Malware Discussions

[rod-puckey]

Attached.

Rod

[malwarekiller]

OK...please remove the SD memory stick before the below process.

Please download MBRCheck to your desktop.

http://majorgeeks.com/MBRCheck_d7076.html

• Be sure to disable your security programs
• Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
• A window similar to this should open on your desktop:
  
  
  
  
  
• If you are prompted with options, enter N at the prompt and press Enter
• Press Enter again
• A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your deskop. Please post the contents of that file.

[rod-puckey]

Spoiler

FYI, there was no SD memory stick in the last report.

The report from MRB

check is attached.

Rod

[malwarekiller]

Run MBRCheck.exe.
http://majorgeeks.com/MBRCheck_d7076.html

You will be presented with the following dialog:

Quote
Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options:

Enter Y and press Enter.

The following dialog will be presented:
Quote
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice:

Enter 2 and press Enter

The following dialog will be presented:

Quote
Enter the physical disk number to fix (0-99, -1 to cancel):

Enter >>0<< and press Enter

The following dialog will be presented:

Available MBR codes:
[ 0] Default (Windows XP)
[ 1] Windows XP
[ 2] Windows Server 2003
[ 3] Windows Vista
[ 4] Windows 2008
[ 5] Windows 7
[-1] Cancel

Please select the MBR code to write to this drive:

Enter >>3<< and press Enter

The following dialog will be presented:

Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue:

Type YES and press Enter (Must type the full word, YES). You will be inform if successfully wrote a new MBR code!

And last the following dialog will be presented:


Done! Press ENTER to exit...

Press Enter. A report will be produced on the desktop. Post that report in your next reply.

[rod-puckey]

The report is attached.

[malwarekiller]

Rerun MBRCheck and attach a fresh log.

[rod-puckey]

Rerun report attached.

Rod

[malwarekiller]

1. If You Have 32 bit (x86) Vista Installed

A) Click on the Download button below to download therecdisc_x86.zip file.B) Go to step 3.

2. If You Have 64 bit (x64) Vista Installed

A) Click on the Download button below to download therecdisc_x64.zip file.

3. Save the ZIP file to your desktop.

4. Right click on the ZIP file (on desktop) and click on Open.

5. Click on Allow for UAC prompt.

6. Extract (drag and drop) the recdisc.exe file to the desktop.
NOTE: You can delete the ZIP file (on desktop) when done if you like afterwards.

7. Right click on the extracted recdisc.exe file, click on Properties, General tab, the Unblock button, and on OK. 
NOTE: If you do not have a Unblock button under the General tab, then the shortcut is already unblocked and you can continue on to step 8.

8. In Windows Explorer, navigate to C:\Windows\System32\recdisc.exe. (See screenshot below)

9. Take ownership and Allow your user account Full Control (permissions) of therecdisc.exe file at this location (step 7).

10. Right click on the extracted recdisc.exe file on the desktop, from step 6, and click on Copy.

11. Go back to the C:\Windows\System32\recdisc.exe window and right click on a empty area and click on Paste. (See screenshot below step 13)

12. Click on Copy and Replace and Continue. 

13. Right click on recdisc.exe and click on Send To and Desktop (create shortcut).

14. Move the shortcut to where you like for easy use.

STEP TWO

---

Creating a Recovery Disc

15. Double click on the recdisc.exe shortcut from aboce to run the program.

16. Select your DVD drive and click on create disc. (See screenshot below.

17. Insert your retail Vista installation DVD into the CD/DVD drive and click onContinue. (See screenshot below)

18. You will now see this. (See screenshot below)

19. After a little bit, it will ask you to replace the Vista installation DVD with a blank CD or DVD.

A) Insert a blank CD or DVD into your CD/DVD drive and click on OK. (See screenshot below)

20. When it is finished click on Close for both windows. (See screenshots below)

21. 

Reboot the computer and start from the CD



When you reboot you will  see this although yours will say windows 7/vista. Click repair my computer 
 
 
Select your operating system 
 
 
Select Command prompt 
 
 
At the command prompt type the following  
 
Bootrec.exe /FixMbr  [notice space between e and /]
  

• Once finished type Exit

[rod-puckey]

I have tried the automatic and the manual method of taking control on the recdisc.exe file.  No success.

Rod.

[malwarekiller]

OK...do u have your windows vista installation CD?

If you have a Windows installation disc:

1. Insert the installation disc.

2. Restart your computer.

   Click the Start button , click the arrow next to the Lock button , and then click Restart.

3. If prompted, press any key to start Windows from the installation disc.

   Note

   If your computer is not configured to start from a CD or DVD, check the information that came with your computer. You may need to change your computer's BIOS settings. For more information, seeBIOS: frequently asked questions.

4. Choose your language settings, and then click Next.

5. Click Repair your computer.

6.Select the operating system you want to repair, and then click Next.

7.Select the command prompt.

8.Type in this command:

Bootrec.exe /FixMbr  [notice space between e and /]

9.Accept any warnings And allow the process to complete.

10.Type exit and hit enter and remove the disc from the computer.