View Single Post
Old 06-18-2008, 11:54 PM   #12 (permalink)
calvin333
Registered User
 
Join Date: May 2008
Posts: 27
OS: xp


Re: cssrss creating HQS Trojan at startup

Hi Ried (finally got that right, sorry about that)

So I moved mbr into c drive then attempted to run but then sytem responded with "can't find it". So I clicked the browse and found that default location from start/run is "Administrator"...

So I did a "C:\mbr.exe -f" and the log is below.
This is like the movie Groundhog Day as for a few days I've been running mbr and it kept giving me that short log

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
malicious code @ sector 0xdf8f900 size 0x1a8 !
copy of MBR has been found in sector 62 !
calvin333 is offline