aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2016-07-07 20:05:12
20:05:12.943 OS Version: Windows x64 6.1.7601 Service Pack 1
20:05:12.943 Number of processors: 4 586 0x3C03
20:05:12.943 ComputerName: PC-KOMPUTER UserName: pc
20:05:13.349 Initialize success
20:05:13.349 VM: initialized successfully
20:05:13.349 VM: Intel CPU supported
20:05:14.099 VM: disk I/O iaStorA.sys
20:05:15.876 Disk 0 (boot) \Device\Harddisk0\DR0 → \Device\00000068
20:05:15.876 Disk 0 Vendor: WDC_____ 01.0 Size: 476940MB BusType: 11
20:05:15.986 Disk 0 MBR read error 0
20:05:15.986 Disk 0 MBR scan
20:05:15.986 Disk 0 unknown MBR code
20:05:15.986 MBR BIOS signature not found 0
20:05:16.422 Disk 0 scanning C:\Windows\system32\drivers
20:05:20.276 Service scanning
20:05:22.397 Service edevmon C:\Windows\system32\DRIVERS\edevmon.sys LOCKED 5
20:05:22.428 Service ehdrv C:\Windows\system32\DRIVERS\ehdrv.sys LOCKED 5
20:05:22.491 Service ekbdflt C:\Windows\system32\DRIVERS\ekbdflt.sys LOCKED 5
20:05:22.600 Service epfw C:\Windows\system32\DRIVERS\epfw.sys LOCKED 5
20:05:22.647 Service EpfwLWF C:\Windows\system32\DRIVERS\EpfwLWF.sys LOCKED 5
20:05:22.662 Service epfwwfp C:\Windows\system32\DRIVERS\epfwwfp.sys LOCKED 5
20:05:28.154 Modules scanning
20:05:28.154 Disk 0 trace - called modules:
20:05:28.169 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStorF.sys storport.sys hal.dll iaStorA.sys
20:05:28.185 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0xfffffa8009bd7060]
20:05:28.185 3 CLASSPNP.SYS[fffff8800140143f] → nt!IofCallDriver → [0xfffffa8009a149e0]
20:05:28.200 5 iaStorF.sys[fffff88001699f84] → nt!IofCallDriver → \Device\00000068[0xfffffa8007331060]
20:05:28.200 Disk 0 statistics 109243/0/0 @ 683,86 MB/s
20:05:28.216 Scan finished successfully
20:05:38.590 Disk 0 MBR fix error
Do you or did you have ESET installed
Thank you for reply. Yes, but only aswmbr detect this malware. Only one time after fix mbr and after 2 minutes log is clear, like virus back to mbr after fix it and when avast don’t show anything my harddrive speed is much slower, my pc go so slow, look:
“20:44:58.068 Disk 0 statistics 98689/0/0 @ 13,60 MB/s”
I believe it’s something come from badusb mouse because mouse install as keyboard, but ps/2 don’t solve my problem in any way. I try to flashing bios without usb devices connected and after flash it always back afterwards. I try everything i think with no result.
aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2016-07-07 20:44:40
20:44:40.206 OS Version: Windows x64 6.1.7601 Service Pack 1
20:44:40.206 Number of processors: 4 586 0x3C03
20:44:40.207 ComputerName: PC-KOMPUTER UserName: pc
20:44:40.625 Initialize success
20:44:40.631 VM: initialized successfully
20:44:40.633 VM: Intel CPU supported
20:44:45.219 VM: disk I/O iaStorA.sys
20:44:47.027 Disk 0 (boot) \Device\Harddisk0\DR0 → \Device\00000068
20:44:47.033 Disk 0 Vendor: WDC_____ 01.0 Size: 476940MB BusType: 11
20:44:47.112 Disk 0 MBR read successfully
20:44:47.116 Disk 0 MBR scan
20:44:47.120 Disk 0 Windows 7 default MBR code
20:44:47.124 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
20:44:47.130 Disk 0 default boot code
20:44:47.136 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476838 MB offset 206848
20:44:47.146 Disk 0 scanning C:\Windows\system32\drivers
20:44:50.902 Service scanning
20:44:52.628 Service edevmon C:\Windows\system32\DRIVERS\edevmon.sys LOCKED 5
20:44:52.694 Service ehdrv C:\Windows\system32\DRIVERS\ehdrv.sys LOCKED 5
20:44:52.773 Service ekbdflt C:\Windows\system32\DRIVERS\ekbdflt.sys LOCKED 5
20:44:52.882 Service epfw C:\Windows\system32\DRIVERS\epfw.sys LOCKED 5
20:44:52.907 Service EpfwLWF C:\Windows\system32\DRIVERS\EpfwLWF.sys LOCKED 5
20:44:52.925 Service epfwwfp C:\Windows\system32\DRIVERS\epfwwfp.sys LOCKED 5
20:44:58.012 Modules scanning
20:44:58.022 Disk 0 trace - called modules:
20:44:58.043 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStorF.sys storport.sys hal.dll iaStorA.sys
20:44:58.050 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0xfffffa8009bd7060]
20:44:58.056 3 CLASSPNP.SYS[fffff8800140143f] → nt!IofCallDriver → [0xfffffa8009a149e0]
20:44:58.062 5 iaStorF.sys[fffff88001699f84] → nt!IofCallDriver → \Device\00000068[0xfffffa8007331060]
20:44:58.068 Disk 0 statistics 98689/0/0 @ 13,60 MB/s
20:44:58.075 Scan finished successfully
Those are ESET drivers and not malware, AswMBR just reports them as locked
OK lets now look with FRST
Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.
https://dl.dropboxusercontent.com/u/73555776/frst.JPG
[*]It will produce a log called FRST.txt in the same directory the tool is run from
[*]Please attach both logs generated
I can see no malware of any description on the system, what problems are you experiencing