?
Solved

Help! MBR infection on win XP Pro SP3 now 'No Boot Device Available' !?

Posted on 2010-03-26
38
Medium Priority
?
679 Views
Last Modified: 2013-11-22
Hi this is my first post so please bear with me!

I run a stock Dell Dimension E520 from around 2007 with Win XP Pro fully patched to sp3 and up-to-date. I've never had any major problems with it and nothing customised except adding 2GB of additional RAM.

Everything was working fine until the system just rebooted itself!?
I appear to have contracted the MBR virus discussed in this forum http://www.overclock.net/intel-cpus/486062-windows-xp-freezes-1-continuous-beep.html

I tried to run Malwarebytes but the system kept on freezing and wouldn't allow me to connect to the internet. I had to keep forcing shut down from the power button.

All of a sudden Ii turn it on again and now it won't even boot! At BIOS screen it says 'No boot device available'

Does this mean the hard-drive is dead and the data unrecoverable? I have original Dell OS Reinstallation CD (XP Pro SP 2) - can this fix anything or is the system dead?

Any help would be greatly appreciated.

Many thanks
0
Comment
Question by:theinkcloud
  • 17
  • 11
  • 5
  • +3
38 Comments
 
LVL 2

Expert Comment

by:storkyIV
ID: 28668950
Hi,

If you boot from the dell OS disc, BUT DON'T FULLY INSTALL, you will get to a menu where you can select "R" to repair the system.

This will take you to the command line where you can type "chkdsk /r" to repair the systemy to enable you to boot.

Once the system restarts, boot into safe mode and then run your anti malware / virus scans.

Let us know how you get on.
0
 
LVL 12

Expert Comment

by:ibrahim52
ID: 28669410
Did you tried to go to BIOS and check whether your hard disk are showing up or not ?

Or

Go to Bios and do the following :
Problem fixed.
Go to  BIOS (using F2) and change the SATA
setting from RAID ON to RAID AUTODETECT. When I made that change.
Setup continued just fine.
0
 

Expert Comment

by:Consiglieri
ID: 28669442
Hello theinkcloud

First check in you bios if the hdd where you normally boot from is present, and if available, check if the s.m.a.r.t. status says: ok. during post

If this is the case, make sure the boot priority order is set to boot from the hdd that has the operating system installed on it.

If the above has been checked, and the problem is still there, consider the following:

1. The cable from the hard drive to motherboard is either loose, or damaged. Disconnect the cable and thoroughly inspect it, and if it looks ok, stick it back in there, and make sure its secured tightly.
2. You have a bad sector on the hard drive- i.e a failing hard drive. Try something like Western Digital Diagnostic tool to check for this.
3. Your MBR is corrupt. You can boot on the CD and go into recovery console mode where you can run fixmbr to test for and repair this.

You might want to get a hold of Ultimate Boot CD.

It has a few utilities that saved me a lot of work. Its legal, and free.

Best regards
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
LVL 12

Expert Comment

by:ibrahim52
ID: 28669636
Try these :

Note : Use the same Windows XP version setup you have installed currently
Boot from the XP / 2000 CDROM and allow the setup to begin. Once the beginning files are copied, you will be asked to Install Windows or use the Recovery Console. Please choose "r" here, to run the recovery console.

You will now type in the following commands when the prompt appears:

chkdsk /f
* This will repair any obvious file system damage, which could complicate things.

diskpart
* This will run the XP disk partition utility. We will be checking to see if your partition looks OK. If you see your partition, and the information diskpart provides appears correct, then that's a good thing. :)

Press [ESC] to exit Diskpart, when everything looks peachy.

fixboot
* We'll write a new boot sector, so the computer knows how to boot the computer

fixmbr
* We'll write a new boot record, so the computer knows how to boot Windows

You should be taken care of. If it still does not work, you may need to delete your partition(s) using diskpart, then recreate the partition(s) (using diskpart, again).
0
 

Author Comment

by:theinkcloud
ID: 28671468
Thankyou all for the quick responses. I've tried changing SATA operation  to RAID Autodetect with no joy. I'm going to check the cables and connections next and then try booting from the CD. I'll report back shortly with the results.
Many thanks.
0
 

Author Comment

by:theinkcloud
ID: 28672154
Checked cabling and reseated all connections...no joy! Moving on to booting to recovery console. will post back with results shortly.
0
 
LVL 22

Expert Comment

by:optoma
ID: 28673067
If the hard drive is detected in the bios then recover your data first, if able.

Use knoppix live cd and boot to it and copy data off hard drive to a usb device
http://knopper.net/knoppix-mirrors/index-en.html

What informed you that you have MBR infection?
0
 

Author Comment

by:theinkcloud
ID: 28673405
Followed instructions to boot from CD, clicked R to access recovery console and tried the following so far:

At c:\> prompt

1) chkdsk /f
RESULT: The parameter in not valid. Try /? for help.

2) chkdsk /r
RESULT: The volume appears to contain one or more unrecoverable problems.

3) diskpart
RESULT:
305243 MB Disk 0 at Id 0 on bus 0 on atapi [MBR]
unpartitioned space 305243 MB

The drive is a 320 GB Western Digital WD3200AAKS and was partitioned as below:
c:\ ~ 220 GB System Drive
d:\ ~80 GB  Backup Drive

Not sure what to do now. As it's seeing an unpartitioned space does that mean all is lost?



0
 

Author Comment

by:theinkcloud
ID: 28674205
@optoma
Thankyou for the link.

Re: What informed you that you have MBR infection?
The computer suddenly rebooted itself for no apparent reason and then it started freezing intermittently. I researched on google variations of 'xp freezing then continuous bleep' which lead me to the link in my original post.

I tried to download rootrepeal from but it didn't work (some DeviceIOControlError?) ,I tried Prevx but it couldn't connect to the internet to run scan, I updated Malwarebytes from my Vista laptop and transferred updated definitions to problem machine and tried to run Malwarebytes. This is how I arrived at writing my post.

Many thanks
0
 
LVL 22

Expert Comment

by:optoma
ID: 28674818
Its possible that if the MBR infection was there and something got really messed up, resulting in a blank drive :(

Is the data vital on machine?
It so, it would be better to bring it to data recovery specialists and let them try and recover the data.
0
 

Author Comment

by:theinkcloud
ID: 28675296
@optoma
I fear this is what that's happened. Most of the vital data was backed up to an external drive but work from the last few days not already backed up would be lost if that was the case.

If I can't rescue it then I'll have to just do that and move on.

I'm assuming there's no way to recover the drive from here on?
0
 
LVL 22

Assisted Solution

by:optoma
optoma earned 1200 total points
ID: 28676942
1-The safest option would be to drop the drive at data recovery specialists and they would try to recover the lost partitions and retrieve the data.
That option would'nt be cheap though :(

2-Another option would be to use Partition Find and Mount and run the thorough scan on drive.
This option would mean to slave that drive in another machine and run the scan.
If any partitions are found you can then mount that "virtual" drive and try and recover data, if applicable>just start with the data which you don't have backed up
http://findandmount.com/fnmsetup.exe
0
 
LVL 2

Expert Comment

by:storkyIV
ID: 28677153
Would the best way not be to boot into xp live (linux disc) and check the drive from there?
0
 
LVL 22

Expert Comment

by:optoma
ID: 28677872
True, Knoppix is mentioned above ;)
0
 

Author Comment

by:theinkcloud
ID: 28678538
ok thankyou all for the kind advice. currently downloading knoppix and also Ultimate boot CD as suggested by Consiglieri. I'm going to check local stores for a replacement drive to clean install OS so i can eventually have a clean boot drive.

In your opinion would it be best to:
a) try and access the drive whilst it's still in with knoppix OR
b) install new drive, clean install os into a new drive, and try and access the old drive as slave?

Thankyou all for your kind assistance.
0
 
LVL 22

Expert Comment

by:optoma
ID: 28682598
No harm in trying Knoppix now.
If the drive is blank,ie, unpartitioned, Knoppix will mount the drive but would throw an error trying to access it.
0
 

Author Comment

by:theinkcloud
ID: 28686287
ok i've loaded Knoppix fine but no sign of the hard drive as partition on the desktop. is there anything i can do to check for the harddrive?

0
 
LVL 22

Expert Comment

by:optoma
ID: 28686905
Is there any hard disk icons in Knoppix on its desktop?
0
 

Author Comment

by:theinkcloud
ID: 28687208
unfortunately not just 2 folders 'My Documents' and 'Knoppix'
0
 

Author Comment

by:theinkcloud
ID: 28687439
i don't know if this means anything but i have the case open on the machine and it would appear the disk is spinning although that might just be because it's powered up. apologies if this is useless info.
0
 
LVL 22

Expert Comment

by:optoma
ID: 28688035
At least its spinning!
Knoppix not seeing it so it probably best to get another drive as you mentioned and load then machine fresh. Then try recovery process.
0
 

Author Comment

by:theinkcloud
ID: 28688293
Thankyou again for your patience kind advice. have located a drive not too far away so will go and pick that up now. will post back with progress once installed.
0
 
LVL 22

Expert Comment

by:optoma
ID: 28688447
:)
0
 
LVL 93

Expert Comment

by:nobus
ID: 28757185
fior Dell disk and MBR problems - read this :  http://www.goodells.net/dellrestore/dellmbr.htm
0
 

Author Comment

by:theinkcloud
ID: 28783874
QUICK UPDATE:
I have installed a new harddrive and installed XP pro from Dell Reinstall Disk and now fully updated to SP3 and .net framework 3.5. I'm happy to say I'm now posting from the clean new machine.
It would be nice to see if we can get to the bottom of the original problem. If we can find a solution to check the disk and access it (if it is still accessible) this might help someone else in the future iwth a similar problem. If I can also recover any data, that would just be a bonus!
AS AN ASIDE:
I never really go to PC world (but desperate times called for desperate measures:) , I popped into the local PC World and managed to persuade the guys at the tech desk to take a look at it. They came back baffled as they said ( what I already knew) that the disk was not showing up on any of the machines BUT it appeared to be spinning normally with no noises or any obvious signs of mechanical failure! Incidentally I got my replacement drive (Hitachi HDS721032CLA362) from a small computer store across the road as PC world only had some own brand drives and NO ONE in the store could tell me the size of the cache on ANY of the drives !? - so I went across the road :)
@nobus
Thankyou for the link. I wish I had seen it before I replaced the drive.
However I still have the original disk, a spare HD bay, a spare SATA & Power cable/connector and a spare SATA slot on the board. Before I do anything foolish can you or anyone else suggest a way forward to try and see if the drive can still be accessed?
Many thanks to you all thus far, at least I have a clean working system again!
0
 
LVL 22

Expert Comment

by:optoma
ID: 28786575
Plug in the "spare" hard drive.
Is it seen in the bios and under computer management?
0
 
LVL 22

Expert Comment

by:optoma
ID: 28786745
Sorry>disk management

>start, run, type

diskmgmt.msc
0
 
LVL 93

Assisted Solution

by:nobus
nobus earned 800 total points
ID: 28789890
ok - first things first : is the drive sen in the bios - correct?
can you run the hddregenerator on it (free trial) :  http://www.dposoft.net/
poqst results on each step !
0
 

Author Comment

by:theinkcloud
ID: 28795878
ok folks,
@optoma:
have installed failed disk and it is seen in bios with full 298.09 GB
have gone into disk management and it appears as:
Disk 1
unknown
298.09 GB
Not Initialized
and shows 298.09 Unallocated
Have not done anything else, 'Initialize and Convert Disk Wizard' has popped up but I haven't done anything with it, i've just left it for now.
@nobus:
am downloading HDD Regenerator now.
Should I close the wizard and Disk Management before attempting to run HDD Regenerator?
(If you respond and don't hear back for while don't worry I have to head out. It's 6pm here and might not be back till late. Will pick up as soon as I can and repsond. )
Many thanks.
0
 

Author Comment

by:theinkcloud
ID: 28796045
Please see screenshot to accompany post above.
DiskMgmt.JPG
0
 
LVL 93

Expert Comment

by:nobus
ID: 28796067
you run it from a CD!
0
 

Author Comment

by:theinkcloud
ID: 28796159
@nobus
thanks :) I'll follow the instructions!
0
 

Author Comment

by:theinkcloud
ID: 28825873
UPDATE: Good news!

Ran HDD Regenerator as prescribed by nobus  and surprisingly (or unsurprisingly) came back with following results:

Complete Scans Done: 1
0 bad sectors found
0 bad sectors recovered
B -0 sectors remain bad
R - 0 sectors ever recovered
N - 0 new bad sectors appeared
R - 0 bad sectors reappere

(Scan Time 1:10)

I almost didn't want to believe it but as i had the cover on the machine open I had to keep physically checking the right disk was spinning to confirm I was indeed checking the 'dead' disk and not the new one!

Having earlier downloaded FindandMount on the advice of optoma I went ahead and installed it then ran it (with fingers crossed of course:)

And what do you know?!

Theres the 'dead' WDC drive with all partitions visible in Partition Find and Mount'. So I click on Partition 2 (previously the main c:\ drive) and theres the complete file structure as last seen a couple of days ago. (it's fair to say I smiled but couldn't really believe it :)  - SEE ATTACHED IMAGE

I grabbed the most important files and copied them over to the new drive immediately...no problem!

It's now nearly 1 am here so I'm going to crash (like a dead harddrive :) and pick up again in the morning.

I would however like to take this opportunity to extend my sincerest gratitude to you that have helped guide me through this esp. optoma and nobus! You guys rock!

I'll check back at some point tomorrow (correction: later today:) to confirm if this is a random event or not.

I end for now with an ironic but still profound quote:
'The Right Process Will Produce the Right Results' - The Toyota Way

Thanks again!


PartitionFound.JPG
0
 
LVL 93

Expert Comment

by:nobus
ID: 28848604
yep - it helped me recover several disks already reported bad by diags etc...not booting...
0
 

Accepted Solution

by:
theinkcloud earned 0 total points
ID: 29252360
Ok I can now confirm I have managed to recover ALL my data off the problem drive and I'm about to make an image of each partition (as a backup/just in case I forgot anything:)
To summarise what worked for me: 
-> I removed the problem drive
-> Installed a new hard drive 
-> re-installed the Operating System on this new drive 
-> downloaded and created bootable CD with HDD regenerator (FREE for DIAGNOSING!)
-> booted into HDD regenerator from CD and checked drive for physical damage
(there was none)
-> rebooted into windows and downloaded/installed Partition Find and Mount 

-> installed the 'problem' drive into the spare hard drive bay (as 2nd/slave) drive 
-> turned on appropriate SATA settings in Bios/System Set-up to recognize the drive
 -> Booted into Windows and ran Partition Find and Mount (FREE!)
 -> ran 'Intellectual Scan' (which found all partitions on the drive)
-> copied some files from 'problem' drive to new drive to check data was recoverable
-> bought a license for Find and Mount full product (to remove file transfer speed limit)
-> copied all the data off the 'problem disk' in less than 30 mins!

:) One Happy Punter
NOTE:
- could have probably run Find and Mount without HDD regenerator but I wanted to know for sure whether there was physical/mechanical damage to the disk - thankfully in my case there was none, as I suspected.
My most sincere thanks to all that have helped with this issue esp. optoma and nobus!
 I doubt I would have arrived at such a successful outcome without all your help!
Again, many thanks ...



0
 

Author Comment

by:theinkcloud
ID: 29258553
Amendment to above:
-> installed the 'problem' drive into the spare hard drive bay (as 2nd/slave) drive BEFORE running HDD regenerator from CD

apologies for any confusion
0
 
LVL 22

Expert Comment

by:optoma
ID: 29267691
You're more than welcome Theinkcloud ;)
It's always great to get a good outcome(getting that lost data back!)
0
 
LVL 93

Expert Comment

by:nobus
ID: 29315658
and tx for the feedback - always useful - i wish all askers posted their solution like you did !
0

Featured Post

Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
Most folks would know the basics of how Dropbox works, so that’s not the purpose of this article. Security is what it’s all about, so here I’ll share how I choose to secure my Dropbox Account and the Data it contains.
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…

588 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question