Bloodhound.MBR

[SPYDERIX]

Hi,

I am using a friend's computer and his Norton says that there is the bloodhound.mbr virus in his master boot record. I can't for the life of me find out how to get rid of this. Can anyone help me out with the removal of this virus so he can get back to using his computer worry free.

Thanks in advance.

NATE

http://www.mainframehosting.net

Got a question? Search G O O G L E first.

 

[SPYDERIX]

One other quick thing to mention is the fact that Norton does not actually show a physical file that is infected to be quarantined or fixed etc.

NATE

http://www.mainframehosting.net

Got a question? Search G O O G L E first.

 

[BadBigBen]

What OS?

XP - Fixmbr (command for reinitializing the MBR)...

Win98 - FDisk /mbr (don't quote me on this one, haven't used Win98 in about 3 years)...

alternative, if you use XP, do a repair install...

this will wipe the MBR of the first Boot drive...



Ben

If it works don't fix it! If it doesn't use a sledgehammer...

 

[MadHerc]

BadBigBen has the right idea... to remove this virus;


XP.. FIXMBR under recovery console using an XP CD

When this is done XP notices that the mbr is bad and tells u u must verify then and it moves on but READ BELOW FIRST

WIN98 is definately- Fdisk /mbr (from and MSDOS start disk can also be used for XP but do not forget wo WRITE PROTECT BEFORE using on an infected machine..

*******NOTE NOTE NOTE NOTE*****************
1. This is not advisable on multiboot or multi partition (more than 4 Partitions) Hard Disks.

2. Be prepared for the worst and make an Image first when in doubt (ie: Ghost the partition to DVD) This proceedure can cause irreparable damage to dod!

but otherwise works perfect


Marcus
aka: MadHerc

 

[pechenegs]

you people should learn to research these things before telling people to start footering about with their MBR!

For more information about Bloodhound technology, please see the white paper Understanding Heuristics: Symantec's Bloodhound Technology.

When Bloodhound detects an unknown virus, Norton AntiVirus reports the virus name as one of the following:

http://securityresponse.symantec.com/avcenter/venc/data/bloodhound.html

http://www.sophos.com/virusinfo/hoaxes/bloodhound.html

 

[BadBigBen]

@all - look at the date of the thread... this was six months ago... he never returned to say if it worked or not... this thread is thus in my eyes, DEAD...

have fun...

@pechenegs - thanx for the info...

Ben

If it works don't fix it! If it doesn't use a sledgehammer...