Mebroot reinfection even after new mobo & system disk installed?

Discussion in 'Malware Help (A Specialist Will Reply)' started by miamigrrl, Apr 16, 2010.

  1. miamigrrl

    miamigrrl Private E-2

    I had a WinXP machine that got infected with boot.mebroot. The virus would slow down and eventually freeze up the machine. I spent almost 2 weeks trying to fix the machine with every method I could find to no avail. Eventually, I figured I would just go ahead and install a newer mobo I had been putting off (a replacement for my XPS 700 from Dell) and buy a new drive and install Win7.

    I upgraded my machine with no problem and one of the first things I installed was the latest Norton 360 software. I also connected my (don't shoot me) infected hard drive so I could recover my documents and photos. I figured it would be safe since Mebroot infects the boot sectors and I wouldn't be booting from the old drive.

    Well, now whenever I start my machine Norton reports 2 entries for Mebroot:
    Boot.Mebroot detected by Auto-Protect - Removed
    Boot.Mebroot detected by Auto-Protect - Fully Removed
    (It used to report 4 entries but I have since disconnected the old drive)

    My machine is not slowing down and freezing like the old one was, but I want to get rid of this Mebroot once and for all. Also, I still have to copy more files over from the old drive.

    I am running Windows 7 Ultimate 64-bit and the latest version of Norton 360.

    Any help would be greatly appreciated!
     

    Attached Files:

    miamigrrl, Apr 16, 2010
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Tell me exactly what Norton is reporting. The full path to the files.
     
    TimW, Apr 16, 2010
    #2
  3. miamigrrl

    miamigrrl Private E-2

    Unfortunately, it doesn't give a file location. I attached screenshots of the Norton advanced details windows.
     

    Attached Files:

    miamigrrl, Apr 16, 2010
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I did not see any malware on your system. It is possible that they were false positives. I would suggest you keep an eye on things and let me know if any other issues arise.

    Try running Trend HouseCall
     
    TimW, Apr 16, 2010
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Those images say it was already removed.
     
    chaslang, Apr 16, 2010
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, they do indicate that. I just want to make sure nothing else is being reported. ;)
     
    TimW, Apr 16, 2010
    #6
  7. miamigrrl

    miamigrrl Private E-2

    Sorry, I left out that it gives that message every time I restart the machine.
     
    miamigrrl, Apr 16, 2010
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The scan I asked you to do should be compatible with your version of Win7. Run it with the other hard drive attached.
     
    TimW, Apr 16, 2010
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Since I will be off the computer for a while, after you run that scan, I want you to do the following assuming you have your install cd:


    1. Insert the Windows Win7 CD-ROM into the CD-ROM drive.
    2. Restart the computer from the CD-ROM drive.
    3. Press R to start the Recovery Console when the "Welcome to Setup" screen appears.
    4. Select the installation that you want to access from the Recovery Console.
    5. Enter the administrator password and press Enter.
    6. Type the following command and press Enter:
      fixmbr
    7. Following the onscreen instructions to restore the Master Boot Record.
    8. Type exit
    9. Press Enter. The computer will now restart automatically.
    Are you still getting the message on boot up?
     
    TimW, Apr 16, 2010
    #9
  10. miamigrrl

    miamigrrl Private E-2

    Now that I connected the old HD Norton it gives me two more notices. I've attached the summary window and the detail window for the two "fully resolved" notices.
     

    Attached Files:

    miamigrrl, Apr 16, 2010
    #10
  11. miamigrrl

    miamigrrl Private E-2

    I ran the TM scan and it didn't find anything.
    I tried "FixMbr" and I still get the same messages from Norton.
     
    miamigrrl, Apr 16, 2010
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    TimW, Apr 17, 2010
    #12
  13. miamigrrl

    miamigrrl Private E-2

    Ok, it seems I have a similar problem to clevenger in this thread:
    http://forums.majorgeeks.com/showthread.php?t=212924

    I have 4 HDs in my system: 1 new system drive I installed after the mebroot infection, 2 that I use for backups and storage and the 4th one is the old system drive that was infected by mebroot.

    Norton was detecting mebroot on two drives - the old system drive and I thought it was detecting it on the new system drive. After I read clevenger's thread I decided to try unplugging the other two drives and rebooting.

    Sure enough, I didn't get any more messages about mebroot. If i recall correctly, one of the other two drives used to have a windows installation on it. Even after formatting the drive before using it for storage, Mebroot must have detected the old OS and written itself to that drive as well.

    I read somewhere that because of where mebroot writes itself the only way to really get rid of it is to do a multi-pass format such as DoD or Gutmann.

    So I'm happy that my system drive is definitely clean and I'll have to try one of those disk wiping methods on the infected drives.
     
    miamigrrl, Apr 17, 2010
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, I just replied to that thread. And I am thinking it is a false positive by Norton. The only way to be sure would be to wipe the drives and see if it persists. Even RootRepeal always says the mbr is infected on external drives. You can't run a fixmbr on a non-bootable drive. Which would be how you remove the mebroot infection.
     
    TimW, Apr 17, 2010
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Wiping the drives would have to include something that rewrites the boot record which means not just a format and reinstall.

    fixmbr can be run on other drives. See the instructions for it in the Recovery Console info. If you do not specify anything after the fixmbr command, it simply defaults to the active Windows boot drive. If you want to rewrite other partition/drives then you have to specify which ones. ;) For example:

    fixmbr \Device\HardDisk0

    In the above example, the master boot record is written to the drive located at \Device\HardDisk0.

    For additional info, see: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/bootcons_fixmbr.mspx?mfr=true
     
    Last edited: Apr 17, 2010
    chaslang, Apr 17, 2010
    #15

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds