# MBR sector of the 1. physical disk contains probably unknown TSR.BOOT virus



## lil_lyly (Nov 30, 2006)

Hi all, 
I've been searching the net and quite a fair bit of people have this problem but i can't find a fix to it. Also well reading through the articles, I'm not sure if it is a virus or if its something wrong with NOD32 software. I'm using NOD32 antivirus software and it keep popping up with this message "*MBR sector of the 1. physical disk contains probably unknown TSR.BOOT virus* Can't be cleaned."

The reason I'm thinking its a virus is cause my computer just froze and wouldn't go pass the user login. So i formatted the bootable HDD and the message was still there. I have 2 HDD both partitioned into 2 parts each. So 4 partitions over the 2 drives. I unplugged the slave drive and tried fixmbr and fixboot on the master drive. Booted up with the slave drive still unplugged and ran the virus scan with no virus found. So i turned off the computer and plugged the slave drive back in and booted up the computer and ran the virus scan again. There is was the same virus message.

So I'm pretty sure the virus is on the slave drive, but is there anyway to fix it without formatting? and even so would formatting and doing the fixmbr and fixboot solve the problem?

Please help its driving me crazy as the slave drive has files i would like to keep and theres like 250GB worth of stuff that i would have to back up. 
Thanks in advance.


----------



## lil_lyly (Nov 30, 2006)

lil_lyly said:


> Hi all,
> I've been searching the net and quite a fair bit of people have this problem but i can't find a fix to it. Also well reading through the articles, I'm not sure if it is a virus or if its something wrong with NOD32 software. I'm using NOD32 antivirus software and it keep popping up with this message "*MBR sector of the 1. physical disk contains probably unknown TSR.BOOT virus* Can't be cleaned."
> 
> The reason I'm thinking its a virus is cause my computer just froze and wouldn't go pass the user login. So i formatted the bootable HDD and the message was still there. I have 2 HDD both partitioned into 2 parts each. So 4 partitions over the 2 drives. I unplugged the slave drive and tried fixmbr and fixboot on the master drive. Booted up with the slave drive still unplugged and ran the virus scan with no virus found. So i turned off the computer and plugged the slave drive back in and booted up the computer and ran the virus scan again. There is was the same virus message.
> ...


*Update*

Ok I'm pretty sure its a virus now as its coming up with win32/mebroot.k trojan and also the computer keeps freezing after about 5mins. I've been reading that people says to use the *fixmbr* in the recovery console. As I've done that on the Master drive already but still have the virus, what i want to know is if i do the *fixmbr* on the slave drive (where all my files are), would it erase my files? or by doing fixmbr just replace the master boot record for the slave drive only and still keep my files safe?


----------

