[CoNtRoLlEr57706]

hello!

here is the log

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-06-01 14:15:42
-----------------------------
14:15:42.578 OS Version: Windows 5.1.2600
14:15:42.578 Number of processors: 1 586 0x1C02
14:15:42.578 ComputerName: REATOGO UserName: SYSTEM
14:15:42.750 Initialze error 0
14:15:46.640 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
14:15:46.656 Disk 0 Vendor: TOSHIBA_ FG01 Size: 152627MB BusType: 3
14:15:46.671 Disk 0 MBR read successfully
14:15:46.687 Disk 0 MBR scan
14:15:46.703 Disk 0 TDL4@MBR code has been found
14:15:46.718 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 143008 MB offset 63
14:15:46.734 Disk 0 Partition 2 00 0C FAT32 LBA MSDOS5.0 9617 MB offset 292881015
14:15:46.750 Disk 0 MBR [TDL4] **ROOTKIT**
14:15:46.765 Disk 0 scanning X:\i386\system32\drivers
14:15:46.781 Service scanning
14:15:47.312 Modules scanning
14:15:48.062 Disk 0 trace - called modules:
14:15:48.093 ntoskrnl.exe CLASSPNP.SYS disk.sys iastor78.SY_ halaacpi.dll
14:15:48.109 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x872c6ab8]
14:15:49.140 3 CLASSPNP.SYS[f75d605b] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x87336030]
14:15:49.187 Scan finished successfully
14:16:03.968 Disk 0 MBR has been saved successfully to "E:\MBR.dat"
14:16:04.046 The log file has been saved successfully to "E:\aswMBR.txt"

attached is the zip
thanks!

[Advertisements]

oops didn't hit attach

Attached Files

•  MBR.zip   529bytes   228 downloads

[CoNtRoLlEr57706]

oops didn't hit attach

Attached Files

•  MBR.zip   529bytes   228 downloads

[CompCav]

Thank you that has yielded the likely culprit and we can now fix it!

• Enter the boot CD and run aswMBR.exe
• Click Scan
• On completion of the scan, click the FIXMBR button
• There is a slight pause after clicking the 'Fix' button.
• Wait for the tool to report 'Infection fixed successfully', now reboot the machine.
• Rebooting the machine prematurely, before seeing this line will result in an incomplete fix.

Note:After the 'Infection fixed successfully' message appears, the machine may became unresponsive. You may have to do a hard boot of your machine. That may be a side effect from the fix. All will be well after the reboot.

• Save the log as before and post in your next reply.

Restart the computer and tell me how it went.

[CoNtRoLlEr57706]

Hello!
when i did the FIXMBR it gave me a warning that the system needed to re-start so i clicked yes.

and

instead of infection fixed it said the boot record was fixed is this the same?

[CompCav]

Yes so try to boot up normally and please note in your next reply details of the startup and the log following the fix!

[CoNtRoLlEr57706]

here is what it says
Disk 0 mbr restored successfully
verifying

then

the machine must be restarted to finish the cleanup.
please close all applications and click [yes] to continue.

i click yes

after clicking yes the computer restarts back to ReaTogo
gonna shut down ReaTogo and attempt to boot normal

[CoNtRoLlEr57706]

when i plug the flash drive in the working computer this is no log

attempting to boot normal

power button
Toshiba page with F2 and F12 option

black screen white cursor

[CoNtRoLlEr57706]

there is no log*

[CompCav]

We need to check to see that the fix worked:

• Enter the boot CD and run aswMBR.exe (as you ran it before like FRST and ListParts)
• Click the Scan button to start the scan
• On completion of the scan, click the save log button, save it to your flash drive and post it in your next reply.
• There will also be another new file on your flash drive named mbr.dat
• Please zip mbr.dat to mbr.zip and attach it to your next post also.

[CoNtRoLlEr57706]

Should be able to do it tomorrow! Thanks!

[CompCav]

No problem, thanks for the update.

[CoNtRoLlEr57706]

Here it is thank you again for your patience

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-06-07 14:01:38
-----------------------------
14:01:38.609 OS Version: Windows 5.1.2600
14:01:38.609 Number of processors: 1 586 0x1C02
14:01:38.625 ComputerName: REATOGO UserName: SYSTEM
14:01:40.343 Initialze error 0
14:01:49.203 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
14:01:49.218 Disk 0 Vendor: TOSHIBA_ FG01 Size: 152627MB BusType: 3
14:01:49.234 Disk 0 MBR read successfully
14:01:49.250 Disk 0 MBR scan
14:01:49.265 Disk 0 TDL4@MBR code has been found
14:01:49.281 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 143008 MB offset 63
14:01:49.656 Disk 0 Partition 2 00 0C FAT32 LBA MSDOS5.0 9617 MB offset 292881015
14:01:49.671 Disk 0 MBR [TDL4] **ROOTKIT**
14:01:49.718 Disk 0 scanning X:\i386\system32\drivers
14:01:49.734 Service scanning
14:01:50.359 Modules scanning
14:01:51.109 Disk 0 trace - called modules:
14:01:51.140 ntoskrnl.exe CLASSPNP.SYS disk.sys iastor78.SY_ halaacpi.dll
14:01:51.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86944030]
14:01:52.187 3 CLASSPNP.SYS[f75d605b] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x872cf030]
14:01:52.234 Scan finished successfully
14:02:29.828 Disk 0 MBR has been saved successfully to "E:\MBR.dat"
14:02:29.906 The log file has been saved successfully to "E:\aswMBR.txt"

Attached Files

•  MBR.zip   529bytes   229 downloads

[CompCav]

• Enter the boot CD and run aswMBR.exe
• Click Scan
• On completion of the scan, click the FIX button
• There is a slight pause after clicking the 'Fix' button.
• Wait for the tool to report 'Infection fixed successfully', now reboot the machine.
• Rebooting the machine prematurely, before seeing this line will result in an incomplete fix.

Note:After the 'Infection fixed successfully' message appears, the machine may became unresponsive. You may have to do a hard boot of your machine. That may be a side effect from the fix. All will be well after the reboot.

• Save the log as before and post in your next reply.

Remove the CD and restart the computer in Normal mode and tell me how it went.

[CoNtRoLlEr57706]

i does not give me the option to run the Fix only the FixMBR

[CompCav]

• Enter the boot CD again and on the desktop you will see an icon for MBRFix
• Double click the MBRFix icon
• In the box that opens, type the following and press enter:

MBRFix /drive 0 fixmbr /yes (Make sure you leave a single space between the x and / as well as between the e and 0, 0 and f, and r and /)

• Accept any warnings
• Shut down and remove the CD
• Reboot to normal windows and let me know how the computer is behaving