Computer Security & Viruses/StealthMBR.b!rootkit

Advertisement


Question
McAfee is reporting this, but is unable to clean it. Under "Item Name" it says "IRP_MJ_INTERNAL_DEVICE_CONTROL. Any suggestions on how to clean this bugger?

Answer
Here's what will almost certainly work.

1) Download either Kapersky Internet Security, which offers a free 30 day trial at http://kapersky.com or F-Secure's Complete Internet security suite, which offers a free thirty day trial: https://store.f-secure.com/cgi-bin/dlreg/ml=EN?ID=FSISTB&desid=TRIAL

2) Disconnect from the Internet.

3) Uninstall McAfee. This is absolutely essential because otherwise it and F-Secure or Kapersky will fight each other and might crash your computer. It isn't good enough to just turn off McAfee because it might have been crippled by your virus infection.

4) Install your Internet Security product. Scan your system and follow any instructions it might give you.

5) Connect to the Internet and download any updates available.

6) Run another complete scan of your computer. Follow any instructions it might give you.

7) Reboot.

If this works, you can either keep your new Internet Security product or uninstall it and reinstall McAfee. Be sure to get all the latest updates right away. Usually antivirus companies are pretty good about updating their programs whenever some new attack becomes able to evade or cripple their product.

If you weren't running a version of McAfee that includes antispyware protection and a firewall, then I recommend that you not reinstall your old program. Nowadays we need total protection, and this includes antispyware and a firewall.

8) To prevent future infections, don't use Internet Explorer, as it is susceptible to introducing viruses, adware and spyware into your computer. Instead you could use Chrome, free from http://www.google.com/chrome Instead of using Outlook for email, you could use Thunderbird, free from Mozilla.org, or Eudora, free from Eudora.com .

Computer Security & Viruses

All Answers


Answers by Expert:


Ask Experts

Volunteer


Carolyn Meinel

Expertise

I cover Windows, Linux, TCP/IP and Ethernet security questions. I do not cover Mac, smart phones, or other networking issues.

Experience

Books by Carolyn Meinel: wrote a chapter for The Hacking of America book (see http://www.amazon.com/exec/obidos/ASIN/1567204600/happyhacker) My article Code Red for the Web for Scientific American was reprinted in the book Best American Science Writing 2002 (see http://www.amazon.com/exec/obidos/ASIN/0060936509/happyhacker). My book The Happy Hacker: A Guide to Mostly Harmless Hacking is now in 4th edition with a Japanese edition (see http://happyhacker.org/hhbook/).

Organizations
IEEE, AAAS

Publications
See a list with some online links at http://cmeinel.com

Education/Credentials
MS, Industrial Engineering, The University of Arizona Took a course in computer forensics at the University of Texas at Austin/

Past/Present Clients
DARPA, SAIC, Palmer Labs

©2012 About.com, a part of The New York Times Company. All rights reserved.