Solved Disk 1 Unknown mbr code

jmarket · Dec 1, 2016

Hey TwiX and welcome

I'll tag @Malnutrition and @DonnaB so one of them can get you underway

We have to complete any malware treatment before we can start hardware/software diagnostics

jmarket · Dec 2, 2016

While we wait for one of them, let's get you started with some scans.

Zoek Scan

Disable your antivirus prior to this scan.
Download Zoek
Save the file to your desktop.
Right click Zoek.exe and run as administrator. (XP Users double click)
Copy and paste the items in red below and paste them into Zoek.

createsrpoint;
emptyfolderscheck;delete
emptyclsid;
emptyalltemp;
ipconfig /flushdns;b
autoclean;

Now hit the run script button.
The log will appear after a reboot, also you can find it on the C: drive.
Post the log in your next reply.

TwiXxiN · Dec 2, 2016

I think my pc is actually fine, i've seen other people logs from aswMBR and every single one has unknown mbr code, so i was just paranoid. But since u asked i can give you logs, i think i my pc is in a perfectly fine state.

Zoek.exe v5.0.0.1 Updated 19-September-2016
Tool run by DuhBoy on pet 02.12.2016. at 23:52:41,56.
Microsoft Windows 10 Pro 10.0.14393 x64
Running in: Normal Mode Internet Access Detected
Launched: D:\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

2.12.2016. 23:52:58 Zoek.exe System Restore Point Created Successfully.

==== Safe Boot Check ======================

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot]
Value AlternateShell is missing
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot]
Value AlternateShell is missing

==== Empty Folders Check ======================

C:\PROGRA~2\Windows Media Player deleted successfully
C:\PROGRA~2\COMMON~1\EAInstaller deleted successfully
C:\Program Files\Windows Media Player deleted successfully
C:\PROGRA~3\Comms deleted successfully
C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) deleted successfully
C:\PROGRA~3\regid.1986-12.com.adobe deleted successfully
C:\PROGRA~3\SoftwareDistribution deleted successfully
C:\Users\defaultuser0\AppData\LocalLow deleted successfully
C:\Users\defaultuser0\AppData\Local\VirtualStore deleted successfully
C:\Users\DuhBoy\AppData\Local\CrashDumps deleted successfully
C:\Users\DuhBoy\AppData\Local\PeerDistRepub deleted successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Maps deleted successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\PeerDistPub deleted successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\PeerDistRepub deleted successfully

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot]
"AlternateShell"="cmd.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot]
"AlternateShell"="cmd.exe"

==== Batch Command(s) Run By Tool======================

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Windows Media Player not found
C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) not found
C:\Users\DuhBoy\AppData\Roaming\discord deleted
C:\PROGRA~3\Package Cache deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\gpt.ini deleted
C:\Windows\Syswow64\GroupPolicy\gpt.ini deleted
C:\Windows\Syswow64\SET3224.tmp deleted
C:\Windows\Syswow64\SET3277.tmp deleted
C:\Windows\Syswow64\SET39E1.tmp deleted
C:\Windows\Syswow64\SET3A34.tmp deleted
C:\Windows\Syswow64\SET3CA1.tmp deleted
C:\Windows\Syswow64\SET9311.tmp deleted
C:\Windows\Syswow64\SETACCC.tmp deleted
C:\Windows\Syswow64\SETAD1F.tmp deleted

==== Chromium Look ======================

uBlock₀ - DuhBoy\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm
Chrome Media Router - DuhBoy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\DuhBoy\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\DuhBoy\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\DuhBoy\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\DuhBoy\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\DuhBoy\AppData\Local\Google\Chrome\User Data\Default\Cache will be emptied at reboot

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=193 folders=88 85065840 bytes)

==== Empty Temp Folders ======================

C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\DuhBoy\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\DuhBoy\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0" deleted
"C:\Users\DuhBoy\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1" deleted
"C:\Users\DuhBoy\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2" deleted
"C:\Users\DuhBoy\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3" deleted
"C:\Users\DuhBoy\AppData\Local\Google\Chrome\User Data\Default\Cache\index" deleted

==== EOF on sub 03.12.2016. at 0:01:16,08 ======================

Malnutrition · Dec 4, 2016

Adware Cleaner Scan.

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Scan button.
When the scan has finished click on Clean button.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

JRT Scan.

Please download Junkware Removal Tool and save it on your desktop.

Shut down your anti-virus, anti-spyware, and firewall software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click it and select Run as administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log is saved to your desktop and will automatically open.
Please post the JRT log.

Adware Removal Tool Scan.

Download Adware removal tool to your desktop, right click the icon and select Run as Administrator.

Hit Ok.

Hit next make sure to leave all items checked, for removal.

The Program will close all open programs to complete the removal, so save any work and hit OK. Then hit OK after the removal process is complete, thenOK again to finish up. Post log generated by tool.

ZHP Scan.

Please download Zhp Cleaner to your desktop. Right Click the icon and select run as administrator.

2. Once you have started the program, you will need to click the scanner button.

The program will close all open browsers!
3. Once the scan is completed, the you will want to click the Repair button.

At the end of the process you may be asked to reboot your machine. After you reboot a report will open on your desktop.
Copy and paste the report here in your next reply.

Security Check Scan.

Download Security Check to your desktop.
Right click it run as administrator.
When the program completes, the tool will automatically open a log file.
Please post that log here in your next post.

TwiXxiN · Dec 4, 2016

I also scanned with eset online scanner, and anti malwarebytes, both didint find anything.
So here are the logs from programs u asked,
# AdwCleaner v6.040 - Logfile created 04/12/2016 at 21:24:28
# Updated on 02/12/2016 by Malwarebytes
# Database : 2016-12-04.1 [Server]
# Operating System : Windows 10 Pro (X64)
# Username : DuhBoy - DUHBOYKX
# Running from : D:\Downloads\adwcleaner_6.040.exe
# Mode: Scan
# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious keys found.

***** [ Shortcuts ] *****

No infected shortcut found.

***** [ Scheduled Tasks ] *****

No malicious task found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Web browsers ] *****

No malicious Firefox based browser items found.
No malicious Chromium based browser items found.

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [980 Bytes] - [04/12/2016 21:24:28]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1052 Bytes] ##########

a~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.9 (09.30.2016)
Operating System: Windows 10 Pro x64
Ran by DuhBoy (Administrator) on ned 04.12.2016. at 21:25:06,52
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 0

Registry: 0

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ned 04.12.2016. at 21:25:54,08
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~ ZHPCleaner v2016.12.4.209 by Nicolas Coolman (2016/12/04)
~ Run by DuhBoy (Administrator) (04/12/2016 21:33:42)
~ Web: https://www.nicolascoolman.com
~ Blog: https://www.anti-malware.top
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Type : Repair
~ Report : C:\Users\DuhBoy\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\DuhBoy\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 10 Pro, 64-bit (Build 14393)

---\\ Services (0)
~ No malicious or unnecessary items found.

---\\ Browser internet (0)
~ No malicious or unnecessary items found.

---\\ Hosts file (1)
~ The hosts file is legitimate (22)

---\\ Scheduled automatic tasks. (0)
~ No malicious or unnecessary items found.

---\\ Explorer ( File, Folder) (3)
MOVED file: C:\Windows\Installer\wix{3973721B-C2ED-4505-98B6-752897ECF2F1}.SchedServiceConfig.rmi =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSIE00B.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSIF7E5.tmp- =>.Superfluous.Empty

---\\ Registry ( Key, Value, Data) (5)
DELETED key*: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\atwola.com [] =>.Superfluous.Atwola
DELETED key*: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\ol.at.atwola.com [] =>.Superfluous.Atwola
DELETED key*: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\atwola.com [] =>.Superfluous.Atwola
DELETED key*: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ol.at.atwola.com [211] =>.Superfluous.Atwola
DELETED key*: HKLM\SYSTEM\CurrentControlSet\Services\CscService [] =>.Superfluous.PCSpeedUp

---\\ Summary of the elements found (3)
https://www.nicolascoolman.com/fr/logiciels-superflus =>.Superfluous.Empty
https://www.anti-malware.top/2016/07/21/superfluous-atwola/ =>.Superfluous.Atwola
https://www.nicolascoolman.com/fr/superfluous-pcspeeduppro/ =>.Superfluous.PCSpeedUp

---\\ Other deletions. (26)
~ Registry Keys Tracing deleted (26)
~ Remove the old reports ZHPCleaner. (0)

---\\ Result of repair
~ Repair carried out successfully
~ Browser not found (Mozilla Firefox)
~ Browser not found (Opera Software)

---\\ Statistics
~ Items scanned : 291
~ Items found : 0
~ Items cancelled : 0
~ Items repaired : 8

~ End of clean in 00h00mn08s

Other adwcleaner didin't find anything, also not sure why are there lines in this text below..

~====================
ZHPCleaner-[R]-04122016-21_33_50.txt
ZHPCleaner--04122016-21_32_54.txt

SecurityCheck by glax24 & Severnyj v.1.4.0.46 [22.09.16]
WebSite: www.safezone.cc
DateLog: 04.12.2016 21:35:07
Path starting: C:\Users\DuhBoy\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: DuhBoy
VersionXML: 3.58is-03.12.2016
___________________________________________________________________________

Windows 10(6.3.14393) (x64) Professional Lang: English(0409)
Installation date OS: 09.08.2016 15:54:39
LicenseStatus: Windows(R), Professional edition Windows is in Notification mode
Boot Mode: Normal
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
SystemDrive: C: FS: [NTFS] Capacity: [111.2 Gb] Used: [51.9 Gb] Free: [59.3 Gb]
------------------------------- [ Windows ] -------------------------------
Internet Explorer 11.447.14393.0
User Account Control enabled
The elevation prompt for administrators disabled
^It is recommended to enable: Win+R typing UserAccountControlSettings and Enter^

Windows Update (wuauserv) - The service has stopped
Security Center (wscsvc) - The service is running
Remote Registry (RemoteRegistry) - The service has stopped
SSDP Discovery (SSDPSRV) - The service is running
Remote Desktop Services (TermService) - The service has stopped
Windows Remote Management (WS-Management) (WinRM) - The service has stopped
---------------------------- [ Antivirus_WMI ] ----------------------------
Windows Defender (disabled)
--------------------------- [ FirewallWindows ] ---------------------------
Windows Firewall (MpsSvc) - The service is running
--------------------------- [ AntiSpyware_WMI ] ---------------------------
Windows Defender (disabled and up to date)
-------------------------- [ SecurityUtilities ] --------------------------
Malwarebytes Anti-Malware version 2.2.1.1043 v.2.2.1.1043
--------------------------- [ OtherUtilities ] ----------------------------
VLC media player v.2.2.4
WinRAR 5.40 (64-bit) v.5.40.0
--------------------------------- [ P2P ] ---------------------------------
------------------------------- [ Browser ] -------------------------------
Google Chrome v.55.0.2883.75
--------------------------- [ RunningProcess ] ----------------------------
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe v.55.0.2883.75
------------------ [ AntivirusFirewallProcessServices ] -------------------
MBAMScheduler (MBAMScheduler) - The service has stopped
MBAMService (MBAMService) - The service has stopped
Windows Defender Service (WinDefend) - The service has stopped
Windows Defender Network Inspection Service (WdNisSvc) - The service has stopped
----------------------------- [ End of Log ] ------------------------------

Malnutrition · Dec 5, 2016

Your machine appears to be in great shape. No need for anything more to be done here.

Glad to have helped!! Please tell a friend ...... or two about us.

suggest the following in place of adblock.
Alternate DNS Server. Ad Blocking DNS.
Ublock Origin.
Anti Ad Block Killer.

Also, keep your browsing private with these tools:

Self Destructing Cookies.
Self Destructing Cookies Chrome.

Some items to keep you safe on the internet.

VooDoo Shield. control of what is running on your machine
Qualys BrowserCheck To update plugins.
Web Of Trust To Avoid Shady Websites.
Unchecky To Avoid Bundled Software.
Privazer To Clean up your mahcine.

Now Lets Clean up the tools we used and remove old restore points.

Download DelFix by "Xplode" to your Desktop.
Right Click the tool and Run as Admin ( Xp Users Double Click)
Put a check mark next the items below:

Remove disinfection tools
Create registry backup
Purge System Restore

Now click on "Run" button.
allow the program to complete its work.
all the tools we used will be removed.
Tool will create and open a log report (DelFix.txt)
Note: The report can be located at the following location C:\DelFix.txt

TwiXxiN · Dec 5, 2016

Thanks guys, that unknown mbr code made me worried. Also found a few nice tools to use!

Malnutrition · Dec 5, 2016

Thanks for taking the time and following up on the thread, much appreciated. Also, if you know of anyone that is in need of any type of computer help, please send them our way. We are fairly new and trying to get the word out about the site.

TwiXxiN

jmarket

PCHF's Almighty Ruler

jmarket

PCHF's Almighty Ruler

TwiXxiN

Malnutrition

Malnurished Admin

TwiXxiN

Malnutrition

Malnurished Admin

TwiXxiN

Malnutrition

Malnurished Admin

Search

Search

Solved Disk 1 Unknown mbr code

We value your privacy