Boot Sector Virus

[Tachion]

I just found out I have a boot sector virus. I am pretty sure it's Wisteria/Nachi (http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100559). The problem is that everytime I reformat and install Windows, it gets infected with Wisteria. The bigger problem is that that virus info doesn't mention it being a boot sector virus.

Any idea how I can find out what virus is in the boot sector and get the tools to remove it?

 

[AngryKid]

How are you "pretty sure" it is Wisteria/Nachi? A scan with a decent, updated anti-virus program should find out what it is. Once you know what it is, you can search for removal instructions on Symantec.

If it's indeed getting infected when you reload, it must be getting it from a backup or infected disk. I would reformat and load Windows from a CD-ROM. The very next thing I would do is load a good, updated virus scanner from CD-ROM or online. Then you can start restoring your system. Perhaps you did this already...

 

[speed01]

Ummm..... Nachi isn't a boot sector virus, it's an internet worm. And Wisteria isn't a virus, it's a plant...🙂 Welchia is probably what you're thinking of but it's still a worm and not a boot sector virus. How do you know you have a virus? Are you getting the Boot Sector Virus warning during install? If you are, check your BIOS for the built in virus protection and turn it off.

Speed

 

[Tachion]

Yeah, I got a boot sector virus warning during the XP install and every time I reformatted and reinstalled Windows, I got another virus without installing anything. I think the reason was because Windows was "formatting" the RAID array and not individually formatting each drive in the array (it is RAID 0). I did a full out format on each drive after getting rid of the array and an updated PC-Cillin didn't detect a boot sector virus, but it did detect MSBLAST.

Hopefully cleaning it out will work, but it still doesn't make sense as to why I would get MSBLAST after a fresh install (I am using a legit copy of XP, so it's not that).