Mayachok.b

Hello, I have a question for a rootkit infection Cidox.b. If your system is infected with this infection, your antivirus program detects this infection, and take measures to clean up, but incorrectly restores the operating system loader (VBR), resulting in a system can not run. Why Anti-Virus tries to restore the boot loader if you do not know how? Other vendors in such cases are encouraged to download a special utility for solving such problems.

Here is a sample of the virus.

http://rghost.ru/39600797

Find more posts tagged with

Comments

rootkit

Hi Rampant

I have reported this situation to our labs and as soon as I receive an answer, I will get back to you.

Take care.

rootkit

Hello

Do you still have that machine infected with that rootkit?

I am asking this because I want some logs from it.

Thank you!

Rampant

No, this is a test we carry out the treatment of active infection, the problem was in a virtual environment on VirtualBox this virus "works" is incorrect. But another question has arisen, when tested on the VM, Bitdefender unable to determine the contamination of the boot area, but could not cure, pointing to the lack of law account, here's the scan result.

rootkit

Hello

You mentioned that the issue was with Rootkit.Boot.Cidox.b, not Mayachok.B

Since the test environment is a virtual machine, it will be a lot easier to reproduce the situation.

Thank you for reporting this. Take care.

Rampant

Rootkit.Boot.Cidox.b This version of Kaspersky Lab.

If necessary, rename the topic title.

rootkit

Hello

I have forwarded all the data to our Labs. My colleagues will check the disinfection routine and if needed they will modify it.

Take care.

Rampant

Good, Christian. But I would like to know why anti-virus ignores the problem of infection.

Thank you.

rootkit

Hello

One more thing to add: are you using an administrator account when scanning the system?

From the logs we can see limited rights listed near the detection.

Thank you!

Rampant

The test uses a standard account, is it for disinfection, it is necessary to activate the built-in Administrator account?

rootkit

Hello

Yes, Bitdefender has to run with administrator privileges. Please rerun the scan from the administrator account and let me know if you still encounter any issues.

Take care.

Rampant

As a simple user learns how to activate the built-in Administrator account?

rootkit

Hello

You have here some instructions:

http://www.howtogeek.com/howto/windows-vis...-windows-vista/

When you install the operating, a default Administrator account is created, access that one.

Take care.

Rampant

Thank you, Christian. Perhaps this statement is necessary to fix a separate topic, since such situations occur quite often, I myself am an advanced user, and use the administrator account to run continuously.

You performed a test with this rootkit?

And another way to activate the built-in administrator.

Enabling account through the interface

Press the key combination <Win+R>, type in the command box that opens, lusrmgr.msc and click OK. Open snap Local Users and Groups

Click in the left pane on the Users folder. Now find the Administrator account in the central panel and click the right mouse button. Select the Properties command.

In the Properties window, click the Administrator of the General tab (or she will immediately open) and uncheck Account is disabled.

As you can see, enable the Administrator account in Windows 7 is a snap. However, using the command line to make it even easier.

rootkit

Hello

My colleagues from the Labs did all the testing on this when I forwarded this situation to them.

That's why I have asked you about the administrator account.

Have a great weekend!

Rampant

My tester had a repeat test with a rootkit, an administrator, the host file has been corrected, but also treat the infection VBR refuses, so the results of the scan.

/applications/core/interface/file/attachment.php?id=10062" data-fileid="10062" rel="">1344534270_1_03.xml

1344534270_1_03.xml

rootkit

Hello

Thank you for your feedback!

Please download this file on that infected machine.

http://www.mediafire.com/file/hx551itqih6xqa4/dump.zip

To use the tool, extract the files from archive( pass: bitdefender ) and run dump.bat on 32 bit systems or dump64.bat on 64 bit systems.

Send us back the files vbr.API, vbr.KERNEL (the tool will generate them in the same location) in an archive via PM.

We appreciate your understanding and cooperation in this matter!

Have a great day!

rootkit

Hello

Valery, thank you for the files.

I have sent them to our labs and as soon as I receive the results, I will post here.

Have a great weekend!

rootkit

Valery, my colleagues tested the routine on the received data and the disinfection works correctly.

We want also to further investigate this issue for other cases: could you please give us that infected machine in this state? I mean infected with that malware and with Bitdefender installed.

If you still have it, please make a snapshot, put the virtual disk in an archive and upload it on a file server.

Send me please the links via PM.

If you have a password on Windows, please mention it in the message.

Thank you very much!

Have a wonderful weekend!

Rampant

Well, Christian, I'll talk to the tester, and if he has the opportunity, we will send you a snapshot of the virtual environment, only the file size can be large, on which the file server you can download it?

Rampant

What files should be packed to the archive?

rootkit

Hello

Yes, those ones.

Pack all the files in the folder and split it into several parts and upload it please on a file server.

Thank you very much!

Rampant

Sorry guys, but my tester is not possible to send a large file, the Internet is very slow.

rootkit

Hello

In this case, please tell me the configuration of the real PC and the settings used in the virtual machine so I can replicate the situation.

Thank you very much. Have a great week!