Mebroot.K trojan

By sky_could_fall
Jun 28, 2008
  1. Hi all, i think u can help me about this. Eset Smart Security detected this in my PC. It can`t be deleted or cleaned. How can I clean it or remove it without losing any data. I know I can do a low level format or something similar to erase MBR but is there any way to do it without losing any data? It`s my bussines PC so the data are very important. Sorry for my bad english. :)
  2. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    That's a good anti-virus you have. Obviously you know already that this infection is in your MBR, so you just need to replace your MBR

    Fix your MBR
    1. Restart your computer with the Windows XP Setup disk in the CDROM drive.
    2. If you are prompted to press a key to start the computer from CDROM, do so quickly. Otherwise it may try to boot from the hard drive.
    3. After a few minutes, you'll see a prompt to press the R key to start the Recovery Console.
    4. When Recovery Console starts, it will prompt you to enter a number corresponding to the Windows XP installation that you need to repair. In most cases, you'll enter "1" (which will be the only choice). If you press ENTER without typing a number, Recovery Console will quit and restart your computer.
    5. Enter your Administrator password. If you don't enter the correct password, you cannot continue.
    6. At the Recovery Console command prompt, type fixmbr and then verify that you want to proceed.

    Your damaged MBR will be replaced with a new one, and you should then be able to boot your system normally.


    After you have done that, I want to see a log

    Highjackthis Instructions
    • Make sure you have the LATEST version of HJT (currently v2.0.0.2) it can be downloaded from HERE
    • Run the HijackThis Installer and it will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe. Please don't change the directory.
    • After installing, the program launches automatically, select Scan now and save a log
    • After the scan is complete please attach your log onto the forums using the paper clip icon above your reply.
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...