[anthonybahn]

and the computer does have a recovery partition.

Edited by anthonybahn, 19 June 2011 - 02:59 PM.

[Advertisements]

The reasoning behind this is that Dell originally used Ghost and added the data to the MBR, but from vista onward they used ximage so that a recovery can be made using the windows recovery console with this command imagex /apply d:\dell\image\factory.wim 1 c:\ a much simpler method. Also does this system have the Normandy MBR protection system ?

You can set win 7 to a classic view as opposed to category - I prefer it that way

[Essexboy]

The reasoning behind this is that Dell originally used Ghost and added the data to the MBR, but from vista onward they used ximage so that a recovery can be made using the windows recovery console with this command imagex /apply d:\dell\image\factory.wim 1 c:\ a much simpler method. Also does this system have the Normandy MBR protection system ?

You can set win 7 to a classic view as opposed to category - I prefer it that way

[anthonybahn]

Ok I have no clue about the normandy part of your question.. how do i check that?

[Essexboy]

OK just found out it is part of RKU

Right lets now use the safest tool for replacing the MBR and confirming it is disc 0

Please download MBRCheck.exe to your desktop.

• Double click to run it
• It will prompt you with some text
• A text file will be generated on your desktop
• Now paste that text here for me.

[anthonybahn]

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows 7 Professional
Windows Information: (build 7600), 64-bit
Base Board Manufacturer: Dell Inc.
BIOS Manufacturer: Dell Inc.
System Manufacturer: Dell Inc.
System Product Name: XPS L501X
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 217):
0x03004000 \SystemRoot\system32\ntoskrnl.exe
0x035E0000 \SystemRoot\system32\hal.dll
0x00BC8000 \SystemRoot\system32\kdcom.dll
0x00CE7000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00D2B000 \SystemRoot\system32\PSHED.dll
0x00D3F000 \SystemRoot\system32\CLFS.SYS
0x00C00000 \SystemRoot\system32\CI.dll
0x00ECB000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F6F000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F7E000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x00FD5000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x00FDE000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x00E00000 \SystemRoot\system32\DRIVERS\pci.sys
0x00E33000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x00E40000 \SystemRoot\System32\drivers\partmgr.sys
0x00E55000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00E5E000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00E6A000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x00D9D000 \SystemRoot\System32\drivers\volmgrx.sys
0x00E7F000 \SystemRoot\System32\drivers\mountmgr.sys
0x01007000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x01211000 \SystemRoot\system32\drivers\amdxata.sys
0x0121C000 \SystemRoot\system32\drivers\fltmgr.sys
0x01268000 \SystemRoot\system32\drivers\N360x64\0501000.01D\SYMDS64.SYS
0x012D9000 \SystemRoot\system32\drivers\fileinfo.sys
0x012ED000 \SystemRoot\system32\drivers\N360x64\0501000.01D\SYMEFA64.SYS
0x013D1000 \SystemRoot\System32\Drivers\PxHlpa64.sys
0x01454000 \SystemRoot\System32\Drivers\Ntfs.sys
0x0164F000 \SystemRoot\System32\Drivers\msrpc.sys
0x016AD000 \SystemRoot\System32\Drivers\ksecdd.sys
0x016C7000 \SystemRoot\System32\Drivers\cng.sys
0x0173A000 \SystemRoot\System32\drivers\pcw.sys
0x0174B000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x01898000 \SystemRoot\system32\drivers\ndis.sys
0x0198A000 \SystemRoot\system32\drivers\NETIO.SYS
0x01800000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01A03000 \SystemRoot\System32\drivers\tcpip.sys
0x0182B000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x01875000 \SystemRoot\system32\DRIVERS\vmstorfl.sys
0x01755000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x01885000 \SystemRoot\system32\DRIVERS\stdcfltn.sys
0x0188E000 \SystemRoot\System32\Drivers\spldr.sys
0x017A1000 \SystemRoot\System32\drivers\rdyboost.sys
0x019EA000 \SystemRoot\System32\Drivers\mup.sys
0x017DB000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01600000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x017E4000 \SystemRoot\system32\DRIVERS\disk.sys
0x01400000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x04473000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x0449D000 \SystemRoot\System32\Drivers\Null.SYS
0x044A6000 \SystemRoot\System32\Drivers\Beep.SYS
0x044AD000 \SystemRoot\System32\drivers\vga.sys
0x044BB000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x044E0000 \SystemRoot\System32\drivers\watchdog.sys
0x044F0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x044F9000 \SystemRoot\system32\drivers\rdpencdd.sys
0x04502000 \SystemRoot\system32\drivers\rdprefmp.sys
0x0450B000 \SystemRoot\System32\Drivers\Msfs.SYS
0x04516000 \SystemRoot\System32\Drivers\Npfs.SYS
0x04527000 \SystemRoot\system32\DRIVERS\tdx.sys
0x04545000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x04552000 \SystemRoot\System32\DRIVERS\netbt.sys
0x02E63000 \SystemRoot\system32\drivers\afd.sys
0x02EEC000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x02EF5000 \SystemRoot\system32\DRIVERS\pacer.sys
0x02F1B000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x02F31000 \SystemRoot\system32\DRIVERS\netbios.sys
0x02F40000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x02F5B000 \SystemRoot\system32\DRIVERS\termdd.sys
0x02F6F000 \SystemRoot\system32\drivers\N360x64\0501000.01D\SYMNETS.SYS
0x02E00000 \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
0x02E36000 \SystemRoot\system32\drivers\N360x64\0501000.01D\Ironx64.SYS
0x02FD5000 \SystemRoot\system32\drivers\N360x64\0501000.01D\SRTSPX64.SYS
0x04597000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x02FEB000 \SystemRoot\system32\drivers\nsiproxy.sys
0x045E8000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x046C7000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20110615.001\IDSvia64.sys
0x04744000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
0x047BD000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0x047E3000 \SystemRoot\System32\drivers\discache.sys
0x04600000 \SystemRoot\system32\drivers\csc.sys
0x04683000 \SystemRoot\System32\Drivers\dfsc.sys
0x046A1000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x04A04000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20110415.001\BHDrvx64.sys
0x04B1C000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x05808000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x063F0000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x04C71000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x04D65000 \SystemRoot\System32\drivers\dxgmms1.sys
