PDA

View Full Version : Customer had boot block rootkit

Galdorf
08-07-2009, 02:31 PM
Wow i didn't think i would see this in the wild yet a customer had boot block rootkit even rootrepeal could not pick up the boot sector it would crash it.

I had to use prevx to remove it only 2 programs now i use if i have problems is unhackme and prevx.

All free rootkit scanners failed to pick up anything some would not even run this is a real nasty one.
Cue
08-08-2009, 01:58 PM
I have bean trying both programs.
Canīt get the hang of unhackme.

But prevx looks promising.
What version did you get personal, business or something else?
iisjman07
08-08-2009, 02:07 PM
On the PrevX website it says that DrWeb can fix it. I tried it out and it did remove the infection with ease. I think itīs nice of PrevX to let you remove the boot sector rootkit for free - nearly everything else you have to pay for...
Galdorf
08-10-2009, 12:50 PM
I have bean trying both programs.
Canīt get the hang of unhackme.

But prevx looks promising.
What version did you get personal, business or something else?

Unhackme starts with a learning scan it is heuristic based it asks if its a false reading if the company field is something you recognize then its false ie microsoft, if it has none and you don't know what it is ie. w673437wrffnhg.sys that is a rootkit.

Rootrepeal is much easier to use you hit hidden tab and scan anything under that is a rootkit and should be deleted mind you this program is still in beta.
studiot
08-10-2009, 02:45 PM
I must say I have never seen a problem with a pc running RootkitNo.
TechProsSD
08-17-2009, 09:25 PM
here's a "what if"

WHAT IF you took the HD out of the affected machine, connected it via IDE/SATA to USB bus to one of your "known clean" computers with a/v-rootkit software - and ran a scan on the affected HD from your computer??




would that help in this situation?
NickCat11
08-17-2009, 09:46 PM
here's a "what if"

WHAT IF you took the HD out of the affected machine, connected it via IDE/SATA to USB bus to one of your "known clean" computers with a/v-rootkit software - and ran a scan on the affected HD from your computer??




would that help in this situation?

+1, I believe that "what if" would be a viable solution...