MBR Check log - found problem

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by MNMP2, Oct 25, 2011.

  1. MNMP2

    MNMP2 Private E-2

    Working on mother in law's laptop. She had the system restore virus which I managed to get rid of, and then a redirect virus that I am having trouble with. TDSSKiller will not run no matter what I try. Ran Goored Fix and that seems to have gotten rid of it (I think). I ran MBR Check and it found some errors. Attaching log to see if you can help or give me next steps.
     

    Attached Files:

  2. MNMP2

    MNMP2 Private E-2

    The redirect problem is not fixed. It keeps coming back. Seems every time I run a scan, it finds somthing - even after I fix it. I am running both MBAM and SAS.
     
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Do you have your XP install disc? If not, you can create one here:
    This is a download of an .iso file of just the Recovery Console for XP.
    Burn to CD with Nero or other 'disc image' capable tool and boot.

    XP Recovery Console.

    You can use ImageBurn to create the disc.

    Boot to the disc ( you will first have to go into the bios and change the boot order to CD/DVD as first boot device ) and in the Recovery Console type:
    fixmbr

    Reboot to normal mode and re-run MBRCheck and attach the log.
     
  4. MNMP2

    MNMP2 Private E-2

    I followed these instructions but it won't boot to the disc. BIOS settings are for the optical drive to be used first. I used image burner to make the disc. Not sure what to do now.

    Oops - I got it now (missed the screen that said press any button to boot from CD)
     
    Last edited: Oct 25, 2011
  5. MNMP2

    MNMP2 Private E-2

    It is giving me a warning that it has a non-standard or invalid master boot record, and that FIXMBR may damage the partition tables. Should I continue?
     
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, just continue.
     
  7. MNMP2

    MNMP2 Private E-2

    OK - everything ran - here is new log.
     

    Attached Files:

  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good. That fixed it. What other malware issues are you having, if any?
     
  9. MNMP2

    MNMP2 Private E-2

    The redirect problem I am not sure if that is gone or not. I cannot run TDSSkiller no matter what I try. Rename, run as admin, in reg mode, safe mode, etc., nothing works to run that.
     
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The redirects should have stopped. Let me know if they haven't.
     
  11. MNMP2

    MNMP2 Private E-2

    Everything looks good now. Thanks very much for the help.
     
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0


    Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

    MajorGeeks on FaceBook
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds