[emeraldnzl]

Okay, sorry for the delay; I have just been doing a bit of research to make sure that the Asus one included the options a normal installation disk has. I don't want you to find that you have carried out a factory reinstall by mistake.

Anyway I think you are fine with that one.

Just follow the instructions as set out. If you are unsure about anything come back.

[Advertisements]

I've got to logoff, it's well past my bedtime. I'll check back on in the mornng. Thanks again for all the help.

[heathermb769]

I've got to logoff, it's well past my bedtime. I'll check back on in the mornng. Thanks again for all the help.

[emeraldnzl]

Okie dokie. Catch you tomorrow. Sleep well.

[heathermb769]

Unfortunately, the ASUS recovery disk appears to be only for a factory restore.

With the recovery disk in the drive, a restart brings me directly the "Windows is loading files...." page, with the status bar making progress. From there, I m given advanced boot options, but here is not an option to rerpair the system.

I have the following choices:

Safe Mode
Safe Mode with Networking
Safe Mode with Command Prompt

Enable Boot Logging
Enable low-resolution video
Last Known Good Configuration
Directory Services Restre Mode
Debugging Mode
Disable automatic restart ons ystem failure
Disable Driver Signature Enforcement

Start Windows Normally


Which option should I choose?

[emeraldnzl]

Unfortunately, the ASUS recovery disk appears to be only for a factory restore.

Okay, lets leave Farbars Recovery Scan.

I have the following choices:

Use this one:

Last Known Good Configuration

Tell me how you get on.

[heathermb769]

tried as you suggested, still no internet access

[heathermb769]

i have to go out for a few hours. be back shortly.

[emeraldnzl]

tried as you suggested, still no internet access

Start up your computer normally.

Go to Control Panel > System Security and under Action Center click on Restore your computer to an earlier time

• Click the Open System Restore button
• and on the lower left check the box Show more restore points
• choose a date and time before you ran Combofix and click on it
• click the button Next
• follow the prompts to restore your computer to the earlier date and time.

If you don't get Internet access after reboot try and earlier time.

Come back and tell me how you got on.

[heathermb769]

:-)))) I have internet again!

[emeraldnzl]

Hooray!!!

Now

See if you can run aswMBR again. Delete the copy of it you have on your desktop and download a new copy.

Download aswMBR.exe ( 4.5mb ) to your desktop.

Double click the aswMBR.exe to run it.

Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply

[heathermb769]

No luck. It still won't run.

[heathermb769]

I tried running troubleshooter on it, and am advised that it is incompatible.

[emeraldnzl]

Try this one:

Please download MBRCheck.exe to your Desktop. Run the application.

If no infection is found, it will produce a report on the desktop. Post that report in your next reply.

If an infection is found, you will be presented with the following dialog:

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Type N and press Enter. A report will be produced on the desktop. Post that report in your next reply.

[heathermb769]

That was easy :-)

Got the "Enter Y for more option..." Here's the log

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer: ASUSTeK Computer Inc.
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: ASUSTeK Computer Inc.
System Product Name: UL50Ag
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 156):
0x03068000 \SystemRoot\system32\ntoskrnl.exe
0x0301F000 \SystemRoot\system32\hal.dll
0x00BA9000 \SystemRoot\system32\kdcom.dll
0x00C10000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00C5F000 \SystemRoot\system32\PSHED.dll
0x00C73000 \SystemRoot\system32\CLFS.SYS
0x00CD1000 \SystemRoot\system32\CI.dll
0x00EEA000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F8E000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F9D000 \SystemRoot\system32\drivers\ACPI.sys
0x00FF4000 \SystemRoot\system32\drivers\WMILIB.SYS
0x00E00000 \SystemRoot\system32\drivers\msisadrv.sys
0x00E0A000 \SystemRoot\system32\drivers\pci.sys
0x00E3D000 \SystemRoot\system32\drivers\vdrvroot.sys
0x00E4A000 \SystemRoot\System32\drivers\partmgr.sys
0x00E5F000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00E68000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00E74000 \SystemRoot\system32\drivers\volmgr.sys
0x00E89000 \SystemRoot\System32\drivers\volmgrx.sys
0x00D91000 \SystemRoot\system32\drivers\pciide.sys
0x00D98000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x00DA8000 \SystemRoot\System32\drivers\mountmgr.sys
0x01085000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x011A1000 \SystemRoot\system32\drivers\atapi.sys
0x011AA000 \SystemRoot\system32\drivers\ataport.SYS
0x011D4000 \SystemRoot\system32\drivers\msahci.sys
0x011DF000 \SystemRoot\system32\drivers\amdxata.sys
0x01000000 \SystemRoot\system32\drivers\fltmgr.sys
0x0104C000 \SystemRoot\system32\drivers\fileinfo.sys
0x01208000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01470000 \SystemRoot\System32\Drivers\msrpc.sys
0x014CE000 \SystemRoot\System32\Drivers\ksecdd.sys
0x014E9000 \SystemRoot\System32\Drivers\cng.sys
0x0155B000 \SystemRoot\System32\drivers\pcw.sys
0x0156C000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x016B3000 \SystemRoot\system32\drivers\ndis.sys
0x01600000 \SystemRoot\system32\drivers\NETIO.SYS
0x01660000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01825000 \SystemRoot\System32\drivers\tcpip.sys
0x01A28000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x01A72000 \SystemRoot\system32\drivers\volsnap.sys
0x01ABE000 \SystemRoot\System32\Drivers\spldr.sys
0x01AC6000 \SystemRoot\System32\drivers\rdyboost.sys
0x01B00000 \SystemRoot\System32\Drivers\mup.sys
0x01B12000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01B1B000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x01B55000 \SystemRoot\system32\DRIVERS\disk.sys
0x01B6B000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x03C00000 \SystemRoot\system32\drivers\cdrom.sys
0x03C2A000 \SystemRoot\System32\Drivers\Null.SYS
0x03C33000 \SystemRoot\System32\Drivers\Beep.SYS
0x03C3A000 \SystemRoot\System32\drivers\vga.sys
0x03C48000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x03C6D000 \SystemRoot\System32\drivers\watchdog.sys
0x03C7D000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x03C86000 \SystemRoot\system32\drivers\rdpencdd.sys
0x03C8F000 \SystemRoot\system32\drivers\rdprefmp.sys
0x03C98000 \SystemRoot\System32\Drivers\Msfs.SYS
0x03CA3000 \SystemRoot\System32\Drivers\Npfs.SYS
0x01BA9000 \SystemRoot\system32\DRIVERS\tdx.sys
0x03DEE000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x01576000 \SystemRoot\system32\drivers\afd.sys
0x017A6000 \SystemRoot\System32\DRIVERS\netbt.sys
0x03CB4000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x01BCB000 \SystemRoot\system32\DRIVERS\pacer.sys
0x01800000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x01816000 \SystemRoot\system32\DRIVERS\netbios.sys
0x0168A000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x017EB000 \SystemRoot\system32\drivers\termdd.sys
0x01400000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x01BF1000 \SystemRoot\system32\drivers\nsiproxy.sys
0x016A5000 \SystemRoot\system32\drivers\mssmbios.sys
0x01451000 \SystemRoot\System32\drivers\discache.sys
0x013AB000 \SystemRoot\System32\Drivers\dfsc.sys
0x013C9000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x013DA000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x01060000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x04AB2000 \SystemRoot\system32\DRIVERS\igdkmd64.sys
