Mbr:sst.c Rootkit, Bitdefender Removal Problems

striptyler

Hi,

As the topic states, I have a machine thats been infected with MBR:SST.C. Both bitdefender total security 2013, and the removal tool detect it. Bitdefender can't access it to remove it.

The removal tool posted in the pinned section detects it, but, after selecting restart, it does nothing (ie doesn't disinfect)

The bit defender rescue mode doesn't detect the book kit at all.

I would be happy to simply reformat the hard drive, but, it appears the bootkit has either infeted the recovery partition, or, is preventing it from loading. ( dell xps 13 - so no external media drives, and no windows cd provided with the machine)

any help is greatly appreciated. Thanks!

rootkit

Hello

Welcome to the forums!

In order to be able to further investigate the reported situation we need a bit more information from your computer as follows:

. A BDSYS log;

[how to GENERATE A BDSYS LOG]

. Save and extract the BDSYS tool to a location of your choice:

http://www.bitdefender.com/files/Knowledge.../BDSysLog_i.exe

. Make sure you close all active applications and then run "BDSysLog_i.exe"; If you receive a firewall

alert,select to Allow the application to connect;

. Click the "Create log" button to start generating the

log; A progress bar is indicating that the tool is creating the report;

. When the small window appears with the message "Log

saved" then the report is complete and a new file named "bdsyslog.zip" has appeared on your Desktop;

. Upload that file on

http://www.sendspace.com

or

http://www.mediafire.com

and send me a PM with the download link.

If you were already asked to generate the log file, disregard the message above and just post the ticket ID.

IMPORTANT:

.During this process the Real Time Protection in Bitdefender must be temporarily disabled;

.If you receive a Bitdefender Firewall alert to inform you that BDSysLog_i.exe tries to connect to the internet,then you need to select Allow;

[how to DISABLE THE ANTIVIRUS PROTECTION in Bitdefender 2013]

In order to disable the antivirus protection, please open Bitdefender and click the "Settings" button in the upper side part of the interface"; In the new window go to "Antivirus" > "Shield" tab and click on "ON" under On-access scanning. Select the time interval that suites your troubleshooting needs and click "OK". The On-access scanning should be enabled back after finishing the troubleshooting procedure.

We will get back to you as soon as the analysis is complete.

Have a nice day.