Error and Access denied

Discussion in 'NOD32 version 2 Forum' started by juppy, Dec 10, 2003.

Thread Status:
Not open for further replies.
  1. juppy

    juppy Registered Member

    Joined:
    Dec 6, 2003
    Posts:
    9
    Location:
    Bristol, UK
    I have just downloaded and run NOD32 version 2 free trial.
    My OS is XP professional
    Is anyone able to tell me if the following error messages are relevant - or should I be doing something about them.
    I have not had any problems using the computer for any purpose.
    The following were only flagged up within and after running NOD32 :eek:

    Scanning log has come up with

    Error occured while scanning MBR sector of the 2. physical disk. Error reading sector The same goes for 3, 4 and 5

    C:\hiberfil.sys - error opening (file locked) (4)
    C:\pagefile.sys - error opening (file locked) (4)

    C:\WINDOWS\$NtUninstallKB824141$\user32dll - error (access denied) (4)
    C:\WINDOWS\$NtUninstallKB824141$\win32k sys - error (access denied) (4)

    There are a further 26 similar messages for
    C:\WINDOWS\$NtUninstallK
    B826939$\ (4 messages)
    B828035$\ (2 messages)
    B829558$\ (20 messages)
    the address does go further, but to write them out would take a lot of space and I am guessing that if anyone is familiar with the above, they would not need to read the rest of the address and those who are not would be like me confused.

    Thanks :oops:
     
  2. sir_carew

    sir_carew Registered Member

    Joined:
    Sep 2, 2003
    Posts:
    884
    Location:
    Santiago, Chile
    Hi,
    Error occured while scanning MBR sector of the 2. physical disk. Error reading sector The same goes for 3, 4 and 5
    It's because you're scanning your computer in a limited account without admin rights on a NT based system like XP.

    C:\hiberfil.sys - error opening (file locked) (4)
    C:\pagefile.sys - error opening (file locked) (4)
    It's also normal, these file are part of XP system, and it's reading these file, for it reason NOD, any AV or any virus can't delete, rename, modify it these files.

    I don't know the others file, but I believe that other aplicattion is using those "denied" files, I recommend that you start Win in safe mode and run a scan with admin rights.
     
  3. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    The other files seem to be the backup (maybe) of a service pack installation and therefore may be locked by the system. Can you get into that directory and try renaming some file to confirm my assumption?
     
  4. MegaHertz

    MegaHertz Registered Member

    Joined:
    Nov 28, 2002
    Posts:
    69
    Location:
    U.S.A.
    Marcos is correct those files are part of the uninstall information for the following windows critical update.

    MS03-045: Buffer Overrun in the ListBox and in the ComboBox Control Could Allow Code Execution
     
  5. Mimo Zus

    Mimo Zus Guest

    I'm seeing the same errors on my WinXP Pro laptop despite the fact that I'm running with Administrator privilege, and two other AV Products have no trouble reading the MBR (F-Prot and Dr.Web).
     
  6. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Then the reason may be that you use a card reader with no card inserted. Don't you have a boot manager or suchlike program installed that modifies MBR sectors?
     
  7. Mimo Zus

    Mimo Zus Guest

    You are correct on at least one count:

    I have a memory card reader (two actually), but I don't know if my SONY VAIO came with a boot manager preinstalled. I don't think so. It did come with WinXP Home installed which I
    upgraded to XP Pro. I did a couple of OS reinstall/upgrades due to problems the first time around. After the first attempt at upgrading I was offered two choices when booting: XP Home or XP Pro. After the second attempt at upgrading Win XP was the only choice at boot.

    However, I do have a theory; maybe someone can validate or debunk it.

    When I do an on-demand scan of a file Nod32 reports something like:
    ---
    NOD32 version 1.617 (20040206) NT
    Command line: C:\Documents and Settings\Me\My Documents\Install\Some Program.exe
    Checking CRC of the NOD32.EXE file: status OK
    Operating memory is OK.
    Error occured while scanning MBR sector of the 3. physical disk. Error reading sector.
    ---

    If this is the output of a normal scan then its different than what I'm used to seeing.Other AV programs will report on a successful memory scan and also on a successful MBR scan (NAV2004, Dr. Web, F-Prot).

    That's what I expected to see here. Instead Nod32 reports on the successful memory scan followed by the failure to read the MBR on what its calling disk 3 (on a previous scan it was disk 2). Based on my previous experience with other AV programs I thought that the MBR read failure was actually on C:.

    So what I want to know is whether I am I on the right track here? Is Nod32 silent about a successful MBR scans?

    Another related question is how do I find out which disk Nod32 is referring to when it says (1,2,3,...) physical disk.
     
Thread Status:
Not open for further replies.