Rootkit infection requires Windows reinstall, says Microsoft

augiedoggie · Jun 30, 2011

This is about 'Popureb'. Keep your machines backed up and watch your surfing habits.

A new variant of a Trojan Microsoft calls "Popureb" digs so deeply into the system that the only way to eradicate it is to return Windows to its out-of-the-box configuration, Chun Feng, an engineer with the Microsoft Malware Protection Center (MMPC), said last week on the group's blog.
"If your system does get infected with Trojan:Win32/Popureb.E, we advise you to fix the MBR and then use a recovery CD to restore your system to a pre-infected state," said Feng.
Click to expand...

Computerworld

On a similar note:

Massive botnet 'indestructible,' say researchers

A new and improved botnet that has infected more than four million PCs is "practically indestructible," security researchers say. "TDL-4," the name for both the bot Trojan that infects machines and the ensuing collection of compromised computers, is "the most sophisticated threat today," said Kaspersky Labs researcher Sergey Golovanov in a detailed analysis Monday.
"[TDL-4] is practically indestructible," Golovanov said.
Others agree.
Click to expand...

Computerworld

TimW · Jun 30, 2011

Wonderful, esp. since most users these days don't have an install disc to use.

mjnc · Jun 30, 2011

When will government agencies and law enforcement get really serious about prosecuting the :*** JERKS that create and deliver this stuff?? :mad

Sorry, but that's just how I feel about it. rolleyes

@augiedoggie
OH, so you're a Loon now? LOL

What brought that on? :-D

thisisu · Jun 30, 2011

Looks like there is another update:

http://www.computerworld.com/s/article/9218062/Microsoft_clarifies_MBR_rootkit_removal_advice

Microsoft clarifies MBR rootkit removal advice
Now says users don't have to reinstall Windows to remove super-stealthy malware, but botnet expert disagrees
Click to expand...

Symantec offers a tool to help users do that.

Named "Norton Bootable Discovery Tool," the free download creates a boot disc for starting up the PC without accessing the hard drive -- and thus without loading the infected MBR. Once the Windows machine boots using the recovery disc, the tool downloads new malware signatures -- the digital "fingerprints" antivirus software uses to detect threats -- sniffs out signs of infection and if necessary, cleans the MBR.
Click to expand...

thisisu · Jun 30, 2011

Well that's dumb. It's a free download yet you have to have a product key for it.

Just tried to test it out :|

oma · Jul 1, 2011

Hitman Pro claims that it can remove that Rootkit infection. This is their website: http://www.surfright.nl/en

We just released a BETA version of Hitman Pro 3.5.9 build 126 that is able to detect and clean Trojan Popureb.E.

Early this week Microsoft advised Windows users to reinstall the operating system to get rid of the trojan.The new build of Hitman Pro allows to remove the trojan withing a few minutes.

We also wrote a blog post upon the matter here.

The BETA can be download here:

32-bit: http://dl.surfright.nl/HitmanPro35beta.exe
64-bit: http://dl.surfright.nl/HitmanPro35beta_x64.exe
Click to expand...

Log in or Sign up

Rootkit infection requires Windows reinstall, says Microsoft

augiedoggie The Canadian Loon - LocoAugie (R.I.P. 2012)

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

mjnc MajorGeek

thisisu Malware Consultant

thisisu Malware Consultant

oma MajorGeek