Vista Tutorial - Removing RootKits

"Karl Levinson, mvp" <levinson_k@securityadmin.info> wrote in message
news:4A06D8AA-A00D-449B-9518-090A0E68DBCA@microsoft.com...
> Most root kits in use nowadays have little to nothing to do with the MBR.
> In old days, some people suggested running FDISK /MBR was recommended as a
> virus removal method, but antivirus experts said this was a bad idea, and
> I
> still agree.

Why did they say it is a bad idea and why do you agree?

"May" <May.J.Court@Blueyonder.co.uk> wrote in message
news:%23yGGW2x3HHA.1208@TK2MSFTNGP05.phx.gbl...
>What ever replaced the ‘Fdisk /MBR’ command?
>
> May


fixboot and fixmbr

http://support.microsoft.com/kb/314058

Crazy

Many of the old XP Recovery Console commands have been changed in Vista. The
following website has these changes documented.

Windows RE Notes : Where are recovery console commands?:
http://blogs.msdn.com/winre/archive/...-commands.aspx


--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"Crazy Noddy" <SPAM@BLOCKER.ACTIVE> wrote in message
news:BUGwi.218652$ss3.90690@fe01.news.easynews.com...
> "May" <May.J.Court@Blueyonder.co.uk> wrote in message
> news:%23yGGW2x3HHA.1208@TK2MSFTNGP05.phx.gbl...
>>What ever replaced the ‘Fdisk /MBR’ command?
>>
>> May
>
>
> fixboot and fixmbr
>
> http://support.microsoft.com/kb/314058

"Ronnie Vernon MVP" <rv@invalid.org> wrote in message
news:OPZngd43HHA.536@TK2MSFTNGP06.phx.gbl...
> Crazy
>
> Many of the old XP Recovery Console commands have been changed in Vista.
> The following website has these changes documented.
>
> Windows RE Notes : Where are recovery console commands?:
> http://blogs.msdn.com/winre/archive/...-commands.aspx
>
>
> --
>
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User

Ok, thanks. And it is "Crazy Noddy" and not just "Crazy".

cyranodesade wrote:
> All,
> I hope this is a simple question does Formatting a Hard Drive and then
> FDisk /MBR remove any rootkits or hidden files on a hard drive??
> If the answer is no then could you please point me to a good resource
> for formatting the boot sector/MBR? Thanks in advance. - CES

Yes, it'll remove the rootkit - IF the rootkit lets you format the
drive. There would be nothing to stop somebody from writing a rootkit
that just made it look like the drive had been formatted.

You could delete and recreate the partition when you're booted from CD
(eg. installing Windows)

Alun Harford