Author Topic: Avast free scan shows virus- can't Repair or Move to chest  (Read 24059 times)

0 Members and 1 Guest are viewing this topic.

bookend

  • Guest
Avast free scan shows virus- can't Repair or Move to chest
« on: March 24, 2012, 04:47:51 AM »
First post. I already typed a post more than hour ago, which doesn't seem to gop through. I tried again and it said I already posted message, but I don't see it. I also have trouble reading the scrunched up verification words and have to type several times to get right. I ran Avast free scan and it said I have MBR: Alureon-k [rlk] Physical drive0\partition 2. I have 2 drives -one is never used. The scan result said I can "Repair, or move to chest or delete" - Repair says "Repair action postponed till next reboot. "Move to chest says "Error: Request not supported (50). Only other choice is "delete". I don't know if I should delete. How can I get rid of a MBR virus?

SafeSurf

  • Guest
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #1 on: March 24, 2012, 10:51:57 AM »
You might have received a quicker response if you posted in the correct area of the forum under Virsus/Worms section, however we can still help you here.  The best option is to always put things in the Virus Chest where it is safe from other parts of your machine.  If you delete it, it may contain vital files needed for your machine to work.

Check the information on the first post of this thread under Virus/Worms for you to check your machine for malware: http://forum.avast.com/index.php?topic=53253.0

Follow the directions of obtaining an MBAM log (make sure you update MBAM first) and the OTS logs (save them as ANSI), and aswMBR log.  Post the logs as an attachment (Additional Options > Attach > Post). 

I am going to refer you to our Certified Malware expert, named Essexboy.  He will also review your logs and give you further instructions, however he comes on the forum late UK time.  He will respond to you in this thread, so remember to check this thread daily.

Please do not make any further changes to your machine after you have provided the logs.

IMPORTANT: If you are on a home network, disconnect the affected machine from the network.  Do not share a USB/flash drive with this affected machine.  Do not use this machine unless Essexboy instructs you do to malware removal instructions; use a different machine to check email, sync your phone, etc. if possible.

Let us know if you have any questions.  Thank you.

Essexboy has been notified.
« Last Edit: March 25, 2012, 12:07:54 PM by SafeSurf »

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #2 on: March 24, 2012, 01:39:29 PM »
Hi I will also need the aswMBR log

bookend

  • Guest
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #3 on: March 25, 2012, 12:53:46 AM »
To SafeSurf and Essex Boy, thank you both for your replies, but I don't know enough about logs or other things you ask me for. I've had a computer for many years, but only a few viruses and was able to find a removal tool from a virus site to remove the virus. I don't know what an MBAM log is, how to update it, or how to attach it to upload it. To Essex boy - I don't know what an aswMBR log is or where to find it. I am not even familiar yet with navigating this site and didn't know where the worms and virus section was..  Maybe I'll come back when I know more about what these logs are, where to find them and how to send them. Thank you for your replies. 

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37506
  • Not a avast user
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #4 on: March 25, 2012, 01:00:37 AM »
you find it in the link that safe surf posted

here it is again    http://forum.avast.com/index.php?topic=53253.0

bookend

  • Guest
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #5 on: March 26, 2012, 04:49:16 AM »
you find it in the link that safe surf posted

here it is again    http://forum.avast.com/index.php?topic=53253.0

I will read the link above more closely. It's confusing as I don't know anything about the files mentioned in the link. I've had a few viruses but not for a long time and they were easier to get rid of. I saw a thread where Marcifo(sp had/has the same virus/trojan I have and Essex replied to him. I checked  discmgment as Essex suggested to Marcifo and it shows Drive C and D and I (DVDrom) but at top of the lists is "1 MB Basic (healthy) unknown Partition" - its the only partition which has a "delete" choice. It has no drive letter. Maybe its part of C drive.  C and D partitions are on the same hard drive and both have Win XP Pro on them. My other hard drive is not used. I will see if I can figure out the above link. Thanks Pondus.

SafeSurf

  • Guest
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #6 on: March 26, 2012, 10:00:50 AM »
Checking in to see if you have any questions that we can help you with to assist you in getting us those logs so we can get rid of the malware.  It's normal to be overwhelmed and confused, so feel free to ask questions.  Please update us when you can.  Thanks.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #7 on: March 26, 2012, 10:58:34 AM »
Could you post a screen shot of the disc managemnet as I feel the 1MB partition is the malware part

bookend

  • Guest
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #8 on: March 28, 2012, 06:52:42 AM »
Checking in to see if you have any questions that we can help you with to assist you in getting us those logs so we can get rid of the malware.  It's normal to be overwhelmed and confused, so feel free to ask questions.  Please update us when you can.  Thanks.

SafeSurf -Thanks for your post. I am still studying about logs. I did a print screen as a .jpg of my discmanagement page as Essex has asked in his post right after yours.
I don't do print screens or check discmanagement very often so hope I did it right. I now have to figure out how to attach the jpg to my the post Essex sent me.

bookend

  • Guest
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #9 on: March 28, 2012, 07:07:56 AM »
Could you post a screen shot of the disc managemnet as I feel the 1MB partition is the malware part

Hi Essex: I went to disc management in Control panel (long way around but same thing). I printed screen to Paint in .bmp form, then changed it to .jpg. I wondered about that 1 MB part as I don't remember it always being there,but can't remember. Its only the last week or two I got the MBR virus on a virus scan. You will notice my D drive is my boot drive. I meant to use C as the boot drive and put another OS on D drive, but things got mixed u p after formatting, and didn't turn out right. The D drive being boot has worked OK for past year till I get around to fixing the drives to make C the boot drive, but haven't done so yet. BTW, I can't get the part on the right side of C:\ part in disc management to show fully. I use 800X600 but even changing to higher res. it still didn't show up. Now I will see if I can figure out how to attach the jpg to your site.

bookend

  • Guest
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #10 on: March 28, 2012, 07:23:43 AM »
Could you post a screen shot of the disc managemnet as I feel the 1MB partition is the malware part

Essex, I just sent you a post and thought I sent you an attachment of a print screen of disc management. I don't think it went through right as I didn't say something like "attachment uploaded". I pressed alt+s as it says at the bottom but that didn't seem to work. Now I will try clicking on "Attachments and other options" and will browse to my folder and attach the .jpg file and hope you get it this time.
BTW, when I come to the forum and want to find my original post, I keep having to go down the whole list to find my original post to remind myself what was said where there are no Unread posts for example? Thanks. 

bookend

  • Guest
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #11 on: March 28, 2012, 07:31:15 AM »
Could you post a screen shot of the disc managemnet as I feel the 1MB partition is the malware part

Hi again Essex, looks like my .jpg of discmanagement got uploaded last with my last message, but not with the first one. But the attachment I sent doesn't show a small part of the right side of disc management for some reason. A little more showed up on the right side on my .jpg including the vertical line on the right side of the C:\ drive area which starts " 1MB " but the rest is missing on the right side. But maybe it is enough info for your purposes (I hope).

SafeSurf

  • Guest
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #12 on: March 28, 2012, 12:42:02 PM »
Hi bookend,

Thank you for your post.  I think the screenshot should be enough.  We'll wait for Essexboy to respond.  He should be back on the forum late UK time zone.  So wait for further instruction.  Thank you.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #13 on: March 28, 2012, 08:35:11 PM »
OK that is a bad partition

Could you go to disc management again
Right click that partition and select delete

Then

Download OTL  to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Select All Users
  • Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
>C:\commands.txt echo list vol /raw /hide /c
/wait
>C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
/wait
type c:\diskreport.txt /c
/wait
erase c:\commands.txt /hide /c
/wait
erase c:\diskreport.txt /hide /c
CREATERESTOREPOINT

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Post both logs

bookend

  • Guest
Re: Avast free scan shows virus- can't Repair or Move to chest
« Reply #14 on: March 30, 2012, 05:07:14 AM »
    OK that is a bad partition

    Could you go to disc management again
    Right click that partition and select delete

    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
      • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
      • Post both logs

    I only quoted parts of your message which I need to ask about before going further. I followed your instructions and after I finished I ended up with Otl.txt and Extras.txt as icons on my desktop. When opened each log takes up a lot of pages and takes up a lot of space. Do you mean I should upload all pages of OTL.txt log and extras.txt log? or the icons of each log? 
    Also, I was so busy concentrating on your instructions, that I didn't see the top part of your message where you said go to disc management and delete the 1MB partition which you said is a "bad partition", so I deleted the bad partition AFTER I created the OTL and Extras logs. Does that matter? I will wait for you to get back to me. Thanks.