MBR error

Discussion in 'NOD32 version 2 Forum' started by rafman, Nov 22, 2004.

Thread Status:
Not open for further replies.
  1. rafman

    rafman Registered Member

    Joined:
    Nov 9, 2004
    Posts:
    16
    I have set NOD to scan every file I download. It completes the scan and every time I get these messages:

    Error occurred while scanning MBR sector of the 3. physical disk - Error reading sector

    Error occurred while scanning MBR sector of the 4. physical disk - Error reading sector

    Chkdsk reports no problems - ran with it /f switch.

    I am not sure if the errors are trying to reference pphysical disks number 3 and 4. I have no number 4 and number 3 is a USB card reader.

    Any help appreciated.
     
  2. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Hi Rafman, the MBR error messages you are seeing, relate to:

    1. you perform a system scan under the account of a limited user
    2. you have a special boot manager or suchlike program that alters boot sectors installed
    3. you use a card reader while no card is actually inserted

    The (file locked) [4] errors are related to “Swap Files” files that are in use (locked) by Windows and as such cannot be infected…

    Hope this helps…

    Cheers :D
     
  3. rafman

    rafman Registered Member

    Joined:
    Nov 9, 2004
    Posts:
    16
    If I insert a card into my card reader, the first MBR message goes away. The second is still there, even if I log in as administrator. I use no boot manager program. Am I understanding correctly that the second message is there due to my swap file being locked?
     
  4. SaphireX

    SaphireX Registered Member

    Joined:
    Jul 29, 2004
    Posts:
    84
    I would agree with your assessment in that your 2nd second message is due to your swap file being locked?

    Saphire
     
  5. Stan999

    Stan999 Registered Member

    Joined:
    Sep 27, 2002
    Posts:
    566
    Location:
    Fort Worth, TX USA
    If you right-click My Computer and select Properties. On the Hardware page of the System properties box, click the Device Manager button. Expand the "Disk drives" to see what drives are present. Does that show an additional physical disk?
     
  6. rafman

    rafman Registered Member

    Joined:
    Nov 9, 2004
    Posts:
    16
    Device manager correctly shows both physical hard disks. It also shows two devices for my card reader - and they each get assigned a drive letter - even though there is only one device present.

    I just installed a trial version of NOD on another machine - and it doesn't show any MBR messages at all. So it doesn't seem like this has anything to do with my swap file. Maybe the card reader?
     
  7. Stan999

    Stan999 Registered Member

    Joined:
    Sep 27, 2002
    Posts:
    566
    Location:
    Fort Worth, TX USA
    It isn't anything to worry about. Windows can show some devices like the card readers as hard disk drives due to the drivers. NOD32 then attempts to access those drives and displays the errors you noted. Because Windows is showing two drives for your card reader NOD32 is displaying those two errors you posted.
     
    Last edited: Nov 23, 2004
  8. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Agreed, nothing to worry about Rafman, all is normal ;) :D

    Cheers :D
     
  9. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    This is common for certain notebooks with a hibernation partition. At any rate, there's no need to worry about - today's viruses do not infect MBR so it's very unlikely it'd be a new boot virus.
     
  10. wayne_b

    wayne_b Registered Member

    Joined:
    May 29, 2004
    Posts:
    56
    I have the same issue, I also have full admin and also have three card readers appearing as removable drives though I disconnect the card readers, I still have the issue doesn't matter what drive(s) I scan 1 or all, the error still appears in the log(s)!

    If I understand the answer correctly, not to worry about it?

    -wayne
     
  11. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Correct.

    Cheers :D
     
  12. wayne_b

    wayne_b Registered Member

    Joined:
    May 29, 2004
    Posts:
    56
    Thanks Blackspear, one last Q..

    Since I am new to NOD32, please bear with me, I done "All Files" scan on two hard drives, are these 'ERRORS' normal? Small Sample listed below (in all, about five hundred of these errors under the same scan)

    FYI, before I show the error list; before un-installin Tm PC-cillin IS 2005, I done a complete system scan and came up clean! After installing and scanning with NOD32, NOD found this; "Firebird_profile\Cache\484DDDCAd01 - Win32/TrojanDownloader.VB.DF trojan - quarantined - unable to clean - deleted" good job :)

    Ok, the short list (is this normal? NOTE, were it states 'password protected' though its not)

    ===========================

    ate: 7.12.2004 time: 18:32:37
    Scanned disks, directories and files: C:; F:
    C:\pagefile.sys - error opening (file locked) [4]
    C:\Documents and Settings\LocalService\NTUSER.DAT - error opening (file locked) [4]
    C:\Documents and Settings\LocalService\ntuser.dat.LOG - error opening (file locked) [4]
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (file locked) [4]
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (file locked) [4]
    C:\Documents and Settings\NetworkService\NTUSER.DAT - error opening (file locked) [4]
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG - error opening (file locked) [4]
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (file locked) [4]
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (file locked) [4]

    C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask »ZIP »arrow1.bmp - error - the file is password-protected
    C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask »ZIP »arrow2.bmp - error - the file is password-protected
    C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask »ZIP »bck1.bmp - error - the file is password-protected
    C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask »ZIP »bck2.bmp - error - the file is password-protected
    C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask »ZIP »bt11.bmp - error - the file is password-protected

    C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Bar Mitzvah Main 16x9.dtl - error - the file is password-protected
    C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Bar Mitzvah Sub 16x9.dtl - error - the file is password-protected
    C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Birthday 1 Main 16x9.dtl - error - the file is password-protected
    C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Birthday 1 Sub 16x9.dtl - error - the file is password-protected
    C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Birthday 2 Main 16x9.dtl - error - the file is password-protected
    C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Birthday 2 Sub 16x9.dtl - error - the file is password-protected
    C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Communion Main 16x9.dtl - error - the file is password-protected
    C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Communion Sub 16x9.dtl - error - the file is password-protected
    C:\Program Files\Pinnacle\Studio 9\hfbm0107.zip »ZIP »Menus 16x9/Family/Family - Gathering Main 16x9.dtl - error - the file is password-protected

    C:\Program Files\TDS3\tds3.kf - error opening (file locked) [4]
    C:\Program Files\TDS3\Ext.Plug\lanscan.exe »PECompact v1.68 - unpack error
    C:\Program Files\TDS3\Ext.Plug\nbsrvem.exe »PECompact v1.68 - unpack error
    C:\Program Files\TDS3\Ext.Plug\shares.exe »PECompact v1.68 - unpack error
    C:\Program Files\TDS3\Ext.Plug\smtp.exe »PECompact v1.68 - unpack error
    C:\Program Files\TDS3\Ext.Plug\tcpinsp.exe »PECompact v1.68 - unpack error
    C:\Program Files\TDS3\Ext.Sys\execprot.exe »PECompact v1.68 - unpack error
    C:\Program Files\TDS3\Ext.Sys\tcp_list.exe »PECompact v1.68 - unpack error
    C:\Program Files\TDS3\xDynamic\TDS.fps\DCSFPS1.bak - error opening (file locked) [4]
    C:\Program Files\TDS3\xDynamic\TDS.fps\DCSFPS10.bak - error opening (file locked) [4]
    C:\Program Files\TDS3\xDynamic\TDS.fps\DCSFPS11.bak - error opening (file locked) [4]
    C:\Program Files\TDS3\xDynamic\TDS.fps\DCSFPS12.bak - error opening (file locked) [4]

    ===========================
     
  13. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
  14. wayne_b

    wayne_b Registered Member

    Joined:
    May 29, 2004
    Posts:
    56
    Ok, thanks.. Everything answered now :) NOD does things slightly different or I am just use to the other AVs. Tested to make sure, I gone to a URL that drops the "Exploit.DragDrop.A" upon connecting and NOD32 flagged it at a blink of an eye in both IE and FireFox, I am convinced all is will now.

    -wayne
     
  15. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Good to see, any questions whatsoever, don't hesitate to start a new thread.

    All the best...

    Cheers :D
     
    Last edited: Dec 7, 2004
  16. mrbrimi

    mrbrimi Registered Member

    Joined:
    Mar 24, 2003
    Posts:
    44
    Just to add my name to the list of those having MBR error

    Scan performed at: 07/12/2004 23:41:00 PM
    Scanning Log
    NOD32 version 1.941 (20041206) NT
    Operating memory - is OK
    MBR sector of the 2. physical disk - error reading disk sector

    Never had the problem with 2.12.2 but I've since added a HP photosmart 7960 printer that has memory card readers.
     
  17. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    There we go, you answered your own Question ;) :D

    Cheers :D
     
  18. redwolfe_98

    redwolfe_98 Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    581
    Location:
    South Carolina, USA
    i have many of the same things in my log when doing an on-demand scan with nod32, though you probably have lots of things installed that i don't have.. i see many of the same things in the log when i do an on-demand scan with etrust ez antivirus, and some when i do an on-demand scan with TrojanHunter.. (i no longer have etrust ez av installed since i installed nod32..) they do not indicate an infection, only that the files could not be scanned because either they were locked ie "in use" or could not be unpacked.. it doesn't hurt to check them out, though.. you could inquire of diamondcs to see if those TDS files that would not unpack are normal, which i imagine that they are..
     
    Last edited: Dec 8, 2004
Thread Status:
Not open for further replies.