[jerry62]

no, i haven't tried that.. i don't have any dosboot subdirectory though on my C... this is quite nasty, whatever it is... can't figure out how to get the mcafee plugin to work with bartpe either, although I ran some AV from UBCD with NTFS support, didn't find anything...

[bandit429]

I understand, There is a link below that discusses how to remove boot Viruses....it also relates back to your idea of the recovery console...Have you had experience with the recovery console before?? If not please ask....I have had experience with it before. I m sorry I missed your post...ususally I get the notification right away.

http://www.bullguard.com/support/tip_boot_viruses.aspx

[jerry62]

Thanks for responding... I think the biggest help would be to know the exact name of the virus so that I could do the proper research, although I will see what else I can do in the mean time... it's difficult to search on the strange characters the screen displays when an attempt is made to boot from the hard drive.

[jerry62]

I don't know if I should have followed those instructions.. I don't think I wanted to run fixboot... that seemed to have wiped everything out... before I could at least see the data files... looks like I'm screwed royally... plus now recovery mode says the c drive is fat16... what ? it's wasted ! then it recognizes another partition it labels as ? at FAT32. I don't know, but one of those 2 commands wiped it out, plus getting those NTLDR not detected... tried copying those over, but still no boot... but why would C be fat16 now... it's worse than before.

[bandit429]

Which did you do?? How to remove boot viruses from Bullguard? Thats All I could find about yo yo 1271 b

http://www.trendmicro.com/vinfo/viru...OYO%2E1271%2DB

[bandit429]

Fixboot should have worked ok. At least not made things worse. Can you still access the recovery console?

http://support.microsoft.com/?kbid=255220

[jerry62]

No one is sure that this is YOYO 1271. That was a guess of the original person's problem in this thread. He said the descriptions seemed similar if I recall.
Yes, I could get back to Recovery Conole using boot floppies, however, using the MAP command, there was a small hidden partition, and the C partition was marked as FAT16. I've been running GETDATABACK all night on the drive using their BartPE Plugin. It can see that there was NTFS based data on C at one time. I can see the NTLDR and NTDETECT.COM files I had copied there, but the C drive used to be NTFS, not FAT16, which it now reports as under RC and/or BartPE. There was a smaller FAT32 partition that the MAP command defined as question mark ?. I'm going to try to recover what data I can and use BartPE so I can network in and perhaps copy the data. There was an error reading a block with GetDataBack, so having that run all night wasn't enough... had to respond to popup in order to continue.

[bandit429]

A hidden partition is probably normal...HP and Compac puts them on some of thier computers. If it found a bad block it could be a bad drive. If after your finished with that and want to continue find the manufactorer of the drive and lets see if there is a utility made for that brand you can run on it.

[bandit429]

Also Jerry you should take a look at the following. It notes that it is impossible for you to convert that drive. Whatever happened,,you did'nt do it. Not with a windows utility. Click the link it may be worth the read. There is another link at the bottom which may be of help.

Note: Windows 2000/XP/2003 provides NO way to convert NTFS partitions to FAT16/32.

http://www.petri.co.il/convert_fat16...00_xp_2003.htm

http://support.microsoft.com/default...b;EN-US;307545

[jerry62]

Thanks for the follow up.
Well, all I can say, is that at first, even with the problems, I was able to see the files on my C drive using BartPE (xp boot cd). When I then used fixmbr and fixboot, there was a C drive, but Recovery Console lists it as FAT16 (with the size of my former NTFS system). So it could be something so messed up, RC is not reporting it properly, but after that I could no longer view my files on the C drive that matched the same size using BartPE. I had booted systems multiple times on CD and I could see the C drive, but after fixmbr/fixboot, no more. The new C did display the ntldr file I copied there using RC, but not the files that used to be there. In RC, the part listed as FAT16 was the larger drive, which I knew was NTFS. GetDataBack was able to recognize that there was NTFS for this same primary partition. I'm just wishing I had backed up what was visible prior to running fixmbr/fixboot. GetDataBack is not free.

[bandit429]

You are welcome,,,that last link maybe a possiblity. It looks complicated and it is to an extent but I believe you can do it. If the hard drive will let you. Please read the summary very carefully as it states

This procedure does not guarantee full recovery of the system to a previous state; however, you should be able to recover data when you use this procedure.

I have used this procedure "One Time" and that time it worked perfectly but still the summary does state that it may not. I understand that BartPE does this. I did nt have BartPE.
And I am still looking. Please keep me informed. Did you purchase getdataback?

Edit...Here is a free download for a data recovery program,, a friend I know recommends it. He says it works well. If it works and if the microsoft recovery procedure does not work maybe you could recover the files that microsoft is asking for in the procedure and get it going that way. Its an idea.

http://www.pcinspector.de/file_recovery/UK/welcome.htm


Edit: Here is another which may help...There is a part at the bottom which may apply to helping you with the fat 16 partition but I would read it all.

http://www.microsoft.com/resources/d...c_str_bjid.asp

I sure hope something of this is help.

[jerry62]

man, this site logs u out quick.
Anyway, yes I purchased...
Don't think the registry is the problem... I think the hidden HP partition is corrupt.
Someone suggested using the xp "convert" command on the C drive.. which might work, but first I'm going to complete my backup efforts (only have so much time per day). I make 2 copies of each dvd in case one disc gets damaged. After that, I just might be able to recover to how it was since so far I've been able to recover/see just about all files...
[edit] Also, I might slave the drive off another (after extracting Partition Magic from the data recovery) at some point... strange though, no AV found any virus (when the drive was visable previously under BartPE).

[bandit429]

That may work as you can convert "supposedly" from a fat partition to NTFS. Still blows my mind as to how it worked the other way around....its not supposed to happen. I cannot help you with partition magic as I have never used the program. I did find a link for the windows convert command. And Partition Magic is recommended.. I hope you can get by any errors. The lower link is for an HP softpaq, which if you have on that computer you should be able to find it at that site by entering your model.

http://www.techrescue.net/guides/pre...sp#ConvertNTFS


http://h18023.www1.hp.com/support/fi...s/romtabl.html

[JimmyLegs]

I can't find any mention of anything like this on the major AV sites. I had ZoneAlarm running and AVG free all up to date, and no indication of problems until trying to restart. The system is P4, 784M ram, 250G HD with WinXP Pro, all up to date.

Recovery console chkdsk /r didn't change anything; I tried recovering the registry using ERDNT (http://www.larshederer.homepage.t-online.de/erunt) also, with no luck.

This HD is backed up except for a few things from the last few days, so I'm not worried about losing anything, but I want to find out what it was. Anyone have any ideas?

[bandit429]

There is no information to be found. This is it as far as I could find. Do you have a compaq or hp as well? And which filing system did you have?
Fat32 or NTFS?
And do you have your bad drive slaved now?