Author Topic: Win32:Kelihos-S[Trj] & faked MBR code  (Read 7166 times)

0 Members and 1 Guest are viewing this topic.

MistyLake

  • Guest
Re: Win32:Kelihos-S[Trj] & faked MBR code
« Reply #15 on: September 19, 2011, 01:03:10 AM »
Because I didn't want to reconnect my router to download the latest Avast! virus definitions database, I ran MBRCheck first and found my "MBR Code Faked!" again (ugh!)

Attached, you'll find the MBRCheck (3) and aswMBR (4b) logs.  I am not able to attach the MBR.dat log (4a).

ML

MistyLake

  • Guest
Re: Win32:Kelihos-S[Trj] & faked MBR code
« Reply #16 on: September 19, 2011, 01:22:38 AM »
And just in case you need it, here's the MBRCheck report (5a) I just generated using the "quick MBR fix" that resulted in my without-your-advice reboot, which wiped out my OS the first time :-[  The .bak file (5b) cannot be attached.

ML

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Win32:Kelihos-S[Trj] & faked MBR code
« Reply #17 on: September 19, 2011, 08:35:50 PM »
OK this is becoming a tad weird as aswMBR is reporting a good MBR now

Lets get a different perspective on it

Download and Install Combofix

Download ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop *

 IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks




  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.[/b]
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now