MBR rootkit help

Hi
Last 2 days KIS2010 kept reporting a trojan found in my internet temp files and it cleaned both. This happened every night at 9pm UK time, usually it says it cleaned it and my PC works fine but last night after it found those 2 trojans I got a IRQL not equal or less BSOD. I did not install new software or hardware so that was not the cause. So I went into safe mode to install Mbam and reboot and KIS found a MBRrootkit and I press clean and restart and once I did that the computer screen went blank and pc restarted. From then on I cannot stay in windows long it either BSODs or black screen and then restarts.

So I decided to do memtest86 and ran it for 2 hours and 4 passes and got no errors. My pc still freezes and restarts randomly in safe mode so then I formatted my C drive and installed Win XP, (I was on win 7 before but cant find disk) which installed fine but after about 20 mins yet again I got a random restart.

Could this be because KIS did not remove the mbr rootkit properly?
If so how do I remove it or what else could be the issue?

thanks

 

Try scanning and cleaning with one of the many Antivirus Rescue CD's. Malware cannot fight back when scanning and cleaning with an Antivirus Rescue CD. Two of the Antivirus Rescue CD's are listed here.

https://www.wilderssecurity.com/showpost.php?p=1793528&postcount=2

 

If you can get to where you can get into Windows and stay there, you could try the Kaspersky TDSSKiller.

http://support.kaspersky.com/viruses/solutions?qid=208280684

 

Another option to get rid of a MBR rootkit is to "fix" your MBR from a boot CD. Instructions for "fixing" your MBR are given here:

http://remove-malware.com/antimalware/anti-malware-howto/getting-rid-of-mbr-rootkits-bootkit/

 

Prevx will remove the MBR Rootkit and Adware for free http://info.prevx.com/downloadcsi.asp but lets hope that KIS has removed the infecter as if the MBR keeps getting reinfected only a licened version will remove the MBR Rootkit and the infecter! Also if you want a full free version of SafeOnline that will do the same job but keep your Browsers secure while banking download this version! http://www.prevx.com/safebook.asp

HTH,

TH

 

thanks for the help
i used fixmbr in recovery console for xp and now so far no crashes and I ran gmer and it found nothing.
is gmer reliable?

 

Yes Gmer is great!

TH

 

Now, I would run DrWeb Cureit's "Express Scan". A full scan will probably take too long. Feedback from others indicates that DrWeb Cureit is one of the best at detecting/cleaning Rootkits. The first thing that DrWeb Cureit scans is all MBR's.

http://www.freedrweb.com/cureit/?lng=en

 

Reinstalling XP will almost certainly write a new MBR unless perhaps you did a "repair install". FIXMBR would also be very effective, as well as being a lot easier to do, although certain types of malware, if they're still active in the system, will just write their redirection code back to the MBR again.

Even if some orphaned malware code remains on the disk (perhaps in a private encrypted filesystem near the end of the disk, as some will do), it still needs to be executed, otherwise it can do nothing. A fresh MBR and a fresh install should cut off all execution possibilities. If you're really concerned and you want to be absolutely certain then you could use the hard drive manufacturer's diagnostics program to fill the entire drive with zeros before installing the OS.

 

Thanks
Weird thing is after my.xp install it done.the same black screen and reboot so I.ran memtest and got no.errors so then done fixmbr and then.seemed fine. Just installed win 7 now.hopefully.nothing happens now kis kinda let me down this time. If xp install overwrites mbr.and it.crashed still does that mean it might not been a rootkit?

 

You could run MBRCheck for another opinion/check?

 

I just ran MBRcheck and here is the output

 

MBRCheck will report suspect mbr as unknown code so it seems that your MBR is clean.

As for the .sys and processes you will have to rely on a decent AV to pick up anything as some malware can run as known files.

No expert here and if you think you may have probs it may be better to post in a dedicated help forum.