support request - invalid partition table

[herebeedragons]

Hi DIY,

I have a computer that recently contracted a virus, one of those kinds that masquerade as anti-virus software and annoy you to death with dire warnings that your computer is infected and you simply must go and buy this product.  This one was particularly unpleasant, as it would boot up before windows and not let you close out.  After removing the virus, my computer was caught in a reboot loop, and the error that would show when I set it to not automatically restart on error indicated that the computer might have a boot sector virus.  (I believe the error was 0x0000007B.)  While trying to remove that, I have somehow managed to invalidate the partition table on the disk ("Invalid Partition Table..." error and black screen on boot). 

I have no reason to suspect that the disk is physically damaged, and I hope that your DiskPatch can get me back to the point where I can scan my C:\ drive with other antivirus/antispyware software.  Here is my support analysis log file; please review it at your leisure and let me know if you think your product will resolve my issue.  My system is running Windows XP SP2 on an NTFS formatted drive.  Please also let me know if I have left out any pertinent information.

Thanks very much,
herebeedragons


.../000:03/LOG> ### LOG START ###
.../000:03/LOG> DISKPATCH 3.5.300
.../000:03/LOG> (C) 2000-2009 DIY DataRecovery
.../000:03/LOG> Contact info: http://HTTP://www.DIYDataRecovery.nl
.../000:03/LOG> MemFree: 74Kb
.../000:03/LOG> CommandLineParms: /sup
.../000:03/LOG> LogDate: 02-21-2011
.../000:03/CFG> FilePath="A:DPFILES\"
.../000:03/CFG> ReadRetries="32"
.../000:03/CFG> WriteRetries="32"
.../000:03/CFG> MaxReadErrors="32"
.../000:03/CFG> MaxWriteErrors="1"
.../000:03/CFG> LogEachReadError="1"
.../000:03/CFG> ReadDelay="0"
.../000:03/CFG> VfyFixedBadSect="1"
.../000:03/CFG> CleanAfterDOD="1"
.../000:03/CFG> DiskReset="1"
.../000:03/CFG> SectorSkip="1024"
.../000:03/CFG> AutoSaveState="1"
.../000:03/CFG> DumpFoundSectors="0"
.../000:03/CFG> FixFats="1"
.../000:03/CFG> MaxFatScan="51200"
.../000:03/CFG> MaxDataColEntries="256"
.../000:03/CFG> IgnoreF8FF="0"
.../000:03/CFG> DownSizeExt="1"
.../000:03/CFG> ScanSignature="55AA"
.../000:03/CFG> Rebuild="00"
.../000:03/13H> Ext13H installed test requested
.../000:03/13H> Disk found at 128
.../000:03/13H> Ext13H version: EDD-3.0
.../000:03/13H> Ext13H Support: Extended disk access functions
.../000:03/13H> Ext13H Support: Enhanced disk drive functions
.../000:03/13H> Drive Interface Info: ATA
.../000:03/13H> Disk 128 X13H data : 16383/16/63 1953525168/512
.../000:03/13H> Ext13H tested ok
.../000:03/FDL> DiskList requested
.../000:03/FDL> Disk found at 128
### DISKLIST.ARRAY ###
__D_|________LBA_|___H_|__S_|__GB_|__GEO
128 | 1953525168 | 255 | 63 | 931 | BIOS
..0 | .........0 | ..0 | .0 | ..0 | BIOS
..0 | .........0 | ..0 | .0 | ..0 | BIOS
..0 | .........0 | ..0 | .0 | ..0 | BIOS
.../000:03/IAS> AdmiSector init complete for disk 0 (128)
.../000:03/EXE> Read/Write pattern test for disk 0 (128) successful
.../000:03/WAS> AdmiSectors in use : 0+
.../000:03/KEY> DEMO/1
.../000:03/PFC> PQstuff signature not detected on disk 0 (128)
.../000:04/PFC> UDMA driver not loaded
.../000:04/PFC> Disk health 50-100
.../000:05/PFC> Partition State backup not found on disk 0 (128)
.../000:06/PFC> No Repair date found on disk 0 (128)
.../000:23/CSD> Start CheckDisk for disk 0 (128)
.../000:23/CSD> CheckDisk complete, ReadErrors 0
.../000:23/USD> Disk 0 (128) selected
.../000:23/GSC> First DP run, geo info for disk 0 (128) not yet recorded
.../000:23/WAS> AdmiSectors in use : 0+
128/000:23/USD> MBR for disk 0 (128)
128/000:23/LOG> SectorDump requested at 0 (0 0 1)
###
000   33 C0 8E D0 BC 00 7C 8E C0 8E D8 BE 00 7C BF 00  |  3ÀŽÐ¼.|ŽÀŽØ¾.|¿.
016   06 B9 00 02 FC F3 A4 50 68 1C 06 CB FB 60 B9 32  |  .¹..üó¤Ph..Ëû`¹2
032   01 BD 2A 06 D2 4E 00 45 E2 FA 22 2C 5C 83 E0 C5  |  .½*.ÒN.Eâú",\ƒàÅ
048   31 20 40 43 13 02 70 1C 60 1D D1 0C B4 24 AF ED  |  1 @C..p.`.Ñ.´$¯í
064   80 3E 18 DE 08 0F 00 B9 31 FD 59 0E B9 03 00 1D  |  €>.Þ...¹1ýY.¹...
080   FD 00 99 17 44 0A FF C6 47 30 1C 62 FF 74 85 00  |  ý.™.D..ÆG0.b.t….
096   EB 9C 20 17 0E C7 02 7E 4A 0D 46 10 85 60 5D BD  |  ëœ ..Ç.~J.F.…`]½
112   16 57 00 00 00 00 18 D8 60 FA 20 20 C6 03 58 01  |  .W.....Ø`ú  Æ.X.
128   10 70 3E 0C 65 04 F1 C0 36 40 36 10 66 FF 8D EF  |  .p>.e.ñÀ6@6.f.�ï
144   80 33 3E 0C 67 04 99 FF 63 1C 20 CC 8F 03 DA 01  |  €3>.g.™.c. Ì�.Ú.
160   66 02 99 52 06 B3 02 CC 38 F0 AD 10 00 5A 90 D7  |  f.™R.³.Ì8ð­..Z�×
176   F5 40 2A 2C 5C 83 73 62 AB 20 10 7D 67 04 4C 18  |  õ@*,\ƒsb« .}g.L.
192   13 FF C4 B7 88 CF 57 E0 EF 1E D5 F1 8A C7 57 E0  |  ..Ä·ˆÏWàï.ÕñŠÇWà
208   20 20 00 91 89 E3 A2 B5 D5 38 22 5F 5D 83 22 B1  |    .‘‰ã¢µÕ8"_]ƒ"±
224   D5 38 19 FD CE BA 01 25 6D 44 5B FD C3 BA 77 11  |  Õ8.ýκ.%mD[ýúw.
240   E1 EA 20 11 1E 2F 02 D7 D8 40 EA 00 02 87 AD C3  |  áê ../.×Ø@ê..‡­Ã
256   D5 40 3C 6D 06 2F 02 26 FF F7 0F 15 8F AE C1 00  |  Õ@<m./.&.÷..�®Á.
272   8C 4C 1F 15 AD AE C1 11 D8 EA 1C 11 AF AE C1 00  |  ŒL..­®Á.Øê..¯®Á.
288   9E 81 B7 13 CF 45 63 AB 70 81 30 8C 4A BA B6 2C  |  ž�·.ÏEc«p�0ŒJº¶,
304   3C 33 C4 81 E8 9F FF 31 DC DD 40 00 BE C9 02 7E  |  <3Ä�èŸ.1ÜÝ@.¾É.~
320   6A 49 BB 0B C9 3A 83 20 EC 1C 1B 20 29 F4 40 F9  |  jI».É:ƒ ì.. )ô@ù
336   98 4F 2D EA EA E1 1B 8C 27 89 D8 00 73 79 73 74  |  ˜O-êêá.Œ'‰Ø.syst
352   65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61  |  em.Missing opera
368   74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00  |  ting system.....
384   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 2C 44 63 1A 07 1B 07 00 00 80 01  |  .....,Dc......€.
448   01 00 07 FE FF FF 3F 00 00 00 C1 1A 70 74 00 00  |  ...þ..?...Á.pt..
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............Uª
###
128/000:25/VEC> Start Verify EPBR Chain for disk 0 (128)
128/000:25/VEC> Listing current partitions on disk:
128/000:25/VEC>     NTFS (P)          N/A          63  1953503937     (932 Gb)
128/000:25/VEC> Partition Table info for sector 0 (0 0 1)
128/000:25/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 .128 | ..07 | ....0...1...1 | .1023.254..63 | ........63 | 1953503937
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
128/000:25/VEC> 55AA sig Ok
128/000:25/LOG> Boot sector dump requested at 63 (0 1 1)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): 33C08E
............OEM Name (txt): м.|ûP.P
....Bytes per Sector (dec): 4294966303
.Sectors per Cluster (dec): 190
....Reserved Sectors (dec): 31771
..............Unused (hex): 5750061BBF
....Media Descriptor (hex): B9
..............Unused (hex): 01E5
...Sectors per Track (dec): 4294943987
.....Heads per Track (dec): 4294950347
......Hidden Sectors (dec): 78710718
..............Unused (hex): 7C006E38
.............Unknown (hex): 83137509
.......Total Sectors (dec): 4108456133
........MFT Location (dec): 1225836163
.MFT Mirror Location (dec): 3047224948
....Clusters per FRS (dec): 3976432
.Clusters/Indx Block (dec): 129760372
...........Volume ID (hex): 88F2EB10CD0EB400
........Volume Label (txt): N/A
............Checksum (hex): 46E8104E
....Sector Signature (hex): AA55
128/000:25/VEC> BS and BBS not equal, dump follows;
128/000:25/LOG> Boot sector dump requested at 1953503999 (121599 254 63)
### BootSectorDump for BStype NTFS (B)
...........Jump Code (hex): EB5290
............OEM Name (txt): NTFS
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 63
..............Unused (hex): 00000000
.............Unknown (hex): 00800080
.......Total Sectors (dec): 1953503936
........MFT Location (dec): 786432
.MFT Mirror Location (dec): 122093996
....Clusters per FRS (dec): 246
.Clusters/Indx Block (dec): 1
...........Volume ID (hex): C408432A08431AB6
........Volume Label (txt): (no name)
............Checksum (hex): 00000000
....Sector Signature (hex): AA55
128/000:25/VEC> Verify EPBR Chain completed
128/000:26/USD> Select disk completed
128/000:36/SCN> DiskScan requested, ScanType is 3
128/000:36/SCN> from 0 (0 0 1) to 1953525167 (121601 80 63), 1953525168 sectors
128/000:37/SCN> Starting QuickScan (pre-vista) at 63 (0 1 1)
128/000:37/CDC> No DataCollection entries, CleanDatacollection aborted
128/000:37/MPL> No DataCollection entries, MakePartList aborted
128/000:37/SCN> Next QuickScan location at 0 (0 0 1)
128/000:37/SCN> QuickScan finished
128/000:37/SCN> Starting SmartScan (pre-vista) at 0 (0 0 1) (JMP=16065, RNG=63)
128/054:16/SCN> SmartScan finished
128/054:16/SCN> DiskScan completed
128/054:16/SCN> ReadErrors for disk 0 (128): 0
128/054:20/LOG> DataCollection items found: 3 / 0
### DATACOLLECTION.ARRAY, FULL ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL_|_F
001 | 128 | .........0 | ...NTFS | PTE1 | ........63 | 1953503937 | PRI | .
002 | 128 | 1433592404 | ...NTFS | .BBS | ........63 | 1433592342 | PRI | .
003 | 128 | 1953503999 | ...NTFS | .BBS | ........63 | 1953503937 | PRI | .
128/054:20/LOG> DataCollection items found: 3 / 0
### DATACOLLECTION.ARRAY, CLEANED ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL
001 | 128 | .........0 | ...NTFS | PTE1 | ........63 | 1953503937 | PRI
002 | 128 | 1433592404 | ...NTFS | .BBS | ........63 | 1433592342 | PRI
003 | 128 | 1953503999 | ...NTFS | .BBS | ........63 | 1953503937 | PRI
128/054:21/LOG> PartList items created: 2
### PARTLIST.ARRAY ###
SEQ_|____TYPE_|_PTE_|__BS_|_BBS_|F8FF_|___S_|___L_|__PL_|_C_|___R
001 | ...NTFS | ..1 | ... | ..3 | ..0 | ..1 | ..1 | ..1 | 2 | ..B
002 | ...NTFS | ... | ... | ..2 | ..0 | ..2 | ..2 | ..2 | 1 | ..B
### PARTLIST.ARRAY.INTERPRETED ###
SEQ_|____TYPE_|______START_|_____LENGTH_|________END_|__PL_|___R_|___A
001 | ...NTFS | ........63 | 1953503937 | 1953503999 | PRI | ..B | ..X
002 | ...NTFS | ........63 | 1433592342 | 1433592404 | PRI | ..B | ..X
128/054:21/SST> SaveState requested for disk 0 (128)
128/054:26/WAS> AdmiSectors in use : 0+
128/054:26/SST> SaveState completed for disk 0 (128)
128/054:26/EXE> Analysis complete
128/054:33/LOG> RunTime: 054:33
128/054:34/LOG> ### CLOSE LOG ###

[Tom]

Looks like a very straightforward repair. The boot sector (the first sector in the volume) is damaged. If you perform a Partition Table repair this will be automatically fixed. It's not possible to tell if further damage exists in the actual volume; if there is it will show up after the repair, when you access the volume. For that reason it's important to follow the repair steps correctly, as explained in the walkthrough:
http://www.diydatarecovery.nl/dp_manual/guide_ptrepair.htm

[herebeedragons]

Thanks Tom.  I've been slow to get started on the repair, but have finally done so and now have a question.  I had to do a full scan to get a list of partitions, but am unable (I believe) to correctly select all of them.  Instead of checkmarks, I get exclamation marks, which I cannot find an explanation for in your manual.  Is this because the starting position of both partitions is the same, and they overlap?  If so, then can I proceed by having both marked with exclamation marks, or do I need to choose one, then go back and run another scan and choose the other?  I am unsure whether the larger or the smaller partition came first on the disk before the damage occured; is there a chance I will be unable to build it correctly?  I appreciate any advice you can offer.
Thanks, herebeedragons

[Joep]

Hello,

But you only need to select ONE. You had one partition, correct? So select:
001 | ...NTFS | ........63 | 1953503937 | 1953503999 | PRI | ..B | ..X