No Threats found - system keeps crashing and corrupting MBR

mark4323 · Nov 13, 2008

Hi,

I've run all of the scans and no threats are found. However, quite regularly my computer will just reboot. When it reboots it gets to the Boot from CD and hangs. I boot from disk and repair using FIXMBR. It says that the Mater Boot Record is corrupt and rewrites it. Then the computer will reboot correctly, until the next time.

I have AVG 8.0 and run updates and scans regularly. I run a batch scan in the wee hours of the morning and the last few days it always reboots during the scan.

Does this sound familiar?

regards,

Mark

mark4323 · Nov 13, 2008

Here's the fourth log file

TimW · Nov 13, 2008

Please run the F-Secure Online Scanner

Note: This Scanner is for Internet Explorer Only!

Follow the Instruction Here for installation.

Accept the License Agreement.

Once the ActiveX installs,Click Full System Scan

Once the download completes,the scan will begin automatically.

The scan will take some time to finish,so please be patient.

When the scan completes, click the Automatic cleaning (recommended) button.

Click the Show Report button and Copy&Paste the entire report in your next reply.

mark4323 · Nov 15, 2008

Here is the scan result:

Scanning Report
Saturday, November 15, 2008 15:00:33 - 16:42:08

Computer name: MARK
Scanning type: Scan system for malware, rootkits
Target: C:\ H:\
Result: 2 malware found
TrackingCookie.2o7 (spyware)
System
TrackingCookie.Advertising (spyware)
System
Statistics
Scanned:
Files: 37204
System: 3150
Not scanned: 10
Actions:
Disinfected: 0
Renamed: 0
Deleted: 0
None: 2
Submitted: 0
Files not scanned:
C:\HIBERFIL.SYS
C:\PAGEFILE.SYS
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\SAM
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
C:\DOCUMENTS AND SETTINGS\MARKA\MY DOCUMENTS\OUTLOOK\OUTLOOK.PST
C:\DOCUMENTS AND SETTINGS\MARKA\MY DOCUMENTS\OUTLOOK\OUTLOOK.PST
C:\DOCUMENTS AND SETTINGS\ALL USERS\DOCUMENTS\RECORDED TV\TEMPREC\TEMPSBE\MSDVRMM_1881044272_786432_28651
Options
Scanning engines:
F-Secure USS: 2.40.0
F-Secure Blacklight: 2.4.1093
F-Secure Hydra: 2.8.8110, 2008-11-14
F-Secure Pegasus: 1.20.0, 2008-10-10
F-Secure AVP: 7.0.171, 2008-11-14
Scanning options:
Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
Use Advanced heuristics

TimW · Nov 15, 2008

It appears as though it did not remove the two infections. Let's see if BitDefender will...Now go to Bitscan link: agree to the license and then select Scan. DO NOT CHANGE THE OPTIONS TO SHOW ALL FILES SCANNED. That will make your logs huge and we don't need to see clean files. Once Bitdefender completes the scan:

Click-on the Detected Problems tab. Then select Click here to export the scan report

When the window comes up to save the report, change the Save as type: box to Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click save. This will save a file named bdscan.txt in whatever folder you are currently in when you save the file (take notice of where you are at so you can find it later). This bdcan.txt file will actually contain HTML code that we can easily view later while reviewing your log. All we have to do is rename the file to bdscan.html.

mark4323 · Nov 16, 2008

Hi,

I've run the bitdefender scan check. It found no threats. Unfortunately, it didn't save the report.

TimW · Nov 16, 2008

I suggest that you post in the software section as this does not seem to be a malware issues.

We can clean up from the scans:

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

Log in or Sign up

No Threats found - system keeps crashing and corrupting MBR

mark4323 Private E-2

Attached Files:

combofix.txt

mbam-log-2008-11-13 (22-44-45).txt

SUPERAntiSpyware Scan Log - 11-13-2008 - 22-33-51.log

mark4323 Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

mark4323 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

mark4323 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member