Re: Very old problem: NYB


On Tue, 18 Oct 2005, Zvi Netiv wrote:
[snip]
> Another worrying aspect is the abundance of bad advice on that subject, in this
> as well as other virus newsgroups, offered on base of ignorance and recycling
> formalistic and incorrect info. Take this thread for example. Although it's
> fairly obvious that the OP is experiencing a false alarm, no one offered advice
> how to confirm this, and feed the poor user with bad advice that risks
> frustrating him, panic, and eventually format the drive. As happened so many
> times before with false boot virus alerts.
>
> To make my post complete, then here is a procedure how to confirm a false alarm
> in the case of NYB: *On condition that a third party boot manager is NOT used
> on that PC (this seems to be the case), then run FIXMBR after having booted of
> the XP setup CD, in "repair console" mode. The procedure will do no harm to the
> MBR (after all it was devised for that) and will assure that no trace of NYB can
> survive in the MBR (just in case the false alert is caused by some residue code
> in the slack part of the MBR loader). Reboot from the hard drive own system.
> Any antivirus that now claims that it finds NYB is necessarily false alarming.

Is there any utility that you could recommend for backing up the MBR
after booting up from a (DOS) boot floppy before making any changes and
for restoring the MBR if those changes turn out to be a disaster (such as
could happen if he *was* using a boot manager installed by the store that
sold him the computer without telling him about it)?

--
``Why don't you find a more appropiate newsgroup to post this tripe into?
This is a meeting place for a totally differnt kind of "vision impairment".
Catch my drift?'' -- "jim" in alt.disability.blind.social regarding an
off-topic religious/political post, March 28, 2005

.

Relevant Pages

  • Re: Boot Manager
    ... No boot manager that usurps the MBR bootstrap area will cooperate with a drive overlay manager which also usurps the MBR bootstrap area. ... If you actually need to use the drive overlay manager, you'll need to find a boot manager that does NOT use the MBR bootstrap area (which means it might requires its own partition or share one). ... You might need to consider getting a new motherboard with a newer BIOS that can actually support the large drives that you want to use, or use an IDE controller card that has newer BIOS to support the larger drives. ...
    (microsoft.public.windowsxp.general)
  • Re: [opensuse] Partitioning problem in installing oS v11.1
    ... Instead of Boot Manager, I see a persistent ... The usual DFSee display doesn't show the MBR code. ... What I did in my ignorance was to follow the lead of DFSee. ... in the partition editor, ...
    (SuSE)
  • Re: Very old problem: NYB
    ... > their advice is to not use their little tools to remove mbr infectors ... > since those tools were not designed to fix mbr infectors... ... Microsoft have been playing a different tune for years, ... They aren't better informed in boot virus matters, ...
    (alt.comp.anti-virus)
  • Re: GRUB question
    ... several partitions capable of holding usable installations of the ... I use the IBM Boot Manager to select ... it insists on using GRUB and over-writes ... I have to re-write the MBR and set the BM ...
    (comp.os.linux.misc)
  • Re: whats the difference....
    ... If you WERE using some kinda boot manager or had other code resident in the ... MBR, then booting from floppy and running FDIK /MBR ... There are only a few very rare instances>> where I can think that this command might be useful. ...
    (microsoft.public.win2000.security)