Rootkit found - but what does it mean?

Hello all, an alert from avast! antivirus popped up on a client PC and says "Rootkid Found" but the file name is pointing to MBR: \\.\PHYSICALDRIVE0\PARTITION3 and the action to take is Delete Now or Ignore. I am fairly certain that on my one harddrive, Partition 3 is where the OS resides. So if I choose to "Delete Now" is that going to harm the MBR and not let me load into Windows? And if I choose to Ignore, is this a real root kit somehow on my PC or a false-alarm?

Any help would be appreciated!
XAnalyzerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Raymond PengSystems EngineerCommented:
I'd suggest reading this article first:

http://www.experts-exchange.com/Software/Internet_Email/Anti_Spyware/A_5124-Stop-the-Bleeding-First-Aid-for-Malware.html

Rootkits are notoriously hard to clean at times and you may need to run scanners such as MBAM and combofix to help troubleshoot / log details.

You'll want to take that machine offline to scan once it's updated with virus definitions
0
larry urbanDevOps EngineerCommented:
A rootkit is a stealthy type of malicious software (malware) designed to hide the existence of certain processes or programs from normal methods of detection and enables continued privileged access to a computer.

http://en.wikipedia.org/wiki/Rootkit

I would back-up the hard drive then allow Avast to delete it.
0
Thomas Zucker-ScharffSolution GuideCommented:
You've gotten some great suggestions so far.  Be careful with rootkits they are a pain.  Check out my article on rootkits.  It explains what they are and reviews a bunch of free software you can use to get rid of them.

http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/A_2245-Anti-rootkit-software.html
0
SD-WAN: Making It Work for You

As bandwidth requirements and Internet costs grow, businesses naturally want to manage budgets by reducing reliance on their most expensive connection types. Learn more about how to make SD-WAN work for your business in our upcoming webinar!

Register Today!
Darr247Commented:
You've yet to reply to the instructions given in Avast's forums yet, either.

http://forum.avast.com/index.php?topic=95887.0

Apparently made about 3 hours after your post here.
0
rpggamergirlCommented:
Just make sure that it is not a legit partition or the one where windows is installed that you are deleting.

Have you first tried TDSSKiller?
TDL4 rootkits creates a hidden partition and modifies the partition table so it point to its malicious partition making it the active partition.
You can see which is the active partition using Gparted and you can change the boot flag there and you also have the option to delete the malicious partition.

The most important thing is to change the boot flag to the correct partition, once you've done that then all is well even if you leave the malicious partition there so long as it doesn't have the boot flag.
If Avast has already changed the boot flag to the correct partition, then the malicious partition is now harmless.


If you have run TDSSKiller and it didn't help, run this new tool below.
Download the yorkyt.exe disinfection tool.

http://www.pandasecurity.com/resources/tools/yorkyt.exe

Doubleclick to run.
A reboot will be requested to install a driver.
Another reboot will be requested to complete the disinfection.
When the disinfection is completed, accept the message that will be displayed.


Avast also has a tool that can also change the boot flag to the correct partition.
http://public.avast.com/~gmerek/aswMBR.htm#fix0
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
XAnalyzerAuthor Commented:
Ran TDSSKILLEE which identified the root kit (bootkit), once I deleted the infections the computer now loads with the blue screen of death in normal and safe mode of Windows. I get a STOP error ending in 7E...

Time for a format ?
0
Darr247Commented:
That should be a SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

And there should be another file name and offset addresses below that message.
What's the file name?
0
rpggamergirlCommented:
TDSSKiller must've deleted the patched driver or file needed at bootup and it wasn't replaced or deleted a file but the reg value e.g. in the subsystems key wasn't restored, it happens.


"Time for a format ?"

That's really up to you, if you don't have the time to troubleshoot and fix the issue then a reformat and clean install of the OS is an excellent idea.
That's what I would do since I don't need to backup my files. A reformat is a simple and quick fix in some cases.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows XP

From novice to tech pro — start learning today.