cancel
Showing results for 
Search instead for 
Did you mean: 

Error 92h after Restoring the EEPC MBR

Good afternoon all,

I have a couple of machines that recently surfaced with the dreaded "Endpoint Encryption for PC is not installed". After attempting to restore the EEPC MBR, I am now getting error 92H. I appreciate any thoughts the community may have on the matter.

Thanks!

--KelleyD

5 Replies

Re: Error 92h after Restoring the EEPC MBR

did you grab the MBR before you replaced it? It would tell you if you had a root kit virus or not.

But, if replacing the EEPC MBR results in a 92H, then absolutely, it's not the right MBR for that machine - maybe there's another object in your DB for the machine?

Re: Error 92h after Restoring the EEPC MBR

I did not pull the MBR, but I have another drive in the same situation (we were tentatively thinking rootkit anyway). Are there instructions anywhere on how to do this?

In terms of the object database, we had the correct one, but I'll do some digging in our database to see what I can find.

Thanks!!

Re: Error 92h after Restoring the EEPC MBR

I would decrypt the machine, boot off WinPE, get the users data off then reimage it unless you needed to do forensic analysis on the virus, or were happy to spend time removing it.

Re: Error 92h after Restoring the EEPC MBR

Ideally, we would do that, but the volume of the "EEPC is not installed" is increasing in a particular Business Unit, and they have requested investigation. I'll just hand it over to our forensics team - the queston was mostly for my own curiousity/ learning

Thanks!

Re: Error 92h after Restoring the EEPC MBR

most likely you have caught the TDSS virus and it's slowly moving through your organization