Very old problem: NYB

  • Thread starter Thread starter news.rcn.com
  • Start date Start date
This was discussed many times in these forums. The latest thread on the subject
starts with http://groups.google.com/group/alt.comp.virus/msg/ddeff668475e993b
Click to expand...

Since you're so much in love with inappropriate methods and dedicated
to giving bad advice, I've got another one for you, Zvi baby. Use the
Repair feature of XXCLONE:

http://www.xxclone.com/

It allows you to repair the MBR, Boot Sector and Boot.ini. Put that in
your goat and smoke it :) You don't even need to leave the Windows
GUI.

Art

http://home.epix.net/~artnpeg
 
Since you're so much in love with inappropriate methods and dedicated
to giving bad advice, I've got another one for you, Zvi baby. Use the
Repair feature of XXCLONE:

http://www.xxclone.com/

It allows you to repair the MBR, Boot Sector and Boot.ini. Put that in
your goat and smoke it :) You don't even need to leave the Windows
GUI.
Click to expand...

Who's going to cough up for xxclone or even bother to download and
install it when fixmbr is already available? Not to mention having to
activate it and have your details on their web server.


Jim.
 
Who's going to cough up for xxclone or even bother to download and
install it when fixmbr is already available? Not to mention having to
activate it and have your details on their web server.
Click to expand...

WTF are you talking about? The free version I have has the capability.
No "details on their web server" at all. Plus the fact that it works
fine for creating bootable backup drives.

Art

http://home.epix.net/~artnpeg
 
WTF are you talking about? The free version I have has the capability.
No "details on their web server" at all. Plus the fact that it works
fine for creating bootable backup drives.
Click to expand...

It's the pro version which needs web activation. I should have known
better than to think you might pay for it.


Jim.
 
Art said:
Are you trying do outdo Zvi with bum information? I don't call 350
miles "not far from" :)
Click to expand...

Hokay.....I thought you were closer than that to Niagara Falls.....but 350
miles is just a pleasant 4 hour drive to a hardy Canadian, lol.

Heather
 
Hokay.....I thought you were closer than that to Niagara Falls.....but 350
miles is just a pleasant 4 hour drive to a hardy Canadian, lol.
Click to expand...

Niagra Falls is probably "only" about 250 miles, but still not what
I'd call "nearby". If I were to head for the Great White North, I'd be
inclined to go up through Utica, NY and the Adirondack mountains. Love
it up there. I worked for GE there for awhile back in 1956.

Art

http://home.epix.net/~artnpeg
 
Zvi said:
I thought that only old fellows have a memory problem. ;-) Read my reply to
Art, in this thread. I am referencing to previous threads where we (you and I)
discussed the issue.
Click to expand...

memory problems? would that be like 'remembering' that you convinced me
you were right and i was wrong even though that never happened?

the previous threads are non-sequiturs, zvi, because you failed to
convince in them...

(you didn't fail to resort to ad hominems, though)
Microsoft have been playing a different tune for years, about both FDISK /MBR
and FIXMBR. It's only recently that they changed the tune, probably as the
result of the new cover-ass policy they adopted with the introduction of the XP
Security Center parody (the page referred by Art is from the XP Professional
Resource Kit documentation, not really intended for the wide public). Read
http://www.microsoft.com/technet/prodtechnol/windows2000pro/tips/reccon.mspx
where Microsoft explicitly recommend FIXMBR to restore the MBR from a boot virus
("cool use" they call it). ;-)
Click to expand...

how very telling... "cool use" indeed... that suggests that it's ability
to deal with mbr infectors was an unintended side effect that someone at
microsoft decided was 'cool'...

specifically, that means a) fixmbr and fdisk /mbr were not designed to
deal with viruses and b) that the page you're referring to was written
by someone who'd just figured out they could do X without investing the
time to uncover any possible deeper issues (after investing that time
the novelty would have certainly worn off)...
In plain language, Microsoft isn't the party to depend upon for advise on the
subject. They aren't better informed in boot virus matters, nor are the
antivirus producers (read the referred thread)! AV producers always did a lousy
job on this particular issue (BSI), and it's even worse now, since boot viruses
are practically extinct and the new AV cadres have no meat to chew on and lack
experience.
Click to expand...

you should take your own advice and refer to that previous thread... i
did and i found that i pointed out (in that previous thread) your vested
interest in stating that opinion...
 
On Tue, 18 Oct 2005, Zvi Netiv wrote:
[snip]
Another worrying aspect is the abundance of bad advice on that subject, in this
as well as other virus newsgroups, offered on base of ignorance and recycling
formalistic and incorrect info. Take this thread for example. Although it's
fairly obvious that the OP is experiencing a false alarm, no one offered advice
how to confirm this, and feed the poor user with bad advice that risks
frustrating him, panic, and eventually format the drive. As happened so many
times before with false boot virus alerts.

To make my post complete, then here is a procedure how to confirm a false alarm
in the case of NYB: *On condition that a third party boot manager is NOT used
on that PC (this seems to be the case), then run FIXMBR after having booted of
the XP setup CD, in "repair console" mode. The procedure will do no harm to the
MBR (after all it was devised for that) and will assure that no trace of NYB can
survive in the MBR (just in case the false alert is caused by some residue code
in the slack part of the MBR loader). Reboot from the hard drive own system.
Any antivirus that now claims that it finds NYB is necessarily false alarming.
Click to expand...

Is there any utility that you could recommend for backing up the MBR
after booting up from a (DOS) boot floppy before making any changes and
for restoring the MBR if those changes turn out to be a disaster (such as
could happen if he *was* using a boot manager installed by the store that
sold him the computer without telling him about it)?
 
Art said:
Niagra Falls is probably "only" about 250 miles, but still not what
I'd call "nearby". If I were to head for the Great White North, I'd be
inclined to go up through Utica, NY and the Adirondack mountains. Love
it up there. I worked for GE there for awhile back in 1956.

Art

http://home.epix.net/~artnpeg
Click to expand...

My buddy went to the Adirondacks over the summer-said the waters were
very clear-good fishing!
-max
--
Playing Nice on Usenet:
http://oakroadsystems.com/genl/unice.htm#xpost
My Pages: http://home.neo.rr.com/manna4u/
Change nomail.afraid.org to yahoo.com to reply.
Registered Linux User #393236
Click to expand...
Click to expand...
 
Art said:
Niagra Falls is probably "only" about 250 miles, but still not what
I'd call "nearby". If I were to head for the Great White North, I'd be
inclined to go up through Utica, NY and the Adirondack mountains. > Love
it up there. I worked for GE there for awhile back in 1956.
Click to expand...

Well.....small world. Not sure which GE you worked at, but Ron worked for
them in Toronto and Guelph, Ontario in the early 50's.

We took a l-o-n-g way home from southern New Brunswick in 2001.....via
Bangor Maine and then north to Quebec City. Incredible wilderness.....only
met up with 2 other cars at rest stops. We even saw a moose ambling along
beside us. Lordy, they are BIG!!

Cheers.....Heather
 
Norman L. DeForest wrote:
[snip]
Is there any utility that you could recommend for backing up the MBR
after booting up from a (DOS) boot floppy before making any changes and
for restoring the MBR if those changes turn out to be a disaster (such as
could happen if he *was* using a boot manager installed by the store that
sold him the computer without telling him about it)?
Click to expand...

i imagine zvi may very well have such a utility or it may be a function
of one of his programs, i don't know...

i do seem to recall that everyone and their grandmother made such
utilities at one time or another... i made a pair of programs for
backing up and restoring the entire track 0 as an exercise in assembler
many moons ago (i have no idea what happened to it)...

the one that sticks out in my mind, however, was part of padgett
peterson's fixutil package...
 
Norman L. DeForest wrote:
[snip]
Is there any utility that you could recommend for backing up the MBR
after booting up from a (DOS) boot floppy before making any changes and
for restoring the MBR if those changes turn out to be a disaster (such as
could happen if he *was* using a boot manager installed by the store that
sold him the computer without telling him about it)?
Click to expand...

i imagine zvi may very well have such a utility or it may be a function
of one of his programs, i don't know...

i do seem to recall that everyone and their grandmother made such
utilities at one time or another... i made a pair of programs for
backing up and restoring the entire track 0 as an exercise in assembler
many moons ago (i have no idea what happened to it)...

the one that sticks out in my mind, however, was part of padgett
peterson's fixutil package...
Click to expand...

F-Secure has BOO32, FIXBOOT, GETBOOT, GETMBR and PUTMBR here:

http://www.f-secure.com/download-purchase/tools.shtml

Art

http://home.epix.net/~artnpeg
 
Norman L. DeForest said:
Is there any utility that you could recommend for backing up the MBR
after booting up from a (DOS) boot floppy before making any changes and
for restoring the MBR if those changes turn out to be a disaster (such as
could happen if he *was* using a boot manager installed by the store that
sold him the computer without telling him about it)?
Click to expand...

RESQDISK will do that. It can back up and restore the MBR, boot sector, as well
as a boot overlay on track 0.

ResQdisk is self contained, there no need to make a boot floppy as the RESQ
setup will make the floppy bootable.

To backup or restore the MBR or boot sector, just position the ResQdisk view
window over the desired sector, and press B or R according to the action you
wish performing.

For the entire track 0 (which includes the MBR) press Alt+Z and select backup,
restore, or compare (the actual track 0 with the backup file) from the drop
menu. The "track 0" function of ResQdisk was especially made to handle boot
overlays (and certain boot managers) that other utilities failed to do properly
(Symantec's RESCUE, and DISKEDIT for example). Boot overlays and managers that
write code to track zero use stealth to protect their own code from being
accidentally overwritten. Ordinary utilities pick the apparent code, not the
true one stored on disk, and end up in disaster if used to recover the track
content. ResQdisk overcomes the problem by its SeeThru technique, developed to
fight stealthy boot infectors.

RESQ is available from www.invircible.com/resq.php

Regards, Zvi
 
Well.....small world. Not sure which GE you worked at, but Ron worked for
them in Toronto and Guelph, Ontario in the early 50's.
Click to expand...

The GE facility in Utica was called LMED (Light Military Electronics
Department). They were involved with radio communications equipment
used on SAC (Strategic Air Command) bombers, among other things.

Art

http://home.epix.net/~artnpeg
 
OP top-posting here:

I pretty much decided some time ago that the NYB was a false positive and
that any failure to read floppies was more likely to be good old Dell
misaligned floppy heads (though the report of DOS mode compatibility in My
Computer properties advanced was baffling, to say the least). But you were
right about hyperventilating until I realised this.

But now someone has given me a new sealed copy of Norton Internet Security
with a validation code on it and I am wondering if there is anything on it
which could be of use to me. Does anyone have a view on this? Or is it yet
another resource hog which, like their other programs, Symantec sell but
don't dare support ?

Do it's antispam features work (90% of all spam I receive gets sent through
to my deleted items folder by Outlook already)? Or do it's security and
pop-up blocking features do anything which Adaware or Spybot don't do? I
think that at the moment I am using not one but TWO hardware firewalls, one
on my Buffalo WiFi router and one on the in-series Linksys router supplied
by my VOIP service.

(I have also found that the Multi_AV program is extraordinarily useful)
 
Back
Top