Corrupt Boot Sector

HELP!!! I can't boot-up or access files/folders on my 80GB Western Digital
HDD (WD800). I'm running Windows Me with 256MB of RAM on a 600MHz custom PC.
I use Roxio GoBack on the corrupt drive, as well as System Restore. I also
used McAfee VirusScan v.9 from a virus-clean disk in a separate system to
troubleshoot the corrupt disk.

I recently installed the corrupt disk as a single drive and transferred my
previous virus-free files, folders and programs from my old disk. I could
successfully access the drive's contents after installation. However, I had
not re-installed security programs (i.e., anti-virus, anti-malware, spybot
and adware programs) before needing to download additonal software and check
some email. I either suffered a catastrophic drive failure, or inadvertantly
picked up some sort of boot sector virus (or other malicious code).

I booted-up the computer a few days ago and received several error messages
when I got to the Windows desktop. Various files from programs that load at
startup could not be found. I hadn't had any startup problems before. I
became suspicious because the HDD was cranking away for quite awhile the
previous day while in standby mode. I thought it odd, but didn't think too
much of it at the time. However, when I rebooted, I received several more
(different) error messages.

I began a routine series of progressively more aggressive recovery attempts.
But, on each successive reboot, I had less and less functionality. Some of
the earlier error messages indicated possible remedies which I followed with
no success. After a couple of these failed fix attempts, I tried running
_Restore, again without success.

Then, I tried resetting the drive to the earliest possible restore point
with GoBack. Unfortunately, I did not have any restore points prior to the
drive's original boot failure. After 6-7 of these failed boot attempts, it
became impossible to boot into Windows normal mode. I used the virus-free
Emergency Boot Disk, but was only able to boot into Safe mode. I tried using
the available Windows and DOS-level recovery tools after booting to Safe
mode, to no avail. Eventually, choosing Safe mode from the EBD Startup Menu
loaded a blank gray screen. Scanning with Dr. Solomon showed the drive had
"no volume label, no serial number, and 0 files on disk".

When the drive stopped booting into Safe Mode, I installed the corrupt disk
as Secondary Master in a virus-free system and tried to scan it with
VirusScan. However, by this time, the corrupt drive was so badly damaged that
it was no longer recognized as a drive by the scan engine. I was therefore
unable to use VirusScan to detect the problem.

While the drive appears to be totally unreadable, it is correctly identified
in the system BIOS. And, FDisk recognizes it as being formatted with a
"Non-DOS" drive type. I attempted to use the Windows 2000 "FixMBR" utility
(before learning that it could totally destroy data on any non-Win2K drive).
Fortunately, the drive was so unreadable that there was no drive detected by
the Win2K EBD, and I couldn't run FixMBR.

I had not backd-up the disk yet, and hope to recover the valuable data. I'm
not even sure the problem is a highly-destructive virus, trojan or worm. I
don't see any outbreaks of such highly-dangerous code on a national virus
map. My A+ instincts and the chronology of the drive's progressive failure
events, plus the research I did on Microsoft's and McAfee's support sites
lead me to believe the boot record has somehow been compromised. Hopefully,
the drive's data is still intact, and can somehow still be recovered if I can
repair or re-write the damaged boot sector and/or partition table.

I read about the "/mbr" switch used with FDisk, and wonder if this might be
the next logical recovery step. Are there any other steps I might try? What
else could I try before giving up the ghost and re-formatting the drive?

Thanks for any ideas or suggestions you might offer. I greatly appreciate
your help!

I use Roxio GoBack on the corrupt drive, as well as
System Restore.

This fact alone could be the cause of all of the problems you are seeing.
System Restore should NEVER be used on a system where GoBack is installed.
--
Mike Maltby MS-MVP



Robert wrote:

HELP!!! I can't boot-up or access files/folders on my 80GB Western
Digital HDD (WD800). I'm running Windows Me with 256MB of RAM on a
600MHz custom PC. I use Roxio GoBack on the corrupt drive, as well as
System Restore. I also used McAfee VirusScan v.9 from a virus-clean
disk in a separate system to troubleshoot the corrupt disk.

I recently installed the corrupt disk as a single drive and
transferred my previous virus-free files, folders and programs from
my old disk. I could successfully access the drive's contents after
installation. However, I had not re-installed security programs
(i.e., anti-virus, anti-malware, spybot and adware programs) before
needing to download additonal software and check some email. I either
suffered a catastrophic drive failure, or inadvertantly picked up
some sort of boot sector virus (or other malicious code).

I booted-up the computer a few days ago and received several error
messages when I got to the Windows desktop. Various files from
programs that load at startup could not be found. I hadn't had any
startup problems before. I became suspicious because the HDD was
cranking away for quite awhile the previous day while in standby
mode. I thought it odd, but didn't think too much of it at the time.
However, when I rebooted, I received several more (different) error
messages.

I began a routine series of progressively more aggressive recovery
attempts. But, on each successive reboot, I had less and less
functionality. Some of the earlier error messages indicated possible
remedies which I followed with no success. After a couple of these
failed fix attempts, I tried running _Restore, again without success.

Then, I tried resetting the drive to the earliest possible restore
point with GoBack. Unfortunately, I did not have any restore points
prior to the drive's original boot failure. After 6-7 of these failed
boot attempts, it became impossible to boot into Windows normal mode.
I used the virus-free Emergency Boot Disk, but was only able to boot
into Safe mode. I tried using the available Windows and DOS-level
recovery tools after booting to Safe mode, to no avail. Eventually,
choosing Safe mode from the EBD Startup Menu loaded a blank gray
screen. Scanning with Dr. Solomon showed the drive had "no volume
label, no serial number, and 0 files on disk".

When the drive stopped booting into Safe Mode, I installed the
corrupt disk as Secondary Master in a virus-free system and tried to
scan it with VirusScan. However, by this time, the corrupt drive was
so badly damaged that it was no longer recognized as a drive by the
scan engine. I was therefore unable to use VirusScan to detect the
problem.

While the drive appears to be totally unreadable, it is correctly
identified in the system BIOS. And, FDisk recognizes it as being
formatted with a "Non-DOS" drive type. I attempted to use the Windows
2000 "FixMBR" utility (before learning that it could totally destroy
data on any non-Win2K drive). Fortunately, the drive was so
unreadable that there was no drive detected by the Win2K EBD, and I
couldn't run FixMBR.

I had not backd-up the disk yet, and hope to recover the valuable
data. I'm not even sure the problem is a highly-destructive virus,
trojan or worm. I don't see any outbreaks of such highly-dangerous
code on a national virus map. My A+ instincts and the chronology of
the drive's progressive failure events, plus the research I did on
Microsoft's and McAfee's support sites lead me to believe the boot
record has somehow been compromised. Hopefully, the drive's data is
still intact, and can somehow still be recovered if I can repair or
re-write the damaged boot sector and/or partition table.

I read about the "/mbr" switch used with FDisk, and wonder if this
might be the next logical recovery step. Are there any other steps I
might try? What else could I try before giving up the ghost and
re-formatting the drive?

Thanks for any ideas or suggestions you might offer. I greatly
appreciate your help!

OK. First I ever heard of this, either from Roxio OR from Microsoft's
Knowledgebase articles. So what do I do now?

-Robert



"Mike M" wrote:

I use Roxio GoBack on the corrupt drive, as well as
System Restore.

This fact alone could be the cause of all of the problems you are seeing.
System Restore should NEVER be used on a system where GoBack is installed.
--
Mike Maltby MS-MVP



Robert wrote:

HELP!!! I can't boot-up or access files/folders on my 80GB Western
Digital HDD (WD800). I'm running Windows Me with 256MB of RAM on a
600MHz custom PC. I use Roxio GoBack on the corrupt drive, as well as
System Restore. I also used McAfee VirusScan v.9 from a virus-clean
disk in a separate system to troubleshoot the corrupt disk.

I recently installed the corrupt disk as a single drive and
transferred my previous virus-free files, folders and programs from
my old disk. I could successfully access the drive's contents after
installation. However, I had not re-installed security programs
(i.e., anti-virus, anti-malware, spybot and adware programs) before
needing to download additonal software and check some email. I either
suffered a catastrophic drive failure, or inadvertantly picked up
some sort of boot sector virus (or other malicious code).

I booted-up the computer a few days ago and received several error
messages when I got to the Windows desktop. Various files from
programs that load at startup could not be found. I hadn't had any
startup problems before. I became suspicious because the HDD was
cranking away for quite awhile the previous day while in standby
mode. I thought it odd, but didn't think too much of it at the time.
However, when I rebooted, I received several more (different) error
messages.

I began a routine series of progressively more aggressive recovery
attempts. But, on each successive reboot, I had less and less
functionality. Some of the earlier error messages indicated possible
remedies which I followed with no success. After a couple of these
failed fix attempts, I tried running _Restore, again without success.

Then, I tried resetting the drive to the earliest possible restore
point with GoBack. Unfortunately, I did not have any restore points
prior to the drive's original boot failure. After 6-7 of these failed
boot attempts, it became impossible to boot into Windows normal mode.
I used the virus-free Emergency Boot Disk, but was only able to boot
into Safe mode. I tried using the available Windows and DOS-level
recovery tools after booting to Safe mode, to no avail. Eventually,
choosing Safe mode from the EBD Startup Menu loaded a blank gray
screen. Scanning with Dr. Solomon showed the drive had "no volume
label, no serial number, and 0 files on disk".

When the drive stopped booting into Safe Mode, I installed the
corrupt disk as Secondary Master in a virus-free system and tried to
scan it with VirusScan. However, by this time, the corrupt drive was
so badly damaged that it was no longer recognized as a drive by the
scan engine. I was therefore unable to use VirusScan to detect the
problem.

While the drive appears to be totally unreadable, it is correctly
identified in the system BIOS. And, FDisk recognizes it as being
formatted with a "Non-DOS" drive type. I attempted to use the Windows
2000 "FixMBR" utility (before learning that it could totally destroy
data on any non-Win2K drive). Fortunately, the drive was so
unreadable that there was no drive detected by the Win2K EBD, and I
couldn't run FixMBR.

I had not backd-up the disk yet, and hope to recover the valuable
data. I'm not even sure the problem is a highly-destructive virus,
trojan or worm. I don't see any outbreaks of such highly-dangerous
code on a national virus map. My A+ instincts and the chronology of
the drive's progressive failure events, plus the research I did on
Microsoft's and McAfee's support sites lead me to believe the boot
record has somehow been compromised. Hopefully, the drive's data is
still intact, and can somehow still be recovered if I can repair or
re-write the damaged boot sector and/or partition table.

I read about the "/mbr" switch used with FDisk, and wonder if this
might be the next logical recovery step. Are there any other steps I
might try? What else could I try before giving up the ghost and
re-formatting the drive?

Thanks for any ideas or suggestions you might offer. I greatly
appreciate your help!

Robert,

I'm sorry but I can't help those who have GoBack installed. This is due
to my having little experience of this program which amongst other things
alters the master boot record on the hard disk which means that amongst
other things the drive can't be accessed from DOS unless a specific
procedure is followed. I simply don't have the knowledge or experience to
continue here.
--
Mike Maltby MS-MVP



Robert wrote:

OK. First I ever heard of this, either from Roxio OR from Microsoft's
Knowledgebase articles. So what do I do now?

Thanks anyhow. At least you gave me something to pursue, regarding "the drive
can't be accessed from DOS unless a specific procedure is followed". I'll
look it up on Roxio.

-Robert




"Mike M" wrote:

Robert,

I'm sorry but I can't help those who have GoBack installed. This is due
to my having little experience of this program which amongst other things
alters the master boot record on the hard disk which means that amongst
other things the drive can't be accessed from DOS unless a specific
procedure is followed. I simply don't have the knowledge or experience to
continue here.
--
Mike Maltby MS-MVP



Robert wrote:

OK. First I ever heard of this, either from Roxio OR from Microsoft's
Knowledgebase articles. So what do I do now?

[I tried to reply to this message on several different occassions. But, for
some reason, this site keeps locking up my computer while I'm trying to
compose a message.]


Are you quoting the official Microsoft policy on using 3rd party
applications (i.e., GoBack), or just your lack of familiarity with the
program? I did further research after reading your response, and it turns out
Symantec-Roxio claims the two are TOTALLY compatible (which is what I thought
I'd read before installing them together). I've used GoBack successfully on
many occassions, and never had a conflict with SystemRestore. In fact, I
almost forgot Restore was there.

The problem is not GoBack. The question I'm asking is whether or not I can
repair/rebuild the MBR so I can access the file allocation table and not
loose existing data. I never had any indication of malicious activity. But,
it's like I had a worm that increasingly destroyed more and more of my
ability to boot with each reboot. I kept getting errors that key boot files
couldn't be located. Before I realized what was happening, I could no longer
boot with the Emergency Boot Disk, GoBack OR SystemRestore!

Now, FDisk indicates there is a "Non-Microsoft" partition, but I can"t read
anything on it. Short of writing off all my files and erasing the disk, I
wondered if there was a way to rebuild/restore a "standard" MBR that might
enable me to at least read the file structure sufficiently to run VirusScan.
Any suggestions?

-Robert




"Mike M" wrote:

I use Roxio GoBack on the corrupt drive, as well as
System Restore.

This fact alone could be the cause of all of the problems you are seeing.
System Restore should NEVER be used on a system where GoBack is installed.
--
Mike Maltby MS-MVP



Robert wrote:

HELP!!! I can't boot-up or access files/folders on my 80GB Western
Digital HDD (WD800). I'm running Windows Me with 256MB of RAM on a
600MHz custom PC. I use Roxio GoBack on the corrupt drive, as well as
System Restore. I also used McAfee VirusScan v.9 from a virus-clean
disk in a separate system to troubleshoot the corrupt disk.

