Help! MBR infection on win XP Pro SP3 now 'No Boot Device Available' !?

Hi this is my first post so please bear with me!

I run a stock Dell Dimension E520 from around 2007 with Win XP Pro fully patched to sp3 and up-to-date. I've never had any major problems with it and nothing customised except adding 2GB of additional RAM.

Everything was working fine until the system just rebooted itself!?
I appear to have contracted the MBR virus discussed in this forum http://www.overclock.net/intel-cpus/486062-windows-xp-freezes-1-continuous-beep.html

I tried to run Malwarebytes but the system kept on freezing and wouldn't allow me to connect to the internet. I had to keep forcing shut down from the power button.

All of a sudden Ii turn it on again and now it won't even boot! At BIOS screen it says 'No boot device available'

Does this mean the hard-drive is dead and the data unrecoverable? I have original Dell OS Reinstallation CD (XP Pro SP 2) - can this fix anything or is the system dead?

Any help would be greatly appreciated.

Many thanks
theinkcloudAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

storkyIVCommented:
Hi,

If you boot from the dell OS disc, BUT DON'T FULLY INSTALL, you will get to a menu where you can select "R" to repair the system.

This will take you to the command line where you can type "chkdsk /r" to repair the systemy to enable you to boot.

Once the system restarts, boot into safe mode and then run your anti malware / virus scans.

Let us know how you get on.
0
ibrahim52Team LeaderCommented:
Did you tried to go to BIOS and check whether your hard disk are showing up or not ?

Or

Go to Bios and do the following :
Problem fixed.
Go to  BIOS (using F2) and change the SATA
setting from RAID ON to RAID AUTODETECT. When I made that change.
Setup continued just fine.
0
ConsiglieriCommented:
Hello theinkcloud

First check in you bios if the hdd where you normally boot from is present, and if available, check if the s.m.a.r.t. status says: ok. during post

If this is the case, make sure the boot priority order is set to boot from the hdd that has the operating system installed on it.

If the above has been checked, and the problem is still there, consider the following:

1. The cable from the hard drive to motherboard is either loose, or damaged. Disconnect the cable and thoroughly inspect it, and if it looks ok, stick it back in there, and make sure its secured tightly.
2. You have a bad sector on the hard drive- i.e a failing hard drive. Try something like Western Digital Diagnostic tool to check for this.
3. Your MBR is corrupt. You can boot on the CD and go into recovery console mode where you can run fixmbr to test for and repair this.

You might want to get a hold of Ultimate Boot CD.

It has a few utilities that saved me a lot of work. Its legal, and free.

Best regards
0
INTRODUCING: WatchGuard's New MFA Solution

WatchGuard is proud to announce the launch of AuthPoint, a powerful, yet simple, Cloud-based MFA service designed to eliminate the vulnerabilities that put your data, systems, and users at risk.

ibrahim52Team LeaderCommented:
Try these :

Note : Use the same Windows XP version setup you have installed currently
Boot from the XP / 2000 CDROM and allow the setup to begin. Once the beginning files are copied, you will be asked to Install Windows or use the Recovery Console. Please choose "r" here, to run the recovery console.

You will now type in the following commands when the prompt appears:

chkdsk /f
* This will repair any obvious file system damage, which could complicate things.

diskpart
* This will run the XP disk partition utility. We will be checking to see if your partition looks OK. If you see your partition, and the information diskpart provides appears correct, then that's a good thing. :)

Press [ESC] to exit Diskpart, when everything looks peachy.

fixboot
* We'll write a new boot sector, so the computer knows how to boot the computer

fixmbr
* We'll write a new boot record, so the computer knows how to boot Windows

You should be taken care of. If it still does not work, you may need to delete your partition(s) using diskpart, then recreate the partition(s) (using diskpart, again).
0
theinkcloudAuthor Commented:
Thankyou all for the quick responses. I've tried changing SATA operation  to RAID Autodetect with no joy. I'm going to check the cables and connections next and then try booting from the CD. I'll report back shortly with the results.
Many thanks.
0
theinkcloudAuthor Commented:
Checked cabling and reseated all connections...no joy! Moving on to booting to recovery console. will post back with results shortly.
0
optomaCommented:
If the hard drive is detected in the bios then recover your data first, if able.

Use knoppix live cd and boot to it and copy data off hard drive to a usb device
http://knopper.net/knoppix-mirrors/index-en.html

What informed you that you have MBR infection?
0
theinkcloudAuthor Commented:
Followed instructions to boot from CD, clicked R to access recovery console and tried the following so far:

At c:\> prompt

1) chkdsk /f
RESULT: The parameter in not valid. Try /? for help.

2) chkdsk /r
RESULT: The volume appears to contain one or more unrecoverable problems.

