How to repair the MBR

[T,X]

The system of my computer in windows7 home edition. Not long before my computer got infected by a kind of nasty software that changed the MBR. Therefore, I have to press the enter to make the choice every time when I boot up my computer. I used Kaspersky to scan, but it didn't reporte any threat. Is there anything I can do to make A recovery? Thanks a lot.

[T,X]

I want to add that my computer is double system, including Windows and MAC, so I can't reset MBR use ways that I know.

[Berny]

@T,X Welcome.

Can you please provide some details about the “nasty software” ?
Do you suspect Kaspersky in this issue ?

 

[gigiadi]

I guess you tried this ...

[gigiadi]

or this...

https://support.apple.com/boot-camp

[T,X]

Well, this is the nasty software's website: https://www.160.com/, I can't attach it since it's larger than 50MB.

The KSC software can't find the threat, but my MBR was changed

Edited July 17, 2022 by T,X
mistake

[T,X]

The issue is that the KSN trusts the software's setup

[harlan4096]

I have just sent to K. analyst the installer DriveTheLife_2571_8.15.99.290.exe via KOTIP, waiting for final verdict... but got also a too large file warning from the robot, so I will try to send it via K. Support ticket...

[T,X]

1 hour ago, harlan4096 said:

I have just sent to K. analyst the installer DriveTheLife_2571_8.15.99.290.exe via KOTIP, waiting for final verdict... but got also a too large file warning from the robot, so I will try to send it via K. Support ticket...

The KIP result says that it is clean, so I have submited a request to reanalyze. Because it did change the MBR of my computer.

Edited July 17, 2022 by T,X

[T,X]

I suspect that the software changed my MBR when I use it to update the drive(not right after the software's installation)

[Gionatan]

19 hours ago, harlan4096 said:

DriveTheLife_2571_8.15.99.290.exe 

 

What says VirusTotal ? 

[harlan4096]

https://www.virustotal.com/gui/file/37a007029f243ab5ea9c6dd98248364fe9cb50d45b862d2b7dad5c0b4151400b?nocache=1

[Gionatan]

18 minutes ago, harlan4096 said:

https://www.virustotal.com/gui/file/37a007029f243ab5ea9c6dd98248364fe9cb50d45b862d2b7dad5c0b4151400b?nocache=1

Thank You.

For all antivirus (as Kaspersky) is clean.

[T,X]

18 hours ago, T,X said:

changed my MBR when I use it to update the drive

So, that's maybe the reason why it's not detected as a virus.

[Wesly.Zhang]

Hello, @T,X

Do you really don't know what is "DriveTheLife" in china ? If you want to restore the mbr information to default, Please use this system command which only available in windows 7, but you should backup the disk first and execute this command :

fdisk /mbr

Usually this command will not lead to lose disk data, but we are afraid of losing data in case.

Regards.

[Wesly.Zhang]

1 hour ago, T,X said:

So, that's maybe the reason why it's not detected as a virus.

Hello, @T,X

Programs that change your mbr are not necessarily malicious programs, such as disk programs such as diskgenius. Why do you say it changes the mbr information? The key is to see what happens after changing the mbr information, locking the system and ransome you, because changing the mbr information is used to do this kind of malicious behavior. I believe this program does not have this behavior. I think this program set the boot item for you. not use mbr section.

Just edit the boot.ini file in driver C root folder.

Regards.