Windows RootKit that requires re-install

[Noway2]

Saw this while having my morning coffee:

http://www.computerworld.com/s/arti...ion_requires_Windows_reinstall_says_Microsoft

Looks pretty serious. Originally saw it on Slashdot:

http://tech.slashdot.org/story/11/06/27/2355205/Rootkit-Infection-Requires-Windows-Reinstall

Thought I would pass it on.

 

[BadBigBen]

Thanks for the heads-up there, interesting read...


Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[sleipnir214]

Aside from the assumption that if you have this malware you have others, too, why reinstall?

Why not boot Linux from a CD or write-protected flash drive and fix the MBR from there?


Want to ask the best questions? Read Eric S. Raymond's essay "How To Ask Questions The Smart Way". TANSTAAFL!

 

[goombawaho]

Nobody provides a description of the symptoms when you have this rootki AND/OR how you know you've got it?!

 

[Noway2]

It appears that this was in reference to the Trojan:Win32/Popureb.E

Here is a link to an updated article, where apparently MS is at least partially reversing their initial position on reformatting.

Here is another, blog, entry from one of their people.

Lastly, here is the slashdot reference.

 

[goombawaho]

Didn't anyone mention something like a BartPE CD with Mcafee plug-in that should be able to look at the MBR and identify the infection?

Or are they just giving the simple advice (reload or fix MBR) to non-technical users as an over-simplified solution?

 

[Noway2]

Or are they just giving the simple advice (reload or fix MBR) to non-technical users as an over-simplified solution?/

I think you may be right. I think that the actual advice was to replace / repair the MBR and then restore the system to a pre-infection state. IIRC, there was a comment about using system restore or something like that returning the system to the initial state.

The big difficulty, as I see it, is that for the average user, finding a means of starting the system without using the MBR could be tricky. This malware takes advantage of the fact that most systems have a "restore" partition rather than bootable write-only media. Unless the access of the restore is before the MBR, it will be impossible to restore it.

In my opinion, writing to the MBR definitely falls into the "root level" compromise category. With any root level compromise, it is impossible to guarantee that you have cleaned the system and removed the infection. Consequently, a restore to a pre-infection state that completely overwrites the system is necessary.

 

[goombawaho]

But booting from some other type of bootable device is enough to allow full removal, right?!

 

[Noway2]

Theoretically, I guess so. But if they had access to the MBR what other presents did they hide?

 

[goombawaho]

I don't know, but I guess I'm not as worried about wiping out other stuff as long as the MBR is clean.