I´ve reformatted Windows XP without getting rid of "Rootkit.MBR.Whistler(Boot image). What to do?

Novice

I´ve reformatted Windows XP without getting rid of "Rootkit.MBR.Whistler(Boot image). What to do?

I have now several times reformatted my hard drive and reinstalled Windows XP without getting rid of "Rootkit.MBR.Whistler(Boot image)".  What to do?

4 REPLIES 4
F-Secure Product Expert

Re: I´ve reformatted Windows XP without getting rid of "Rootkit.MBR.Whistler(Boot image). What

Hi,

 

Welcome! I moved your post to the Protection board.

Best Regards,
Peter
Champion

Re: I´ve reformatted Windows XP without getting rid of "Rootkit.MBR.Whistler(Boot image). What

Hi,

 

not sure how to remove it, didn't find instructions at F-Secure page.

 

One thing you can try is the rescue CD it boots a Linux image and will scan the drive and might be able to remove.

 

Second option would be to install a Linux and rewrite MBR. Linux has better tools for that.

 

My personal experience.

 

 

 

 

F-Secure Product Expert

Re: I´ve reformatted Windows XP without getting rid of "Rootkit.MBR.Whistler(Boot image). What

Hi berjan,

Please refer the KB article below to disinfect MBR in Win XP:
http://support.microsoft.com/kb/314058 (under the fixmbr section)
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/bootcons_fixmbr.mspx

Thanks.


Best Regards,
Jayson

"A person who never made a mistake never tried anything new" -Albert Einstein

Has somebody helped you? Say thanks by giving kudos. Has your issue been solved? Mark the post using "Accept As Solution" button to let others know.
F-Secure Product Expert

Re: I´ve reformatted Windows XP without getting rid of "Rootkit.MBR.Whistler(Boot image). What

Hi berjan,

 

Just to add an additional information from our Security Lab.
http://www.f-secure.com/v-descs/rootkit_w32_whistler_a.shtml

Thanks.


Best Regards,
Jayson

"A person who never made a mistake never tried anything new" -Albert Einstein

Has somebody helped you? Say thanks by giving kudos. Has your issue been solved? Mark the post using "Accept As Solution" button to let others know.