Published Aug 16, 2012 | Updated Sep 15, 2017


Detected by Microsoft Defender Antivirus

Aliases: TROJ_DISTTRACK.A (Trend Micro) Trojan.Win32.Erase.MBR.a (Kaspersky) Trojan.Win32.Erase.MBR (Ikarus) W32.DistTrack (Symantec)


Trojan:Win32/WipMBR.gen!A is a trojan that connects to a remote host and may download arbitrary files.

If this threat is detected on your computer, it is likely that your computer is also infected with other variants of Trojan:Win32/WipMBR, such as Trojan:Win32/WipMBR.B. These trojans can overwrite your computer's MBR (master boot record) and other files, thus preventing you from accessing your operating system and using your computer.

To detect this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:

Additional remediation instructions for Trojan:Win32/WipMBR.gen!A

If you suspect your computer is infected with this threat, do not start Windows. We recommend booting from a safe source, such as Windows Defender Offline, to prevent the trojan from executing its payload. See the instructions on how to use Windows Defender Offline below.

A confirmed infection of Trojan:Win32/WipMBR.gen!A may make changes to the MBR (Master Boot Record). You may need to restore the MBR so that you can access your computer's operating system.

Please see the following articles for further details on restoring the MBR with the Windows Recovery Console:

When the MBR has been successfully restored, run a full-system scan with an up-to-date antivirus product such as the Microsoft Safety Scanner.

For additional information about the Windows Recovery Console, please see the following articles in the Microsoft Knowledge Base:

How to install and use the Recovery Console in Windows XP
How to access the System Recovery Options in Windows Vista
How to access the System Recovery Options in Windows 7

Using Windows Defender Offline

The way Windows Defender Offline works, is by allowing you to:

  • Download a copy of the tool from a computer that has access to the internet
  • Save a copy of the recovery tool to a removable drive, in order to create bootable media
  • Run the recovery tool on a compromised computer

You might want to use Windows Defender Offline when:

  • You need to scan your computer to check for rootkits and other malware
  • You are infected with malware that prevents you from downloading and installing an antivirus or the latest updates for your antivirus software
  • Your antivirus does not detect or remove advanced malware, such as a rootkit

Note: Windows Defender Offline is not a replacement for a full antivirus solution providing ongoing protection; it is meant to be used in situations where you cannot start or otherwise effectively scan your infected computer due to a virus or other malware actively running on the computer and impeding the effective action of antimalware software. For no-cost, real-time protection that helps guard your home or small business computers against viruses, spyware, and other malicious software, download Microsoft Security Essentials.

  1. Determine if you require the 32-bit or 64-bit download.

    See the Microsoft Help and Support article for instructions on how to determine whether a computer is running a 32-bit version or 64-bit architecture of the Windows operating system.
  2. Using a computer that can connect to the internet, download the version of the Windows Defender Offline that applies to the affected computer.

    If the affected computer is a:

    - 32-bit computer, then download the 32-bit version here.
    - 64-bit computer, then download the 64-bit version here.

    Note: In order for the recovery tool to be effective, make sure you download the version that matches the architecture of the affected computer. For example, if your 64-bit desktop is affected, you will need to download the 64-bit version of the Windows Defender Offline and save it to a removable drive.
  3. Save the downloaded file to a local drive on your computer.
  4. Launch the downloaded file, and create a bootable device by following the instructions on the wizard.

    Note: We recommend creating a bootable USB or CD; if you create a bootable USB, this can be updated for future use.
  5. From the affected computer, boot from the USB or CD you created in step 4.

    Note: You may need to set the boot order in the BIOS to do this. This will be device specific, so if you are unsure, refer to your system manual or manufacturer.
  6. Follow the prompts to run a full system scan.

    Depending on the outcome of the scan, your next steps will vary. Follow the prompts from Windows Defender Offline to manage any threat detections.

Steps you can take once your computer has been cleaned

  • Install security software, such as Microsoft Security Essentials, or other products that provide a complete, real-time antivirus solution.
  • Keep your antivirus up to date by making sure you have the latest definitions.
  • Use the Microsoft Safety Scanner if you suspect you are infected but are unable to confirm this with your existing antivirus solution.
Follow us