Removing RootKits

C

cyranodesade

All,
I hope this is a simple question does Formatting a Hard Drive and then
FDisk /MBR remove any rootkits or hidden files on a hard drive??
If the answer is no then could you please point me to a good resource
for formatting the boot sector/MBR? Thanks in advance. - CES
 
J

Jerry

Reformatting the drive removes everything. FDISK /MBR is redundant if you
just formatted.

The only other option is a manufacturer's low-level format and that program
is probably not available for a user.
 
K

Kerry Brown

cyranodesade said:
All,
I hope this is a simple question does Formatting a Hard Drive and then
FDisk /MBR remove any rootkits or hidden files on a hard drive??
If the answer is no then could you please point me to a good resource
for formatting the boot sector/MBR? Thanks in advance. - CES
Click to expand...


Yes it will remove the rootkit. You should figure how the rootkit got
installed and alter your computing habits so it doesn't happen again. One of
the reasons people ask this question is because they have done this then
become infected again because they didn't change their habits and the
rootkit got installed again by the same method it was the first time.
 
N

Noddy

Jerry said:
Reformatting the drive removes everything. FDISK /MBR is redundant if you
just formatted.
Click to expand...

Format does not clear the mbr. If it did then Linux Grub or Lilo wouldn't be
left behind after a format, but it is and to get rid of it you run fdisk
/mbr. HDD manufacturers still provide what they call low level format
utilities but all they really are is a zero wipe utility which does
overwrite every sector on a HDD and is the best method to ensure you are
virus free. Or you can simply use Dban's quick wipe, same thing. Dban is
available as a separate download or on The Ultimate Boot Disk.
 
T

Tyler Larson

Noddy said:
Format does not clear the mbr. If it did then Linux Grub or Lilo
wouldn't be left behind after a format, but it is and to get rid of it
you run fdisk /mbr. HDD manufacturers still provide what they call low
level format utilities but all they really are is a zero wipe utility
which does overwrite every sector on a HDD and is the best method to
ensure you are virus free. Or you can simply use Dban's quick wipe, same
thing. Dban is available as a separate download or on The Ultimate Boot
Disk.
Click to expand...

The MBR is stored on sector 0, whereas partitions start at sector 1
(specifically to avoid overwriting the boot sector (MBR)). Therefore,
nothing you can do to the partition will affect the boot sector.
However, in the process of reinstalling windows, you'll automatically
write a new boot sector, since that's what SETUP does.
 
G

Guest

cyranodesade said:
All,
I hope this is a simple question does Formatting a Hard Drive and then
FDisk /MBR remove any rootkits or hidden files on a hard drive??
If the answer is no then could you please point me to a good resource
for formatting the boot sector/MBR? Thanks in advance. - CES
Click to expand...

It will remove the root kit. However, it is not the best first thing to
try, as there are better and easier ways to both remove root kits and to
reduce the risk of re-infection.

Most root kits in use nowadays have little to nothing to do with the MBR.
In old days, some people suggested running FDISK /MBR was recommended as a
virus removal method, but antivirus experts said this was a bad idea, and I
still agree.

Besides the other suggestions you received... if you have two computers that
are networked, using one known clean computer to virus scan the hard drive of
the suspect computer will allow you to detect the root kits commonly used
today. Root kits only hide objects from the infected local OS, not remote
connections to that OS.
 
M

May

Hello

Also by deleting all partitions and recreating new partitions will wipe the
MBR, albeit extreme unless you with to start from scratch. What ever
replaced the ‘Fdisk /MBR’ command?

May
 
C

Crazy Noddy

Tyler Larson said:
The MBR is stored on sector 0, whereas partitions start at sector 1
(specifically to avoid overwriting the boot sector (MBR)). Therefore,
nothing you can do to the partition will affect the boot sector. However,
in the process of reinstalling windows, you'll automatically write a new
boot sector, since that's what SETUP does.
Click to expand...


Then why are boot managers left behind when installing XP if the mbr is
overwrote completely? Because it obviously doesn't. You either have to
destroy the partition or use fdisk /mbr. Install Linux with a boot manager
and then go format it with XP and start setup, afterwards you will see that
Linux boot manager is still there. If XP setup overwrote the mbr then the
Linux boot manager wouldn't still be there. Same thing will happen if you do
a XP/Vista dual boot and you want to go back to just XP. The Vista boot
manager will still be there and you have to edit it with BCDedit.
 
C

Crazy Noddy

Karl Levinson said:
Most root kits in use nowadays have little to nothing to do with the MBR.
In old days, some people suggested running FDISK /MBR was recommended as a
virus removal method, but antivirus experts said this was a bad idea, and
I
still agree.
Click to expand...

Why did they say it is a bad idea and why do you agree?
 
A

Alun Harford

cyranodesade said:
All,
I hope this is a simple question does Formatting a Hard Drive and then
FDisk /MBR remove any rootkits or hidden files on a hard drive??
If the answer is no then could you please point me to a good resource
for formatting the boot sector/MBR? Thanks in advance. - CES
Click to expand...

Yes, it'll remove the rootkit - IF the rootkit lets you format the
drive. There would be nothing to stop somebody from writing a rootkit
that just made it look like the drive had been formatted.

You could delete and recreate the partition when you're booted from CD
(eg. installing Windows)

Alun Harford
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Removing Rootkits from Boot Sector. 2
Rootkit infection (Popureb) requires Windows reinstall, says Microsoft 1
A required device isn't connected or can't be accessed. Error code:0xc0000225 5
Cannot boot WinPE on USB Stic,k, when BIOS is removable. 0
Formatting the Entire Hard Drive 7
Confusion about MBR depending if USB drive is connected 2
will fixmbr fix different OS'es from BartPE? 1
MBR or More? 1

Top