Rootkit: hidden boot sector

Page 2 of 2 Previous  1, 2

View previous topic View next topic Go down

Rootkit: hidden boot sector

Post by AdkWoody on Wed 11 May 2011, 2:59 pm

First topic message reminder :

Hello all. I have a friends computer that I'm working on trying to remove this pesky thing. File name is MBR:\\.\PHYSICALDRIVE0 and the Rootkit name is Rootkit: hidden boot sector. Avast has picked it up every time and says it has deleted it every time. I have even done a boot scan, it caught it, said it got rid of it, did another scan after start up and it said nothing found. Not a half hour later, avast says it found the rootkit again. There is no restore point to go from since my friend never created one and earlier today was the most recent. Malwarebytes comes up clean, and housecall.trendmicro.com comes up clean. There is no boot disk or windows disk to load to wipe it clean. I do have the application dvd and the drivers and utilities dvd. Is there anything I can do to fix this with what I have?

AdkWoody

Rookie Surfer
Rookie Surfer

Posts : 69
Joined : 2010-08-17
Operating System : Windows 7 Home Premium 64-Bit

View user profile

Back to top Go down


Re: Rootkit: hidden boot sector

Post by AdkWoody on Wed 18 May 2011, 12:01 am

Awesome! I think it's gone then! What's the MBR? I know that Avast and TDSSkiller both came back clean. Thanks again Crush!

AdkWoody

Rookie Surfer
Rookie Surfer

Posts : 69
Joined : 2010-08-17
Operating System : Windows 7 Home Premium 64-Bit

View user profile

Back to top Go down

Re: Rootkit: hidden boot sector

Post by Crush on Wed 18 May 2011, 5:22 am

The Master Boot Record. This infection will produce a detection from Avast similar to what you're stating. Is the detection from the first post gone?

Crush

Tech Officer
Tech Officer

Posts : 3889
Joined : 2010-01-28

View user profile

Back to top Go down

Re: Rootkit: hidden boot sector

Post by AdkWoody on Thu 19 May 2011, 4:20 am

Yes. All is gone nothing is being detected. Thank you so much for your help Crush! My friend thanks you too!

AdkWoody

Rookie Surfer
Rookie Surfer

Posts : 69
Joined : 2010-08-17
Operating System : Windows 7 Home Premium 64-Bit

View user profile

Back to top Go down

Re: Rootkit: hidden boot sector

Post by Crush on Thu 19 May 2011, 4:55 am

To uninstall ComboFix



  • Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  • In the field, type in ComboFix /uninstall




(Note: Make sure there's a space between the word ComboFix and the forward-slash.)



  • Then, press Enter, or click OK.
  • This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.

====

Download Security Check from here or here.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


Crush

Tech Officer
Tech Officer

Posts : 3889
Joined : 2010-01-28

View user profile

Back to top Go down

I have a similar issue

Post by Lapps on Sat 02 Feb 2013, 1:18 am

Hey guys,
I made an account specifically for noticing this thread. My problem is that my world of warcraft account continuously gets hacked, and I have FOUR of those things popping up in my avast security when I try doing a quick scan. The datasafe_green pops up, along with the following:
|>diff_000001.dif
|>IRIMG1.BMP
|>IRIMG1.JPG

Now I notice you guys have figured these notices are not of issue, however what is it exactly that keeps on gaining access to my WOW account and locking it? Is it a keylogger? And what can I do to get rid of this? It's been happening for several years even when I was not playing on the account.

Any help will be greatly appreciated!!
Lapps

Lapps

Unborn
Unborn

Posts : 1
Joined : 2013-02-02
Operating System : Windows 7

View user profile

Back to top Go down

Re: Rootkit: hidden boot sector

Post by Sponsored content Today at 12:45 am


Sponsored content


Back to top Go down

Page 2 of 2 Previous  1, 2

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum