[dba-Tech] Generic MBR Rootkit and Vipre

Hi Jim,
I usually use Belarc Advisor or Gabriel Topala's SIW to print an HTML report
to a USB stick in order to not lose license numbers and such when working on
this kind of infection. I just nuked one. A really nice (huge screen) HP
Pavilion 9000dv notebook. The thing was full of stuff the owner didn't want
and the wireless networking wasn't using. I found it infected and she didn't
care about anything so I SIW'ed it and nuked the HD. Problem is that the
wireless networking still doesn't work and when checking on the Internet it
appears that this should have been a major recall as not very many of them
do seem to work. We're going with a USB Wireless unit and forgetting about
the built-in in one. Oh-well, can't win them all...

Maybe you could image it and send it in to sunbelt ;o)

Best of luck!

-----Original Message-----
From: dba-tech-bounces at databaseadvisors.com
[mailto:dba-tech-bounces at databaseadvisors.com] On Behalf Of Jim Lawrence
Sent: Tuesday, April 14, 2009 2:33 PM
To: 'Discussion of Hardware and Software issues'
Subject: Re: [dba-Tech] Generic MBR Rootkit and Vipre

Thanks so much John. 

I will test using the GMER and Rootkit Revealer and see if this bring some
sort of resolution. The OS have been through so many virus and malware scans
that part of system's degradation in response time is due these products as
well.

I am making a list of all the apps that are current running on the computer
and then I think a good nuking will clean up things permanently.

I am really amazed at the infections ability to resist all attempts at
completely removing it. It has been effectively blocked from outside access
but some of the components are still running at intervals and assisting in
various system crashes. It wrecked all the browsers (IE, FireFox and Chrome)
as well. 

Now I am very curious at what 'IT' could be. I will keep you posted as well
if any more details emerge. 

Jim