Hacktool.Stonedbootkit and Boot.Stonedbootkit
Hacktool.Stonedbootkit is a Trojan designed to drop a copy of Boot.Stonedbootkit. Hacktool.Stonedbootkit will replace the master boot record (MBR) with its own code to gain control of the infected computer.
While, Boot.Stonedbootkit is a boot sector virus installed by Hacktool.Stonedbootkit. The two are separate Trojans that targets Master Boot Record on victims PC.
Alias: StonedBootkit
Damage Level: Low
Systems Affected: Windows 9x, 2000, XP, Windows Vista
Characteristics
This Trojan will drop numerous files and folders to the compromised system.
It will make a backup copy of the original Master Boot Record (MBR) on the following location:
SystemDrive%\Stoned\Master Boot Record.bak
To take control of the PC, this Trojan will replace the existing MBR with its own. With this method, the Trojan can now hook various system files and malicious code that overrides existing security privileges.
Distribution
Hacktool.Stonedbootkit primarily spread through spam operation. It is either in the form of email or Internet campaign. The Trojan will infect web site through vulnerabilities. Then, it will inject a code commonly used to process drop-by-download method to infect visitors. Authors of this Trojan also embed the code into downloadable executable files that are mostly hosted on unsecured file-sharing networks or peer-to-peer connection.
How to Remove Hacktool.Stonedbootkit and Boot.Stonedbootkit
1. Temporarily Disable System Restore (Windows Me/XP). [how to]
2. To be able to identify even the most recent variant of Hacktool.Stonedbootkit, open your antivirus application and update the virus definition file.
3. Start Windows in Safe Mode with Networking.
- From a power-off state, turn on the computer and press F8 on your keyboard repeatedly.
- Your computer will display Windows Advanced Boot Options menu. Please select Safe Mode with Networking.
- The system will now boot Windows and loads only necessary drivers and files.
4. Open your antivirus program and run a full system scan. After the scan, delete all infected items. If unable to delete, better place them in quarantine. Once the scan is complete, please proceed with the next step.
Scan with Norton Power Eraser:
Additional virus removal tool like Norton Power Eraser provides deep scanning technology to eliminate other threats not detected by a normal virus scan. Use this tool with extra caution.
5. Go to Norton Power Eraser web page and download the tool.
6. Once the download completes, double click on the file NPE.exe to run the program.
7. It will prompt for End User License Agreement, click on Accept to continue.
8. On NPE main window, click on Scan. Then select Exclude Rootkit Scan. Click on Continue to proceed.
9. Virus scanning may take some time. After running the scan, NPE will display the scan result.
Important! If there are any detected threats under Suspicious, remove the check mark. Only threats in Detected category are necessary to remove at this point. Make sure that you mark the Create System Restore Point before proceeding with the fix.
10. Now click on Fix to start removing the threats including Hacktool.Stonedbootkit remnants if there are any.
11. When done, Norton Power Eraser will restart the computer. Then after a reboot, it will initialize and display the eliminated threats.
12. You may now close Norton Power Eraser.