Solved How to fix a hard disk with a bad MBR created by BIOS malware such as a Mebroni variant

Discussion in 'Windows - Virus and spyware problems' started by Mez, Aug 22, 2014.

Thread Status:
Not open for further replies.
  1. Mez

    Mez Active member

    Joined:
    Aug 12, 2005
    Messages:
    2,895
    Likes Received:
    9
    Trophy Points:
    68
    I was infected by a variant of this http://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/.

    The above is detected by AV scanners what got me was not detectable by Avast and can't be removed by usual rootkit cleaners that are cleaned by a utility in a optical disk. The drive will not be readable.
    The MBRs are rewritten during the boot process. The BIOS infection can be removed by shorting the BIOS jumper. Once you do that you will discover your HD will become unreadable.

    The solution is testdisk which will re-build the MBR. Second mention is an easUS product. It accesses the disk in RO mode and will allow you to copy up to 1g of files for the trial version. I copied out a few dozen must have files before I trusted testdisk to rebuild the MBR. The disk was overly complex 1.5 T of data with at least 150,000 files and complex directory structures. The recovery product only found 20 G of files.

    Note, you can now read the disk but C: will still have the rootkit. I will just re-image C: but probably a root kit on a RO disk may work. I being overly careful would not trust that the disk is clean. I would either make that disk D: and buy a new C: or remove all the valuable data then re-install windows.
     
Thread Status:
Not open for further replies.

Share This Page