Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

MBR clean, or not?


  • Please log in to reply
5 replies to this topic

#1 Themakaris

Themakaris

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:03 PM

Posted 13 January 2010 - 07:18 AM

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x012A14C00
malicious code @ sector 0x012A14C03 !
PE file found in sector at 0x012A14C19 !

===============

Undoubtedly I had been infected a few days ago by some rootkit - symptoms were the creation of Help Assistant user account and system running slowly and randomly hanging..

Following a lot of work, (though I haven't deleted the Help Assistant folder) there are currently no visible symptoms of the malware; mbr had previously reported infection, and I followed its recommendation to run mbr -f ; subsequently Symantec's FixMebroot tool reports "no infection". I've run ESET and Malwarebytes and allowed them to clean what they found (only four files reported, and not apparently very serious threats). The pc is running without obvious defects.

Is it possible to say whether the "copy" reported in the mbr output above remains a cause for concern? If so, what steps would I be advised to take?

Thanks for any help.

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:03 PM

Posted 15 January 2010 - 12:02 AM

If the log results say both say both the user & kernel MBR are OK, its not considered an active MBR infection even if it indicates detected hooks/malicious code. If the output said...

MBR rootkit code detected !
MBR rootkit infection detected !
Use: "mbr.exe -f" to fix.,

then you would need to be concerned about an infection. The presence of malicious code and a PE file indicates that there was an infection but it has been cleaned and the MBR has been restored successfully.

Mebroot overwrites the MBR of the hard disk and uses rootkit techniques to hide itself. The installer of the rootkit writes the content of a malicious kernel driver to the last sectors of the disk, and then modifies sectors to include sector 0 (MBR). According to gmer, fixmbr restores only sector 0 (MBR) and as such, mbr.exe will always show all sectors that were related to Mebroot even after the infection is removed.

Go to Control Panel > User Accounts and remove HelpAssistant Account after cleanup.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 Themakaris

Themakaris
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:03 PM

Posted 15 January 2010 - 05:47 AM

Thanks for the response and the reassurance..

[For your information, HelpAssistant was never shown as a user in User Accounts (XP Home, SP3), but there was a profile stored under System > Advanced > User Accounts; deleting this profile removed the folder and it hasn't subsequently been recreated. ]

I naturally accept your diagnosis of "no active infection" - however, restoring the MBR, as I undersand it, didn't of itself clear the original malware. Presumably the clean scans by ESET, Malwarebytes, SuperAntiSpyware, Windows Live Scanner (and others), plus the non-recreation of the HelpAssistant folder, is what makes you confident that the system is now clean?

Thanks again..

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:03 PM

Posted 15 January 2010 - 09:48 AM

Following the recommendation to run mbr -f restored your MBR successfully. With these types of infections making the rounds these days, a combination of effective security scanning/cleaning tools is usually required to ensure the malicious files and registry modifications are detected/removed.

How is your computer running now? Are there any more reports/alerts, signs of infection or issues with your browser?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 Themakaris

Themakaris
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:03 PM

Posted 15 January 2010 - 10:43 AM

No issues and no current signs of infection (other than the "copy" referred to in the mbr report).

Thanks.

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:03 PM

Posted 15 January 2010 - 10:51 AM

You're welcome.

Tips to protect yourself against malware and reduce the potential for re-infection:

Keep Windows and Internet Explorer current with all critical updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. If you're not sure how to do this, see Microsoft Update helps keep your computer current.

Avoid gaming sites, porn sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs (i.e. Limewire, eMule, uTorrent). They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. Porn sites can lead to the Trojan.Mebroot MBR rootkit and other dangerous malware. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.Beware of Rogue Security software as they are one of the most common sources of malware infection. They infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware. For more specific information on how these types of rogue programs and infections install themselves, read:Keeping Autorun enabled on USB (pen, thumb, jump) and other removable drives has become a significant security risk as they are one of the most common infection vectors for malware which can transfer the infection to your computer. To learn more about this risk, please read:Many security experts recommend you disable Autorun asap as a method of prevention. Microsoft recommends doing the same.

...Disabling Autorun functionality can help protect customers from attack vectors that involve the execution of arbitrary code by Autorun when inserting a CD-ROM device, USB device, network shares, or other media containing a file system with an Autorun.inf file...

Microsoft Security Advisory (967940): Update for Windows Autorun
How to Maximize the Malware Protection of Your Removable Drives

Other related reading sources:• Finally, if you need to replace your anti-virus, firewall or need a reliable anti-malware scanner please refer to:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users