Advice Request Anyone using MBRFilter?

[AtlBo]

Any risks with MBRFilter? Specifically I would like to know if MBRFilter might block a required change and cause a problem that way. Also, it would be helpful to know if this issues a warning or if a Windows warning is the sign the protection has blocked something. Really would like to know if this will block MBR damaging malware (Petya) working with AppCheck Free.

I have a Windows 7 PC that is GPT, so I guess I will not need this for protection against MBR damaging ransomware and other malware. Is this a safe conclusion to make? Other MBR PCs here are the ones I am concerned about for now.

 

[509322]

Any risks with MBRFilter? Specifically I would like to know if MBRFilter might block a required change and cause a problem that way. Also, it would be helpful to know if this issues a warning or if a Windows warning is the sign the protection has blocked something. Really would like to know if this will block MBR damaging malware (Petya) working with AppCheck Free.

I have a Windows 7 PC that is GPT, so I guess I will not need this for protection against MBR damaging ransomware and other malware. Is this a safe conclusion to make? Other MBR PCs here are the ones I am concerned about for now.

The greatest danger is that the uninstall directions are poorly written. If the uninstall is done incorrectly\goes badly, then you might get the dreaded BSOD INACCESSIBLE_BOOT_DEVICE - which means a probable clean install of the OS.

Ask others who have uninstalled it successfully if need be.

 

[509322]

I have a Windows 7 PC that is GPT, so I guess I will not need this for protection against MBR damaging ransomware and other malware. Is this a safe conclusion to make? Other MBR PCs here are the ones I am concerned about for now.

I'm going to relay what Fabian Wosar stated over at Wilders. It goes something like this...

MBR modifying malware can still cause trouble. Some don't check if the system boots using BIOS\etc and will over-write the GPT causing damage. Then it will have to be repaired.

I'm not sure of the GPT subtleties - in other words, if MBRFilter will protect GPT. For a reliably accurate answer ask Fabian Wosar. He might answer, he might not answer. It's like Santa Claus, you won't get it unless you ask for it.

 

[Davidov]

For me glitch is that the flash drive can not be formatted (MBR filter protects all MBR thus the flash memory). But otherwise I have no problem. If you switch to safe mode, then it is formatted flash drive.

 

[Zero Knowledge]

MBRFilter is only for MBR disks. Pretty sure it does not protect or have anything to do with GPT disks.

It's from Cisco's Talos security team. They have some very smart people working there.

 

[jelson]

I'm going to relay what Fabian Wosar stated over at Wilders. It goes something like this...
<elided>

Does Fabian Wosar go by the username "mood" over there?

 

[Wave]

Does Fabian Wosar go by the username "mood" over there?

No, his username is "Fabian Wosar" over there too, I think at least. Same as here.

 

[Windows_Security]

Any risks with MBRFilter? Specifically I would like to know if MBRFilter might block a required change and cause a problem that way. Also, it would be helpful to know if this issues a warning or if a Windows warning is the sign the protection has blocked something. Really would like to know if this will block MBR damaging malware (Petya) working with AppCheck Free.

I have a Windows 7 PC that is GPT, so I guess I will not need this for protection against MBR damaging ransomware and other malware. Is this a safe conclusion to make? Other MBR PCs here are the ones I am concerned about for now.

It behaved OK on my PC's (allowing restores etc), as @mood said the uninstall instructons are very poorly written and require that you are familiar with registry editor (you should not delete the key, only the value from the key). So while it is easy to install it is hard to remove.

 

[Davidov]

I need detailed instructions on how to uninstall the MBR filter or some script.Podle this manual it probably removes bad because I can not delete a registry key.

GitHub - vrtadmin/MBRFilter: Cisco Talos MBR Filter Driver
Maybe the bad I proceed Can anyone give me step by step, thank you.

 

[Behold Eck]

Don`t use it on XP as it produces a blue screen at shutdown.

Fine so far on Win7.

Yeah the uninstall is a bit sketchy

Regards Eck

 

[Davidov]

It behaved OK on my PC's (allowing restores etc), as @mood said the uninstall instructons are very poorly written and require that you are familiar with registry editor (you should not delete the key, only the value from the key). So while it is easy to install it is hard to remove.

I can not uninstall MBRfilter confuses some guidance that works thanks? I have every time BSOD.

 

[Windows_Security]

@Davidov

Open Regedit and navigate to this key:

HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}

Post the contents (attack screen print as picture or copy text in line)

 

[509322]

I can not uninstall MBRfilter confuses some guidance that works thanks? I have every time BSOD.

If you deleted the entire key, then it will result in an INACCESSIBLE_BOOT_DEVICE BSOD.

To fix that type of BSOD you must clean install the OS or use the Microsoft ISO on a bootable disk\usb and try the repair disk function or do an image restore that has a Windows boot loader. A clean install works like a charm every time. The others not so much.

The MBRFilter uninstall instructions are poorly written. You just need to delete the key value and not the entire key itself.

 

[Davidov]

@Davidov

Open Regedit and navigate to this key:

HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}

Post the contents (attack screen print as picture or copy text in line)

https://s23.postimg.org/x2xbld1xn/MBRfilter.jpg

What is my value in the registry to delete?

 

[Davidov]

I already figured it out, I just removed it MBRfilter and after a reboot of the authors removed the driver and it works but thanks.

https://s15.postimg.org/5t0ge734r/MBRfilter.jpg

Only in this red squares removed. Thanks guys.

 

[Windows_Security]

Yep, that is the value to remove.

 

[Brahman]

https://s15.postimg.org/5t0ge734r/MBRfilter.jpg

.

The Image is gone. 404 error. Well I am still struggling to remove the key. Already got BSOD 2 times (Phew ....restored from image). Please help me to get rid of this MBR filter.

 

[Ink]

@Lockdown What about users of UEFI and GPT?

 

[Windows_Security]

The Image is gone. 404 error. Well I am still struggling to remove the key. Already got BSOD 2 times (Phew ....restored from image). Please help me to get rid of this MBR filter.

Open Regedit and navigate to this key:

HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}

Post the contents (attach screen print as picture or copy text in line)

I will tell you what to remove

 

[Brahman]

Open Regedit and navigate to this key:

HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}

Post the contents (attach screen print as picture or copy text in line)

I will tell you what to remove

I tried to delete the upper filters key and it ended in a bsod. I am on windows 10 ( insecure boot)