Re: FixMBR says I have on-standard or invalid boot record

"ronrobjoe" wrote in message news:B5C2A01A-B963-4268-9104-25D5A3ED3229@xxxxxxxxxxxxxxxx
I was concerned about getting very bad virus that is going around Europe
that writes (Storm Virus?( and hides itself on the Master Boot Record. So I
use the Recovery Cosole to enter the command fixmbr and stopped because I got
this message:

This computer appears to have a non-standard or invalid boot record.
Fixmbr may damage your partition tables if you proceed.
This could cause all the partitions on the current hard disk to become
inaccesible .
If you are not having problems accessing your drive, do not continue
Are you sure you want to write a new mbr?

I answer no. I am concerned that I may already have the virus because I have
a router and I notice all lot of activity, send receive lights flashing on it
when I am doing nothing on the internet, especially later in the evening.

Can anyone tell me what the recovery console meant in its message about my
hard disk mbr being non-standard or invalid and being unable to access it if
I processed with the fixmbr.


Have you installed any software that usurps the bootstrap record (first 446 bytes) of the MBR (first and unusable sector)? Boot managers, backup programs, disk encryption programs, and others will replace the bootstrap program with their own.

These good usurpers do not alter the partition table. Viruses might change the offset of where to find the partition descriptors in the MBR. That means a good bootstrap program that looks at the standard offsets will not properly find the start of your partitions. So FIXMBR is warning you that something in the bootstrap area does not look like a standard bootstrap program. Every version of DOS and Windows has had a slightly different set of bytes for their "standard" bootstrap program. Grub used with Linux would be a different set of bytes. I'm not sure how FIXMBR could determine what is a standard bootstrap program since every version of them is different, so it is probably telling you that what is in the MBR's bootstrap area is different that what it will put there.

While I haven't specifically done this, you could use a utility that reads and saves a copy of the MBR, like 'mbrtool', and then go look in the saved file to see if there are any strings that identify whose bootstrap program is located in the first 446 bytes. I'd have to download mbrtool, use it to create the bootable floppy, and reboot my host to find out what was in the saved mbr file but that would interrupt my reply here plus I really don't have that much impetus to go through all that.

.

Relevant Pages

  • Re: Fixmbr doesnt fix mbr
    ... multiboot manager that usurps the bootstrap code area of the MBR (GAG, ... FIXMBR but it claims that the hard disk has a non-standard or invalid ... I executed FIXMBR three times in a row, ... partition to it? ...
    (microsoft.public.windowsxp.hardware)
  • Re: Protecting the Operating System
    ... The MBR is not protected if physical ... Regarding point 2, it is very easy to boot up from, say, a known good read- ... Rather than have it load a program that is stored within a partition, use the first track which isn't accessible to any partition. ... MBR bootstrap program reads the partition table to find which partition to boot from. ...
    (alt.computer.security)
  • Re: Mbr messed up?
    ... can't boot up at all after coming out of hibernation. ... Looked at the MBR sector which seems to be ok ... The bootstrap program is in the first 460 ... > program reads the partition table to find out which partition is marked ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: for FAT32: FIXMBR vs FDISK /MBR - which is correct?
    ... Although folks may refer to a "standard" bootstrap program, there are actually several versions of it but they all perform the same task. ... The bootstrap code added to the MBR when using FDISK /MBR will be different in size depending on which version of Windows that you use. ... With a Win9x bootable floppy containing FDISK, you just use FDISK to mark the active partition. ... to get help on commands. ...
    (microsoft.public.windowsxp.newusers)
  • RE: FixMBR says I have on-standard or invalid boot record
    ... ie if HP they tend to use their own mbr to access the repair partition. ... Fixmbr may damage your partition tables if you proceed. ... This could cause all the partitions on the current hard disk to become ...
    (microsoft.public.windowsxp.general)