News
OS Reinstall Not Necessary To Remove 'Popureb' Rootkit, Says Microsoft
Windows has retracted previous advice for removing 'Popureb' rootkit; now, infected systems can be fixed via a Windows recovery tool.
Windows has retracted previous advice it gave for removing a new rootkit nicknamed 'Popureb' and now says admins can fix infected systems via a Windows recovery tool.
"If your system is infected with Trojan:Win32/Popureb.E, we advise fixing the MBR using the Windows Recovery Console to return the MBR to a clean state," wrote MMPC engineer Chun Feng in an update to a blog post on TechNet.
Microsoft had advised that admins completely wipe system, due to the fact that the Trojan operated by overwriting a system's hard drive master boot record to bore its way into a sector accessed only before a computer's BIOS begins the startup process. This causes the OS and security software to not be able to detect the intruding malware.
Feng advises individuals who have been infected to use the Bootrec.exe tool located in the Windows Recovery Environment to repair their system. A detailed explanation on how to use the tool can be found here.
However, removing the 'Popureb' Trojan in this manner may not be enough. "Once you're infected, the best advice is to [reinstall] Windows and start over, said Joe Stewart, director of malware research for Dell SecureWorks, in an interview with Computerworld. " ... [MBR rootkits] download any number of other malware. How much of that are you going to catch? This puts the user in a tough position."
Marco Giuliani, a threat research analyst at Webroot, also shares Stewart's advice, but also warns that, due to the nature of the malware, wiping a system will not guarantee its removal. "What is really a nightmare is that the Trojan looks like it has bugs and sometimes it hangs the system during the reboot stage," he wrote in a blog posting.
Giuliani and his team at Webroot are currently finishing up on a tool to safely remove the Trojan and will release it after internal testing is complete.