Microsoft Now Says OS Reinstall Unnecessary for ' Popureb' Trojan

After previously advising Windows users infected with a new rootkit nicknamed 'Popureb' to completely reinstall the OS, Microsoft yesterday retracted, saying a complete wipe is not necessary.

"If your system is infected with Trojan:Win32/Popureb.E, we advise fixing the MBR using the Windows Recovery Console to return the MBR to a clean state," wrote MMPC engineer Chun Feng in an update to a blog post on TechNet.

The previous advise of completely wiping a system was previously given due to the fact that the Trojan operated by overwriting a system's hard drive master boot record to boar its way into a sector accessed only before a computer's BIOS begins the startup process. This causes the OS and security software to not be able to detect the intruding malware.

Feng advises individuals who have been infected to use the Bootrec.exe tool located in the Windows Recovery Environment to repair their system. A detailed explanation on how to use the tool can be found here.

However, removing the 'Popureb' Trojan in this manner may not be enough. "Once you're infected, the best advice is to [reinstall] Windows and start over, said Joe Stewart, director of malware research for Dell SecureWorks, in an interview with Computerworld.  " ... [MBR rootkits] download any number of other malware. How much of that are you going to catch? This puts the user in a tough position."

Marco Giuliani, a threat research analyst at Webroot, also shares Stewart's advice, but also warns that, due to the nature of the malware, wiping a system will not guarantee its removal. "What is really a nightmare is that the Trojan looks like it has bugs and sometimes it hangs the system during the reboot stage," he wrote in a blog posting.

Giuliani and his team at Webroot are currently finishing up on a tool to safely remove the Trojan and will release it after internal testing is complete.


About the Author

Chris Paoli is the site producer for and


  • Spaceflight Training in the Middle of a Pandemic

    Surprisingly, the worldwide COVID-19 lockdown has hardly slowed down the space training process for Brien. In fact, it has accelerated it.

  • Surface and ARM: Why Microsoft Shouldn't Follow Apple's Lead and Dump Intel

    Microsoft's current Surface flagship, the Surface Pro X, already runs on ARM. But as the ill-fated Surface RT showed, going all-in on ARM never did Microsoft many favors.

  • IT Security Isn't Supposed To Be Easy

    Joey explains why it's worth it to endure a little inconvenience for the long-term benefits of a password manager and multifactor authentication.

  • Microsoft Makes It Easier To Self-Provision PCs via Windows Autopilot When VPNs Are Used

    Microsoft announced this week that the Windows Autopilot service used with Microsoft Intune now supports enrolling devices, even in cases where virtual private networks (VPNs) might get in the way.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.