0x04DAB000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x04DCF000 \SystemRoot\system32\DRIVERS\HECIx64.sys
0x04DE0000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x04C00000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x04E9A000 \SystemRoot\system32\DRIVERS\NETw5s64.sys
0x04E00000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x04E0D000 \SystemRoot\system32\DRIVERS\nusb3xhc.sys
0x04E3D000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x04E3F000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x04B42000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x04C56000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x06609000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x06761000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x06770000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x0677D000 \SystemRoot\system32\DRIVERS\Accelern.sys
0x0678D000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x067A3000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x067AC000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x067B1000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x067C1000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x067D7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04C65000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04B60000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x04B8F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x04BAA000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x04BCB000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x04DF1000 \SystemRoot\system32\DRIVERS\rdpbus.sys
0x067FB000 \SystemRoot\system32\DRIVERS\swenum.sys
0x04200000 \SystemRoot\system32\DRIVERS\ks.sys
0x04BE5000 \SystemRoot\system32\DRIVERS\umbus.sys
0x06ACE000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x06B28000 \SystemRoot\system32\DRIVERS\nusb3hub.sys
0x06B40000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x06B55000 \SystemRoot\system32\drivers\nvhda64v.sys
0x06B78000 \SystemRoot\system32\drivers\portcls.sys
0x06BB5000 \SystemRoot\system32\drivers\drmk.sys
0x06BD7000 \SystemRoot\system32\drivers\ksthunk.sys
0x0881E000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x08A7A000 \SystemRoot\System32\Drivers\crashdmp.sys
0x04243000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x00050000 \SystemRoot\System32\win32k.sys
0x08A88000 \SystemRoot\System32\drivers\Dxapi.sys
0x08A94000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x08AA7000 \SystemRoot\system32\DRIVERS\monitor.sys
0x02826000 \SystemRoot\system32\drivers\btwampfl.sys
0x02AAF000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x02AC7000 \SystemRoot\System32\Drivers\bthport.sys
0x005C0000 \SystemRoot\System32\TSDDD.dll
0x006A0000 \SystemRoot\System32\cdd.dll
0x02B53000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x02B70000 \SystemRoot\System32\Drivers\usbvideo.sys
0x02B9E000 \SystemRoot\system32\DRIVERS\qicflt.sys
0x02BA9000 \SystemRoot\system32\DRIVERS\CtClsFlt.sys
0x02BD4000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x02800000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0x08AB5000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x08AD5000 \SystemRoot\system32\DRIVERS\btwavdt.sys
0x08B52000 \SystemRoot\system32\drivers\btwaudio.sys
0x02810000 \SystemRoot\system32\DRIVERS\btwl2cap.sys
0x0281E000 \SystemRoot\system32\DRIVERS\btwrchid.sys
0x08BD9000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x08BF2000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x06BDD000 \SystemRoot\system32\drivers\luafv.sys
0x06A00000 \SystemRoot\system32\drivers\WudfPf.sys
0x08800000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x06A21000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x06A74000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x06A87000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x08815000 \SystemRoot\system32\DRIVERS\TurboB.sys
0x08CF9000 \SystemRoot\system32\drivers\HTTP.sys
0x08DC1000 \SystemRoot\system32\DRIVERS\bowser.sys
0x08DDF000 \SystemRoot\System32\drivers\mpsdrv.sys
0x08C00000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x08C2D000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x08C7B000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x09208000 \??\C:\Windows\system32\Drivers\rikvm_9EC60124.sys
0x0988E000 \SystemRoot\system32\drivers\peauth.sys
0x09934000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x0993E000 \SystemRoot\System32\Drivers\secdrv.SYS
0x09949000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x09976000 \SystemRoot\System32\drivers\tcpipreg.sys
0x09988000 \SystemRoot\System32\DRIVERS\srv2.sys
0x0C0EE000 \SystemRoot\System32\DRIVERS\srv.sys
0x0C183000 \SystemRoot\System32\Drivers\fastfat.SYS
0x0C000000 \SystemRoot\system32\drivers\N360x64\0501000.01D\SRTSP64.SYS
0x0CE04000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20110619.002\EX64.SYS
0x0C0C0000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20110619.002\ENG64.SYS
0x0C0E0000 \??\C:\Users\Robert\AppData\Local\Temp\aswMBR.sys
0x774A0000 \Windows\System32\ntdll.dll
0x47690000 \Windows\System32\smss.exe
0xFF7C0000 \Windows\System32\apisetschema.dll
0xFF0A0000 \Windows\System32\autochk.exe
0xFF5A0000 \Windows\System32\ole32.dll
0xFF570000 \Windows\System32\imm32.dll
0x773A0000 \Windows\System32\user32.dll
0xFF460000 \Windows\System32\msctf.dll
0xFF3E0000 \Windows\System32\shlwapi.dll
0xFF3C0000 \Windows\System32\imagehlp.dll
0x77280000 \Windows\System32\kernel32.dll
0xFF290000 \Windows\System32\rpcrt4.dll
0xFF1C0000 \Windows\System32\usp10.dll
0xFF150000 \Windows\System32\gdi32.dll
0xFF130000 \Windows\System32\sechost.dll
0xFF0E0000 \Windows\System32\ws2_32.dll
0xFF000000 \Windows\System32\oleaut32.dll
0xFEF80000 \Windows\System32\difxapi.dll
0xFEF70000 \Windows\System32\lpk.dll
0x77070000 \Windows\System32\iertutil.dll
0xFE1E0000 \Windows\System32\shell32.dll
0xFE000000 \Windows\System32\setupapi.dll
0xFDF60000 \Windows\System32\msvcrt.dll
0xFDE80000 \Windows\System32\advapi32.dll
0x77670000 \Windows\System32\psapi.dll
0x76F20000 \Windows\System32\urlmon.dll
0xFDDE0000 \Windows\System32\comdlg32.dll
0xFDD40000 \Windows\System32\clbcatq.dll
0xFDD30000 \Windows\System32\nsi.dll
0x76DC0000 \Windows\System32\wininet.dll
0xFDCE0000 \Windows\System32\Wldap32.dll
0x77660000 \Windows\System32\normaliz.dll
0xFDCA0000 \Windows\System32\cfgmgr32.dll
0xFDC00000 \Windows\System32\comctl32.dll
0xFDB90000 \Windows\System32\KernelBase.dll
0xFDA20000 \Windows\System32\crypt32.dll
0xFD9E0000 \Windows\System32\wintrust.dll
0xFD9C0000 \Windows\System32\devobj.dll
0xFD9B0000 \Windows\System32\msasn1.dll
0x75210000 \Windows\SysWOW64\normaliz.dll

Processes (total 112):
0 System Idle Process
4 System
328 C:\Windows\System32\smss.exe
484 csrss.exe
552 C:\Windows\System32\wininit.exe
572 csrss.exe
620 C:\Windows\System32\services.exe
636 C:\Windows\System32\lsass.exe
644 C:\Windows\System32\lsm.exe
756 C:\Windows\System32\svchost.exe
820 C:\Windows\System32\nvvsvc.exe
860 C:\Windows\System32\svchost.exe
924 C:\Windows\System32\svchost.exe
956 C:\Windows\System32\svchost.exe
996 C:\Program Files (x86)\Sensible Vision\Fast Access\FAService.exe
144 C:\Windows\System32\winlogon.exe
1016 C:\Windows\System32\svchost.exe
1132 C:\Windows\System32\svchost.exe
1196 C:\Windows\System32\nvvsvc.exe
1236 C:\Program Files\Dell\DellDock\DockLogin.exe
1516 C:\Windows\System32\svchost.exe
1652 C:\Windows\System32\wlanext.exe
1672 C:\Windows\System32\conhost.exe
1760 C:\Windows\System32\taskeng.exe
1796 C:\Windows\System32\spoolsv.exe
1852 C:\Windows\System32\svchost.exe
1880 C:\Windows\System32\rundll32.exe
1900 C:\Windows\SysWOW64\rundll32.exe
1996 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
2020 C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
1052 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1812 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
1008 C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe
1100 C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
1228 C:\Windows\System32\svchost.exe
2056 C:\Windows\System32\spool\drivers\x64\3\lxdwserv.exe
2156 C:\Windows\System32\lxdwcoms.exe
2200 C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
2304 C:\Program Files (x86)\Norton 360\Engine\5.1.0.29\ccSvcHst.exe
2392 C:\Windows\System32\taskhost.exe
2468 C:\Windows\System32\dwm.exe
2500 C:\Windows\explorer.exe
2584 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
2660 C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe
2764 C:\Program Files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe
2812 C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
2688 C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
2672 C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
2780 C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
3104 C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
3132 C:\Windows\System32\svchost.exe
3200 C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
3260 C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
3320 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
3400 C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
3448 C:\Program Files (x86)\Norton 360\Engine\5.1.0.29\ccSvcHst.exe
3544 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3576 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
3820 C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
3828 C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
3848 C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
3856 C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
3872 C:\Program Files (x86)\Lexmark 7600 Series\lxdwmon.exe
3916 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
3924 C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
3932 C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
3944 C:\Program Files\Dell\DellDock\DellDock.exe
3156 C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
3360 C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
2740 C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
2796 C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
3380 C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
3364 C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
3392 C:\Program Files (x86)\CyberLink\Shared files\brs.exe
3384 C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe
4264 C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayAlert.exe
4276 C:\Program Files (x86)\iTunes\iTunesHelper.exe
4292 C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe
4304 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
4384 C:\Program Files (x86)\Sensible Vision\Fast Access\Vendor\FastAccessChatAssist.exe
4940 C:\Program Files (x86)\Memeo\Memeo Send\MemeoSend.exe
4220 C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoDashboard.exe
4720 C:\Program Files\Intel\WiFi\bin\EvtEng.exe
5036 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
1372 C:\Program Files (x86)\Memeo\AutoBackup\InstantBackup.exe
6036 unsecapp.exe
6088 WmiPrvSE.exe
6100 WmiPrvSE.exe
5304 C:\Windows\System32\wbem\unsecapp.exe
5492 C:\Windows\System32\SearchIndexer.exe
6240 C:\Program Files\iPod\bin\iPodService.exe
6904 C:\Windows\System32\svchost.exe
6932 C:\Windows\System32\svchost.exe
1172 C:\Windows\SysWOW64\rundll32.exe
2536 C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
3900 C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
5228 C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
4832 C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
5384 C:\Program Files\Windows Media Player\wmpnetwk.exe
6868 C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
4244 C:\Program Files (x86)\Internet Explorer\iexplore.exe
6836 C:\Program Files (x86)\Internet Explorer\iexplore.exe
2432 C:\Users\Robert\Desktop\KD\aswMBR.exe
2084 C:\Windows\System32\svchost.exe
4964 C:\Windows\System32\mmc.exe
1216 C:\Windows\System32\vds.exe
1980 C:\Windows\System32\SearchFilterHost.exe
1708 C:\Windows\System32\SearchProtocolHost.exe
7128 C:\Windows\System32\audiodg.exe
7000 C:\Users\Robert\Desktop\KD\mbr\MBRCheck.exe
4320 C:\Windows\System32\conhost.exe
7032 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`abf38a00 (NTFS)

