Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Infected with mebroot (MRB malware)

  • This topic is locked This topic is locked
1 reply to this topic

#1 shikuza


  • Members
  • 1 posts
  • Local time:05:40 AM

Posted 19 July 2010 - 08:20 PM

The symptoms I am receiving are background sounds of advertisement from time to time, I have nod32 and I found out that iexplorer.exe is receiving data even though I don't have internet explorer open. I checked my processes and it is indeed running, however when I try to end it it keeps reappearing.

I have use superantispyware and other software such us search and destroy but still couldn't remove it.

I've attached the dds, attach, ark logs! Thank you!

EDIT: i also have a log file for rootunhooker ~

LAST EDIT: I fixed it my self after much researching T_T

Fixed it by running mbrchecker and fixing the root ~

Attached Files

Edited by shikuza, 19 July 2010 - 10:51 PM.

BC AdBot (Login to Remove)


#2 sempai



  • Malware Response Team
  • 5,288 posts
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:06:40 PM

Posted 25 July 2010 - 12:49 AM

LAST EDIT: I fixed it my self after much researching T_T

Since this issue appears to be resolved ... this Topic has been closed.

If your the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

Everyone else please begin a New Topic.


You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users