[Render]

Im still not sure how long you would expect the scan to take.

I don't know. Normally it takes 10 - 15 minutes.

I would recommend you to abort this scan. Then release at least 5GB of free space on system partition by moving documents and multimedia (pictures, videos etc) files to external disk. Also I would suggest to uninstall unneeded applications.
Then proceed with aswMBR scan as instructed previously.

[Advertisements]

I read what you have said,

I was trying to avoid having to create so much space....

IF it should only take less than 20 mins...then I will 1st try again.

JUST AFTER I sent my last reply, my computer crashed....

Luckily its restored back..

upon doing so, I found numerous pages restored back....so it seems I must have still had about 6 pages open..

I will try again and see what happens.

I am hoping that if I can fix the virus found somehow..that it will at least make it run better while I
do any other scans etc.

Hope it scans in less than 20 mins this time..

[dowsp]

I read what you have said,

I was trying to avoid having to create so much space....

IF it should only take less than 20 mins...then I will 1st try again.

JUST AFTER I sent my last reply, my computer crashed....

Luckily its restored back..

upon doing so, I found numerous pages restored back....so it seems I must have still had about 6 pages open..

I will try again and see what happens.

I am hoping that if I can fix the virus found somehow..that it will at least make it run better while I
do any other scans etc.

Hope it scans in less than 20 mins this time..

[dowsp]

Upon re doing the scan,

I found that there is an option to just select a particular file...

so in the past when Ive had problems like this, I have used other AV software that had a similar option..
and it does allow one to scan certain directories or folders/files only where viruses often seem to occur,
System 32 in windows is a typical one..

Otherwise as I see it, the scan will take many hours to scan the whole "C" drive, as you pointed out it is almost full..

IF I can find some viruses in the main folders where I have usually found them in the past.This should
enable the process to get quicker results..

I can later do whatever full scans are required.

As a suggestion, Im wondering If I can just scan certain folders and post the logs for them initially, just to see if I can get rid of the virus if that is something that you will allow me to consider.

Thank you

[dowsp]

Here is a scan log file for the folder that had the virus that I found earlier..
Windows system 32...

upon completing this I am only left with an option to FIX MBR....NOT just FIX !....

so I am not sure what I need to do to fix the problem or get rid of the virus from that scan.

MBR.dat to follow.

---------------------------------------------

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-07-12 00:52:28
-----------------------------
00:52:28.586 OS Version: Windows 5.1.2600 Service Pack 2
00:52:28.586 Number of processors: 1 586 0xD08
00:52:28.586 ComputerName: DGR76K1J UserName:
00:52:36.358 Initialize success
00:55:26.042 AVAST engine defs: 12071000
00:57:10.492 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
00:57:10.492 Disk 0 Vendor: HTS548040M9AT00 MG2OA5EA Size: 38154MB BusType: 3
00:57:10.512 Disk 0 MBR read successfully
00:57:10.512 Disk 0 MBR scan
00:57:11.443 Disk 0 unknown MBR code
00:57:11.473 Disk 0 Partition 1 00 DE Dell Utility Dell 4.1 78 MB offset 63
00:57:12.144 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 35252 MB offset 160650
00:57:12.414 Disk 0 Partition 3 00 DB CP/M / CTOS MSWIN4.1 2816 MB offset 72356760
00:57:12.685 Disk 0 scanning sectors +78124095
00:57:13.967 Disk 0 scanning C:\WINDOWS\system32\drivers
00:58:56.644 Service scanning
01:01:22.124 Modules scanning
01:01:53.929 Disk 0 trace - called modules:
01:01:54.110 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys
01:01:54.110 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8338e478]
01:01:54.110 3 CLASSPNP.SYS[f88f805b] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8338ed98]
01:01:58.326 AVAST engine scan C:\WINDOWS\SYSTEM32
01:34:08.922 File: C:\WINDOWS\SYSTEM32\ssblinkx.scr **INFECTED** Win32:Dropper-gen [Drp]
01:37:31.663 Scan finished successfully
01:59:51.840 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\P\Desktop\Kap\MBR.dat"
01:59:51.930 The log file has been saved successfully to "C:\Documents and Settings\P\Desktop\Kap\aswMBR.txt"

[dowsp]

Upon looking at the MBR.dat file, there seems very little information on it.

Although I realize that this is only for a small folder that contained the last log file that I sent.



General
Complete name : C:\Documents and Settings\P\Desktop\Kap\MBR.dat
File size : 512 Bytes

[Render]

Please attach MBR.dat file here in your next reply.

How to add an attachment to a new topic or reply

[dowsp]

I am not sure if you were ok with me posting the log file just for the windows system 32 folder that contained the virus and if you think its worth me deleting that before I do the next scans...

Please note if I do a full scan...I suspect highly that it will take several hours.

I did post the MBR.dat file above JUST for the windows system 32 file..

unfortunately there was very little in it... see what it showed below..


General
Complete name : C:\Documents and Settings\P\Desktop\Kap\MBR.dat
File size : 512 Bytes

As I say should I try and delete that virus first...I think it will help my computer run quicker..

[Render]

Hi,

You can delete this file if you wish.
Open Windows explorer and navigate to C:\WINDOWS\SYSTEM32\ folder, find and delete file ssblinkx.scr.

But I still need above mentioned file MBR.dat. Not its content but file.

Please read here how to attach a file.

[dowsp]

Hi Render,

thanks for your reply,

Can I send you the MBR.dat file via PM... as it has some details wrote on it
Id rather not post on a public forum, unless there is somewhere on the forum to post
personal stuff.

I will try and delete that virus file.

[Render]

MBR.dat is a backup of your computer Master Boot Record, created by aswMBR. It does not and can not contain your personal data.

[dowsp]

It has my real name on the description of it which id rather not post !

[Render]

You can send me that file on this e-mail address: [email protected]

[dowsp]

Just to confirm that I have sent you the MBA.dat file to your email and deleted the virus.

[Render]

Hi,

MBR is clean. That's good.

Please follow the steps below:

Step 1

Download TFC to your desktop

• Open the file and close any other windows.
• It will close all programs itself when run, make sure to let it run uninterrupted.
• Click the Start button to begin the process. The program should not take long to finish its job
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Step 2

OTL Custom Scan

• Double click on the icon to run it.
• Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top, make sure Stadard output is selected.
• Select Scan all users
• Check the boxes beside LOP Check and Purity Check.
• Under the Custom Scans/Fixes box copy and paste this in:
  
  

  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  consrv.dll
  /md5stop
  %systemroot%\*. /mp /s
  hklm\software\clients\startmenuinternet|command /rs
  hklm\software\clients\startmenuinternet|command /64 /rs
  CREATERESTOREPOINT

• Click the button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open OTL.Txt in Notepad window.
• Please copy (Edit->Select All, Edit->Copy) the content of this file and post it with your next reply.

[dowsp]

Hi Render,

Did you want me to run the FULL Scan of aswMBR first ? before I follow your next steps.

IF so this may take me several hours ! which I will try and do before tomorrow.