PDA

View Full Version : Error on MBR sector message with Nod32


Greeps
07-12-2005, 01:27 PM
I bought a hdd one week ago (seagate Barracuda 160gb ST3160021A), set the antivirus nod32 then I update the definition of virus, when I want to run the program this message leaves:

Error occurred while scanning MBR sector of the 1. physical disk. Error reading sector.

But I can scan normally my hdd and Nod32 does not find virus.
I can make everything normal with my hdd, it is a bug of nod32 or that it should do?

Thanks

Paul Komski
07-12-2005, 07:26 PM
I expect NOD is picking-up some intermediate change to the mbr (such as overlay installed on a large drive to make if all usable or a boot manager to run multiboot operating systems) or just detecting the new drive "as something new". Perhaps there is a way of reinitialisng NOD short of uninstalling/reinstalling. If something has changed on the mbr then that is not a bug and is by design; NOD is in effect telling you that a change has occured (the sort of thing a boot sector virus would do) rather than formally scanning for virus definitions.

Greeps
07-13-2005, 09:54 AM
I'm going to reinstall nod32 and view if I even have the message, which antivirus do you recommend to me for scan my mbr and my memory.

B/c nod32 does not find any virus.

Paul Komski
07-13-2005, 03:44 PM
I am open to correction on this but antivirus scans don't directly search for specific code within the mbr. They either detect boot sector viruses because the same virus has also created specific files within the file system as part of its activities and which the a/v then detects or by noting relevant changes to the mbr.

The fact that a change has been made to the executable code in the mbr is pretty easy to recognise and most a/v software (inluding software that is embedded in the computer's BIOS) simply make a reference of the boot sector when they are installed (or when the CMOS is cleared or a BIOS a/v is reset) and then can recognise at a subsequent boot-up whether the executable code has changed in the interim.

Drive overlay as used by various boot managers or DDO to make large disks accessible on older computers are two benign examples that alter the mbr's executable code and that would trigger a warning by an antivirus.

So if any benign overlay has been installed (eg to allow recognition of the large 160 gig hdd) that would trigger such a warning and would require that you reinitialise the antivirus.