Click here to get back home

I've done both of these 'silly things'!

 HomeNewsGroups | Search | About
 microsoft.public.security.virus    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
I've done both of these 'silly things'! ~BD~ 03-30-2008
Posted by ~BD~ on April 1, 2008, 3:37 am
Please log in for more thread options
Indeed, Kurt. Thank you for your response.

A quote from Computer Active
http://www.computeractive.co.uk/computeractive/news/2207251/mebroot-attack-takes-security

"Mebroot, which is designed to steal personal information and bank details,
is embedded in legitimate websites.
If the latest updates and patches for browsers or the XP operating system
have been applied, then anti-virus software can stop the rootkit and the
associate malware such as keystroke loggers and others it downloads.

But if patches have not been applied the malware downloads to a PC and then
hides from security software. It can be removed quite simply, according to
Hypponen, but currently only by the user rewriting the MBR".

My question remains. HOW does a user rewrite the MBR.

Many thanks to anyone who can provide the answer!

--

Dave







Posted by Richard Urban on April 14, 2008, 1:58 am
Please log in for more thread options
Boot using a DOS setup floppy (latest/last version).

Type fdisk /mbr

The /mbr is an undocumented call that will replace the mbr on the master
hard drive. It is best to physically disconnect all other hard drives when
performing this call to prevent any unwanted actions due to multiple hard
drives being connected.


> Indeed, Kurt. Thank you for your response.
>
> A quote from Computer Active
>
http://www.computeractive.co.uk/computeractive/news/2207251/mebroot-attack-takes-security
>
> "Mebroot, which is designed to steal personal information and bank
> details, is embedded in legitimate websites.
> If the latest updates and patches for browsers or the XP operating system
> have been applied, then anti-virus software can stop the rootkit and the
> associate malware such as keystroke loggers and others it downloads.
>
> But if patches have not been applied the malware downloads to a PC and
> then hides from security software. It can be removed quite simply,
> according to Hypponen, but currently only by the user rewriting the MBR".
>
> My question remains. HOW does a user rewrite the MBR.
>
> Many thanks to anyone who can provide the answer!
>
> --
>
> Dave
>
>
>
>
>
>


Posted by FromTheRafters on April 14, 2008, 10:54 am
Please log in for more thread options

> Boot using a DOS setup floppy (latest/last version).
>
> Type fdisk /mbr
>
> The /mbr is an undocumented call that will replace the mbr on the master
> hard drive. It is best to physically disconnect all other hard drives when
> performing this call to prevent any unwanted actions due to multiple hard
> drives being connected.

Care must be taken to ensure that the correct MBR code
is what replaces the existing code. Why do you assume
the "latest/last" DOS version is the correct one for the
OP's system?

>> Indeed, Kurt. Thank you for your response.
>>
>> A quote from Computer Active
>>
http://www.computeractive.co.uk/computeractive/news/2207251/mebroot-attack-takes-security
>>
>> "Mebroot, which is designed to steal personal information and bank
>> details, is embedded in legitimate websites.
>> If the latest updates and patches for browsers or the XP operating system
>> have been applied, then anti-virus software can stop the rootkit and the
>> associate malware such as keystroke loggers and others it downloads.
>>
>> But if patches have not been applied the malware downloads to a PC and
>> then hides from security software. It can be removed quite simply,
>> according to Hypponen, but currently only by the user rewriting the MBR".
>>
>> My question remains. HOW does a user rewrite the MBR.
>>
>> Many thanks to anyone who can provide the answer!
>>
>> --
>>
>> Dave
>>
>>
>>
>>
>>
>>
>


Posted by Richard Urban on April 14, 2008, 12:20 pm
Please log in for more thread options
Because I have never found a hard drive that it would not clear/rewrite the
MBR and make the drive usable again. I use what ""I"" know is best for me. I
recommend the same to others.


>
>> Boot using a DOS setup floppy (latest/last version).
>>
>> Type fdisk /mbr
>>
>> The /mbr is an undocumented call that will replace the mbr on the master
>> hard drive. It is best to physically disconnect all other hard drives
>> when performing this call to prevent any unwanted actions due to multiple
>> hard drives being connected.
>
> Care must be taken to ensure that the correct MBR code
> is what replaces the existing code. Why do you assume
> the "latest/last" DOS version is the correct one for the
> OP's system?
>
>>> Indeed, Kurt. Thank you for your response.
>>>
>>> A quote from Computer Active
>>>
http://www.computeractive.co.uk/computeractive/news/2207251/mebroot-attack-takes-security
>>>
>>> "Mebroot, which is designed to steal personal information and bank
>>> details, is embedded in legitimate websites.
>>> If the latest updates and patches for browsers or the XP operating
>>> system have been applied, then anti-virus software can stop the rootkit
>>> and the associate malware such as keystroke loggers and others it
>>> downloads.
>>>
>>> But if patches have not been applied the malware downloads to a PC and
>>> then hides from security software. It can be removed quite simply,
>>> according to Hypponen, but currently only by the user rewriting the
>>> MBR".
>>>
>>> My question remains. HOW does a user rewrite the MBR.
>>>
>>> Many thanks to anyone who can provide the answer!
>>>
>>> --
>>>
>>> Dave
>>>
>>>
>>>
>>>
>>>
>>>
>>
>


Posted by Massimo on April 14, 2008, 1:23 pm
Please log in for more thread options
Hello,

On Mon, 14 Apr 2008 01:58:59 -0400, "Richard Urban"

>Boot using a DOS setup floppy (latest/last version).
>
>Type fdisk /mbr
>
>The /mbr is an undocumented call that will replace the mbr on the master
>hard drive. It is best to physically disconnect all other hard drives when
>performing this call to prevent any unwanted actions due to multiple hard
>drives being connected.
>
>
I read this posting but do not know what has been said before. I
believe to remember that the fdisk /mbr call can only be used on a fat
(16,32?) system. Does the OP have that kind of format on his hd? If
not, could this call ruin his hd?

Massimo
============

>> Indeed, Kurt. Thank you for your response.
>>
>> A quote from Computer Active
>>
http://www.computeractive.co.uk/computeractive/news/2207251/mebroot-attack-takes-security
>>
>> "Mebroot, which is designed to steal personal information and bank
>> details, is embedded in legitimate websites.
>> If the latest updates and patches for browsers or the XP operating system
>> have been applied, then anti-virus software can stop the rootkit and the
>> associate malware such as keystroke loggers and others it downloads.
>>
>> But if patches have not been applied the malware downloads to a PC and
>> then hides from security software. It can be removed quite simply,
>> according to Hypponen, but currently only by the user rewriting the MBR".
>>
>> My question remains. HOW does a user rewrite the MBR.
>>
>> Many thanks to anyone who can provide the answer!
>>
>> --
>>
>> Dave
>>
>>
>>
>>
>>
>>

Similar ThreadsPosted
My cursor has taken over my computer, opening windows and doing things April 4, 2007, 10:47 am
Where is the list of things Windows Defender Addresses? August 16, 2007, 8:56 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap