Disinfecting master boot record viruses that do not store the boot sector
1. Hard disk
1.1. Disinfecting master boot viruses in Windows 95/98 and DOS1.2. Disinfecting master boot viruses in Windows NT/2000/XP
2. Floppy disk
2.1. Disinfecting master boot viruses on floppy disks in Windows 95/98/NT/2000/XP2.2. Disinfecting master boot viruses on floppy disks in DOS
1. Hard disk
1.1. Disinfecting master boot record viruses in Windows 95/98 and DOS
The boot sector must be replaced using the DOS utility FDISK.EXE:
- Switch off the PC, wait several seconds then boot from a clean system disk to prevent the virus from being loaded into memory.
- At the command prompt type
DIR C:
- Check that the contents of the infected drive are visible. If they are not contact support for advice.
- To overwrite the master boot sector enter:
FDISK /MBR
If a virus fragment is reported in upper memory then it probably indicates the presence of a virus. Contact support for advice.
1.2. Master boot record viruses in Windows NT/2000/XP
Do not switch the PC off. It may not be able to boot again.
2. Floppy disk
2.1. Disinfecting master boot viruses on floppy disks in Windows 95/98/NT/2000/XP
- Start the Sophos Anti-Virus GUI.
- Select the 'Immediate' tab.
- Go to Options|Configuration... select the 'Action' tab, tick 'Disinfect boot sectors' and 'Request confirmation'. Click 'OK'.
- Double-click the 'A:' icon to scan the floppy disk drive.
- Click 'OK' when asked if the disk should be disinfected.
- Scan the floppy disk again to confirm that disinfection succeeded.
If disinfection failed use Windows Explorer to copy the files to another disk. Reformat the floppy disk.
2.2. Disinfecting master boot viruses on floppy disks in DOS
At the command prompt:
- Change to the directory where Sophos Anti-Virus is installed.
- Type the following command and insert the floppy disk when prompted:,
SWEEP A: -DI -MU
- Check the floppy disk again to confirm that disinfection was successful.
If disinfection failed copy the files to another disk using COPY or XCOPY (not DISKCOPY). Reformat the floppy disk.
![[TOP]](/images/arrowtop.gif){kind=small}