0x054D1000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x04A00000 \SystemRoot\System32\drivers\dxgmms1.sys
0x04A46000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x04A53000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x055C5000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x055D6000 \SystemRoot\system32\drivers\HDAudBus.sys
0x040A7000 \SystemRoot\system32\DRIVERS\NETw1v64.sys
0x0476E000 \SystemRoot\system32\DRIVERS\L1C62x64.sys
0x04781000 \SystemRoot\system32\drivers\i8042prt.sys
0x0479F000 \SystemRoot\system32\DRIVERS\kbfiltr.sys
0x047A7000 \SystemRoot\system32\drivers\kbdclass.sys
0x047B6000 \SystemRoot\system32\DRIVERS\ETD.sys
0x047DE000 \SystemRoot\system32\drivers\mouclass.sys
0x047ED000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x047FA000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x04000000 \SystemRoot\system32\DRIVERS\ATK64AMD.sys
0x04008000 \SystemRoot\system32\drivers\CompositeBus.sys
0x04018000 \SystemRoot\System32\Drivers\RootMdm.sys
0x04020000 \SystemRoot\system32\drivers\modem.sys
0x0402F000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x04045000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04069000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04075000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x00DC2000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x00DDD000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x0580D000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x05827000 \SystemRoot\system32\DRIVERS\wanatw64.sys
0x05833000 \SystemRoot\system32\DRIVERS\RimSerial_AMD64.sys
0x0583B000 \SystemRoot\system32\drivers\swenum.sys
0x0583D000 \SystemRoot\system32\drivers\ks.sys
0x05880000 \SystemRoot\system32\drivers\umbus.sys
0x05892000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x058EC000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x07E09000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x05901000 \SystemRoot\system32\drivers\portcls.sys
0x0593E000 \SystemRoot\system32\drivers\drmk.sys
0x07FE8000 \SystemRoot\system32\drivers\ksthunk.sys
0x05960000 \SystemRoot\system32\drivers\IntcHdmi.sys
0x07FEE000 \SystemRoot\system32\drivers\hidusb.sys
0x05987000 \SystemRoot\system32\drivers\HIDCLASS.SYS
0x07E00000 \SystemRoot\system32\drivers\HIDPARSE.SYS
0x07FFC000 \SystemRoot\system32\drivers\USBD.SYS
0x059A0000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x059AD000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x08422000 \SystemRoot\system32\DRIVERS\snp2uvc.sys
0x085DA000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0x085EB000 \SystemRoot\system32\DRIVERS\sncduvc.SYS
0x08400000 \SystemRoot\System32\Drivers\crashdmp.sys
0x03CBD000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x0840E000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x00010000 \SystemRoot\System32\win32k.sys
0x085F4000 \SystemRoot\System32\drivers\Dxapi.sys
0x059CA000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00440000 \SystemRoot\System32\TSDDD.dll
0x007B0000 \SystemRoot\System32\cdd.dll
0x059D8000 \SystemRoot\system32\drivers\luafv.sys
0x02431000 \SystemRoot\system32\drivers\WudfPf.sys
0x02452000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x02467000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x024BA000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x024CD000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x024E5000 \??\C:\Program Files\ATKGFNEX\ASMMAP64.sys
0x024EC000 \SystemRoot\system32\drivers\HTTP.sys
0x025B5000 \SystemRoot\system32\DRIVERS\bowser.sys
0x025D3000 \SystemRoot\System32\drivers\mpsdrv.sys
0x02400000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x0482E000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x0487C000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x048A0000 \SystemRoot\system32\drivers\peauth.sys
0x04946000 \SystemRoot\System32\Drivers\secdrv.SYS
0x04951000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x04982000 \SystemRoot\System32\drivers\tcpipreg.sys
0x04994000 \SystemRoot\System32\DRIVERS\srv2.sys
0x096E7000 \SystemRoot\System32\DRIVERS\srv.sys
0x097BB000 \SystemRoot\System32\Drivers\fastfat.SYS
0x77320000 \Windows\System32\ntdll.dll
0x47880000 \Windows\System32\smss.exe
0xFF640000 \Windows\System32\apisetschema.dll

Processes (total 91):
0 System Idle Process
4 System
296 C:\Windows\System32\smss.exe
432 csrss.exe
488 C:\Windows\System32\wininit.exe
504 csrss.exe
536 C:\Windows\System32\services.exe
556 C:\Windows\System32\lsass.exe
564 C:\Windows\System32\lsm.exe
676 C:\Windows\System32\svchost.exe
772 C:\Windows\System32\winlogon.exe
800 C:\Windows\System32\svchost.exe
904 C:\Windows\System32\svchost.exe
936 C:\Windows\System32\svchost.exe
976 C:\Windows\System32\svchost.exe
384 C:\Windows\System32\svchost.exe
972 C:\Windows\System32\svchost.exe
1136 C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe
1144 C:\Windows\System32\FBAgent.exe
1172 C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe
1240 C:\Program Files\ATKGFNEX\GFNEXSrv.exe
1344 C:\Windows\System32\spoolsv.exe
1412 C:\Windows\System32\taskhost.exe
1468 C:\Windows\System32\dwm.exe
1508 C:\Windows\explorer.exe
1536 C:\Windows\System32\svchost.exe
1664 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1780 C:\Windows\System32\taskeng.exe
1824 C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
1836 C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
1848 C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
1864 C:\Program Files\P4G\BatteryLife.exe
1876 C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
1888 C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
1928 C:\Windows\SysWOW64\ACEngSvr.exe
1220 C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
1628 C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe
1976 C:\Program Files\Bonjour\mDNSResponder.exe
2008 C:\Windows\System32\svchost.exe
2040 C:\Program Files (x86)\ASUS\Game Park\GameConsole\OberonGameConsoleService.exe
2212 C:\Windows\System32\svchost.exe
2236 C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
2296 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
2708 C:\Windows\System32\SearchIndexer.exe
2848 WmiPrvSE.exe
1996 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
3316 C:\Program Files (x86)\ASUS\Asus WebStorage\BackupService.exe
3328 C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
3684 C:\Program Files\Elantech\ETDCtrl.exe
3692 C:\Windows\System32\igfxtray.exe
3700 C:\Windows\System32\hkcmd.exe
3716 C:\Windows\System32\igfxpers.exe
3736 C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
3760 C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
3840 C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
3900 C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.5.0.20090908-0900\soffice.exe
4044 C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
4052 C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
4060 C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
4068 C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
4076 C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
4084 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
2812 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
2968 C:\Program Files (x86)\iTunes\iTunesHelper.exe
3076 C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
1672 C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
3444 C:\Program Files\iPod\bin\iPodService.exe
4128 C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe
4368 C:\Program Files (x86)\ASUS\Asus WebStorage\EeeStorageUploader.exe
4676 C:\Windows\splwow64.exe
4836 C:\Program Files (x86)\Common Files\aol\1278338091\ee\aolsoftware.exe
3308 C:\Program Files (x86)\Internet Explorer\iexplore.exe
3872 C:\Program Files\Windows Media Player\wmpnetwk.exe
5068 C:\Windows\System32\svchost.exe
4764 C:\Windows\System32\taskeng.exe
1004 C:\Windows\System32\rundll32.exe
5036 C:\Windows\System32\VSSVC.exe
4472 C:\Windows\System32\svchost.exe
2960 C:\Windows\AsScrPro.exe
2948 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
2080 C:\Program Files (x86)\AOL 9.5\waol.exe
5052 C:\Program Files (x86)\AOL 9.5\shellmon.exe
3212 C:\Program Files (x86)\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe
3988 C:\Windows\System32\SearchProtocolHost.exe
3572 C:\Windows\System32\SearchFilterHost.exe
604 C:\Windows\System32\dllhost.exe
3408 C:\Windows\System32\audiodg.exe
2284 dllhost.exe
2548 dllhost.exe
4944 C:\Users\Heather Laptop\Desktop\MBRCheck.exe
1556 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`a9700000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000016`4af00000 (NTFS)

PhysicalDrive0 Model Number: ST9320325AS, Rev: 0002SDM1

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 654ED52FE6A88C0FA62CE3A0F7B4080D93A35F7A


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

[emeraldnzl]

Well that is saying the same as RogueKiller in that your machines MBR is infected. I am not entirely sure about it though and we don't want to mess with the MBR if it is not infected.

SOooo please do this:

Run MBRCheck.exe again

1. Wait until program writes this line "Enter 'Y' and hit ENTER for more options, or 'N' to exit:"
2. Please enter y key and press Enter
3. When program ask you "Enter your choice:" enter 1 and press Enter key
4. Now the program will ask you "Enter the physical disk number to dump (0-99, -1 to cancel):"
5. Enter 0 and press Enter key
6. Now the program will ask you where to dump MBR. Enter

      C:\mbrdump.dmp

and press Enter

After that

Please go to Virus Total

Copy/paste this file and path into the white box at the top:

C:\mbrdump.dmp

Press Submit - this will submit the file for testing.

Please wait for all the scanners to finish then copy and paste the results in your next response.