[Essexboy]

OK next question in the slow but sure - what is the make of this computer i.e. Dell or HP ?

[Advertisements]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

[Essexboy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

[Essexboy]

User returned

[Apelila]

It's a Dell.

P.S. Thanks for reopening the post. Got a brand new plastic knuckle in my hand so I'm one-handed for a while but I am here.

[Essexboy]

OK the problem here is that you have a Dell system which contains the system reset within the MBR, but the MBR is infected and we need to change it

Download DSR.zip
Unzip DSRFIX.ZIP file.
Inside you will locate an ISO file.
Burn a CD with that ISO file.
You will get a bootable FreeDOS CD with DSRFIX tool on it.
Put that CD into the PC which MBR you want to analyze and fix.
Reboot the PC and make sure it boots from the CD.
Once system boots, you will get a DOS command prompt.
Type DSRFIX then press Enter key.
It should analyze your MBR and give you status.

If it reports that it is OK then we will need to revisit OTL to see if I missed something

If it reports bad then use dsrfix /f

[Apelila]

Once I figured out how to make the CD I booted from it and got a screen full of stuff that ended with

PANIC: mcb chain corrupted
System halted

[Essexboy]

OK keep the dsr disc as you will probably need that if you want to do a factory reset - at the moment that option is no longer available to you



Run MBRCheck.exe once again.

You will be presented with the following dialog:

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Enter Y and press Enter.

The following dialog will be presented:

Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice:

Enter 2 and press Enter

The following dialog will be presented:

Enter the physical disk number to fix (0-99, -1 to cancel):

Enter >>0<< and press Enter

The following dialog will be presented:

Available MBR codes:
[ 0] Default (Windows XP)
[ 1] Windows XP
[ 2] Windows Server 2003
[ 3] Windows Vista
[ 4] Windows 2008
[ 5] Windows 7
[-1] Cancel

Please select the MBR code to write to this drive:

Enter >>1<< and press Enter

The following dialog will be presented:

Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue:

Type YES and press Enter (Must type the full word, YES). You will be inform if successfully wrote a new MBR code!

And last the following dialog will be presented:

Done! Press ENTER to exit...

Press Enter. A report will be produced on the desktop. Post that report in your next reply.

[Apelila]

Just to clarify, none of this will erase any personal items on the computer right?

[Essexboy]

That is correct it will just replace the MBR with a good copy

[Apelila]

Ok here's the report:

 MBRCheck_08.27.11_18.41.47.txt   11.2KB   127 downloads

[Essexboy]

OK let us now do a final run with Combofix (allow it to update if it asks)

Once completed then recheck for redirects

[Apelila]

Ok now from yahoo search things go ok but google still gives me the page stating:

Sorry, we can't find "geeks to go". Please check the spelling of the web address.

But the web address that show is no longer the domainadvisor one.

 ComboFix.txt   13.37KB   99 downloads

EDIT: the address showing is ~ http://www.google.co...e=hp&channel=np and if I search a few times it starts working right...

Edited by Apelila, 28 August 2011 - 04:41 PM.

[Essexboy]

Does this occur in Firefox, IE or both ?

[Apelila]

Both...

EDIT: It now shows the original web address too.

Edited by Apelila, 31 August 2011 - 01:31 PM.

[Essexboy]

So are you still getting redirects or is it just slooow