MBR Rootkit - sector mismatches - hiberfil.sys locked

lckc · Jan 22, 2010

Computer seems to be running fine but RootRepeal indicates there is a MBR Rootkit dectected on C & D drives. Both drives have numerous sector mismatches. The C drive indicates that hiberfil.sys is locked to Windows API.
Not sure or confident that the system is free of all malware.
Have completed Read Me Run Me First tasks.
Have read numerous MajorGeeks MBR and hiberfil threads.
Ran MBR.exe fix guidance found in Tim W instructions in one of the threads after seeing the same initial guidance in several threads (in and out of MajorGeeks) so I will attach those files as well.
Have tested the internet connection and several programs and they seem to work fine.
Would appreciate any guidance that can be provided as to system soundness.
Is it free of malware or not?

MGtools and mbr logs will be attached to the next thread.

lckc · Jan 22, 2010

MGtool log and mbr logs attached.
Also attached RootRepeal ShadowSSDTlog which indicated an number of locked items.

Your guidance is appreciated.

TimW · Jan 23, 2010

Your logs are clean. There is no trace of any MBR infection and I would strongly advise you not to follow instructions given for other computers.

You have traces of Norton still on your system. Please give the Norton Removal Tool (SymNRT) a run > reboot your machine and then run it again for good measure.

Run this: Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

You should also not have torrents running at start up. You may wish to use one of these:

Startup_CPL

Since you are not having any malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real-time protection. They are useful as backup scanners.They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore ato create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

lckc · Jan 26, 2010

Tim W, Thank you for taking the time to check out my logs and signal the all clear. Folllowed all of your instructions regarding cleaning up the loose ends by removing program fragments and checking the start up menu for unneeded programs. After checking every program that is executed on start up I did not find the torrent program you refered to in your last post. I guess I did not know what to llook for. I used the Bleeping Computer startup definitions library (http://www.bleepingcomputer.com/startups/) for guidance but did not find anything out of the ordianry. Would appreciate more specific guidance here as I agree we don't need torrents running on start up.

In any case thank you very much for your guidance and assistance.

All the best.

TimW · Jan 27, 2010

Well.........did someone just swap logs??? roflmao.

I swear it was there before, but unless my mind was still holding a few bits of info from someone elses logs, there is no sign of you having a torrent running at start up. ( Yes, for a child of almost 2, I made a mistake. Sorry about that!!)

You are most welcome. Safe surfing!!

lckc · Jan 28, 2010

Thanks for rechecking the logs for me. Glad I did not miss something.
Can only imagine how many log lines you are viewing very likely multitasking as most of us do. Certainly no apologies necessary considering how helpful you have been.
A sincere thanks for all of your assistance.

TimW · Jan 29, 2010

You are quite welcome. Safe surfing.

Log in or Sign up

MBR Rootkit - sector mismatches - hiberfil.sys locked

lckc Private E-2

Attached Files:

SAS Log - 01-22-2010 - 13-18-31.txt

mbam-log-2010-01-22 (13-41-28).txt

lCombofixog.txt

rootrepeallog.txt

lckc Private E-2

Attached Files:

MGlogs.zip

mbr1.log

mbr2.log

RootRepealShadowSSDTLog.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

lckc Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

lckc Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member