2

I have run hitman pro and found 'traces of the TDL3 Alureon' rootkit on the computer. However, running TDSSKiller would of solved this issue - but - apparently the symptoms keep coming back so I decided to scan using COMBOFIX. I have run it once, it found a rootkit on the MBR. Rebooted the computer, the symptoms were still there. I ran COMBOFIX again, still detecting the rootkit. Is there a way to get rid of it without having to format the hard disk? Here is the log message:

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86EE3ACE]<< 
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7605f28
\Driver\ACPI -> ACPI.sys @ 0xf7578cb8
\Driver\atapi -> atapi.sys @ 0xf750a852
\Driver\iaStor -> iaStor.sys @ 0xf7477918
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
 ParseProcedure -> ntoskrnl.exe @ 0x80578f7a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
 ParseProcedure -> ntoskrnl.exe @ 0x80578f7a
NDIS:  -> SendCompleteHandler -> 0x0
 PacketIndicateHandler -> 0x0
 SendHandler -> 0x0
user & kernel MBR OK 

**************************************************************************
Jean-François Beaulieu
  • 155
  • 2
  • 7

2 Answers2

1

Use boot manager repair procedure for your operating system. It should overwrite MBR data, so you should be safe. Just to be safe you could repeat procedure several times.

AndrejaKo
  • 17,075
  • 20
  • 80
  • 128
  • 2
    No sense in repeating the procedure. Cleaning the hard drive is not like cleaning glass. – Catherine Aug 19 '10 at 18:38
  • Maybe, maybe not. Data from a formatted disk can be restored and I did hear (unconfirmed) reports of viruses reinfecting systems after entire disk was nulled. It's better to be safe than sorry. – AndrejaKo Aug 19 '10 at 18:42
  • I have to mention, this computer is not running Windows Vista, but Windows XP SP3. I am supposing that in this case we boot with the XP installation CD and when prompted, press R to repair a Windows XP installation. – Jean-François Beaulieu Aug 19 '10 at 18:49
  • @Kaeso Well, yes. I can't remember at this time exact procedure and don't have any XP disks to try it out, but you should be able to get into repair console. There you'll have command like FIXMBR or something similar (FIXBOOT, I think only fixes configuration on windows partition, not the MBR). You can type HELP too. It will display list of available options. It's not too complicated. – AndrejaKo Aug 19 '10 at 18:56
0

Maybe you should try the Kaspersky TDSSKiller by downloading it from http://support.kaspersky.com/downloads/utils/tdsskiller.zip, unzipping it, renaming the .exe program to "something".com, run it and follow the directions. It worked wonderfully on a PC infected with the Alureon' rootkit.

Doug
  • 1