[VIRUS] Unable to resolve MBR:Backboot-G [Rtk] *MBR0

tjeharriet · 02 Oct 2018

Hi all,

My computer is under attack and random pop ups keeps appearing. I previously installed MalwareBytes, it is always showing me that it is helping me to block Trojan every few seconds. I did a scan using it and it did not show that I have any virus.

1. I tried AVG and did the deep scanning, and this time the virus showed up. However, when I click resolve, nothing happens.

2. I tried to follow some tutorials by typing the command code in cmd administrator to boot in safe mode, however I can't seem to get back to the stage where my windows reboots normally.

Will appreciate if anyone is kind enough to advice :)

I've also attached the image of error

Thanks alot in advance!

Caledon Ken · 02 Oct 2018

Hi tjeharriet. Welcome to the TenForums @tjeharriet

If you use Malwarebytes you have to add a check mark to scan RootKits. If it is still installed please make the change

You could also try their tool specific tool.

https://www.malwarebytes.com/antirootkit/

Not sure what you mean boot normally, are you stuck in safe mode or this pest is just causing a troublesome boot.

Are you able to start Windows?

tjeharriet · 03 Oct 2018

Thank you @Caledon Ken.

I will try your suggestion :)

My Windows starts in Windows Boot Manager (The page before I click Windows 10 to go to the screen to choose safe mode)

Previous I ran a command to trigger Boot by clicking F8. Now I cant reverse that move.

I am able to start windows 10

Caledon Ken · 03 Oct 2018

What command did you run please?

tjeharriet · 03 Oct 2018

Malwarebytes
Free Antivirus Replacement & Anti-Malware Tool | Malwarebytes

Code:

-Log Details-
Scan Date: 10/3/18
Scan Time: 11:33 PM
Log File: a364d09a-c721-11e8-89cf-309c23cff04b.json

-Software Information-
Version: 3.6.1.2711
Components Version: 1.0.463
Update Package Version: 1.0.7163
License: Trial

-System Information-
OS: Windows 10 (Build 17134.286)
CPU: x64
File System: NTFS
User: DESKTOP-UMP721T\Harriet

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Cancelled
Objects Scanned: 137367
Threats Detected: 2
Threats Quarantined: 2
Time Elapsed: 1 min, 26 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 1
PUP.Optional.NetMeterX, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\nfstat, Quarantined, [4556], [575960],1.0.7163

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
PUP.Optional.NetMeterX, C:\WINDOWS\SYSTEM32\DRIVERS\NFSTAT.SYS, Quarantined, [4556], [575960],1.0.7163

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

tjeharriet · 03 Oct 2018

I've followed your instructions regarding malwarebytes and the logs above is what i get.

I've use this command

bcdedit /set {current} bootmenupolicy Legacy

i found it on Enable or Disable F8 Advanced Boot Options in Windows 10 | Windows 10 Tutorials

I also tried the disable command, but sadly it does not work.

On a side note, do you think it is faster if i just reinstall windows 10?

clam1952 · 03 Oct 2018

Probably not as it's a rootkit installed in the mbr and takes over before you get to Windows, need to fix the mbr, not done any of this for years but tdsskiller should get rid of it, wait for confirmation from someone with more recent experience with rootkits first though.

Caledon Ken · 03 Oct 2018

The log you posted says rootkit is still disabled in Malwarebytes.

[VIRUS] Unable to resolve MBR:Backboot-G [Rtk] *MBR0-image.png

tjeharriet · 03 Oct 2018

I've already checked the Rootkit box.

maybe this virus is too strong that it switch off the check?

But I have also reinstalled Windows 10. Hopefully it will solve the issue.

Thank you for your prompt responses and help. :)

TairikuOkami · 03 Oct 2018

You can also try those (last updated in 2018):

Download Bitdefender Rootkit Remover 3.0.2.2.014

Download TDSSKiller 3.1.0.17