3) diskpart
RESULT:
305243 MB Disk 0 at Id 0 on bus 0 on atapi [MBR]
unpartitioned space 305243 MB

The drive is a 320 GB Western Digital WD3200AAKS and was partitioned as below:
c:\ ~ 220 GB System Drive
d:\ ~80 GB  Backup Drive

Not sure what to do now. As it's seeing an unpartitioned space does that mean all is lost?



0
theinkcloudAuthor Commented:
@optoma
Thankyou for the link.

Re: What informed you that you have MBR infection?
The computer suddenly rebooted itself for no apparent reason and then it started freezing intermittently. I researched on google variations of 'xp freezing then continuous bleep' which lead me to the link in my original post.

I tried to download rootrepeal from but it didn't work (some DeviceIOControlError?) ,I tried Prevx but it couldn't connect to the internet to run scan, I updated Malwarebytes from my Vista laptop and transferred updated definitions to problem machine and tried to run Malwarebytes. This is how I arrived at writing my post.

Many thanks
0
optomaCommented:
Its possible that if the MBR infection was there and something got really messed up, resulting in a blank drive :(

Is the data vital on machine?
It so, it would be better to bring it to data recovery specialists and let them try and recover the data.
0
theinkcloudAuthor Commented:
@optoma
I fear this is what that's happened. Most of the vital data was backed up to an external drive but work from the last few days not already backed up would be lost if that was the case.

If I can't rescue it then I'll have to just do that and move on.

I'm assuming there's no way to recover the drive from here on?
0
optomaCommented:
1-The safest option would be to drop the drive at data recovery specialists and they would try to recover the lost partitions and retrieve the data.
That option would'nt be cheap though :(

2-Another option would be to use Partition Find and Mount and run the thorough scan on drive.
This option would mean to slave that drive in another machine and run the scan.
If any partitions are found you can then mount that "virtual" drive and try and recover data, if applicable>just start with the data which you don't have backed up
http://findandmount.com/fnmsetup.exe
0
storkyIVCommented:
Would the best way not be to boot into xp live (linux disc) and check the drive from there?
0
optomaCommented:
True, Knoppix is mentioned above ;)
0
theinkcloudAuthor Commented:
ok thankyou all for the kind advice. currently downloading knoppix and also Ultimate boot CD as suggested by Consiglieri. I'm going to check local stores for a replacement drive to clean install OS so i can eventually have a clean boot drive.

In your opinion would it be best to:
a) try and access the drive whilst it's still in with knoppix OR
b) install new drive, clean install os into a new drive, and try and access the old drive as slave?

Thankyou all for your kind assistance.
0
optomaCommented:
No harm in trying Knoppix now.
If the drive is blank,ie, unpartitioned, Knoppix will mount the drive but would throw an error trying to access it.
0
theinkcloudAuthor Commented:
ok i've loaded Knoppix fine but no sign of the hard drive as partition on the desktop. is there anything i can do to check for the harddrive?

0
optomaCommented:
Is there any hard disk icons in Knoppix on its desktop?
0
theinkcloudAuthor Commented:
unfortunately not just 2 folders 'My Documents' and 'Knoppix'
0
theinkcloudAuthor Commented:
i don't know if this means anything but i have the case open on the machine and it would appear the disk is spinning although that might just be because it's powered up. apologies if this is useless info.
0
optomaCommented:
At least its spinning!
Knoppix not seeing it so it probably best to get another drive as you mentioned and load then machine fresh. Then try recovery process.
0
theinkcloudAuthor Commented:
Thankyou again for your patience kind advice. have located a drive not too far away so will go and pick that up now. will post back with progress once installed.
0
optomaCommented:
:)
0
nobusCommented:
fior Dell disk and MBR problems - read this :  http://www.goodells.net/dellrestore/dellmbr.htm
0
theinkcloudAuthor Commented:
QUICK UPDATE:
I have installed a new harddrive and installed XP pro from Dell Reinstall Disk and now fully updated to SP3 and .net framework 3.5. I'm happy to say I'm now posting from the clean new machine.
It would be nice to see if we can get to the bottom of the original problem. If we can find a solution to check the disk and access it (if it is still accessible) this might help someone else in the future iwth a similar problem. If I can also recover any data, that would just be a bonus!
AS AN ASIDE:
I never really go to PC world (but desperate times called for desperate measures:) , I popped into the local PC World and managed to persuade the guys at the tech desk to take a look at it. They came back baffled as they said ( what I already knew) that the disk was not showing up on any of the machines BUT it appeared to be spinning normally with no noises or any obvious signs of mechanical failure! Incidentally I got my replacement drive (Hitachi HDS721032CLA362) from a small computer store across the road as PC world only had some own brand drives and NO ONE in the store could tell me the size of the cache on ANY of the drives !? - so I went across the road :)
@nobus
Thankyou for the link. I wish I had seen it before I replaced the drive.
However I still have the original disk, a spare HD bay, a spare SATA & Power cable/connector and a spare SATA slot on the board. Before I do anything foolish can you or anyone else suggest a way forward to try and see if the drive can still be accessed?
Many thanks to you all thus far, at least I have a clean working system again!
0
optomaCommented:
Plug in the "spare" hard drive.
Is it seen in the bios and under computer management?
0
optomaCommented:
Sorry>disk management

>start, run, type

diskmgmt.msc
0
nobusCommented:
ok - first things first : is the drive sen in the bios - correct?
can you run the hddregenerator on it (free trial) :  http://www.dposoft.net/
poqst results on each step !
0
theinkcloudAuthor Commented:
ok folks,
@optoma:
have installed failed disk and it is seen in bios with full 298.09 GB
have gone into disk management and it appears as:
Disk 1
unknown
298.09 GB
Not Initialized
and shows 298.09 Unallocated
Have not done anything else, 'Initialize and Convert Disk Wizard' has popped up but I haven't done anything with it, i've just left it for now.
@nobus:
am downloading HDD Regenerator now.
Should I close the wizard and Disk Management before attempting to run HDD Regenerator?
(If you respond and don't hear back for while don't worry I have to head out. It's 6pm here and might not be back till late. Will pick up as soon as I can and repsond. )
Many thanks.
0
theinkcloudAuthor Commented:
Please see screenshot to accompany post above.
DiskMgmt.JPG
0
nobusCommented:
you run it from a CD!
0
theinkcloudAuthor Commented:
@nobus
thanks :) I'll follow the instructions!
0
theinkcloudAuthor Commented:
UPDATE: Good news!

Ran HDD Regenerator as prescribed by nobus  and surprisingly (or unsurprisingly) came back with following results:

Complete Scans Done: 1
0 bad sectors found
0 bad sectors recovered
B -0 sectors remain bad
R - 0 sectors ever recovered
N - 0 new bad sectors appeared
R - 0 bad sectors reappere

(Scan Time 1:10)

I almost didn't want to believe it but as i had the cover on the machine open I had to keep physically checking the right disk was spinning to confirm I was indeed checking the 'dead' disk and not the new one!

Having earlier downloaded FindandMount on the advice of optoma I went ahead and installed it then ran it (with fingers crossed of course:)

And what do you know?!

Theres the 'dead' WDC drive with all partitions visible in Partition Find and Mount'. So I click on Partition 2 (previously the main c:\ drive) and theres the complete file structure as last seen a couple of days ago. (it's fair to say I smiled but couldn't really believe it :)  - SEE ATTACHED IMAGE

I grabbed the most important files and copied them over to the new drive immediately...no problem!

It's now nearly 1 am here so I'm going to crash (like a dead harddrive :) and pick up again in the morning.

I would however like to take this opportunity to extend my sincerest gratitude to you that have helped guide me through this esp. optoma and nobus! You guys rock!

I'll check back at some point tomorrow (correction: later today:) to confirm if this is a random event or not.

I end for now with an ironic but still profound quote:
'The Right Process Will Produce the Right Results' - The Toyota Way

Thanks again!


PartitionFound.JPG
0
nobusCommented:
yep - it helped me recover several disks already reported bad by diags etc...not booting...
0
theinkcloudAuthor Commented:
Ok I can now confirm I have managed to recover ALL my data off the problem drive and I'm about to make an image of each partition (as a backup/just in case I forgot anything:)
To summarise what worked for me: 
-> I removed the problem drive
-> Installed a new hard drive 
-> re-installed the Operating System on this new drive 
-> downloaded and created bootable CD with HDD regenerator (FREE for DIAGNOSING!)
-> booted into HDD regenerator from CD and checked drive for physical damage
(there was none)
-> rebooted into windows and downloaded/installed Partition Find and Mount 

-> installed the 'problem' drive into the spare hard drive bay (as 2nd/slave) drive 
-> turned on appropriate SATA settings in Bios/System Set-up to recognize the drive
 -> Booted into Windows and ran Partition Find and Mount (FREE!)
 -> ran 'Intellectual Scan' (which found all partitions on the drive)
-> copied some files from 'problem' drive to new drive to check data was recoverable
-> bought a license for Find and Mount full product (to remove file transfer speed limit)
-> copied all the data off the 'problem disk' in less than 30 mins!

:) One Happy Punter
NOTE:
- could have probably run Find and Mount without HDD regenerator but I wanted to know for sure whether there was physical/mechanical damage to the disk - thankfully in my case there was none, as I suspected.
My most sincere thanks to all that have helped with this issue esp. optoma and nobus!
 I doubt I would have arrived at such a successful outcome without all your help!
Again, many thanks ...



0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
theinkcloudAuthor Commented:
Amendment to above:
-> installed the 'problem' drive into the spare hard drive bay (as 2nd/slave) drive BEFORE running HDD regenerator from CD

apologies for any confusion
0
optomaCommented:
You're more than welcome Theinkcloud ;)
It's always great to get a good outcome(getting that lost data back!)
0
nobusCommented:
and tx for the feedback - always useful - i wish all askers posted their solution like you did !
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.