Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HELP! MBR-rootkit detected!


  • Please log in to reply
6 replies to this topic

#1 frmarine

frmarine

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:marietta, georgia
  • Local time:11:31 AM

Posted 07 January 2010 - 06:26 AM

OS> XP-SP3 : I ran rootrepeal a few days ago on a whim from your site & it showed "mbr rootkit detected in files scan". don't know how long its been on the pc , i think it infected my pc over the new years day weekend. i had read somewhere else about combofix & also on your forum & ran it but it didn't remove it or show it listed. i deleted combofix & downloaded gmer.net's mbr removal tool, but i could not get it to open/run. the author on gmer.net said to rename the file "test.exe" in case the rootkit tried to prevent it from running. i right clicked on the file to rename it hoping that it what he meant, but it still wouldn't run. i also read where you can boot up with the 'XP-CD", go into recovery console, click on "fixmbr" & it will delete the old mbr file along with the mbr rootkit & creates a new one. i can't find the XP-CD, so i ordered a replacement from microsoft but it on their website it says it can take up to 30 days to get one. i have mbam,sas, and neither picked it up. i installed geswall a few days before new years day, but i wasn't running firefox in isolated mode(geswall) till the weekend, so i think it got infected before that. i don't have any logfiles to post (i'm not sure if i know the correct way to do so). i can open the command prompt on its on if i need to run a file from that. i tried to run mbr.exe -f from it but it opened for a split second & disapeared. sorry for the long msg. here, but any help would be much appreciated. THANX FOR YOUR TIME/HELP.*** i've read the warnings about combofix, i didn't encounter any problems. i have RestoreIT software on here & no points were deleted. i have xp sys restore turned off. i might try to restore back to before christmas & rerun the rootrepeal scan.

Edited by frmarine, 07 January 2010 - 06:39 AM.


BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,109 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:11:31 AM

Posted 07 January 2010 - 08:43 AM

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.

==>PLEASE DO NOT NOW POST LOGS<== unless a log is specifically requested.
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Internet Security, NoScript Firefox ext.


animinionsmalltext.gif

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,060 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:31 AM

Posted 07 January 2010 - 09:56 AM

downloaded gmer.net's mbr removal tool, but i could not get it to open/run. the author on gmer.net said to rename the file "test.exe" in case the rootkit tried to prevent it from running. i right clicked on the file to rename it hoping that it what he meant, but it still wouldn't run.


RootRepeal has an option to fix the MBR rootkit and reboot immediately. When RootRepeal starts a file scan, it scans the first track of the hard drive, looking for a mismatch between the Windows API and the actual on-disk data. If it detects a mismatch in the first sector (sector 0), it reports "MBR Rootkit Detected!".

Double-click on RootRepeal.exe to rerun it again.
  • Click on the Files tab, then click the Scan button.
  • In the Select Drives, dialog Please select drives to scan: select your primary system drive (usually C:), then click OK.
  • When the scan has completed, a list of files will be generated in the RootRepeal window.
  • Locate and right-click the MBR rootkit file: Path: Volume C:\ Status: MBR Rootkit Detected!
  • This time choose option #1- restore and reboot immediately.
You can also try using GMER's MBR Removal Tool from a command prompt instead of double-clicking.

Make sure mbr.exe is placed in the root directory, usually C:\ <- (Important!).
Then go to Posted Image > Run..., and in the Open dialog box, type: cmd
press Ok.
The command prompt needs to be at the root directory (C:\>_). To do that, type: cd \
press Enter.
At the command prompt C:\>_, type: mbr.exe -f
(make sure you have a space before the e and the -f)
press Enter.
At the command prompt, type: exit
press Enter.

-- If you're not sure how to use the command prompt, please refer to this guide: Introduction to the Command Prompt.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 frmarine

frmarine
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:marietta, georgia
  • Local time:11:31 AM

Posted 07 January 2010 - 03:09 PM

to: global moderator>Quietman7, THANX,THANX,THANX, for responding so QUICKLY & for the very detailed info on removing the mbr rootkit. i reran rootrepeal as per your instructions, and it WORKED! :thumbsup: mbr rootkit GONE WITH THE WIND! and thanx for the link for the "intro to the command prompt" which i'll read. you know your stuff! i wish i was that knowledgeable. to orange blossom, sorry i posted in the wrong forum, wasn't sure which one to go with. wilderssecurity has great info too along with a few others, but this the best forum for help by far. THANX AGAIN!

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,060 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:31 AM

Posted 07 January 2010 - 03:13 PM

You're welcome.

Tips to protect yourself against malware and reduce the potential for re-infection:

Keep Windows and Internet Explorer current with all critical updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. If you're not sure how to do this, see Microsoft Update helps keep your computer current.

Avoid gaming sites, porn sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs (i.e. Limewire, eMule, uTorrent). They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. Porn sites can lead to the Trojan.Mebroot MBR rootkit and other dangerous malware. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.Beware of Rogue Security software as they are one of the most common sources of malware infection. They infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware. For more specific information on how these types of rogue programs and infections install themselves, read:Keeping Autorun enabled on USB (pen, thumb, jump) and other removable drives has become a significant security risk as they are one of the most common infection vectors for malware which can transfer the infection to your computer. To learn more about this risk, please read:Many security experts recommend you disable Autorun asap as a method of prevention. Microsoft recommends doing the same.

...Disabling Autorun functionality can help protect customers from attack vectors that involve the execution of arbitrary code by Autorun when inserting a CD-ROM device, USB device, network shares, or other media containing a file system with an Autorun.inf file...

Microsoft Security Advisory (967940): Update for Windows Autorun
How to Maximize the Malware Protection of Your Removable Drives

Other related reading sources:• Finally, if you need to replace your anti-virus, firewall or need a reliable anti-malware scanner please refer to:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 qElijahq

qElijahq

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:10:31 AM

Posted 07 January 2010 - 04:56 PM

Thank you.

Edited by qElijahq, 08 January 2010 - 03:13 PM.


#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,060 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:31 AM

Posted 08 January 2010 - 08:35 AM

Sorry your thread was overlooked but we are all volunteers and sometimes a topic will get overlooked as the forum is overwhelmed with requests for help. The staff at BC and most on-line community forums do our best to answer everyone but are all volunteers who contribute to helping members as time permits us. I will look at your other thread.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users