MBR Trojan 

essexboy · 2008-01-09T22:24:45.000Z

As long as you have the recovery consol on XP you shoud be OK. Need to check Vista though

EDIT : Found it

/FixMbr
The /FixMbr option writes a Windows Vista-compatible MBR to the system partition. This option does not overwrite the existing partition table. Use this option when you must resolve MBR corruption issues, or when you have to remove non-standard code from the MBR.

http://support.microsoft.com/kb/927392

szc · 2008-01-09T23:52:03.000Z

This is becoming uncontrollable! It looks like pretty soon Windows machines will be totally doomed ;D

oldman960 · 2008-01-10T00:27:33.000Z

SasH post:4:

This is becoming uncontrollable! It looks like pretty soon Windows machines will be totally doomed ;D

Maybe, but then we’d have to deal with M^cTrojans.

szc · 2008-01-10T03:22:00.000Z

Not a single one here… comparing to my Windows machine, working on and using my Mac is real pleasure.

essexboy · 2008-01-10T12:02:30.000Z

If you surf safely then the great majority of these infections will not affect you - but if you like crakz - p**n sites and use p2p without scanning then I will await your visit

But a lot of this is, in a way paranoia, I mean I just have an AV and windows firewall and have yet to be unintentionally infected, and the times I tried to get myself infected I found it hard. Be safe

Lisandro · 2008-01-10T12:36:38.000Z

essexboy post:3:

As long as you have the recovery consol on XP you shoud be OK.

Will the fixmbr restore the information of all the partitions on my disk? Even Linux ones?

essexboy · 2008-01-10T12:39:52.000Z

It will replace the old MBR with a clean version from the recovery consol, but I am not sure how that would affect Linux. But doesn’t Linux have its own version of MBR or am I thinking of Bootstrap ???

Lisandro · 2008-01-10T13:38:29.000Z

essexboy post:9:

But doesn’t Linux have its own version of MBR or am I thinking of Bootstrap ???

Yes, Linux has. But when you have a dual boot system, some of them should control the MBR. Windows has its own boot loader, and Linux has LILO or GRUB. My system uses the Windows loader at the boot sector of the first partition and it is redirected to Linux in another partition.
Maybe I’m messing MBR and boot sector ???

Dwarden · 2008-01-10T18:24:13.000Z

good news there is detection , it would be bad if not lol

essexboy · 2008-01-10T22:31:14.000Z

Dwarden post:11:

good news there is detection , it would be bad if not lol

Plus it is easy peasy to remove

polonus · 2008-01-10T22:31:37.000Z

Hi folks,

Avast can handle this now, but of course a cure for this is using the fixmbr command which is a recovery console command that is available in the below Microsoft Operating Systems.

Windows 2000
Windows XP

polonus

system · 2008-01-12T15:57:09.000Z

So Avast can detect this new Mebroot rootkit trojan?

Lisandro · 2008-01-12T18:18:54.000Z

sanctuary24 post:14:

So Avast can detect this new Mebroot rootkit trojan?

As far I can understand, yes.

system · 2008-01-12T18:29:05.000Z

Good News…!!!

SpeedyPC · 2008-01-13T05:31:08.000Z

Tech post:15:

sanctuary24 post:14:

So Avast can detect this new Mebroot rootkit trojan?

As far I can understand, yes.

Great! now we all can have peace and safe using Avast ;D…I’m not worried

szc · 2008-01-13T14:44:23.000Z

SpeedyPC post:17:

Tech post:15:

sanctuary24 post:14:

So Avast can detect this new Mebroot rootkit trojan?

As far I can understand, yes.

Great! now we all can have peace and safe using Avast ;D…I’m not worried

Praises aside, it is nice to know you’re protected, but I haven’t noticed any official statement from Alwil in this thread. Or am I missing something here ? Who can guarantee this “good news there is detection” is official ?

Lisandro · 2008-01-13T14:50:25.000Z

SasH post:18:

I haven’t noticed any official statement from Alwil in this thread. Or am I missing something here ? Who can guarantee this “good news there is detection” is official ?

Nobody guarantees it’s official…

Tech post:15:

As far I can understand, yes.

It will be good if Maxx posts something here…

Lisandro · 2008-01-20T12:13:02.000Z

Tech post:15:

sanctuary24 post:14:

So Avast can detect this new Mebroot rootkit trojan?

As far I can understand, yes.

Not so sure anymore…
http://forum.avast.com/index.php?topic=32547.0;topicseen

system · 2008-01-20T14:13:15.000Z

If your windows is upto date,and you also use limited user rights,I beleive you will not get infected.Gmer detects and removes this threat.You need to scroll down,to read article
http://blog.washingtonpost.com/securityfix/

system · 2008-01-30T16:27:56.000Z

Dr.Web " first AV " to be able to remove MBR ,( I presume that include Cureit too )
http://info.drweb.com/show/3257/en

Announcements