Click here to get back home

I've done both of these 'silly things'!
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.security.virus    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
I've done both of these 'silly things'! ~BD~ 03-30-2008
Posted by jen on April 14, 2008, 8:33 pm
Please log in for more thread options
 The OP's OS is XP. He should instead boot from the Recovery Console and
type: fixmbr.

Fixmbr Command Syntax:

fixmbr (device_name):

device_name = This is where you designate the exact drive location that
a master boot record will be written to. If no device is specified, the
master boot record will be written to the primary boot drive.
Fixmbr Command Examples:

fixmbr \Device\HardDisk0

In the above example, the master boot record is written to the drive
located at \Device\HardDisk0.

fixmbr:

In this example, the master boot record is written to the device that
your primary system is loaded onto. If you have a single installation of
Windows installed, which is normally the case, running the fixmbr
command in this way is usually the right way to go.
Fixmbr Command Availability:

The fixmbr command is only available from within the Recovery Console in
Windows 2000 and Windows XP.

-jen

> Boot using a DOS setup floppy (latest/last version).
>
> Type fdisk /mbr
>
> The /mbr is an undocumented call that will replace the mbr on the
> master hard drive. It is best to physically disconnect all other hard
> drives when performing this call to prevent any unwanted actions due
> to multiple hard drives being connected.
>
>
>> Indeed, Kurt. Thank you for your response.
>>
>> A quote from Computer Active
>>
http://www.computeractive.co.uk/computeractive/news/2207251/mebroot-attack-takes-security
>>
>> "Mebroot, which is designed to steal personal information and bank
>> details, is embedded in legitimate websites.
>> If the latest updates and patches for browsers or the XP operating
>> system have been applied, then anti-virus software can stop the
>> rootkit and the associate malware such as keystroke loggers and
>> others it downloads.
>>
>> But if patches have not been applied the malware downloads to a PC
>> and then hides from security software. It can be removed quite
>> simply, according to Hypponen, but currently only by the user
>> rewriting the MBR".
>>
>> My question remains. HOW does a user rewrite the MBR.
>>
>> Many thanks to anyone who can provide the answer!
>>
>> --
>>
>> Dave
>>
>>
>>
>>
>>
>>
>



Posted by FromTheRafters on April 1, 2008, 8:37 pm
Please log in for more thread options
> FromTheRafters wrote:
> [snip]
>>> I do take on board, though, your point regarding backups possibly being
>>> contaminated.
>>
>> The chances of you having the specific kind of virus that attaches to
>> boot code is extremely small.
>
> true for viruses, less true for malware in general... specifically,
> there's mbr malware being deployed via drive-by downloads from compromised
> websites as we speak... i believe you can get more information by
> searching for the keyword "mebroot"...

Thanks kurt, I'll check that out. :o)


Posted by David H. Lipman on April 1, 2008, 9:05 pm
Please log in for more thread options

|
>> FromTheRafters wrote:
>> [snip]
>>>> I do take on board, though, your point regarding backups possibly being
>>>> contaminated.
>>>
>>> The chances of you having the specific kind of virus that attaches to
>>> boot code is extremely small.
>>
>> true for viruses, less true for malware in general... specifically,
>> there's mbr malware being deployed via drive-by downloads from compromised
>> websites as we speak... i believe you can get more information by
>> searching for the keyword "mebroot"...
|
| Thanks kurt, I'll check that out. :o)

The mebroot is a Trojan that uses the MBR as part of its RootKit technique.

http://www.symantec.com/enterprise/security_response/weblog/2008/01/from_bootroot_to_trojanmebroot.html

http://www.symantec.com/security_response/writeup.jsp?docid=2008-010718-3448-99

This is different from the traditional boot sector infectors which are true
viruses.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Posted by FromTheRafters on April 2, 2008, 6:30 pm
Please log in for more thread options

>
> |
>>> FromTheRafters wrote:
>>> [snip]
>>>>> I do take on board, though, your point regarding backups possibly
>>>>> being
>>>>> contaminated.
>>>>
>>>> The chances of you having the specific kind of virus that attaches to
>>>> boot code is extremely small.
>>>
>>> true for viruses, less true for malware in general... specifically,
>>> there's mbr malware being deployed via drive-by downloads from
>>> compromised
>>> websites as we speak... i believe you can get more information by
>>> searching for the keyword "mebroot"...
> |
> | Thanks kurt, I'll check that out. :o)
>
> The mebroot is a Trojan that uses the MBR as part of its RootKit
> technique.
>
>
http://www.symantec.com/enterprise/security_response/weblog/2008/01/from_bootroot_to_trojanmebroot.html
>
> http://www.symantec.com/security_response/writeup.jsp?docid=2008-010718-3448-99
>
> This is different from the traditional boot sector infectors which are
> true viruses.

Thanks Dave. If you have this, and you format the disk,
are you essentially left with just a corrupted MBR?


Posted by David H. Lipman on April 2, 2008, 6:46 pm
Please log in for more thread options


>>
>> The mebroot is a Trojan that uses the MBR as part of its RootKit
>> technique.
>>
>>
http://www.symantec.com/enterprise/security_response/weblog/2008/01/from_bootroot_to_trojanmebroot.html
>>
>>
http://www.symantec.com/security_response/writeup.jsp?docid=2008-010718-3448-99
>>
>> This is different from the traditional boot sector infectors which are
>> true viruses.

|
| Thanks Dave. If you have this, and you format the disk,
| are you essentially left with just a corrupted MBR?

I don't think so but... I can't say for sure.

I would say that IF you went to this method, you should delete the partition
table,
repartition and then reformat not just reformat the hard disk.


BTW: Symantec has a removal tool...
http://www.symantec.com/security_response/writeup.jsp?docid=2008-020817-4716-99

What the tool does
The Removal Tool does the following:
- Restores the Master Boot Record
- Terminates the associated processes
- Deletes the associated files

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Similar ThreadsPosted
My cursor has taken over my computer, opening windows and doing things April 4, 2007, 10:47 am
Where is the list of things Windows Defender Addresses? August 16, 2007, 8:56 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap