Vista - Mebroot and vista

01-12-2008

How susceptible to the root virus Mebroot is Vista?
I cannot believe in this day and age that an antivirus
program would allow writing to the MBR without warning.

It is my understanding that no AV Program (I am using
OneCare) protects.

Suggestions and recommendations appreciated.

Thanks

01-12-2008

From: "GeraldF" <me@xxxxxx>

| How susceptible to the root virus Mebroot is Vista?
| I cannot believe in this day and age that an antivirus
| program would allow writing to the MBR without warning.
|
| It is my understanding that no AV Program (I am using
| OneCare) protects.
|
| Suggestions and recommendations appreciated.
|
| Thanks

Mebroot is a Trojan, not a virus and you mean RootKit.

If you have an active anti virus application, that has signatures for the Trojan Mebroot,
performing "On Access" scanning then you will not be rooted with this Trojan RootKit that
overwrite areas of the Master Boot Record.

OneCare may detect Mebroot and it may not. OneCare is NOT good to begin with. You want a
better AV solution such as NOD32 or Kaspersky if you are really worried.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

01-12-2008

In article <eaJBLJZVIHA.2000@xxxxxx>,
DLipman~nospam~@Verizon.Net says...

Quote:

> Mebroot is a Trojan, not a virus and you mean RootKit.
>
> If you have an active anti virus application, that has signatures for the Trojan Mebroot,
> performing "On Access" scanning then you will not be rooted with this Trojan RootKit that
> overwrite areas of the Master Boot Record.
>
> OneCare may detect Mebroot and it may not. OneCare is NOT good to begin with. You want a
> better AV solution such as NOD32 or Kaspersky if you are really worried.
>
>
>

How is it possible that any antivirus program allows
access "On Access" to the MBR?

From your post the implication is that OneCare does not
have this capability (elementary dear Watson!)

thanks

01-12-2008

In article <eaJBLJZVIHA.2000@xxxxxx>,
DLipman~nospam~@Verizon.Net says...

Quote:

> OneCare may detect Mebroot and it may not. OneCare is NOT good to begin with. You want a
> better AV solution such as NOD32 or Kaspersky if you are really worried.

PC Magazine review suggests BitDefender is better than
Kasperky because of registry startup protection. Any
comment?

thanks

01-12-2008

From: "GeraldF" <me@xxxxxx>

| How is it possible that any antivirus program allows
| access "On Access" to the MBR?
|
| From your post the implication is that OneCare does not
| have this capability (elementary dear Watson!)
|
| thanks

Many legit. programs can modify the MBR.

Kaspersky is better the BitDefender albeit BitDefender is very good.

I haven't trusted information from PC Mag in years. This comes from somebody who had an
article published in PC Mag in May '88.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

01-12-2008

In article <ekzPdjZVIHA.5508@xxxxxx>,
DLipman~nospam~@Verizon.Net says...

Quote:

> I haven't trusted information from PC Mag in years. This comes from somebody who had an
> article published in PC Mag in May '88.

Thanks

It is amazing what you learn when you have insider
information. Back in the late 70's we learned about Mike
Wallace and 60 minutes. A special on "Ghost Surgery" was
so stressful, one of the nurses involved died of a heart
attack after it aired, and he called CBS to complain
that the information was deliberatly falsified . Ratings
mattered more than the truth. I've never watched since.

01-12-2008	#1 (permalink)
GeraldF n/a posts	Mebroot and vista How susceptible to the root virus Mebroot is Vista? I cannot believe in this day and age that an antivirus program would allow writing to the MBR without warning. It is my understanding that no AV Program (I am using OneCare) protects. Suggestions and recommendations appreciated. Thanks
My System Specs

01-12-2008	#2 (permalink)
David H. Lipman n/a posts	Re: Mebroot and vista From: "GeraldF" <me@xxxxxx> \| How susceptible to the root virus Mebroot is Vista? \| I cannot believe in this day and age that an antivirus \| program would allow writing to the MBR without warning. \| \| It is my understanding that no AV Program (I am using \| OneCare) protects. \| \| Suggestions and recommendations appreciated. \| \| Thanks Mebroot is a Trojan, not a virus and you mean RootKit. If you have an active anti virus application, that has signatures for the Trojan Mebroot, performing "On Access" scanning then you will not be rooted with this Trojan RootKit that overwrite areas of the Master Boot Record. OneCare may detect Mebroot and it may not. OneCare is NOT good to begin with. You want a better AV solution such as NOD32 or Kaspersky if you are really worried. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
My System Specs

01-12-2008	#3 (permalink)
GeraldF n/a posts	Re: Mebroot and vista In article <eaJBLJZVIHA.2000@xxxxxx>, DLipman~nospam~@Verizon.Net says... Quote: > Mebroot is a Trojan, not a virus and you mean RootKit. > > If you have an active anti virus application, that has signatures for the Trojan Mebroot, > performing "On Access" scanning then you will not be rooted with this Trojan RootKit that > overwrite areas of the Master Boot Record. > > OneCare may detect Mebroot and it may not. OneCare is NOT good to begin with. You want a > better AV solution such as NOD32 or Kaspersky if you are really worried. > > > How is it possible that any antivirus program allows access "On Access" to the MBR? From your post the implication is that OneCare does not have this capability (elementary dear Watson!) thanks
My System Specs

01-12-2008	#4 (permalink)
GeraldF n/a posts	Re: Mebroot and vista In article <eaJBLJZVIHA.2000@xxxxxx>, DLipman~nospam~@Verizon.Net says... Quote: > OneCare may detect Mebroot and it may not. OneCare is NOT good to begin with. You want a > better AV solution such as NOD32 or Kaspersky if you are really worried. PC Magazine review suggests BitDefender is better than Kasperky because of registry startup protection. Any comment? thanks
My System Specs

01-12-2008	#5 (permalink)
David H. Lipman n/a posts	Re: Mebroot and vista From: "GeraldF" <me@xxxxxx> \| How is it possible that any antivirus program allows \| access "On Access" to the MBR? \| \| From your post the implication is that OneCare does not \| have this capability (elementary dear Watson!) \| \| thanks Many legit. programs can modify the MBR. Kaspersky is better the BitDefender albeit BitDefender is very good. I haven't trusted information from PC Mag in years. This comes from somebody who had an article published in PC Mag in May '88. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
My System Specs

01-12-2008	#6 (permalink)
GeraldF n/a posts	Re: Mebroot and vista In article <ekzPdjZVIHA.5508@xxxxxx>, DLipman~nospam~@Verizon.Net says... Quote: > I haven't trusted information from PC Mag in years. This comes from somebody who had an > article published in PC Mag in May '88. Thanks It is amazing what you learn when you have insider information. Back in the late 70's we learned about Mike Wallace and 60 minutes. A special on "Ghost Surgery" was so stressful, one of the nurses involved died of a heart attack after it aired, and he called CBS to complain that the information was deliberatly falsified . Ratings mattered more than the truth. I've never watched since.
My System Specs