Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

MBR:SST Rootkit Removal, Help please!


  • Please log in to reply
6 replies to this topic

#1 Eskimio

Eskimio

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 15 July 2014 - 12:28 PM

Hi,

 

This morning my father's workstation would not boot into Windows 7. I installed the boot scan tool from Avast! onto a USB and ran it. Here were the results:

 

http://i.imgur.com/kWoHspp.jpg

 

4 of the 5 items were successfully deleted/quarantined, etc.

The 5th item, the first in that list, is a Master Boot Record rootkit.

I am still unable to boot into Windows 7.

When booting, it will show the splash screen with the Windows flag, but seconds after showing said screen the computer restarts and is stuck in the loop.

System repair will freeze with a full progress-bar.

Safe mode freezes at loading the classpnp.sys driver, then subsequently reboots.

After running a Windows 7 boot disk system repair, it states the problem could not be fixed.

At this point I have booted into the computer using a Linux Mint live cd (that I'm currently using to type this) from which my father extracted the majority of important and sensitive files. The HDD has two partitions, one for system files and programs, one for data. The Data partition is 4GB and could be copied to an external drive or flash USB, then the drive could be reformatted.

However, I'm inquiring to see if there is any way to save the current install without reformatting even though I cannot currently boot into the Windows 7 operating system.

Or, rather, can the rootkit be extracted/removed from the MBR without booting into an operating system. As in, say, a boot-time USB rootkit removal software? I cannot seem to find anything of this kind.

Thoughts?


Edited by Eskimio, 15 July 2014 - 12:31 PM.


BC AdBot (Login to Remove)

 


m

#2 JohnC_21

JohnC_21

  • Members
  • 21,659 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:00 AM

Posted 15 July 2014 - 01:42 PM

If you can boot to a command prompt:

 

Bootrec /fixmbr  <enter>

Bootrec /fixboot <enter>

 

You can make a bootable system repair disk if you have another computer with Windows 7.



#3 Eskimio

Eskimio
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 15 July 2014 - 01:50 PM

JohnC_21, I can get to a command prompt via the Win7 boot disk I already have.

I'll try that, thanks.



#4 Eskimio

Eskimio
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 15 July 2014 - 02:04 PM

JohnC_21, well it did SOMETHING.

I can now boot into Windows both via Safe Mode and Normal boot... however, all I get is a cursor on a blank screen.

That's it.


I think I'm going to use my Linux live disc to pull all the data we want and just reformat. Seem's like the easiest course of action at this point.



#5 JohnC_21

JohnC_21

  • Members
  • 21,659 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:00 AM

Posted 15 July 2014 - 02:13 PM

At the command prompt type:

 

bootrec /rebuildbcd

 

See if you can boot to Windows

 

If that does not work type this at the command prompt

 

bcdboot C:\Windows

Reboot


#6 Eskimio

Eskimio
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 15 July 2014 - 02:58 PM

JohnC_21,

 

We've opted to just do a fresh install.

Thanks for your help.



#7 JohnC_21

JohnC_21

  • Members
  • 21,659 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:00 AM

Posted 15 July 2014 - 03:10 PM

Being a rootkit, that was probably the best way to go. I would suggest after doing the clean install and all updates to download and install something like Macrium Free and create a disk image to an external drive. Macrium will also let you create a WinPE bootable disk with a small download should the computer not boot because of malware or the hard drive becomes defective. Bad disk? Put in a new one, boot the WinPE disk and restore the Image. Macrium is very fast at restoring Images. It has saved my bacon quite a few times.

 

http://www.macrium.com/reflectfree.aspx






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users