Rootkit: hidden boot sector

Viruses and worms
41

Did you also do drive 6 with MBRcheck ? as that may be what ASWMbr is picking up

42

No, should I?

43

I also just did a rootkit scan with Avast & it still says the threat is on physical drive 1!?

44

And there is stilll no fix button ?

On your desktop should be an MBR.dat file could you scan that with Avast via the right click function
If it does not alert then could you add it to the virus chest and then upload to the virus labs

You can put my name in if you wish - I will ask GMER to look at this thread

45

If there is no mbr.dat on the desktop could you run ASWMbr again please and save the log. As GMER would like to look at it

Then do you know how to upload it to Avasts FTP incoming ?

46

http://www.mediafire.com/?o403x8vsnko345j

Here is the link for the .dat file. Still no ‘fix’ available.Uploaded it to virus labs after putting it into Avast chest.

Cheers

47

Thanks I have also sent GMER a copy to look at

48

Thanks for all your help and patience with this dude, much appreciated. :slight_smile:

49

Please go to PROFILE then Modify Profile then Forum Profile Information then select your country in Please select your country: then update your Signature: with information like my signature as this helps the helpers offer pertinent advice.
In Account Related Settings select Hide email address from public? to prevent scammers and spammers harvesting your gmail.com email address.

50

Thank you for the file.

Here is the VT report, so the MBR is definitely infected.

http://www.virustotal.com/file-scan/report.html?id=3e3eca88f3a4a4b49bfd3b0e643926a0d5e6604dd4c5b4f2f61c32af045cdbe8-1299483113

This variant doesn’t hide the MBR so the simple fix doesn’t work.

I’ll check the code and improve the tool. The other way for cleanup is fixmbr from Recovery Console.

Thanks

51

Cheers GMER ;D

OK with windows 7 it is a slightly different procedure where we need to use bootrec

There are full instructions here from MS http://support.microsoft.com/kb/927392

But the basic command from the c prompt is

bootrec /FixMbr

52

Got as far as doing the command prompt, it said operation was succesfull but I didn’t know where to go from there and microsofts instructions don’t say?

53

Reboot and see if it has gone

You did use this command at the c prompt bootrec /FixMbr

54

I did it after you do system recovery options, command prompt & bootres.exe and it comes up with a few options. Then rebooted. It’s still showing in aswMBR & Avast?

What sort of damage is this rootkit doing to my pc out of interest?

55

As it appears to be on the unused XP partition then at the moment none. Your active 7 partition is OK
How often do you use XP now ?

56

Not at all really anymore, my only worry is that I think that drive is where the start of the boot process begins as I seem to remember taking it out once and windows 7 wouldn’t boot from just the solo drive?

57

You can do that but would need to run BCDEdit to remove the XP reference

I will get that sorted in my own mind and have a fix for you tomorrow

58

GMER has now updated ASWMbr to combat this - so could you download a fresh copy and run… This time use the fixmbr button as the fix one will be inactive for this variant ;D

59

What version is the new one-just to be on the safe side!?

60

I think it is 0.94 also could you run it from the infected partition