How to Remove an MBR Virus

[xacked]

The following information is the result of much research and experience from my In-House lab, note that by following anything in this guide I'm not responsible for your actions or any damages that may arise.

Master Boot Record is 512 bytes at the beginning of the hard drive that, following BIOS, contains the partition table. In essence, points to the first line of the kernel, most importantly the boot partition. The first 440 bytes are blank, therefore it's a great place for malware to hide itself. Most AV products won't scan the MBR or catch the fact its infected because they look at the filesystem, but omit the first 512bytes on the hard drive. After what many techs will consider a successful cleaning, they'll restart the computer, only to discover the virus has come back in full force. The infected MBR has reinfected the system.

Removal Strategy: Remove viruses on the system that may have initially caused the MBR infection, check the MBR, clean the MBR, reboot, recheck the MBR.

Step 1: Disinfect as much of the system as you can. I recommend running Malwarebytes in Safe Mode and doing a full scan, then removing everything found. This step is important because it will most likely find the malware that can reinfect the MBR.

Step 2: Scan for the MBR virus with Bootkit Remover (don't forget to "Run as Admin" if you are not in Safe Mode).

If it says "Rootkit Activity Detected" it's self-explanatory

Step 3: You have three options, one safe route and two risky routes:

Option A:

WinXP: Boot into the Recovery Console (or install it with the XP disk) and type "fixmbr" and the MBR should be wiped.

Win Vista/7: Use the Recovery Disk or the installation disk for Windows Vista/7, boot into it, select the language, and instead of pressing Install Now select "Repair Your Computer" and click the Command Prompt. In it, type bootsect /nt60 :X /fixmbr (please replace X with your systemroot drive, it most commonly is C or D drive however you should know the config) then reboot the system and run the Bootkit Remover Tool again. If this doesn't work, you may have multiple partitions or hard drives, with their MBR possibly infected.

Option B:
Run TDSS Killer . Be prepared for this to break the OS, we've seen this happen in some instances, usually Option A and a chkdsk /r will fix it, however it's still risky.

Option C:
Run Combofix, which will both remove any malware and may remove the MBR infection as well.

Step 4 After any of the above methods are completed, restart the OS and use URL="http://www.esagelab.com/resources.php?s=bootkit_remover"] Bootkit Remover[/URL] again to scan the MBR. If it's gone, congrats! If it's not, then backup and format!

If your OS does break, backup the data (Be sure to run the backup files through an AV and MBAM and reformat the computer's hard drive with something like GParted, by wiping the whole drive and blowing out any partitions. This may be a point of contention, some people may opt for "Startup Repair" which may or may not fix the broken OS, we've seen it more often as a futile attempt. Other people may try the computer's "Factory Restore" option. Right off the bat I'll tell you it's not worth your time. We've tried this in the lab with several HP machines using a clean wipe of the hard drive, and the MBR virus is still there. This makes sense since the partition structure is still in place for the recovery partition to still function, thus the MBR hasn't been altered

*edit*

Another option would be to download a small program called mbrfix which is command line driven and can be directed towards a specific drive. This means it can be run on a slave drive, or from a PE environment. It also gives backup and restore options for the mbr as well as a host of other options.

-Thanks ATTech!

**edit2**
The guide has been updated, since Combofix now supports 64-bit it has mbrfix built into it.

 

[iisjman07]

Nice, informative post. Thanks for contributing to Technibble

 

[MobileTechie]

It's worth noting that running fixmbr on system with custom MBR code, like Dells and other branded computers removes some of their boot functionality including the ability to boot into rescue partitions and other recovery features.

There is a tool: mbr.exe from the gmer site which will detect and fix infected mbr's. Whether it fixes them by re-writing the entire MBR (thus doing the same damage as fixmbr) I don't know.

 

[iisjman07]

There is a tool: mbr.exe from the gmer site which will detect and fix infected mbr's. Whether it fixes them by re-writing the entire MBR (thus doing the same damage as fixmbr) I don't know.

I didn't know mbr.exe fixed the problems; I thought it only told you about them

 

[MobileTechie]

It's got a few switches including -f which fixes.

Others are:

Usage: mbr.exe [options]
-f - fix mbr
-c start_sector size_in_sectors filename - copy selected sectors to file
-t - trace called modules
-u - unload driver

I've contacted the authors to find out what the fix actually does.

Update: heard back and apparently it restores the original mbr that the rootkit saves thus making it safe to use on Dell systems. I wasn't aware a RK would bother to back up the mbr.

 

[xacked]

It's worth noting that running fixmbr on system with custom MBR code, like Dells and other branded computers removes some of their boot functionality including the ability to boot into rescue partitions and other recovery features.

There is a tool: mbr.exe from the gmer site which will detect and fix infected mbr's. Whether it fixes them by re-writing the entire MBR (thus doing the same damage as fixmbr) I don't know.

Good point! Usually Bootkit Remover will flag these as "Unknown boot code". However if the MBR isn't cleanable there's no point in having those partitions around, they may be infected and cause a reinfection.

We have OEM disks in the office and we use their COA sticker licences to activate the respective version of Windows, however if they are under warranty we usually encourage them to have the manufacturer ship them a copy of the recovery disk in case they ever need to restore the system now that the recovery partition is gone and if they fall outside of our support critereon.

I haven't gotten around to trying out mbr.exe fully, the two times I tried it seemed to not have any effect. There's also EasyBCD that can rewrite the MBR, however it doesn't seem to be able to remove the bootkit virus. I'm quite curious what your results with mbr.exe have been and if its safer than TDSS killer

 

[ZenTree]

Update: heard back and apparently it restores the original mbr that the rootkit saves thus making it safe to use on Dell systems. I wasn't aware a RK would bother to back up the mbr.

Some of them do as when a program tries to scan the infected mbr, it can divert the call to the stored original. Not too common at the moment but have read a few articles in the netherweb about it.

 

[MobileTechie]

I haven't gotten around to trying out mbr.exe fully, the two times I tried it seemed to not have any effect. There's also EasyBCD that can rewrite the MBR, however it doesn't seem to be able to remove the bootkit virus. I'm quite curious what your results with mbr.exe have been and if its safer than TDSS killer

I've used it a few times with success. It finds the Alureon rootkit I've been messing with on a VM recently and, as part of other removal methods, sorts out the MBR. However it doesn't cure it on its own like TDSSKiller does. Just cleaning the MBR results in it being reinfected if the RK has been unhooked and its infected driver file replaced.

 

[iladelf]

Very informative post among fellow techs; this is what I'm here for. Thanks to all!

 

[ATTech]

Just some clarification, the MBR contains partition information and points to the first line of the kernel, rather than pointing to the "rest of the hard drive"

Another option would be to download a small program called mbrfix which is command line driven and can be directed towards a specific drive. This means it can be run on a slave drive, or from a PE environment. It also gives backup and restore options for the mbr as well as a host of other options.

 

[Cambridge PC Support]

Just some clarification, the MBR contains partition information and points to the first line of the kernel, rather than pointing to the "rest of the hard drive"

Another option would be to download a small program called mbrfix which is command line driven and can be directed towards a specific drive. This means it can be run on a slave drive, or from a PE environment. It also gives backup and restore options for the mbr as well as a host of other options.

I'm just starting to find my old Ghost gdisk proggy from years ago doesn't see a lot of the SATA drives so I can't wipe the mbr

So mbrfix looks dead handy, I presume it's this one?

http://www.sysint.no/nedlasting/mbrfix.htm

 

[ATTech]

I'm just starting to find my old Ghost gdisk proggy from years ago doesn't see a lot of the SATA drives so I can't wipe the mbr

So mbrfix looks dead handy, I presume it's this one?

http://www.sysint.no/nedlasting/mbrfix.htm

Yup. This is Filler text

 

[ajc196]

After whichever mix of TDSSKiller, hot-swap MSE scan, Avast BART scan, and manual removal I choose, I use the "rebuild MBR" function in PWHE.

 

[meanderer]

this is worth a sticky..

 

[xacked]

After whichever mix of TDSSKiller, hot-swap MSE scan, Avast BART scan, and manual removal I choose, I use the "rebuild MBR" function in PWHE.

Fascinating! It's too bad for me PWHE costs money to use in a corp/enterprise setting. Hehehe, oh Avast BART, I haven't used that program in years. Last time I ran it on my own machine it broke my Windows XP However, there's barely anything short of a dying hard drive and infected MBR that the repair install couldn't fix, why they got rid of that feature in Vista and Win7 is beyond me (the In-Place Upgrade almost never works)

this is worth a sticky..

I'm glad you find it useful

 

[stro]

Option B:
Run TDSS Killer . Be prepared for this to break the OS, we've seen this happen 1 out of 8 cases.

I've run it over 70 times now and only had it break one system. They tend to release new versions from time to time and don't really announce it, and most problems with it are the result of running older versions against newer variants of tdss. So make sure you download a fresh copy on a weekly basis.