PhysicalDrive0 Model Number: ST9500420AS, Rev: D005SDM1

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

[Essexboy]

Hmm that states the MBR as OK

I have been researching this beast and it appears to be very difficult to remove

How long has it been on the computer ?

I am just going to review all the logs to ensure that I have missed nothing

[anthonybahn]

I can't confirm how long this problem has been on the computer. This laptop fell on my lap on Friday to fix, and I have been racking my brain trying to resolve this.

I will wait while you search through the logs again.

[Essexboy]

OK the last decent tool in my current armoury - but the most important part of it is the analysis log


Download AVPTool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan
On the first tab select all elements down to and including Computer and then select start scan
Once it has finished select report and post that.



Do not close AVPTool or it will self uninstall, if it does uninstall - then just rerun the setup file on your desktop

Now an analysis scan
Select the Manual Disinfection tab
Press the Gather System Information button
Once done Open the last report saved folder then attach the zip file to your next post zip
The file is located at C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip

[anthonybahn]

running now, seems this will take a while I will post back in about 30 minutes.

[anthonybahn]

40% and it has killed two threats so far....

/crossing fingers

[anthonybahn]

62% scan

I am going to let this run. I have to go to a Fathers Day event, I will follow up with this in probably 3-4 hours from now, and probably will just post the log at the bare minimum tonight.

Thank you for your help so far, hopefully this issue will resolve.

Vr/

Anthony

[Essexboy]

This is one of those where you get it first time or you have to chase it down, I have just completed a scour which went with just a modicum of persuasion. There is another on another website were they are still searching for a resolution

[Essexboy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.