BleepingComputer.com: Redirect Virus cannot move it

Hi All,
I have a redirect virus on IE9 and google chrome and i have tried 9 different scanners none of which worked ?
i have been trying to spek with cryptodan he has sent me a few emails trying to help but the progress is extremely slow
as when i am home from work and in front of the machine trying to fix , (between 7pm and 12am GMT) he does not reply
so i only get to run 1 thing then when i attach the text report to the forum there is no reply , Is there someone who can help me this evening
after 7pm where i can actually make some progress as i cannot get rid of this virus and i need to use the machine

Thanks Matt

Welcome aboard

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=============================================================================

Please download MiniToolBox and run it.

Checkmark following boxes:

• Report IE Proxy Settings
  
• List content of Hosts
  
• List IP configuration
  
• List last 10 Event Viewer log
  
• List Users, Partitions and Memory size

Click Go and post the result.

=============================================================================

Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

=============================================================================

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

hi broni , Thanks !
Are you free to assist me , i will start doing the 1st action now .

regards matt

Hi Broni , Security check runs and does everything but post the log file ? the black screen just says preparing done , but no text file appears

any ideas

regards matt

hi broni , security check has completed now it just took a whie , please see log below

Results of screen317's Security Check version 0.99.7
Windows 7 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
McAfee Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
Malwarebytes' Anti-Malware
Java™ 6 Update 26
Out of date Java installed!
Adobe Flash Player 10.0.12.36
Adobe Reader 9.1
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe
Ad-Aware AAWTray.exe
``````````End of Log````````````



regards matt

MiniToolBox by Farbar
Ran by Will (administrator) on 06-07-2011 at 20:23:18
Windows 7 Home Premium (X64)

***************************************************************************


========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

========================= End of IE Proxy Settings ========================
=============== Hosts content: ============================================

# Copyright © 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

=============== End of Hosts ==============================================

================= IP Configuration: =======================================

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . : Will-VAIO
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter
Physical Address. . . . . . . . . : 2A-81-58-F1-C0-73
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : 00-19-0E-05-E2-A8
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Marvell Yukon 88E8057 PCI-E Gigabit Ethernet Controller
Physical Address. . . . . . . . . : 00-24-BE-B5-36-2E
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Atheros AR928X Wireless Network Adapter
Physical Address. . . . . . . . . : 2C-81-58-F1-C0-73
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::8c0:ec0a:9c56:5fb1%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.3(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 06 July 2011 19:59:43
Lease Expires . . . . . . . . . . : 07 July 2011 19:59:46
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . : 184558635
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-15-A1-94-A5-00-24-BE-B5-36-2E
DNS Servers . . . . . . . . . . . : 192.168.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{E71868B7-EED6-40BE-9356-C83791F0C615}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fd:3c08:135b:a1b7:321f(Preferred)
Link-local IPv6 Address . . . . . : fe80::3c08:135b:a1b7:321f%15(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled
Server: UnKnown
Address: 192.168.0.1

Name: google.com
Addresses: 209.85.146.104
209.85.146.105
209.85.146.106
209.85.146.147
209.85.146.99
209.85.146.103


Pinging google.com [209.85.146.106] with 32 bytes of data:
Reply from 209.85.146.106: bytes=32 time=44ms TTL=49
Reply from 209.85.146.106: bytes=32 time=43ms TTL=49

Ping statistics for 209.85.146.106:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 43ms, Maximum = 44ms, Average = 43ms
Server: UnKnown
Address: 192.168.0.1

Name: yahoo.com
Addresses: 72.30.2.43
98.137.149.56
209.191.122.70
67.195.160.76
69.147.125.65


Pinging yahoo.com [98.137.149.56] with 32 bytes of data:
Reply from 98.137.149.56: bytes=32 time=207ms TTL=47
Reply from 98.137.149.56: bytes=32 time=210ms TTL=47

Ping statistics for 98.137.149.56:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 207ms, Maximum = 210ms, Average = 208ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
16...2a 81 58 f1 c0 73 ......Microsoft Virtual WiFi Miniport Adapter
14...00 19 0e 05 e2 a8 ......Bluetooth Device (Personal Area Network)
12...00 24 be b5 36 2e ......Marvell Yukon 88E8057 PCI-E Gigabit Ethernet Controller
11...2c 81 58 f1 c0 73 ......Atheros AR928X Wireless Network Adapter
1...........................Software Loopback Interface 1
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
15...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.3 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.0.0 255.255.255.0 On-link 192.168.0.3 281
192.168.0.3 255.255.255.255 On-link 192.168.0.3 281
192.168.0.255 255.255.255.255 On-link 192.168.0.3 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.0.3 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.0.3 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
15 58 ::/0 On-link
1 306 ::1/128 On-link
15 58 2001::/32 On-link
15 306 2001:0:5ef5:79fd:3c08:135b:a1b7:321f/128
On-link
11 281 fe80::/64 On-link
15 306 fe80::/64 On-link
11 281 fe80::8c0:ec0a:9c56:5fb1/128
On-link
15 306 fe80::3c08:135b:a1b7:321f/128
On-link
1 306 ff00::/8 On-link
15 306 ff00::/8 On-link
11 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

================= End of IP Configuration =================================

========================= Event log errors: ===============================

Application errors:
==================
Error: (07/06/2011 08:00:29 PM) (Source: VzCdbSvc) (User: )
Description: Failed to load the plug-in module. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})(Error code = 0x80042019)

Error: (07/06/2011 07:16:21 PM) (Source: VzCdbSvc) (User: )
Description: Failed to load the plug-in module. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})(Error code = 0x80042019)

Error: (07/06/2011 08:14:57 AM) (Source: VzCdbSvc) (User: )
Description: Failed to load the plug-in module. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})(Error code = 0x80042019)

Error: (07/05/2011 09:38:22 PM) (Source: VzCdbSvc) (User: )
Description: Failed to load the plug-in module. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})(Error code = 0x80042019)

Error: (07/05/2011 03:28:59 AM) (Source: VzCdbSvc) (User: )
Description: Failed to load the plug-in module. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})(Error code = 0x80042019)

Error: (07/05/2011 00:07:57 AM) (Source: VzCdbSvc) (User: )
Description: Failed to load the plug-in module. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})(Error code = 0x80042019)

Error: (07/04/2011 10:54:18 PM) (Source: Application Error) (User: )
Description: Faulting application name: Explorer.EXE, version: 6.1.7600.16768, time stamp: 0x4d688122
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000001da30f8
Faulting process id: 0x640
Faulting application start time: 0xExplorer.EXE0
Faulting application path: Explorer.EXE1
Faulting module path: Explorer.EXE2
Report Id: Explorer.EXE3

Error: (07/04/2011 09:39:03 PM) (Source: VzCdbSvc) (User: )
Description: Failed to load the plug-in module. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})(Error code = 0x80042019)

Error: (07/04/2011 07:19:09 PM) (Source: VzCdbSvc) (User: )
Description: Failed to load the plug-in module. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})(Error code = 0x80042019)

Error: (07/04/2011 07:14:51 PM) (Source: VzCdbSvc) (User: )
Description: Failed to load the plug-in module. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})(Error code = 0x80042019)


System errors:
=============
Error: (07/06/2011 07:59:40 PM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Roxio Upnp Server 10 service to connect.

Error: (07/06/2011 07:15:17 PM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Roxio Upnp Server 10 service to connect.

Error: (07/06/2011 08:14:48 AM) (Source: Service Control Manager) (User: )
Description: The SBSD Security Center Service service failed to start due to the following error:
%%1053

Error: (07/06/2011 08:14:48 AM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the SBSD Security Center Service service to connect.

Error: (07/06/2011 08:13:55 AM) (Source: Service Control Manager) (User: )
Description: The VAIO Power Management service failed to start due to the following error:
%%1053

Error: (07/06/2011 08:13:55 AM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the VAIO Power Management service to connect.

Error: (07/06/2011 08:13:21 AM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Roxio Upnp Server 10 service to connect.

Error: (07/06/2011 08:13:10 AM) (Source: EventLog) (User: )
Description: The previous system shutdown at 05:36:53 on ?06/?07/?2011 was unexpected.

Error: (07/05/2011 09:40:21 PM) (Source: Service Control Manager) (User: )
Description: The MBAMService service depends on the MBAMProtector service which failed to start because of the following error:
%%2

Error: (07/05/2011 09:40:21 PM) (Source: Service Control Manager) (User: )
Description: The MBAMProtector service failed to start due to the following error:
%%2


Microsoft Office Sessions:
=========================

========================= End of Event log errors =========================

========================= Memory info: ====================================

Percentage of memory in use: 39%
Total physical RAM: 2939.02 MB
Available physical RAM: 1774.3 MB
Total Pagefile: 5876.18 MB
Available Pagefile: 4184.5 MB
Total Virtual: 4095.88 MB
Available Virtual: 3985.11 MB

======================= Partitions: =======================================

1 Drive c: () (Fixed) (Total:288.56 GB) (Free:256.58 GB) NTFS
4 Drive f: (SP_4_80B_ML) (CDROM) (Total:0.1 GB) (Free:0 GB) CDFS

================= Users: ==================================================

User accounts for \\WILL-VAIO

-------------------------------------------------------------------------------
Administrator Guest Will
The command completed successfully.

================= End of Users ============================================

MBAM Report

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-07-04 20:37:27
Windows 6.1.7600
Running: syqmdpxi.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00190e05e2a8
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00190e05e2a8@000761ed2a62 0x53 0x13 0x9D 0x45 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0024337512d1
Reg HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@Last Counter 6378
Reg HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@Last Help 6379
Reg HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@First Counter 6200
Reg HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@First Help 6201
Reg HKLM\SYSTEM\CurrentControlSet\services\WmiApRpl\Performance@Object List 6200 6206 6218 6228 6238 6258 6302 6312 6350 6356 6372
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00190e05e2a8 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0024337512d1 (not active ControlSet)
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\Will\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VAIO Premium Partners\McAfee\xae Internet Security Suite - Sony VAIO Edition.lnk 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Premium Partners\McAfee\xae Internet Security Suite - Sony VAIO Edition.lnk 1

---- Files - GMER 1.0.15 ----

File C:\Windows\winsxs\Catalogs\3dd5a727f2a1142223c6d9a7bff73ae7676aac714a4da8192f66123045b11c41.cat 0 bytes
File C:\Windows\winsxs\Catalogs\61ca110ca24a110fddbff725af2e7205e12fc7eca9facecec8d87d595e01acbb.cat 0 bytes
File C:\Windows\winsxs\Catalogs\d4106aa2a6eb6fb48440cd9728d01cd829d94a69da0a493ec2a4364f835f8695.cat 0 bytes

---- EOF - GMER 1.0.15 ----

sorry ignore above ....mbam report below :

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 7034

Windows 6.1.7600
Internet Explorer 9.0.8112.16421

06/07/2011 20:33:35
mbam-log-2011-07-06 (20-33-35).txt

Scan type: Quick scan
Objects scanned: 165462
Time elapsed: 5 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER still just running will post result in a minute

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-07-06 20:54:05
Windows 6.1.7600
Running: syqmdpxi.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00190e05e2a8
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0024337512d1
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00190e05e2a8 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0024337512d1 (not active ControlSet)
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\Will\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VAIO Premium Partners\McAfee\xae Internet Security Suite - Sony VAIO Edition.lnk 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Premium Partners\McAfee\xae Internet Security Suite - Sony VAIO Edition.lnk 1

---- Files - GMER 1.0.15 ----

File C:\Users\Will\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO6E4RIH\afr[2].htm 767 bytes
File C:\Users\Will\AppData\Local\Temp\~DF6195319D64DA2C50.TMP 16384 bytes
File C:\Users\Will\AppData\Local\Temp\~DF7C57188D3CFDE9B1.TMP 16384 bytes

---- EOF - GMER 1.0.15 ----

Any help would be much appreciated on the above browser redirect problem , i have ran all the required tasks and uploaded the reports as requested .
can anyone help please

regards matt

No reason to push by posting in "Please post in this topic if you have not received help after three days".
I replied yesterday and since then I had to sleep and go to work.


Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
Click the "Scan" button to start scan:


On completion of the scan click "Save log", save it to your desktop and post in your next reply:


NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

Hi Broni , Sorry for posting in other topic . When aswMBR has finished scan , should i click fix or just save the log ???

thanks Matt

Just save a log and post it.

hi Broni , please see log below :

aswMBR version 0.9.7.705 Copyright© 2011 AVAST Software
Run date: 2011-07-08 18:37:33
-----------------------------
18:37:33.037 OS Version: Windows x64 6.1.7600
18:37:33.037 Number of processors: 2 586 0x170A
18:37:33.037 ComputerName: WILL-VAIO UserName: Will
18:37:34.036 Initialize success
18:39:46.401 AVAST engine defs: 11070800
18:41:20.298 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
18:41:20.298 Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 3
18:41:20.298 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000073
18:41:20.313 Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
18:41:20.313 Disk 2 \Device\Harddisk2\DR2 -> \Device\00000074
18:41:20.329 Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
18:41:20.344 Disk 0 MBR read successfully
18:41:20.344 Disk 0 MBR scan
18:41:20.344 Disk 0 Windows 7 default MBR code found via API
18:41:20.360 Disk 0 unknown MBR code
18:41:20.360 Disk 0 MBR hidden
18:41:20.376 Service scanning
18:41:21.717 Disk 0 trace - called modules:
18:41:21.764 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa8003da0254]<<
18:41:21.764 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8003d86790]
18:41:21.780 3 CLASSPNP.SYS[fffff8800101543f] -> nt!IofCallDriver -> [0xfffffa8002df7290]
18:41:21.795 5 ACPI.sys[fffff88000f72781] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8002dfd050]
18:41:21.795 \Driver\iaStor[0xfffffa8002d8ce70] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xfffffa8003da0254
18:41:22.716 AVAST engine scan C:\Windows
19:07:11.986 File: C:\Windows\System32\drivers\en-US\bfe.dll.mui **SUSPICIOUS**
19:07:12.672 File: C:\Windows\System32\drivers\en-US\ndiscap.sys.mui **SUSPICIOUS**
19:07:13.109 File: C:\Windows\System32\drivers\en-US\pacer.sys.mui **SUSPICIOUS**
19:07:13.296 File: C:\Windows\System32\drivers\en-US\qwavedrv.sys.mui **SUSPICIOUS**
19:07:13.624 File: C:\Windows\System32\drivers\en-US\scfilter.sys.mui **SUSPICIOUS**
19:07:13.920 File: C:\Windows\System32\drivers\en-US\tcpip.sys.mui **SUSPICIOUS**
19:07:27.664 File: C:\Windows\System32\drivers\wimmount.sys **SUSPICIOUS**
19:38:03.678 AVAST engine scan C:\Users\Will
19:40:04.796 AVAST engine scan C:\ProgramData
19:42:35.976 Scan finished successfully
19:46:15.379 Disk 0 MBR has been saved successfully to "H:\Software\ASWMBR\MBR.dat"
19:46:15.426 The log file has been saved successfully to "H:\Software\ASWMBR\aswMBR log.txt"