-1-continuous-beep.html
I tried to run Malwarebytes but the system kept on freezing and wouldn't allow me to connect to the internet. I had to keep forcing shut down from the power button.
All of a sudden Ii turn it on again and now it won't even boot! At BIOS screen it says 'No boot device available'
Does this mean the hard-drive is dead and the data unrecoverable? I have original Dell OS Reinstallation CD (XP Pro SP 2) - can this fix anything or is the system dead?
Any help would be greatly appreciated.
Many thanks
Did you tried to go to BIOS and check whether your hard disk are showing up or not ?
Or
Go to Bios and do the following :
Problem fixed.
Go to BIOS (using F2) and change the SATA
setting from RAID ON to RAID AUTODETECT. When I made that change.
Setup continued just fine.
Or
Go to Bios and do the following :
Problem fixed.
Go to BIOS (using F2) and change the SATA
setting from RAID ON to RAID AUTODETECT. When I made that change.
Setup continued just fine.
Hello theinkcloud
First check in you bios if the hdd where you normally boot from is present, and if available, check if the s.m.a.r.t. status says: ok. during post
If this is the case, make sure the boot priority order is set to boot from the hdd that has the operating system installed on it.
If the above has been checked, and the problem is still there, consider the following:
1. The cable from the hard drive to motherboard is either loose, or damaged. Disconnect the cable and thoroughly inspect it, and if it looks ok, stick it back in there, and make sure its secured tightly.
2. You have a bad sector on the hard drive- i.e a failing hard drive. Try something like Western Digital Diagnostic tool to check for this.
3. Your MBR is corrupt. You can boot on the CD and go into recovery console mode where you can run fixmbr to test for and repair this.
You might want to get a hold of Ultimate Boot CD.
It has a few utilities that saved me a lot of work. Its legal, and free.
Best regards
First check in you bios if the hdd where you normally boot from is present, and if available, check if the s.m.a.r.t. status says: ok. during post
If this is the case, make sure the boot priority order is set to boot from the hdd that has the operating system installed on it.
If the above has been checked, and the problem is still there, consider the following:
1. The cable from the hard drive to motherboard is either loose, or damaged. Disconnect the cable and thoroughly inspect it, and if it looks ok, stick it back in there, and make sure its secured tightly.
2. You have a bad sector on the hard drive- i.e a failing hard drive. Try something like Western Digital Diagnostic tool to check for this.
3. Your MBR is corrupt. You can boot on the CD and go into recovery console mode where you can run fixmbr to test for and repair this.
You might want to get a hold of Ultimate Boot CD.
It has a few utilities that saved me a lot of work. Its legal, and free.
Best regards
Try these :
Note : Use the same Windows XP version setup you have installed currently
Boot from the XP / 2000 CDROM and allow the setup to begin. Once the beginning files are copied, you will be asked to Install Windows or use the Recovery Console. Please choose "r" here, to run the recovery console.
You will now type in the following commands when the prompt appears:
chkdsk /f
* This will repair any obvious file system damage, which could complicate things.
diskpart
* This will run the XP disk partition utility. We will be checking to see if your partition looks OK. If you see your partition, and the information diskpart provides appears correct, then that's a good thing. :)
Press [ESC] to exit Diskpart, when everything looks peachy.
fixboot
* We'll write a new boot sector, so the computer knows how to boot the computer
fixmbr
* We'll write a new boot record, so the computer knows how to boot Windows
You should be taken care of. If it still does not work, you may need to delete your partition(s) using diskpart, then recreate the partition(s) (using diskpart, again).
Note : Use the same Windows XP version setup you have installed currently
Boot from the XP / 2000 CDROM and allow the setup to begin. Once the beginning files are copied, you will be asked to Install Windows or use the Recovery Console. Please choose "r" here, to run the recovery console.
You will now type in the following commands when the prompt appears:
chkdsk /f
* This will repair any obvious file system damage, which could complicate things.
diskpart
* This will run the XP disk partition utility. We will be checking to see if your partition looks OK. If you see your partition, and the information diskpart provides appears correct, then that's a good thing. :)
Press [ESC] to exit Diskpart, when everything looks peachy.
fixboot
* We'll write a new boot sector, so the computer knows how to boot the computer
fixmbr
* We'll write a new boot record, so the computer knows how to boot Windows
You should be taken care of. If it still does not work, you may need to delete your partition(s) using diskpart, then recreate the partition(s) (using diskpart, again).
ASKER
Thankyou all for the quick responses. I've tried changing SATA operation to RAID Autodetect with no joy. I'm going to check the cables and connections next and then try booting from the CD. I'll report back shortly with the results.
Many thanks.
Many thanks.
ASKER
Checked cabling and reseated all connections...no joy! Moving on to booting to recovery console. will post back with results shortly.
If the hard drive is detected in the bios then recover your data first, if able.
Use knoppix live cd and boot to it and copy data off hard drive to a usb device
http://knopper.net/knoppix-mirrors/index-en.html
What informed you that you have MBR infection?
Use knoppix live cd and boot to it and copy data off hard drive to a usb device
http://knopper.net/knoppix-mirrors/index-en.html
What informed you that you have MBR infection?
ASKER
Followed instructions to boot from CD, clicked R to access recovery console and tried the following so far:
At c:\> prompt
1) chkdsk /f
RESULT: The parameter in not valid. Try /? for help.
2) chkdsk /r
RESULT: The volume appears to contain one or more unrecoverable problems.
3) diskpart
RESULT:
305243 MB Disk 0 at Id 0 on bus 0 on atapi [MBR]
unpartitioned space 305243 MB
The drive is a 320 GB Western Digital WD3200AAKS and was partitioned as below:
c:\ ~ 220 GB System Drive
d:\ ~80 GB Backup Drive
Not sure what to do now. As it's seeing an unpartitioned space does that mean all is lost?
At c:\> prompt
1) chkdsk /f
RESULT: The parameter in not valid. Try /? for help.
2) chkdsk /r
RESULT: The volume appears to contain one or more unrecoverable problems.
3) diskpart
RESULT:
305243 MB Disk 0 at Id 0 on bus 0 on atapi [MBR]
unpartitioned space 305243 MB
The drive is a 320 GB Western Digital WD3200AAKS and was partitioned as below:
c:\ ~ 220 GB System Drive
d:\ ~80 GB Backup Drive
Not sure what to do now. As it's seeing an unpartitioned space does that mean all is lost?
ASKER
@optoma
Thankyou for the link.
Re: What informed you that you have MBR infection?
The computer suddenly rebooted itself for no apparent reason and then it started freezing intermittently. I researched on google variations of 'xp freezing then continuous bleep' which lead me to the link in my original post.
I tried to download rootrepeal from but it didn't work (some DeviceIOControlError?) ,I tried Prevx but it couldn't connect to the internet to run scan, I updated Malwarebytes from my Vista laptop and transferred updated definitions to problem machine and tried to run Malwarebytes. This is how I arrived at writing my post.
Many thanks
Thankyou for the link.
Re: What informed you that you have MBR infection?
The computer suddenly rebooted itself for no apparent reason and then it started freezing intermittently. I researched on google variations of 'xp freezing then continuous bleep' which lead me to the link in my original post.
I tried to download rootrepeal from but it didn't work (some DeviceIOControlError?) ,I tried Prevx but it couldn't connect to the internet to run scan, I updated Malwarebytes from my Vista laptop and transferred updated definitions to problem machine and tried to run Malwarebytes. This is how I arrived at writing my post.
Many thanks
Its possible that if the MBR infection was there and something got really messed up, resulting in a blank drive :(
Is the data vital on machine?
It so, it would be better to bring it to data recovery specialists and let them try and recover the data.
Is the data vital on machine?
It so, it would be better to bring it to data recovery specialists and let them try and recover the data.
ASKER
@optoma
I fear this is what that's happened. Most of the vital data was backed up to an external drive but work from the last few days not already backed up would be lost if that was the case.
If I can't rescue it then I'll have to just do that and move on.
I'm assuming there's no way to recover the drive from here on?
I fear this is what that's happened. Most of the vital data was backed up to an external drive but work from the last few days not already backed up would be lost if that was the case.
If I can't rescue it then I'll have to just do that and move on.
I'm assuming there's no way to recover the drive from here on?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Would the best way not be to boot into xp live (linux disc) and check the drive from there?
True, Knoppix is mentioned above ;)
ASKER
ok thankyou all for the kind advice. currently downloading knoppix and also Ultimate boot CD as suggested by Consiglieri. I'm going to check local stores for a replacement drive to clean install OS so i can eventually have a clean boot drive.
In your opinion would it be best to:
a) try and access the drive whilst it's still in with knoppix OR
b) install new drive, clean install os into a new drive, and try and access the old drive as slave?
Thankyou all for your kind assistance.
In your opinion would it be best to:
a) try and access the drive whilst it's still in with knoppix OR
b) install new drive, clean install os into a new drive, and try and access the old drive as slave?
Thankyou all for your kind assistance.
No harm in trying Knoppix now.
If the drive is blank,ie, unpartitioned, Knoppix will mount the drive but would throw an error trying to access it.
If the drive is blank,ie, unpartitioned, Knoppix will mount the drive but would throw an error trying to access it.
ASKER
ok i've loaded Knoppix fine but no sign of the hard drive as partition on the desktop. is there anything i can do to check for the harddrive?
Is there any hard disk icons in Knoppix on its desktop?
ASKER
unfortunately not just 2 folders 'My Documents' and 'Knoppix'
ASKER
i don't know if this means anything but i have the case open on the machine and it would appear the disk is spinning although that might just be because it's powered up. apologies if this is useless info.
At least its spinning!
Knoppix not seeing it so it probably best to get another drive as you mentioned and load then machine fresh. Then try recovery process.
Knoppix not seeing it so it probably best to get another drive as you mentioned and load then machine fresh. Then try recovery process.
ASKER
Thankyou again for your patience kind advice. have located a drive not too far away so will go and pick that up now. will post back with progress once installed.
:)
fior Dell disk and MBR problems - read this : http://www.goodells.net/dellrestore/dellmbr.htm
ASKER
QUICK UPDATE:
I have installed a new harddrive and installed XP pro from Dell Reinstall Disk and now fully updated to SP3 and .net framework 3.5. I'm happy to say I'm now posting from the clean new machine.
It would be nice to see if we can get to the bottom of the original problem. If we can find a solution to check the disk and access it (if it is still accessible) this might help someone else in the future iwth a similar problem. If I can also recover any data, that would just be a bonus!
AS AN ASIDE:
I never really go to PC world (but desperate times called for desperate measures:) , I popped into the local PC World and managed to persuade the guys at the tech desk to take a look at it. They came back baffled as they said ( what I already knew) that the disk was not showing up on any of the machines BUT it appeared to be spinning normally with no noises or any obvious signs of mechanical failure! Incidentally I got my replacement drive (Hitachi HDS721032CLA362) from a small computer store across the road as PC world only had some own brand drives and NO ONE in the store could tell me the size of the cache on ANY of the drives !? - so I went across the road :)
@nobus
Thankyou for the link. I wish I had seen it before I replaced the drive.
However I still have the original disk, a spare HD bay, a spare SATA & Power cable/connector and a spare SATA slot on the board. Before I do anything foolish can you or anyone else suggest a way forward to try and see if the drive can still be accessed?
Many thanks to you all thus far, at least I have a clean working system again!
I have installed a new harddrive and installed XP pro from Dell Reinstall Disk and now fully updated to SP3 and .net framework 3.5. I'm happy to say I'm now posting from the clean new machine.
It would be nice to see if we can get to the bottom of the original problem. If we can find a solution to check the disk and access it (if it is still accessible) this might help someone else in the future iwth a similar problem. If I can also recover any data, that would just be a bonus!
AS AN ASIDE:
I never really go to PC world (but desperate times called for desperate measures:) , I popped into the local PC World and managed to persuade the guys at the tech desk to take a look at it. They came back baffled as they said ( what I already knew) that the disk was not showing up on any of the machines BUT it appeared to be spinning normally with no noises or any obvious signs of mechanical failure! Incidentally I got my replacement drive (Hitachi HDS721032CLA362) from a small computer store across the road as PC world only had some own brand drives and NO ONE in the store could tell me the size of the cache on ANY of the drives !? - so I went across the road :)
@nobus
Thankyou for the link. I wish I had seen it before I replaced the drive.
However I still have the original disk, a spare HD bay, a spare SATA & Power cable/connector and a spare SATA slot on the board. Before I do anything foolish can you or anyone else suggest a way forward to try and see if the drive can still be accessed?
Many thanks to you all thus far, at least I have a clean working system again!
Plug in the "spare" hard drive.
Is it seen in the bios and under computer management?
Is it seen in the bios and under computer management?
Sorry>disk management
>start, run, type
diskmgmt.msc
>start, run, type
diskmgmt.msc
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
ok folks,
@optoma:
have installed failed disk and it is seen in bios with full 298.09 GB
have gone into disk management and it appears as:
Disk 1
unknown
298.09 GB
Not Initialized
and shows 298.09 Unallocated
Have not done anything else, 'Initialize and Convert Disk Wizard' has popped up but I haven't done anything with it, i've just left it for now.
@nobus:
am downloading HDD Regenerator now.
Should I close the wizard and Disk Management before attempting to run HDD Regenerator?
(If you respond and don't hear back for while don't worry I have to head out. It's 6pm here and might not be back till late. Will pick up as soon as I can and repsond. )
Many thanks.
@optoma:
have installed failed disk and it is seen in bios with full 298.09 GB
have gone into disk management and it appears as:
Disk 1
unknown
298.09 GB
Not Initialized
and shows 298.09 Unallocated
Have not done anything else, 'Initialize and Convert Disk Wizard' has popped up but I haven't done anything with it, i've just left it for now.
@nobus:
am downloading HDD Regenerator now.
Should I close the wizard and Disk Management before attempting to run HDD Regenerator?
(If you respond and don't hear back for while don't worry I have to head out. It's 6pm here and might not be back till late. Will pick up as soon as I can and repsond. )
Many thanks.
ASKER
Please see screenshot to accompany post above.
DiskMgmt.JPG
DiskMgmt.JPG
you run it from a CD!
ASKER
@nobus
thanks :) I'll follow the instructions!
thanks :) I'll follow the instructions!
ASKER
UPDATE: Good news!
Ran HDD Regenerator as prescribed by nobus and surprisingly (or unsurprisingly) came back with following results:
Complete Scans Done: 1
0 bad sectors found
0 bad sectors recovered
B -0 sectors remain bad
R - 0 sectors ever recovered
N - 0 new bad sectors appeared
R - 0 bad sectors reappere
(Scan Time 1:10)
I almost didn't want to believe it but as i had the cover on the machine open I had to keep physically checking the right disk was spinning to confirm I was indeed checking the 'dead' disk and not the new one!
Having earlier downloaded FindandMount on the advice of optoma I went ahead and installed it then ran it (with fingers crossed of course:)
And what do you know?!
Theres the 'dead' WDC drive with all partitions visible in Partition Find and Mount'. So I click on Partition 2 (previously the main c:\ drive) and theres the complete file structure as last seen a couple of days ago. (it's fair to say I smiled but couldn't really believe it :) - SEE ATTACHED IMAGE
I grabbed the most important files and copied them over to the new drive immediately...no problem!
It's now nearly 1 am here so I'm going to crash (like a dead harddrive :) and pick up again in the morning.
I would however like to take this opportunity to extend my sincerest gratitude to you that have helped guide me through this esp. optoma and nobus! You guys rock!
I'll check back at some point tomorrow (correction: later today:) to confirm if this is a random event or not.
I end for now with an ironic but still profound quote:
'The Right Process Will Produce the Right Results' - The Toyota Way
Thanks again!
PartitionFound.JPG
Ran HDD Regenerator as prescribed by nobus and surprisingly (or unsurprisingly) came back with following results:
Complete Scans Done: 1
0 bad sectors found
0 bad sectors recovered
B -0 sectors remain bad
R - 0 sectors ever recovered
N - 0 new bad sectors appeared
R - 0 bad sectors reappere
(Scan Time 1:10)
I almost didn't want to believe it but as i had the cover on the machine open I had to keep physically checking the right disk was spinning to confirm I was indeed checking the 'dead' disk and not the new one!
Having earlier downloaded FindandMount on the advice of optoma I went ahead and installed it then ran it (with fingers crossed of course:)
And what do you know?!
Theres the 'dead' WDC drive with all partitions visible in Partition Find and Mount'. So I click on Partition 2 (previously the main c:\ drive) and theres the complete file structure as last seen a couple of days ago. (it's fair to say I smiled but couldn't really believe it :) - SEE ATTACHED IMAGE
I grabbed the most important files and copied them over to the new drive immediately...no problem!
It's now nearly 1 am here so I'm going to crash (like a dead harddrive :) and pick up again in the morning.
I would however like to take this opportunity to extend my sincerest gratitude to you that have helped guide me through this esp. optoma and nobus! You guys rock!
I'll check back at some point tomorrow (correction: later today:) to confirm if this is a random event or not.
I end for now with an ironic but still profound quote:
'The Right Process Will Produce the Right Results' - The Toyota Way
Thanks again!
PartitionFound.JPG
yep - it helped me recover several disks already reported bad by diags etc...not booting...
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Amendment to above:
-> installed the 'problem' drive into the spare hard drive bay (as 2nd/slave) drive BEFORE running HDD regenerator from CD
apologies for any confusion
-> installed the 'problem' drive into the spare hard drive bay (as 2nd/slave) drive BEFORE running HDD regenerator from CD
apologies for any confusion
You're more than welcome Theinkcloud ;)
It's always great to get a good outcome(getting that lost data back!)
It's always great to get a good outcome(getting that lost data back!)
and tx for the feedback - always useful - i wish all askers posted their solution like you did !
If you boot from the dell OS disc, BUT DON'T FULLY INSTALL, you will get to a menu where you can select "R" to repair the system.
This will take you to the command line where you can type "chkdsk /r" to repair the systemy to enable you to boot.
Once the system restarts, boot into safe mode and then run your anti malware / virus scans.
Let us know how you get on.