Botnets have become more prevalent as malware writers becomes more sophisticated. One of the more diabolical pieces of malware that showed up back in 2008 is called Mebroot. This virus, which is still in the wild today, is a rootkit that changes a computers Master Boot Record allowing it to install even before the operating system of the computer gets loaded, which protects it from anti-virus protection software.
When prioritizing elements of enterprise network security, preventing malware like a rootkit that hides itself and allows for total control of the machine is right at the top. Mebroot by itself is mostly harmless since it does not contain any specific applications but becomes a platform for other malware. The most prevalent of these is Torpig, a very large botnet.
Torpig contains a number of different data stealing elements of malware that scan the infected machine for private data, accounts and passwords as well as supposedly permitting attackers full access to the computer. In 2009 a team of researchers were able to take control of the Torpig botnet for ten days. During that time, they pulled out over 70GB of stolen information from infected computers.
Mebroot gets onto computers by a user going to a website using a web browser that is older and has not been patched to eliminate the weaknesses that Mebroot uses to add itself to the user’s system. A surefire way to detect Mebroot is with a network based detector, since the virus hides itself on the machine it is installed on which may make it undetectable.
Only some virus scanners can find and remove Mebroot. If a machine is rebooting or acting infected, yet no virus shows up in a scan, repairing the Master Boot Record on the system will remove Mebroot if it installed. Doing a web search for “Fix MBR” will turn up a few different ways to repair the Master Boot Record. After that is done, run a complete virus scan on the computer again to locate anything additional that was hidden.
The best course of action is to prevent machine infection is by keeping browsers updated, and operating both host and network based malware detection programs that are constantly updated with real time information to stop any infection before it starts.