Microsoft clarifies MBR rootkit removal advice
Now says users don't have to reinstall Windows to remove super-stealthy malware, but botnet expert disagrees
Computerworld - Microsoft yesterday clarified the advice it gave users whose Windows PCs are infected with a new, sophisticated rootkit that buries itself on the hard drive's boot sector.
Several security researchers agreed with Microsoft's revisions, but a noted botnet expert doubted that the advice guaranteed a clean PC.
Last week, the Microsoft Malware Protection Center (MMPC) highlighted a new Trojan, dubbed "Popureb," and said that the only way to eradicate the malware was to use a recovery disc.
Because a recovery disc returns Windows to its factory settings, Microsoft was essentially telling users that they needed to reinstall Windows to completely clean an infected PC.
That recommendation was similar to what Microsoft had offered more than a year ago, when another Trojan buried rootkit code into the master boot record (MBR) of the PC's hard drive.
On Wednesday, MMPC engineer Chun Feng clarified Microsoft's advice.
"If your system is infected with Trojan:Win32/Popureb.E, we advise fixing the MBR using the Windows Recovery Console to return the MBR to a clean state," Feng wrote on an updated blog yesterday.
Feng provided links to instructions on how to use the Recovery Console for Windows XP, Vista and Windows 7.
Once the MBR has been scrubbed, users can run antivirus software to scan the PC for additional malware for removal, Feng added.
Malware like Popureb is especially difficult to detect and delete once it's on a system because it overwrites the hard drive's MBR, the first sector -- sector 0 -- where code is stored to bootstrap the operating system after the computer's BIOS does its start-up checks. Because it hides on the MBR, the rootkit installed by Popureb makes not only itself, but any follow-on malware installed by it later, invisible to both the operating system and security software.
MBR rootkit malware is among the most advanced of all threats, researchers said yesterday during interviews about a different family, called "TDL-4," a bot whose collection of compromised computers they called "practically indestructible."
Several security firms have also weighed in on the debate about whether users need to reinstall Windows.
"Reinstalling is definitely overkill for this malware problem," said Vikram Thakur, principal security response manager with Symantec, in an interview today. "It can be resolved simply by fixing the MBR via an external disk."
Symantec offers a tool to help users do that.
Named "Norton Bootable Discovery Tool," the free download creates a boot disc for starting up the PC without accessing the hard drive -- and thus without loading the infected MBR. Once the Windows machine boots using the recovery disc, the tool downloads new malware signatures -- the digital "fingerprints" antivirus software uses to detect threats -- sniffs out signs of infection and if necessary, cleans the MBR.
- Top 10 Reasons to Strengthen Information Security with Desktop Virtualization Regain control and reduce risk without sacrificing business productivity and growth
- Preventing Sophisticated Attacks: Anti-Evasion & Advanced Evasion Techniques McAfee Next Generation Firewall applies sophisticated analysis techniques specifically to detect advanced evasion techniques (AET).
- The Security Industry's Dirty Little Secret The debate over advanced evasion techniques (AETs) This report summarizes the findings of a McAfee commissioned research group to determine the level of understanding IT security professionals have about AETs...
- Demand More, Get the Most from the Move to a Next-Generation Firewall Beyond the basics in a next generation firewall, to protect your investment you should demand other valuable features: intrusion prevention, contextual rules, advanced...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!