MBR rootkit

Yep, there's been a lot of talk about this newish rootkit, and Microsoft's advise on how to clean it.

But going back years when I first started with UNIX systems, the advise for a system that had a rootkit installed or had been hacked was simple. "Wipe the HDDs and do a clean install. Restore user data from backup, and verify setup in line with documentation".

Or as Ellen Ripley put "nuke the entire site from orbit. It’s the only way to be sure".

My personal thought is, yes you may have cleaned the rootkit, but what else has been installed?
 
Chewy509 said:
Yep, there's been a lot of talk about this newish rootkit, and Microsoft's advise on how to clean it.

But going back years when I first started with UNIX systems, the advise for a system that had a rootkit installed or had been hacked was simple. "Wipe the HDDs and do a clean install. Restore user data from backup, and verify setup in line with documentation".

Or as Ellen Ripley put "nuke the entire site from orbit. It’s the only way to be sure".

My personal thought is, yes you may have cleaned the rootkit, but what else has been installed?
Click to expand...

+1. What else is there to say.
 
I'm surprised nobody has found a hardware solution to this, something like putting a jumper on the HDD which disables writing to the boot sector. Once you partition a hard drive, there's no reason for anything to be written to the boot sector unless you're repartitioning it.
 
IIRC, BIOSes have supported a "Virus MBR Lock" for some time, where it will interrupt any changes to the MBR when enabled. Of course, you have to turn it off to install the OS then remember to turn it back on.
 
I guess this would be one benefit from using an advanced format drive to boot from?
 
That is useless when the virus/malware bypasses the AV software.
 
You must log in or register to reply here.
Back
Top