phantomphantom

Fantastic I'll give that go once I've got a drive - thanks for all your help! Really appreciate it. :) You've all been really helpful and prompt (and patient with a newbie) Will defo be dontating once I'm on a clean computer! Cheers, Jim

Ok kool. That's a bit better than having to install windows and all my programs again. :) I just need to buy a large external drive so I can copy all my data across. Is there any risk /or how can I stop any virus being copied across to the external drive? I read you can stop windows autorunning it or something? Even if it's not running from windows from that drive does the sinowal trojan still work/continue to be active?

I had a problem last year when I tried to update my windows/install 4OD (channel 4 s/w) and it completely crashed and wouldn't boot up. So i bought a new hard drive and did a clean install of windows on there. Which is now C: I've just left a message with my brother as he helped sort it - I have a vague memory that windows was on this E: drive originally. And it was deleted afterwards. I'm checking if that was the case thou. Is there a simple way to check? E: is where the majority of all my data is stored

I have two drives C: and E: Windows XP is installed on C:

Just wondered if there is anything else to try - as I write music for living so have loads of music progs on my system and it takes to ages to install them tweak them for my system.

Hi, The Avira isn't that descriptive and I've checked the quarantine and it hasn't moved it to there. Avira Report: Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Master boot sector HD1 [DETECTION] Contains code of the BOO/Sinowal.A boot sector virus [NOTE] The boot sector was not written! I ran that bootrepair tool again and it just says: Virus: The MBR contains a signature of the virus 'Boo/Sinowal.A' Is there another way to check exactly where it is? >Be informed though that you will lose all your previous restore points. What will I lose if this method is followed? I've now got my windows cd to hand btw Thanks for your continued help with this one :)

I haven't got it here - so I'd have to continue tomorrow... What's the next kind of steps?

It ran a few lines - that said it had found the virus, deleted 0 files and then just went back to the command prompt. The only option it gave me was right at the beginning to choose english or german lang

Ok - I see where I was going wrong - I had burnt the cd as data rather than an image (1st time I've done that - I realise what an iso is now....) It ran - and detected the boo.sinowal.A but didn't repair it or delete it. ?

interesting vid and writings on the sinowal virus: YouTube - Warning Serious Internet Explorer Torpig Mebroot Sinowal Virus / Phishing scam

If I double click on that Iso file it opens up similar to a .rar or .zip file. In it is a folder called CVS and once that folder is open it contains the following files: Template (size 0) Root (size 55k) Repository (size 47k) Entries.Old (size 0) Entries.Extra.Old (size 0) Entries.Extra (size 65) Entries (size 140) Do you think its a case of extracting these files and putting them on another cd and giving that a go?

Hi Wolfeymole, Yes I checked again that the Bios was set to boot to cd drive first and it was... Again it booted up fine from cd straight through to windows. Should it have written a new boot sector or something?

Update - i saved the iso and burnt it as test.iso to a cd (does it matter what it's called as it didn't supply a default?) Turned off computer with cd in and let it boot. It was definitely accessing the cd on bootup and it went straight through to windows fine. Did a scan with Avira and it found the Boo Sinowal again on Masterboot sector HD1 Was I doing something wrong? Or is there anything else to try? Thanks for ya continued help. Appreciate it. Jim

Ah right - I think that makes sense. :) So I exit the program - it asks me if I want to save the ISO. I save it somewhere on my h/d. I then burn that ISO file to a cd. Then I insert that cd once Avira Boot Sector Repair Tool starts up. Is that correct?

Nero (for my sins) ;-)