GeekPolice
Welcome to GeekPolice.net!

From "wow" to "whoa" - we're teaching practical technology and helping others with tech support. Join our family here!

You are viewing the forum as a "Guest" which doesn't give you member privileges to ask questions or post comments.

Take 30 seconds to register or log in below and unlock the limitations of this website to discover new computer knowledge!

MBR:\...\PHYSICALDRIVE0

Page 2 of 2 Previous  1, 2

View previous topic View next topic Go down

Re: MBR:\...\PHYSICALDRIVE0

Post by Qaytu on Thu Nov 17, 2011 7:47 pm

Here is information from Virus total.

MD5 : cc48f88fe17bb8e5eb6fa1a8a9477006
SHA1 : e023a8ba2ddcdadb00c8af9f3c4f1057d5443a0a
SHA256: c707a9bdba208ac476466ec25850e976dc123dd65c7151dadc0cfe1b7bf0cd16
ssdeep: 192:g0gwnDIZOCCg88D3vp4mLkwE7hpu+1Ylw0yowJL/8Qpkqs1INTrQx+ebCfu12IZR:b83Cg8
q4Dh/j0YJLu1CUnbCW/6jk
File size : 16184 bytes
First seen: 2011-03-10 18:10:58
Last seen : 2011-11-17 19:29:59
TrID:
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: IObit Information Technology
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
signing date.: 9:52 23/02/2011
verified.....: -

PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x503E
timedatestamp....: 0x4D64C75B (Wed Feb 23 08:37:47 2011)
machinetype......: 0x14c (I386)

[[ 5 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x15C0, 0x1600, 6.13, 1ff00b938e829f47fc76ac9d23d1f2bf
.rdata, 0x3000, 0x1B8, 0x200, 3.71, ae6ff710b3d9146162ba4c2e72874945
.data, 0x4000, 0x310, 0x200, 0.24, 312651a6f76490d97aff95c683a68247
INIT, 0x5000, 0x2E8, 0x400, 4.38, 45e506cc153ba817964d9bf35593b912
.reloc, 0x6000, 0x162, 0x200, 4.20, aeac947ed92a1cf8e2bb678fbe8718ce

[[ 1 import(s) ]]
ntoskrnl.exe: _vsnwprintf, memset, ExFreePoolWithTag, ZwQueryValueKey, RtlInitUnicodeString, ExAllocatePoolWithTag, ZwClose, ZwOpenKey, IofCompleteRequest, IoDeleteDevice, IoDeleteSymbolicLink, MmGetSystemRoutineAddress, wcsstr, ZwEnumerateValueKey, IoCreateFileSpecifyDeviceObjectHint, ZwWaitForSingleObject, ZwFsControlFile, _wcsicmp, memcpy, IoCreateSymbolicLink, IoCreateDevice, IoRegisterBootDriverReinitialization, InitSafeBootMode, KeTickCount, KeBugCheckEx, RtlUnwind

ExifTool:
file metadata
CodeSize: 6656
EntryPoint: 0x503e
FileSize: 16 kB
FileType: Win32 EXE
ImageVersion: 6.1
InitializedDataSize: 2048
LinkerVersion: 9.0
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 6.1
PEType: PE32
Subsystem: Native
SubsystemVersion: 6.0
TimeStamp: 2011:02:23 09:37:47+01:00
UninitializedDataSize: 0


Qaytu
Novice
Novice

Status :
Online
Offline

Posts : 33
Joined : 2011-08-12
Gender : Female
OS : Vista 2nd update
Points : 19832
# Likes : 0

View user profile

Back to top Go down

Re: MBR:\...\PHYSICALDRIVE0

Post by Dr Jay on Fri Nov 18, 2011 1:33 pm

Please download [You must be registered and logged in to see this link.] and save it to your Desktop. Do NOT perform a scan yet

  • Double-click on drweb-cureit.exe to start the program.
    An Express Scan of your PC notice will appear.
  • Under Start the Express Scan Now, Click OK to start the scan.
    This is a short scan that will scan the files currently running in memory.
    If something is found, click the Yes button when it asks you if you want to cure it.
  • Once the short scan has finished, Click Options > Change settings
  • Choose the Scan tab and UNcheck Heuristic analysis
  • Back at the main window, click Custom Scan, then Select drives (a red dot will show which drives have been chosen).
  • Then click the Start/Stop Scanning button (green arrow on the right, and the scan will start.
  • When finished, a message will be displayed at the bottom advising if any viruses were found.
  • Click Yes to all if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can see the icon next to the files found.
    If so, click it, then click the next icon right below and select Move incurable.
    (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
  • Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
  • Save the DrWeb.csv report to your Desktop.
  • Exit Dr.Web Cureit when you have finished.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Administrator
Administrator

Status :
Online
Offline

Posts : 13705
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro
Points : 144815
# Likes : 10

View user profile

Back to top Go down

Page 2 of 2 Previous  1, 2

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum