What is Reddit's opinion of aswMBR?

From 3.5 billion Reddit comments

NAL, but advice from the IT side of things:

Disconnect this PC from the internet, as these internet scammers likely have some kind of anytime remote connection enabled to it. You need to uninstall anything like Teamviewer to prevent them connecting. Also, go to Control Panel > System > Remote and look for 2 options, "Allow Remote Assistance invitations to be sent from this computer" and "Allow users to connect remotely to this computer". Make sure both of these are unchecked.

You're also going to want to get some good anti-badware programs (Comodo Cleaning Essentials, Hitman Pro and aswMBR are good examples) to ensure there's no remaining threat to the PC. You can put these on a USB drive from another PC and transfer them to the infected computer.

For anyone else suffering from this MBR infection; here are two tools that target it directly:

TDSSKiller by Kaspersky

aswMBR by Avast

If those don't do it, and fixmbr may not cut it sometimes, you need an MBR editor from a live cd.

use something like Unlocked to lock the HDD. kill any process that you dont recognize (since its external, kill ALL of them, only system drive needs processes locking HDD). Install decent antivirus and aswMBR. Your drive is now clean from viruses, you can release the grip on the HDD. and you dont need to do it on another computer either, but then make sure not to kill windows processes or your going to get BSOD.

Try TDSSKiller, like SharpyUK mentioned. There are some other anti-rootkit tools out there, you could also run. Like aswMBR from avast or Vba32 AntiRootkit.

I had the same issue. It finally cleared up when I made the optical media (burned the discs) and powered off the pc and ran the recovery from the bootable media. The issue was that the rootkit infected the MBR and was loading into memory before the recovery could take place. By booting from the optical media (DVD) I was able to avoid that problem (but I made sure to wipe the disk / partition table and rebuild it too).

Since then Avast has come out with an MBR repair utility that I think might fix the problem. Link

You might have to run combofix and/or tdsskiller too. However, if you just make the optical media and boot off of that and do a recovery you'll likely save time and ensure you are clean. I was able to make the recovery media on the infected system, it wasn't able to infect that, but ymmv.

I had trouble even detecting it. I knew it was on there from the search engine redirects. The system had a factory recovery option that you could run from the HDD, but since it infects the MBR it was loading and infecting the system before it could be restored. I ended up making a set of recovery cd's, booted a live CD and wiped the partition table, and then reimaged it. That finally did the trick.

Since then Avast has released a MBR repair utility but I'm not sure how well it'll work. aswmbr link