WiredWX Hobby Weather ToolsLog in

 


MBR:\...\PHYSICALDRIVE0

2 posters

descriptionMBR:\...\PHYSICALDRIVE0 - Page 4 EmptyRe: MBR:\...\PHYSICALDRIVE0

more_horiz
Here is information from Virus total.

MD5 : cc48f88fe17bb8e5eb6fa1a8a9477006
SHA1 : e023a8ba2ddcdadb00c8af9f3c4f1057d5443a0a
SHA256: c707a9bdba208ac476466ec25850e976dc123dd65c7151dadc0cfe1b7bf0cd16
ssdeep: 192:g0gwnDIZOCCg88D3vp4mLkwE7hpu+1Ylw0yowJL/8Qpkqs1INTrQx+ebCfu12IZR:b83Cg8
q4Dh/j0YJLu1CUnbCW/6jk
File size : 16184 bytes
First seen: 2011-03-10 18:10:58
Last seen : 2011-11-17 19:29:59
TrID:
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: IObit Information Technology
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
signing date.: 9:52 23/02/2011
verified.....: -

PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x503E
timedatestamp....: 0x4D64C75B (Wed Feb 23 08:37:47 2011)
machinetype......: 0x14c (I386)

[[ 5 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x15C0, 0x1600, 6.13, 1ff00b938e829f47fc76ac9d23d1f2bf
.rdata, 0x3000, 0x1B8, 0x200, 3.71, ae6ff710b3d9146162ba4c2e72874945
.data, 0x4000, 0x310, 0x200, 0.24, 312651a6f76490d97aff95c683a68247
INIT, 0x5000, 0x2E8, 0x400, 4.38, 45e506cc153ba817964d9bf35593b912
.reloc, 0x6000, 0x162, 0x200, 4.20, aeac947ed92a1cf8e2bb678fbe8718ce

[[ 1 import(s) ]]
ntoskrnl.exe: _vsnwprintf, memset, ExFreePoolWithTag, ZwQueryValueKey, RtlInitUnicodeString, ExAllocatePoolWithTag, ZwClose, ZwOpenKey, IofCompleteRequest, IoDeleteDevice, IoDeleteSymbolicLink, MmGetSystemRoutineAddress, wcsstr, ZwEnumerateValueKey, IoCreateFileSpecifyDeviceObjectHint, ZwWaitForSingleObject, ZwFsControlFile, _wcsicmp, memcpy, IoCreateSymbolicLink, IoCreateDevice, IoRegisterBootDriverReinitialization, InitSafeBootMode, KeTickCount, KeBugCheckEx, RtlUnwind

ExifTool:
file metadata
CodeSize: 6656
EntryPoint: 0x503e
FileSize: 16 kB
FileType: Win32 EXE
ImageVersion: 6.1
InitializedDataSize: 2048
LinkerVersion: 9.0
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 6.1
PEType: PE32
Subsystem: Native
SubsystemVersion: 6.0
TimeStamp: 2011:02:23 09:37:47+01:00
UninitializedDataSize: 0

descriptionMBR:\...\PHYSICALDRIVE0 - Page 4 EmptyRe: MBR:\...\PHYSICALDRIVE0

more_horiz
Please download DrWeb-CureIt and save it to your Desktop. Do NOT perform a scan yet

  • Double-click on drweb-cureit.exe to start the program.
    An Express Scan of your PC notice will appear.
  • Under Start the Express Scan Now, Click OK to start the scan.
    This is a short scan that will scan the files currently running in memory.
    If something is found, click the Yes button when it asks you if you want to cure it.
  • Once the short scan has finished, Click Options > Change settings
  • Choose the Scan tab and UNcheck Heuristic analysis
  • Back at the main window, click Custom Scan, then Select drives (a red dot will show which drives have been chosen).
  • Then click the Start/Stop Scanning button (green arrow on the right, and the scan will start.
  • When finished, a message will be displayed at the bottom advising if any viruses were found.
  • Click Yes to all if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can see the icon next to the files found.
    If so, click it, then click the next icon right below and select Move incurable.
    (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
  • Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
  • Save the DrWeb.csv report to your Desktop.
  • Exit Dr.Web Cureit when you have finished.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum