Need help please with Boot.mebroot

Hello all. Thank you in advance for any help you can lend me!

I was having problems with my computer, and so did a clean reinstall of windows and reformatted my drives. I had presu,ed the problem I was having (freezing) was perhaps a virus, and though starting again would be a good idea. I reforamtted and reinstalled, but since then my Norton internet security has been detecting Boot.mebroot. It also finds it when I connect my external drives or a usb stick. It says that it removes it, but of course it doesn't.

I have followed their instructions and run the fixmbr and then performed the full scan. But so far no luck, It keeps reappearing.

When I decided to reformat my externals, I transferred all the data onto my desktop. If I need to reformat it all again, would the trojan be contained in those files if I backed them up to an external again? There is much there that I would not like to lose.

Any help you could give me on removing this would be greatly appreciated

Thanks

gus

Mebroot is a Trojan horse that overwrites the Master Boot Record of the hard disk with its own code and stores a copy of the original master boot record at another sector (62) while using rootkit techniques to hide itself. The installer of the rootkit writes the content of a malicious kernel driver to the last sectors of the disk, and then modifies sectors 0 (MBR), 60, 61 and 62.

...During infection, it copies itself to the %temp% folder and starts as a service. This service overwrites the MBR with its own code and keeps a backup of original MBR in sector 62. It also overwrites sector 60 and 61 with rootkit loader code and rootkit components in the last sectors of the active partition. Later it restarts the system. Upon reboot, the infected MBR takes control of the system and gives control to the rootkit loader code. The loader code then patches the kernel to load and start its rootkit component.

StealthMBR Rootkit

Mebroot is contracted and spread through ads in spam e-mail attachments, by using shared folders on peer-to-peer networkes, using Torrents, and via drive-by downloads when visiting porn and malicious websites using browser exploits. For more specific details about this infection, read:

• The Rise of MBR Rootkits
• MBR Rootkit: A Web Threat?
• Stealth MBR rootkit
• Master Boot Record Rootkit is here
• Botnets and Torpig

If it keeps reappearing after using the "mbr.exe -f" command, then either that fix did not work or you are getting reinfected through one of its spreading venues.

Edited by quietman7, 07 February 2010 - 09:04 AM.