PDA

View Full Version : Mebroot.MBR


huffman_j
February 28th, 2010, 02:08 AM
NOD32 gives an alert:
Win32/Mebroot.mbr trojan
MBR section of the 1. physical drive

As this is only an alert, NOD will NOT remove the trojan. -{ Quote: "Is there anyway to get NOD to remove the threat? " }- I downloaded Symantec's FixMebroot and it does not find the trojan as being active.

Is NOD giving a false reading or is it real. On one site that told how to fix it, it said to find the trojan and delete it. Since it seems to be in the MBR how do I find it to delete it.

Any suggestions would be greatly appreciated.

siljaline
February 28th, 2010, 02:15 AM
You can download a removal tool here (http://www.eset.eu/buxus/generate_page.php?page_id=20689)
A full description of the Trojan may be found here (http://www.eset.eu/encyclopaedia/mebroot_backdoor_sinowal_trojan_mebroot_stealth_mbr_trojan_backdoor_maosboot?lng=en)

ESS3
February 28th, 2010, 07:18 AM
-{ Quote: "NOD32 gives an alert:
Win32/Mebroot.mbr trojan
MBR section of the 1. physical drive

As this is only an alert, NOD will NOT remove the trojan. I downloaded Symantec's FixMebroot and it does not find the trojan as being active.

Is NOD giving a false reading or is it real. On one site that told how to fix it, it said to find the trojan and delete it. Since it seems to be in the MBR how do I find it to delete it.

Any suggestions would be greatly appreciated." }-
ESET SysInspector Service Script removes Mebroot all versions(+stoned) ;)

huffman_j
March 1st, 2010, 05:29 AM
ailjaline the removal tool worked great, thank you.

ESS3 I also got ESET SysInspector Service Script to keep in my arsonal thanks very much.

siljaline
March 1st, 2010, 08:42 AM
Thanks for letting us know the removal tool worked huffman_j

Please advise is there is anything else we can do for you.

Regards,