whistler black internet

frankpost · Dec 11, 2010

Hello
Since a couple days NOD32 (Smart Security 4) tells me my pc is infected. I get the message
object:
MBR sector of the 1. physical disk
threat:
win32/mebroot.EZ trojan

I first did a clean install of windows (quick format)

When using MBRCheck it tells me physical disk nr1 is infected with the black internet whistler trojan.

The infected disk is NOT the same physical disk which my OS is installed on, and no infected files are listed when doing a virus scan on the 2 partitions of nr 1 physical disk.

I already replaced the MBR of the disk by using MBRCheck, and replacing it with a default windows 7 MBR.
Also tried combofix, and Malwarebytes' anti-malware, nothing seems to solve the problem.

I attached the mbrcheck log combofix log and OTL log

can anybody please help me solve this??
Thank you!

regards
Frank Post

Kestrel13! · Dec 11, 2010

Also I need to ask some questions:

Do you have any drives that has a non-windows installation on them

Are all drives NTFS formatted

Do you have any non-standard or special MBRs which can occur from companies like Dell or HP who frequently install additional partitions used for recovery partitions in lieu of giving CD/DVDs.

Is any program like Grub ( see:http://www.gnu.org/software/grub/ ) being used

Is drive-encryption being used?

Are any drives external USB pen drives or external hard drives being used?

VERY IMPORTANT: Do you have all important data backed up? You really should do this before continuing since we will need to rewrite your MBR to fix this and while most times this can be done without any problem, these infections can react badly and that could result in a PC not being bootable. You really don't have much choice though since these infections are too dangerous to your security to leave on a PC.

frankpost · Dec 11, 2010

Hello Kestrel13,
First of all thank you for your quick response!

the answers:

1. no other than win7 installed on physical drive 0 (c : \)
2. all drives are NTFS formatted
3. no other non-standard MBR is used/installed (its a custom installed 'desktop' pc)
4. never used/installed Grub
5. no drive-encryption is used
6. USB portable HDD is used occasionally, but not as default (the usual 'USB-stick usage')
7. got the data backed up. (data on other physical drives than the infected also need to be backed up..??)

if you need any other info please ask

thanks
regards
Frank

Kestrel13! · Dec 11, 2010

Download bootkit_remover.rar

Click the underlined DOWNLOAD text to download the file and save it to your Desktop
You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use7-Zip After extracing remover.exe to your Desktop.

Click Start, Run and copy and paste the below into the Run box and click OK.

"%userprofile%\Desktop\remover.exe" fix \\.\PhysicalDrive1
Click to expand...

Now reboot your PC and after reboot continue with the below instructions.

Now go to this MGTools and download MGtools.exe.

Run MGTools.exe as per the instructions in the Read and Run me first

Then attach the below logs:

C:\MGlogs.zip

Make sure you tell me how things are working now!

frankpost · Dec 11, 2010

I ran remover.exe as you stated, unfortunately I get the following error:

ATA_Write(): DeviceIoControl() ERROR 1
ERROR: Can't write first sector of the disk.

I also tried to run it in Safe Mode, same error

I attached the bootkit remover log

regards
Frank

Kestrel13! · Dec 11, 2010

Try again

Download bootkit_remover.rar

Click the underlined DOWNLOAD text to download the file and save it to your Desktop.

You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use7-Zip

After extracing remover.exe to your Desktop, double click the remover.exe file to run the program.

Attach or post inline here, the output from remover.exe

frankpost · Dec 11, 2010

here you go

Kestrel13! · Dec 11, 2010

That's the wrong log, I don't know if it ran correctly or not, but here is an example of what I should be seeing in the log:

Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhysicalDrive0
MD5: b19ee33a0168d5f0bb9afbe12e2bc035

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Unknown boot code
Click to expand...

Either screenshot it or attach that log if you can.

frankpost · Dec 11, 2010

sorry

here you go again:

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.2.0.0
OS Version: Microsoft Windows 7 Ultimate Edition (build 7600), 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`06500000
Boot sector MD5 is: bb4f1627d8b9beda49ac0d010229f3ff

Size Device Name MBR Status
--------------------------------------------
139 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)
Click to expand...

frankpost · Dec 11, 2010

also did the check on the infected drive, resulting in:

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.2.0.0
OS Version: Microsoft Windows 7 Ultimate Edition (build 7600), 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`06500000
Checking boot sector on \\.\PhysicalDrive1
Boot sector MD5 is: c94e92c4339c9841494beece8b9f22b6

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive1 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
Click to expand...

regards
Frank

Kestrel13! · Dec 11, 2010

Click Start, Run and copy and paste the below into the Run box and click OK.

"%userprofile%\Desktop\remover.exe" fix \\.\PhysicalDrive1
Click to expand...

Now run MGTools as previously instructed.

Then attach the below logs:

C:\MGlogs.zip

Make sure you tell me how things are working now!

frankpost · Dec 12, 2010

I managed to fix it (well..it looks like it) with mbrfix (Sysint).

Remover returned the write error, but for some reason mbrfix did work (first cleaned the mbr, and then created a new one)

nonetheless thank you for your time, much appreciated!!!

regards
Frank

Kestrel13! · Dec 12, 2010

You're more than welcome. Do you wish to run MGTools just so I can check for any remaining malware?

Log in or Sign up

whistler black internet

frankpost Private E-2

Attached Files:

OTL.Txt

ComboFix.txt

MBRCheck_12.11.10_16.58.18.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

frankpost Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

frankpost Private E-2

Attached Files:

bootkit_remover_debug_log.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

frankpost Private E-2

Attached Files:

bootkit_remover_debug_log.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

frankpost Private E-2

frankpost Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

frankpost Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Log in or Sign up

whistler black internet

frankpost Private E-2

Attached Files:

OTL.Txt

ComboFix.txt

MBRCheck_12.11.10_16.58.18.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

frankpost Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

frankpost Private E-2

Attached Files:

bootkit_remover_debug_log.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

frankpost Private E-2

Attached Files:

bootkit_remover_debug_log.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

frankpost Private E-2

frankpost Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

frankpost Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches