Home Malware Programs Rootkits WIN32:MBRootkit

WIN32:MBRootkit

Posted: December 14, 2011

Threat Metric

Ranking: 7,160
Threat Level: 8/10
Infected PCs: 2,293
First Seen: December 14, 2011
Last Seen: October 17, 2023
OS(es) Affected: Windows

WIN32:MBRootkit is a dangerous rootkit that adds itself to free legitimate software downloads without knowledge of the software publisher and the person who provides it. Once WIN32:MBRootkit installs itself on the compromised machine, it goes directly into Mater Boot Record. WIN32:MBRootkit states privileges similar to that of legitimate computer system. WIN32:MBRootkit generates its own system to interrupt with the one installed on the computer to help the user. WIN32:MBRootkit blocks incoming and outgoing data of browsers on the corrupted PC. The data is investigated to obtain personal information such as passwords, user names, etc. You should remove WIN32:MBRootkit immediately after detection.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = "%LocalAppData%\.exe" -a "%1" %*HKEY_CLASSES_ROOT\ah\shell\open\command "(Default)" = "%LocalAppData%\.exe" -a "%1" %*HKEY_CLASSES_ROOT\ahHKEY_CURRENT_USER\Software\Classes\ah "(Default)" = 'Application'HKEY_CURRENT_USER\Software\Classes\.exe "(Default)" = 'ah'HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%LocalAppData%\.exe" -a "%1" %*HKEY_CURRENT_USER\Software\Classes\ah "Content Type" = 'application/x-msdownload'HKEY_CURRENT_USER\Software\Classes\ah\DefaultIcon "(Default)" = '%1'HKEY_CURRENT_USER\Software\Classes\ah\shell\open\command "(Default)" = "%LocalAppData%\.exe" -a "%1" %*HKEY_CLASSES_ROOT\ah\shell\open\command "IsolatedCommand"
Loading...