Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with Win32/Mebroot Trojan


  • Please log in to reply
4 replies to this topic

#1 dj78

dj78

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:10 AM

Posted 26 December 2010 - 07:07 PM

Hi all,

My Win 7 desktop has been infected with a nasty Win32/Mebroot Trojan and I'm unable to remove it.

The strange thing is this Trojan was infected on another operating system (XP) and hard disk. When I had that Trojan/virus last week I tried a number of different programs to kill it including Avast, Vipre, NOD32, Malwarebytes Anti-Malware and SuperAntiSpyware but none have been able to remove it. NOD32 picked it up but it's unable to delete or clean it.

So I gave up and bought a new HD and installed a legit copy of Windows 7 Pro 64 Bit on it.

Before shelfing the old HD, I backed up all the files I needed from the HD to the external HD. Yesterday I connected up my external HD to the desktop comp to retrieve some files.

I re-installed NOD32 today and I'm shocked, it's picked up the same Win32/Mebroot Trojan again and again NOD32 is unable to clean it or remove it (even in safe mode). I definitely have not visited any risky sites or let anything installed without my knowledge. Is it possible this Trojan has copied itself onto the new operating system from the external HD? How can I get rid of it?

Please help.

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,176 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:10 AM

Posted 26 December 2010 - 07:37 PM

Hello as the proper logs are not posted I moved this to the Am I Infected forum.
The infection is deeper than that.

Win32/Mebroot replaces the original MBR (Master Boot Record) of the hard disk drive with its own program code, as well as placing additional code to load and patch the following files:

Win32/Mebroot is a trojan that installs Win32/PSW.Sinowal malware.

Win32/PSW.Sinowal is a trojan that steals passwords and other sensitive information.

The trojan is able to log keystrokes. The trojan can send the information to a remote machine.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 dj78

dj78
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:10 AM

Posted 26 December 2010 - 08:33 PM

Hi Boopme, I'm using the laptop now. This machine is clean. The desktop machine has been disconnected from the Internet.
I haven't done any online banking so should be OK. Have changed passwords on my accounts.
I didn't realize how serious this Trojan was!

I'm happy to do a reformat and re-install the OS. The re-installation notes on the link you provided says I should back up my data - that's my biggest concern, if I back up my data to my external HD and use it again in future, will I be infected again? I've currently partitioned the HD into 2 partitions, will I need to format D: as well?

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,176 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:10 AM

Posted 26 December 2010 - 08:53 PM

Hi DJ, that'a the decision I would make if this were my PC.

Only back up your important documents, personal data files, photos to a CD or DVD drive, not a flash drive or external hard drive as they may become compromised in the process. The safest practice is not to backup any executable files (*.exe), screensavers (*.scr), autorun (.ini) or script files (.php, .asp, .htm, .html, .xml ) files because they may be infected by malware. Avoid backing up compressed files (.zip, .cab, .rar) that have executables inside them as some types of malware can penetrate compressed files and infect the .exe files within them. Other types of malware may even disguise itself by hiding a file extension or adding to the existing extension as shown here (click Figure 1 to enlarge) so be sure you look closely at the full file name. If you cannot see the file extension, you may need to reconfigure Windows to show file name extensions. Then make sure you scan the backed up data with your anti-virus prior to to copying it back to your hard drive.

If your CD/DVD drive is unusable, another word of caution if you are considering backing up to an external usb hard drive as your only alternative. External drives are more susceptible to infection and can become compromised in the process of backing up data. I'm not saying you should not try using such devices but I want to make you aware of all your options and associated risks so you can make an informed decision if its worth that risk.Again, do not back up any files with the following file extensions: exe, .scr, .ini, .htm, .html, .php, .asp, .xml, .zip, .rar, .cab as they may be infected.

If you're not sure how to reformat or need help with reformatting, please review:These links include step-by-step instructions with screenshots:Vista users can refer to these instructions:Don't forget you will have to go to Microsoft Update and apply all Windows security patches after reformatting.

Note: If you're using an IBM, Sony, HP, Compaq or Dell machine, you may not have an original XP CD Disk. By policy Microsoft no longer allows OEM manufactures to include the original Windows XP CD-ROM on computers sold with Windows preinstalled. Instead, most computers manufactured and sold by OEM vendors come with a vendor-specific Recovery Disk or Recovery Partition for performing a clean "factory restore" that will reformat your hard drive, remove all data and restore the computer to the state it was in when you first purchased it. See Technology Advisory Recovery Media. If the recovery partition has become infected, you will need to contact the manufacturer, explain what happened and ask them to send full recovery disks to use instead..

If you need additional assistance with reformatting or partitioning, you can start a new topic in the Operating Systems Subforums forum.



EDIT: You had win7,the first part is still the same.

Reformat a computer with Windows 7

How to format and Reinstall Windows 7

Edited by boopme, 26 December 2010 - 08:59 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 dj78

dj78
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:10 AM

Posted 26 December 2010 - 10:02 PM

Thank you boopme, I'm doing a deep scan of all my drives including the external HDs now with NOD32 and then will start backing up the important data before I reformat with Win 7. Hopefully it will be all OK after that.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users