I can't erase Win32/Pitou.J

[Neoshnx 0]

I've been recently infected by RansomWare (STOP.djvu, the "pcqq" variant), and I've been trying to erase all of it's leftovers, there is one that I can't erase though. And it's this:

 

As you can see, the malware is located on the MBR sector, but I don't know how to erase it. If you need any more information please tell me. I am sorry for my broken English.

[Marcos 5,238]

Since the infection is in MBR, fix MBR as per the instructions at https://neosmart.net/wiki/fix-mbr/ for instance.

[Neoshnx 0]

I tried doing that, but when I type "bootrec /FixBoot" it says "Access denied". I tried doing it through System Recovery and not through a Recovery USB.

[itman 1,743]

5 hours ago, Neoshnx said:

I tried doing it through System Recovery and not through a Recovery USB.

Per the linked Neosmart article for a Win 10 installation, the MBR repair must be performed from Win 10 installation or recovery drive media:

Quote

 

The instructions are:

1. Boot from the original installation DVD (or the recovery USB)
2. At the Welcome screen, click Repair your computer
3. Choose Troubleshoot
4. Choose Command Prompt
5. When the Command Prompt loads, type the following commands:

   
   
   
   bootrec /FixMbr bootrec /FixBoot bootrec /ScanOs bootrec /RebuildBcd

   

    

6. Press Enter after each command and wait for each operation to finish
7. Remove the DVD from the disk tray
8. Type exit
9. Hit Enter
10. Restart your computer and check if Windows 10 can now boot

 

-EDIT- Also according to this article: https://www.pcworld.com/article/3113585/how-to-repair-windows-master-boot-record-and-fix-your-bricked-pc.html , running bootrec /FixMbr should have worked via Win 10 Recovery Environment cmd prompt option. Note: you need to be running from the default local admin account when booting to the recovery environment; not a standard user account.

Edited May 21, 2021 by itman