I recently installed the corrupt disk as a single drive and
transferred my previous virus-free files, folders and programs from
my old disk. I could successfully access the drive's contents after
installation. However, I had not re-installed security programs
(i.e., anti-virus, anti-malware, spybot and adware programs) before
needing to download additonal software and check some email. I either
suffered a catastrophic drive failure, or inadvertantly picked up
some sort of boot sector virus (or other malicious code).

I booted-up the computer a few days ago and received several error
messages when I got to the Windows desktop. Various files from
programs that load at startup could not be found. I hadn't had any
startup problems before. I became suspicious because the HDD was
cranking away for quite awhile the previous day while in standby
mode. I thought it odd, but didn't think too much of it at the time.
However, when I rebooted, I received several more (different) error
messages.

I began a routine series of progressively more aggressive recovery
attempts. But, on each successive reboot, I had less and less
functionality. Some of the earlier error messages indicated possible
remedies which I followed with no success. After a couple of these
failed fix attempts, I tried running _Restore, again without success.

Then, I tried resetting the drive to the earliest possible restore
point with GoBack. Unfortunately, I did not have any restore points
prior to the drive's original boot failure. After 6-7 of these failed
boot attempts, it became impossible to boot into Windows normal mode.
I used the virus-free Emergency Boot Disk, but was only able to boot
into Safe mode. I tried using the available Windows and DOS-level
recovery tools after booting to Safe mode, to no avail. Eventually,
choosing Safe mode from the EBD Startup Menu loaded a blank gray
screen. Scanning with Dr. Solomon showed the drive had "no volume
label, no serial number, and 0 files on disk".

When the drive stopped booting into Safe Mode, I installed the
corrupt disk as Secondary Master in a virus-free system and tried to
scan it with VirusScan. However, by this time, the corrupt drive was
so badly damaged that it was no longer recognized as a drive by the
scan engine. I was therefore unable to use VirusScan to detect the
problem.

While the drive appears to be totally unreadable, it is correctly
identified in the system BIOS. And, FDisk recognizes it as being
formatted with a "Non-DOS" drive type. I attempted to use the Windows
2000 "FixMBR" utility (before learning that it could totally destroy
data on any non-Win2K drive). Fortunately, the drive was so
unreadable that there was no drive detected by the Win2K EBD, and I
couldn't run FixMBR.

I had not backd-up the disk yet, and hope to recover the valuable
data. I'm not even sure the problem is a highly-destructive virus,
trojan or worm. I don't see any outbreaks of such highly-dangerous
code on a national virus map. My A+ instincts and the chronology of
the drive's progressive failure events, plus the research I did on
Microsoft's and McAfee's support sites lead me to believe the boot
record has somehow been compromised. Hopefully, the drive's data is
still intact, and can somehow still be recovered if I can repair or
re-write the damaged boot sector and/or partition table.

I read about the "/mbr" switch used with FDisk, and wonder if this
might be the next logical recovery step. Are there any other steps I
might try? What else could I try before giving up the ghost and
re-formatting the drive?

Thanks for any ideas or suggestions you might offer. I greatly
appreciate your help!

Since I don't work for Microsoft I have no idea as to their policies but
can't imagine that they have one about using third party applications
otherwise no-one would have any use for a computer whatsoever. I made it
quite clear in my second post, which I know you have read but will restate
for your benefit, that:

"I'm sorry but I can't help those who have GoBack installed. This is due
to my having little experience of this program which amongst other things
alters the master boot record on the hard disk which means that amongst
other things the drive can't be accessed from DOS unless a specific
procedure is followed. I simply don't have the knowledge or experience to
continue here."

Having no experience of the use of GoBack and therefore the changes that
it makes to the Master Boot Record I am unable and unwilling to continue
with this thread. I would advise you to check out the Roxio site for the
help you need as far more might be involved than simply changing a bit in
the MBR and I would hate to cause you to lose your data.
--
Mike Maltby MS-MVP



Robert wrote:

[I tried to reply to this message on several different occassions.
But, for some reason, this site keeps locking up my computer while
I'm trying to compose a message.]


Are you quoting the official Microsoft policy on using 3rd party
applications (i.e., GoBack), or just your lack of familiarity with the
program? I did further research after reading your response, and it
turns out Symantec-Roxio claims the two are TOTALLY compatible (which
is what I thought I'd read before installing them together). I've
used GoBack successfully on many occassions, and never had a conflict
with SystemRestore. In fact, I almost forgot Restore was there.

The problem is not GoBack. The question I'm asking is whether or not
I can repair/rebuild the MBR so I can access the file allocation
table and not loose existing data. I never had any indication of
malicious activity. But, it's like I had a worm that increasingly
destroyed more and more of my ability to boot with each reboot. I
kept getting errors that key boot files couldn't be located. Before I
realized what was happening, I could no longer boot with the
Emergency Boot Disk, GoBack OR SystemRestore!

Now, FDisk indicates there is a "Non-Microsoft" partition, but I
can"t read anything on it. Short of writing off all my files and
erasing the disk, I wondered if there was a way to rebuild/restore a
"standard" MBR that might enable me to at least read the file
structure sufficiently to run VirusScan. Any suggestions?

I would try different memory chips. See if your HD works in another PC.

"Robert" wrote:

HELP!!! I can't boot-up or access files/folders on my 80GB Western Digital
HDD (WD800). I'm running Windows Me with 256MB of RAM on a 600MHz custom PC.
I use Roxio GoBack on the corrupt drive, as well as System Restore. I also
used McAfee VirusScan v.9 from a virus-clean disk in a separate system to
troubleshoot the corrupt disk.

I recently installed the corrupt disk as a single drive and transferred my
previous virus-free files, folders and programs from my old disk. I could
successfully access the drive's contents after installation. However, I had
not re-installed security programs (i.e., anti-virus, anti-malware, spybot
and adware programs) before needing to download additonal software and check
some email. I either suffered a catastrophic drive failure, or inadvertantly
picked up some sort of boot sector virus (or other malicious code).

I booted-up the computer a few days ago and received several error messages
when I got to the Windows desktop. Various files from programs that load at
startup could not be found. I hadn't had any startup problems before. I
became suspicious because the HDD was cranking away for quite awhile the
previous day while in standby mode. I thought it odd, but didn't think too
much of it at the time. However, when I rebooted, I received several more
(different) error messages.

I began a routine series of progressively more aggressive recovery attempts.
But, on each successive reboot, I had less and less functionality. Some of
the earlier error messages indicated possible remedies which I followed with
no success. After a couple of these failed fix attempts, I tried running
_Restore, again without success.

Then, I tried resetting the drive to the earliest possible restore point
with GoBack. Unfortunately, I did not have any restore points prior to the
drive's original boot failure. After 6-7 of these failed boot attempts, it
became impossible to boot into Windows normal mode. I used the virus-free
Emergency Boot Disk, but was only able to boot into Safe mode. I tried using
the available Windows and DOS-level recovery tools after booting to Safe
mode, to no avail. Eventually, choosing Safe mode from the EBD Startup Menu
loaded a blank gray screen. Scanning with Dr. Solomon showed the drive had
"no volume label, no serial number, and 0 files on disk".

When the drive stopped booting into Safe Mode, I installed the corrupt disk
as Secondary Master in a virus-free system and tried to scan it with
VirusScan. However, by this time, the corrupt drive was so badly damaged that
it was no longer recognized as a drive by the scan engine. I was therefore
unable to use VirusScan to detect the problem.

While the drive appears to be totally unreadable, it is correctly identified
in the system BIOS. And, FDisk recognizes it as being formatted with a
"Non-DOS" drive type. I attempted to use the Windows 2000 "FixMBR" utility
(before learning that it could totally destroy data on any non-Win2K drive).
Fortunately, the drive was so unreadable that there was no drive detected by
the Win2K EBD, and I couldn't run FixMBR.

I had not backd-up the disk yet, and hope to recover the valuable data. I'm
not even sure the problem is a highly-destructive virus, trojan or worm. I
don't see any outbreaks of such highly-dangerous code on a national virus
map. My A+ instincts and the chronology of the drive's progressive failure
events, plus the research I did on Microsoft's and McAfee's support sites
lead me to believe the boot record has somehow been compromised. Hopefully,
the drive's data is still intact, and can somehow still be recovered if I can
repair or re-write the damaged boot sector and/or partition table.

I read about the "/mbr" switch used with FDisk, and wonder if this might be
the next logical recovery step. Are there any other steps I might try? What
else could I try before giving up the ghost and re-formatting the drive?

Thanks for any ideas or suggestions you might offer. I greatly appreciate
your help!

I've tried different memory chips. Doesn't seem to be a mem problem. I also
tried moving the hard drive to a different WinME system. The drive is
recognized by the system BIOS, but doesn't appear in the list of installed
drives in Windows. Thanks for any further suggestions.

-Robert




"Ilya" wrote:

I would try different memory chips. See if your HD works in another PC.