BloodHound.Boot detected after PerfectDisk Build 64 Boot time Defrag

siliconman01,

 

At this point, regardless of whether PerfectDisk is installed or not, your master boot record has been changed. I suggested getting a copy of it and submit it to Symantec's Response team for further analysis.

 

P.S. I've had success in the past using MBRutil.exe that can be found via the second item at Tools and References for the MBR and OS Boot Records to get a copy of the MBR for submission.

Message Edited by reese_anschultz on 11-24-2008 01:33 PM
1 Like

Thanks very much for your response, Reese

 

The file MyMBR.zip has been submitted with a tracking number of Tracking #10060819.  The /SH parameter was used to generate MyMBR.bin.

siliconman01, thanks for the submission. Please keep us up-to-date with how the submission goes.

After 24 hours I have received no email on the status.  And the issue is still present.  How does one check the status via the tracking number?

Below is the automated response.  Hopefully a human analysis will be performed and result in a fix.

 


We have analyzed your submission.  The following is a report of our findings for each file you have submitted:

 

filename:  C:\Users\Tom xxx\Desktop\MyMBR.zip

machine: Machine

result: See the developer notes

 

filename: MyMBR.bin

machine: Machine

result: See the developer notes

 

Customer notes:

On Vista SP1 Business unning NIS 2009 with aggressive heuristics and Early Load selected.  On each system reboot NIS 2009 detects Bloodhound.boot.  I believe this is a false positive because on rescan nothing is found.  This happens on every system reboot.

  

Developer notes:

 C:\Users\Tom xxx\Desktop\MyMBR.zip is a container file of type  ZIP MyMBR.bin Our automation was unable to identify any malicious content in this submission.

 The file will be stored for further human analysis  This file is contained by   C:\Users\Tom xxx\Desktop\MyMBR.zip


 

I didn’t expect the automatic detection to find anything. We’ll see what the reviewers find…

Thanks again for your attention to this issue.

 

No email notification yet concerning the human analysis. 

No e-mail yet on human analysis of submitted file and BloodHound.Boot alerts continue to occur.

 

How can I find out the status of this?

siliconman01, we are unable to progress your issue due to the fact that we are unable to reproduce it in our lab.

 

Just to confirm - are you running 64bit Vista?

 

JohnM

Symantec

No, I am currently on Vista SP1 Business 32-bit.  I plan to convert to 64-bit soon, but have not as of this time.

 

As stated in the subject title, I am running PerfectDisk 2008, B64; however, I do not have it set to do offline defrags on each reboot. 

 

I do have heuristics set to Aggressive.  Bloodhound.boot does not get detected when heuristics are on Automatic.

Message Edited by siliconman01 on 12-05-2008 12:14 AM

Yeah, that's the setup we used. Apologies for this, but can I ask you to fill out the online form here - https://submit.symantec.com/false_positive/index.html with details of your issue. In the URL field just list the tracking number of your file, and in the Additional information field list this forum URL. That way we can start tracking your issue a bit easier.

 

I think this is going to be one of those tricky issues that requires your (almost) exact setup in order to reproduce.

 

Appreciate your patience.

 

JohnM

Symantec

 

 

The false positive submission has been made.

 

I will supply any additional info that you need. 

Thanks. Received and being processed.

 

JohnM

I wondering if the Bloodhound. Boot detection is not the result of the following: 

 

Sometime back, on my Vista SP1 system in msconfig>Boot tab, I changed the timeout seconds from 30 seconds to 5 seconds.  I then made all settings permanent. 

 

I’m wondering if NIS heuristics is detecting the change as a malicious attempt. Just a thought…inasmuch as you have not been able to reproduce the problem.

This morning I completely rebuilt my hard drive, reformatted, and upgraded to Vista SP1 Business 64-bit (from 32-bit).  I installed NIS 2009 right after installing Vista.  No other third party programs installed.

 

AND I still get the Bloodhound.Boot alert on system reboot with aggressive heuristics and early load. :smileysad:

Did you write zero’s to the drive?


Dieselman743 wrote:
Did you write zero's to the drive?

 

No, just did a full format. 

Well that’s probably the problem. Hannah awhile back had a problem till I told her to write zero’s to the drive and after that it was fixed. The virus is most likely in your Master Boot Records. You need to delete all partitions and write zero’s to the drive. The manufacture of your drive should have downloadable software.

Could FIXMBR fix it?

1 Like

huwyngr wrote:
Could FIXMBR fix it?

 

Thanks, I'll try it in a day or so....once I get my Casper V5.0 backup to my backup drive installed...just in case. :smileywink:

 

I'm still installing stuff because of the 64-bit rebuild on the C drive and do not yet want to overwrite my 32-bit system on the backup drive.  Hopefully FIXMBR will resolve...once and for all.