I have set NOD to scan every file I download. It completes the scan and every time I get these messages: Error occurred while scanning MBR sector of the 3. physical disk - Error reading sector Error occurred while scanning MBR sector of the 4. physical disk - Error reading sector Chkdsk reports no problems - ran with it /f switch. I am not sure if the errors are trying to reference pphysical disks number 3 and 4. I have no number 4 and number 3 is a USB card reader. Any help appreciated.
Hi Rafman, the MBR error messages you are seeing, relate to: 1. you perform a system scan under the account of a limited user 2. you have a special boot manager or suchlike program that alters boot sectors installed 3. you use a card reader while no card is actually inserted The (file locked) [4] errors are related to “Swap Files” files that are in use (locked) by Windows and as such cannot be infected… Hope this helps… Cheers
If I insert a card into my card reader, the first MBR message goes away. The second is still there, even if I log in as administrator. I use no boot manager program. Am I understanding correctly that the second message is there due to my swap file being locked?
I would agree with your assessment in that your 2nd second message is due to your swap file being locked? Saphire
If you right-click My Computer and select Properties. On the Hardware page of the System properties box, click the Device Manager button. Expand the "Disk drives" to see what drives are present. Does that show an additional physical disk?
Device manager correctly shows both physical hard disks. It also shows two devices for my card reader - and they each get assigned a drive letter - even though there is only one device present. I just installed a trial version of NOD on another machine - and it doesn't show any MBR messages at all. So it doesn't seem like this has anything to do with my swap file. Maybe the card reader?
It isn't anything to worry about. Windows can show some devices like the card readers as hard disk drives due to the drivers. NOD32 then attempts to access those drives and displays the errors you noted. Because Windows is showing two drives for your card reader NOD32 is displaying those two errors you posted.
This is common for certain notebooks with a hibernation partition. At any rate, there's no need to worry about - today's viruses do not infect MBR so it's very unlikely it'd be a new boot virus.
I have the same issue, I also have full admin and also have three card readers appearing as removable drives though I disconnect the card readers, I still have the issue doesn't matter what drive(s) I scan 1 or all, the error still appears in the log(s)! If I understand the answer correctly, not to worry about it? -wayne
Thanks Blackspear, one last Q.. Since I am new to NOD32, please bear with me, I done "All Files" scan on two hard drives, are these 'ERRORS' normal? Small Sample listed below (in all, about five hundred of these errors under the same scan) FYI, before I show the error list; before un-installin Tm PC-cillin IS 2005, I done a complete system scan and came up clean! After installing and scanning with NOD32, NOD found this; "Firebird_profile\Cache\484DDDCAd01 - Win32/TrojanDownloader.VB.DF trojan - quarantined - unable to clean - deleted" good job Ok, the short list (is this normal? NOTE, were it states 'password protected' though its not) =========================== ate: 7.12.2004 time: 18:32:37 Scanned disks, directories and files: C:; F: C:\pagefile.sys - error opening (file locked) [4] C:\Documents and Settings\LocalService\NTUSER.DAT - error opening (file locked) [4] C:\Documents and Settings\LocalService\ntuser.dat.LOG - error opening (file locked) [4] C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (file locked) [4] C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (file locked) [4] C:\Documents and Settings\NetworkService\NTUSER.DAT - error opening (file locked) [4] C:\Documents and Settings\NetworkService\ntuser.dat.LOG - error opening (file locked) [4] C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (file locked) [4] C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (file locked) [4] C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask »ZIP »arrow1.bmp - error - the file is password-protected C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask »ZIP »arrow2.bmp - error - the file is password-protected C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask »ZIP »bck1.bmp - error - the file is password-protected C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask »ZIP »bck2.bmp - error - the file is password-protected C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask »ZIP »bt11.bmp - error - the file is password-protected C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Bar Mitzvah Main 16x9.dtl - error - the file is password-protected C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Bar Mitzvah Sub 16x9.dtl - error - the file is password-protected C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Birthday 1 Main 16x9.dtl - error - the file is password-protected C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Birthday 1 Sub 16x9.dtl - error - the file is password-protected C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Birthday 2 Main 16x9.dtl - error - the file is password-protected C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Birthday 2 Sub 16x9.dtl - error - the file is password-protected C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Communion Main 16x9.dtl - error - the file is password-protected C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Communion Sub 16x9.dtl - error - the file is password-protected C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Gathering Main 16x9.dtl - error - the file is password-protected C:\Program Files\TDS3\tds3.kf - error opening (file locked) [4] C:\Program Files\TDS3\Ext.Plug\lanscan.exe »PECompact v1.68 - unpack error C:\Program Files\TDS3\Ext.Plug\nbsrvem.exe »PECompact v1.68 - unpack error C:\Program Files\TDS3\Ext.Plug\shares.exe »PECompact v1.68 - unpack error C:\Program Files\TDS3\Ext.Plug\smtp.exe »PECompact v1.68 - unpack error C:\Program Files\TDS3\Ext.Plug\tcpinsp.exe »PECompact v1.68 - unpack error C:\Program Files\TDS3\Ext.Sys\execprot.exe »PECompact v1.68 - unpack error C:\Program Files\TDS3\Ext.Sys\tcp_list.exe »PECompact v1.68 - unpack error C:\Program Files\TDS3\xDynamic\TDS.fps\DCSFPS1.bak - error opening (file locked) [4] C:\Program Files\TDS3\xDynamic\TDS.fps\DCSFPS10.bak - error opening (file locked) [4] C:\Program Files\TDS3\xDynamic\TDS.fps\DCSFPS11.bak - error opening (file locked) [4] C:\Program Files\TDS3\xDynamic\TDS.fps\DCSFPS12.bak - error opening (file locked) [4] ===========================
Hi there these are Password Protected files and locked files and as such can not be infected, there are a number of threads on this issue: https://www.wilderssecurity.com/search.php?searchid=200158 I have made a step by step tutorial on extra settings for those wanting to “Tweak” it up a bit, here: https://www.wilderssecurity.com/showthread.php?t=37509 Hope this helps… Cheers
Ok, thanks.. Everything answered now NOD does things slightly different or I am just use to the other AVs. Tested to make sure, I gone to a URL that drops the "Exploit.DragDrop.A" upon connecting and NOD32 flagged it at a blink of an eye in both IE and FireFox, I am convinced all is will now. -wayne
Just to add my name to the list of those having MBR error Scan performed at: 07/12/2004 23:41:00 PM Scanning Log NOD32 version 1.941 (20041206) NT Operating memory - is OK MBR sector of the 2. physical disk - error reading disk sector Never had the problem with 2.12.2 but I've since added a HP photosmart 7960 printer that has memory card readers.
i have many of the same things in my log when doing an on-demand scan with nod32, though you probably have lots of things installed that i don't have.. i see many of the same things in the log when i do an on-demand scan with etrust ez antivirus, and some when i do an on-demand scan with TrojanHunter.. (i no longer have etrust ez av installed since i installed nod32..) they do not indicate an infection, only that the files could not be scanned because either they were locked ie "in use" or could not be unpacked.. it doesn't hurt to check them out, though.. you could inquire of diamondcs to see if those TDS files that would not unpack are normal, which i imagine that they are..