Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have run hitman pro and found 'traces of the TDL3 Alureon' rootkit on the computer. However, running TDSSKiller would of solved this issue - but - apparently the symptoms keep coming back so I decided to scan using COMBOFIX. I have run it once, it found a rootkit on the MBR. Rebooted the computer, the symptoms were still there. I ran COMBOFIX again, still detecting the rootkit. Is there a way to get rid of it without having to format the hard disk? Here is the log message:


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86EE3ACE]<< 
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7605f28
\Driver\ACPI -> ACPI.sys @ 0xf7578cb8
\Driver\atapi -> atapi.sys @ 0xf750a852
\Driver\iaStor -> iaStor.sys @ 0xf7477918
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
 ParseProcedure -> ntoskrnl.exe @ 0x80578f7a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
 ParseProcedure -> ntoskrnl.exe @ 0x80578f7a
NDIS:  -> SendCompleteHandler -> 0x0
 PacketIndicateHandler -> 0x0
 SendHandler -> 0x0
user & kernel MBR OK 

share|improve this question
up vote 1 down vote accepted

Use boot manager repair procedure for your operating system. It should overwrite MBR data, so you should be safe. Just to be safe you could repeat procedure several times.

share|improve this answer
No sense in repeating the procedure. Cleaning the hard drive is not like cleaning glass. – whitequark Aug 19 '10 at 18:38
Maybe, maybe not. Data from a formatted disk can be restored and I did hear (unconfirmed) reports of viruses reinfecting systems after entire disk was nulled. It's better to be safe than sorry. – AndrejaKo Aug 19 '10 at 18:42
I have to mention, this computer is not running Windows Vista, but Windows XP SP3. I am supposing that in this case we boot with the XP installation CD and when prompted, press R to repair a Windows XP installation. – JFB Aug 19 '10 at 18:49
@Kaeso Well, yes. I can't remember at this time exact procedure and don't have any XP disks to try it out, but you should be able to get into repair console. There you'll have command like FIXMBR or something similar (FIXBOOT, I think only fixes configuration on windows partition, not the MBR). You can type HELP too. It will display list of available options. It's not too complicated. – AndrejaKo Aug 19 '10 at 18:56

Maybe you should try the Kaspersky TDSSKiller by downloading it from, unzipping it, renaming the .exe program to "something".com, run it and follow the directions. It worked wonderfully on a PC infected with the Alureon' rootkit.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .