MBR root kit was detected on my PC. Since it took control of the PC and would not allow me to connect ti the Internet, I installed a new Hard Drive and rebuilt from scratch. The old drive has been removed, installed into a case and will eventually be used as a backup drive. In the meantime, I would need to pull some data fron this drive, so I would like to have some help in removing the root kit.
Your help would be much appreciated.
[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
[external image: Posted Image] Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
I had trouble installing and running GMER. It finally crashed when \i went to save the log file (it ran for 16 hours). The file is lost. Should |I re-run GMER?
Thanks for your help.
Mark.
Hi
Try running it in safe mode with just "sections" and the "C:\" drive checked,
Take not in the window if any files say "suspicious modification" and tell me what they are if you still can't save a log.
