# Infected Boot Record **URL:** \ **Category:** Factual Questions\ **Created:** [December 20, 2003, 4:52pm UTC](https://boards.straightdope.com/t/infected-boot-record/220187 "2003-12-20T16:52:01Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![peasea](https://avatars.discourse-cdn.com/v4/letter/p/bc79bd/32.png) [@peasea](https://boards.straightdope.com/u/peasea)\ **Post date:** [December 20, 2003, 4:52pm UTC](https://boards.straightdope.com/t/infected-boot-record/220187/1 "2003-12-20T16:52:01Z")
Every once in a while, McAfee Virus Scan will tell me it found an infected boot record, but that it can’t clean it or really do anything about it. Can I fix this? Formatting my hard drive is not an option. Also, I’m running XP. Where does the boot record live, anyway? ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [December 20, 2003, 4:54pm UTC](https://boards.straightdope.com/t/infected-boot-record/220187/2 "2003-12-20T16:54:22Z")
Though my first reaction was going to be to slam McAfee… Instead I’ll say… use the free online scanner from [Housecall](http://housecall.trendmicro.com/housecall/start_corp.asp) to see what it reports back to you and is able to get rid of. Post back. ---
**Author:** ![sigSEGV](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@sigSEGV](https://boards.straightdope.com/u/sigSEGV)\ **Post date:** [December 20, 2003, 5:10pm UTC](https://boards.straightdope.com/t/infected-boot-record/220187/3 "2003-12-20T17:10:07Z")
In the old days, running the undocumented fdisk /mbr would rewrite the original boot record. Don’t know if its still around, but you could try running the command. Should be safe. ---
**Author:** ![peasea](https://avatars.discourse-cdn.com/v4/letter/p/bc79bd/32.png) [@peasea](https://boards.straightdope.com/u/peasea)\ **Post date:** [December 20, 2003, 11:02pm UTC](https://boards.straightdope.com/t/infected-boot-record/220187/4 "2003-12-20T23:02:22Z")
> [@](#): > > \*Originally posted by sigSEGV \* > \*\*In the old days, running the undocumented fdisk /mbr would rewrite the original boot record. Don’t know if its still around, but you could try running the command. Should be safe. \*\* No, it doesn’t appear to be a part of XP. ---
**Author:** ![AskNott](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/asknott/32/5790_2.png) [@AskNott](https://boards.straightdope.com/u/AskNott)\ **Post date:** [December 21, 2003, 3:12pm UTC](https://boards.straightdope.com/t/infected-boot-record/220187/5 "2003-12-21T15:12:54Z")
I avoided this thread yesterday. I thought it was going to be about jungle rot on soldiers’ feet, and some really disgusting Guinness World Record pictures. ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [December 21, 2003, 5:30pm UTC](https://boards.straightdope.com/t/infected-boot-record/220187/6 "2003-12-21T17:30:57Z")
**peasea** Have you tried the online scan yet? ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [December 21, 2003, 9:58pm UTC](https://boards.straightdope.com/t/infected-boot-record/220187/7 "2003-12-21T21:58:00Z")
Boot records of disk drives are typically protected against modification (by things like viruses) with a CMOS setting. Your scanner may be unable to make the changes it wants since this has been set. Reboot, enter the CMOS setup (mistakenly called “BIOS setup” by many), turn off the boot sector protection. Try your antivirus software again. Then set the protection back again. Not 100% sure this will work, but it might. ---
**Author:** ![peasea](https://avatars.discourse-cdn.com/v4/letter/p/bc79bd/32.png) [@peasea](https://boards.straightdope.com/u/peasea)\ **Post date:** [January 24, 2004, 1:53am UTC](https://boards.straightdope.com/t/infected-boot-record/220187/8 "2004-01-24T01:53:38Z")
Sorry I never replied, **Daizy** , but I stubbornly wanted to make McAfee work. When I did a web search for info on **sigSEGV** ’s fdisk suggestion, I found out that the XP CD has a Restore Manager, which has a fixboot command that does the same thing. For some reason, though, I wasn’t able to get the system to boot from the disk. Well, I just tried it again tonight. I don’t know what I was doing wrong before, but it just worked, and I was able to run fixboot successfully. I then installed AVG Anti-Virus, which was suggested by a coworker, and it found 361 infected files. I’ll use that now, at least for a while, but I’ll check into Housecall as well. ---
**Author:** ![GorillaMan](https://avatars.discourse-cdn.com/v4/letter/g/50afbb/32.png) [@GorillaMan](https://boards.straightdope.com/u/GorillaMan)\ **Post date:** [January 24, 2004, 8:05pm UTC](https://boards.straightdope.com/t/infected-boot-record/220187/9 "2004-01-24T20:05:48Z")
“fixmbr” in the recovery console restores the boot record. [http://www.microsoft.com/windowsxp/home/using/productdoc/en/default.asp?url=/WINDOWSXP/home/using/productdoc/en/bootcons\_fixmbr.asp](http://www.microsoft.com/windowsxp/home/using/productdoc/en/default.asp?url=/WINDOWSXP/home/using/productdoc/en/bootcons_fixmbr.asp) ---
**Author:** ![engineer\_comp\_geek](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/engineer_comp_geek/32/504_2.png) [@engineer\_comp\_geek](https://boards.straightdope.com/u/engineer_comp_geek)\ **Post date:** [January 25, 2004, 12:42am UTC](https://boards.straightdope.com/t/infected-boot-record/220187/10 "2004-01-25T00:42:33Z")
> [@peasea](#): > > Where does the boot record live, anyway? The boot record is the first sector of the disk. When a PC boots, it goes through all of its self checks, etc. then it starts looking for a device to boot from. It goes through the list of devices as set in your BIOS, and checks each device’s boot record to see if it’s in the proper format for a boot record. For example, if your PC is set to boot from the floppy, then hard disk, it will first look at the floppy. If the boot sector contains a valid boot segment, then it will load this segment into memory and execute it as if it were a program. If there is no floppy in the drive then it will skip the floppy and do the same thing with the hard drive. In the old days, if there wasn’t a valid boot sector on the hard drive, the computer would then try to boot into the BASIC ROM, which most computers didn’t have, so you would get this cryptic “NO ROM BASIC” error if the hard drive was futzed. The boot sector contains a small program which loads the rest of the operating system (or else loads a bigger program which then loads the rest of the operating system). Since the boot sector executes long before a virus scanner or even the operating system itself is up and running, many BIOSes will have an option to disable writing to it, which helps to prevent a nasy virus from getting in there and executing. Once a virus is in there, it will execute long before the virus scanner has a chance to do anything about it.