MBR infection source ideas?

[Elaine Albertson]

I have a client whose Compaq is constantly being reinfected by what appears to be an MBR virus.  They're getting the XP error "Reboot and select boot device..." thing and the BIOS info for the hard drive is bogus, and defaulting the BIOS doesn't fix it.

Aside from they've been running Norton and we're going to switch them to Avast! Pro, any ideas on where this may be coming from?  It's happened twice to them in the past month, but they were able to default the BIOS, boot, and Norton swept it...now they can't boot, and I'm going to have to try the fixmbr function from Recovery Console to get past it, then install uninstall Norton, install Avast, and resweep on boot.

I'm concerned that this may be a new bug coming from a particular vector.

[Lisandro]

I'm not an expert on virus removal but, the fixmbr should 'restore' the original condition of the Master Boot Record.
Maybe you'll have to use fixboot to set the HDD to boot, check if the partition is primary and active.
In the past, I have boot problems until I remember the partition, for some strange reason, 'became' inactive.
Welcome to avast! forums 

Oh, I'm a NAV converted either 

[polonus]

Hello Elaine,

If you cannot change the bios-settings of this thingy, and the old settings keep coming back, you must also consider hardware trouble. Did you peep inside the housing, did you see a lot of dust. A computer housing needs a dust out every half a year: DUST CAN KILL YOUR COMPUTER(motherboard via other dusty overheated parts) . You know:- not only a virus or malware. Apart from software trouble, there are two main threats to the computers: DUST and the fluctiations from the MAIN CURRENT. I hope it is a virus thing. That can be cleared. But always be on the look out for the other two killers. Do a test elaine, turn your keyboard topsy turvy and give it a good pat, you see what I mean. That is why that letter always hung in WORD 2000, and you got the semi-colon in staed of...

All the best,

Greetings,



polonus

[polonus]

Hi Elaine,

Now to the nitty gritty of an MBR virus, that can be cleared by a normal AV tool.
Before you try to do this, you have to know your system thoroughly though.
Before you proceed read all of this:
Step by step, here we go.
1. Boot from a clean DOS-diskette, Version 5.0 or higher. OS does not matter in this case.
2. Give in this command fdisk/status Now you should have access to all built-in disks, or you should find up a plausible PT (partition table).
3. For all the Dos-formatted partitions of the first disk give this command: dir p: (where p is the letter of that particular partition). The first could well be: dir:c
For all non-Dos partioned partitions boot the machine from a clean diskette and test if partitions are correctly readable at once.
4. You do the above mentioned steps, after you have come to the conclusion that the first partition you checked was freely, instantly  and correctly readable.
Type fdisk/mbr Through this action the first partition is changed into the (virusfree) MBR-Program of the diskette, the PT in this MBR is kept. Rests of virus on the hard disk does not matter now anymore, because it is disarmed and can be ignored further.
5. Reinstall special MBR from the original diskette (Boot-Manager- System Controll).

There are a couple of ifs. In the case od a cloaked MBR virus:
A. in the case of the Stone Empire Monkey A virus, with a MBR virus that is cloaked, you read the MBR with a program, that uses BIOS-services, MBR has address 0,01. Save  MBR in a file.
B. Sometimes the current PT has to be reconstructed. You are not allowed to change the MBR in the case of a special MBR, a special Boot-Manager. There you will not find up a usual partition table.

Good luck from,

polonus

PS. Use your  Huna-powers. It helps us all.

[polonus]

Hi Elaine & others,

I found up some more information on MBR viruses. There are viruses, that on infecting, encrypt and hide the original information in the sector the virus infects. In the case of infection, there are those that advise to use generic DOS commands (like, SYS and/or FDISK/MBR), this in order to correct the problem. Doing so may in some cases severely add to the problem. E.g. Monkey encrypts the partition information and then moves it. In overwriting through FDISK/MBR there is the possibility that you don't longer see your disk, because DOS/Windows is no longer able to trace the PT, and the encrypted version becomes inaccessible. Anti-virus software and tools are able to circumvent this problem. This as an extra caution to my former posting on these MBR viruses.

kindest regards,

polonus