Hello there I have been having this alert for the past 2 weeks, I reformatted my C drive and it is still there. It seems that it is on my other drive E, I think, but it doesn’t say anywhere where its located exactly though.
Disk 0 Masterboot Record MBR:whistler-C [rtk]
What should do?
thank you.
ok attached
does not show as whistler there…maybe a new version ?
follow the guide here and attach the logs, then essexboy will have a look tomorrow
http://forum.avast.com/index.php?topic=53253.0
he is usually in here around 08:00pm - 11:59pm UK time…
Hi ok here is a screen shot , I will attach those other logs after I finish with the malwarebytes log
Ok here are the other logs
08:43:08.063 Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-4 08:43:08.065 Disk 0 Vendor: WDC_WD1001FALS-00K1B0 05.00K05 Size: 953869MB BusType: 3 08:43:08.072 Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP5T0L0-5 08:43:08.075 Disk 1 Vendor: Patriot_Pyro 319ABBF0 Size: 57241MB BusType: 3 08:43:10.082 Disk 1 MBR read successfully 08:43:10.086 Disk 1 MBR scan 08:43:10.090 Disk 1 Windows 7 default MBR codeThis is where the problem resides .. Disc 0 is not configured as a boot drive but it has an MBR and that is what is being detected. It in itself is not a problem but to clear the alert you will need to reformat that disc (I believe that will be the E drive ) Or I can place an inert MBR on there for you
Hi sorry I don’t quite understand , is the MBR:whistler-C [rtk] a problem? This drive is my storage drive so if I reformat it , it would clear all my data.
What should I do?
Thank you for your help I really appreciate it.
If you wish I can replace that MBR with a replacement
Please download MBRCheck.exe to your Desktop. Run the application.
If no infection is found, it will produce a report on the desktop. Post that report in your next reply.
If an infection is found, you will be presented with the following dialog:
[QUOTE]Enter ‘Y’ and hit ENTER for more options, or ‘N’ to exit:
[/quote]
Type N and press Enter. A report will be produced on the desktop. Post that report in your next reply.
Hi ok here it is attached , I don’t know much about these viruses so I will go with what you say maybe a replacement is best?
Lets put a windows 7 MBR there
Run MBRCheck.exe once again.
You will be presented with the following dialog:
[QUOTE]Found non-standard or infected MBR.
Enter ‘Y’ and hit ENTER for more options, or ‘N’ to exit:
[/quote]
Enter Y and press Enter.
The following dialog will be presented:
[QUOTE]Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.
Enter your choice:
[/quote]
Enter 2 and press Enter
The following dialog will be presented:
[QUOTE]Enter the physical disk number to fix (0-99, -1 to cancel):
[/quote]
Enter >>0<< and press Enter
The following dialog will be presented:
Enter >>5<< and press Enter
The following dialog will be presented:
[QUOTE]Do you want to fix the MBR code? Type ‘YES’ and hit ENTER to continue:
[/quote]
Type YES and press Enter (Must type the full word, YES). You will be inform if successfully wrote a new MBR code!
And last the following dialog will be presented:
[QUOTE]Done! Press ENTER to exit…
[/quote]
Press Enter. A report will be produced on the desktop. Post that report in your next reply.
ok did it attached
Could you confirm the alerts have now ceased
ok let me do a scan
it still says its there, here is screen shot
Intriguing could you run a quick mbrcheck scan and post the log - so that I can see what it says
hi its not saveing the log to the desk top when I run mbrcheck.exe
ok got it
Hmm it is not allowing anything to clear it - probably because it is not bootable
The alternatives are
As it stands it can do no harm to your computer though
Oh ok , so I shouldn’t worry about any passwords being stolen or anything like that?
If I wanted to reformat the drive I would have to transfer my files to another drive, where is this virus so I don’t transfer it to another drive? Is it in a particular folder?
Thank you