MBR:Cidox-E [rtk] - Avast can not remove

The log I attached may not be the most recent, in fact it may have been create during a scan in safe mode. But that is the same version I have been running. It crashes at atapi.sys every time.

Hmm this is weird as none of the other tools are even hinting at cidox

So lets run a scan with windows and the MBR inactive

Create an emergency repair USB drive:
Download Dr Web Live USB to your desktop

[]Connect a USB flash drive to the computer. Registering the plugging in event takes no more than 10 seconds.
[
]Launch drwebliveusb.exe.
[*]The program will detect available USB-devices automatically and prompt you to choose the one you?d like to use as an emergency repair drive. You can format the device if you like (a warning will be displayed before you proceed with formatting). In order to read the License agreement, follow a corresponding link found in the program window (the page containing the license agreement text will be loaded in your default browser).

https://dl.dropbox.com/u/73555776/liveusb_ru.jpg

[]To create a bootable USB flash drive, press the Create Dr.Web LiveUSB button.
[
]Files will be copied automatically.
[]Once the copying process is completed, press the Exit button to close the application.
[
]Reboot the infected computer with the USB in the drive
[]Ensure that the first boot device is USB - If you are not sure about that then see this page for instructions
[
]As loading starts, a dialogue window will prompt you to choose between the standard and safe modes.

https://dl.dropboxusercontent.com/u/73555776/Live%20boot%20screen.png

[*]Use arrow keys to select DrWeb-LiveCD (Default)

https://dl.dropboxusercontent.com/u/73555776/drwebselect.JPG

[*]Press select objects for scanning

https://dl.dropboxusercontent.com/u/73555776/drwebfolders.JPG

[*]When the system is loaded, check the disks or folders you want to scan, and click on Start.

[*]The programme will now scan for and cure/delete any malware that it finds. Allow it to do so

https://dl.dropboxusercontent.com/u/73555776/drwebscan.JPG

[*]When it has completed

https://dl.dropboxusercontent.com/u/73555776/drwebscancomplete.JPG

[]Select Open Report and copy to the USB
[
]Once completed reboot to normal windows, and attach the report here

I ran the scanner a few times and it found around 50 or so items to fix and fixed them. I never did see the option to “open report” but I found the name of the log file in the help section and did a search for it. It’s too big so I split it up into 3 parts. There are 2 - 4 items that it repeatedly finds in between scans and booting into windows. Something about UserInit if I remember correctly.

Part 2 of 3

Part 3 of 3

Is Avast still alerting ?

Yes, Avast is still alerting

Could you do the following :

Go to > Control panel > administrative tools > computer management > storage > disc management
Then take a screen shot and post it here

Screenshot

Have you tried the Delete now option ?

It looks as though it may be alerting on the 10Gb EISA partition which is a restore partition

Yes, I have. It requests to schedule a boot scan and restart the computer, but it is not found during the boot scan and removed.

As it stands none of my tools have found it so I believe it is a false alarm on your recovery partition

If there was even a trace then TDSSKiller or DrWeb would have seen it.

Tick the do not alert again box

OK, will do. Thanks so much for the help! Happy holidays!!! :smiley:

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Remove Combofix

Click Start then Run.
On Windows7 or Vista you may use Start Search field if Run is not available.
In the box copy/paste the following command:

ComboFix /Uninstall

Note that there is a space between " ComboFix " and " /Uninstall " .

Then click OK (or press Enter ).
Wait for the uninstall process to complete.

Remove tools

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme :wink:

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave: