Boot Sector Viruses & Rootkits Poised For Comeback

Ant writes "Ars Technica says Panda Labs' first quarter 2008 malware report raises a new concern, though it comes from a surprising direction. According to the company, boot sector viruses loaded with rootkits are poised to make a comeback. This honestly sounds a bit odd, considering how long it has been since a boot virus has topped the malware charts, but it's at least theoretically possible (pdf). Such viruses have a simple method of operation. The virus copies itself into the Master Boot Record (MBR) of a hard drive, and rewrites the actual MBR data in a different section of the drive. The report also covers a number of other topics and makes predictions about the types of attacks computer users may see in the future. Forecasting these trends is always tricky."

Comments

Re:Let me guess

[MooseMuffin]

Yep. Just copy this little protection file into your MBR...

I can see it now

[oni]

GNU GRUB version 0.95 (638 lower / 288704K upper memory)

Ubuntu, kernel 2.6.12-9-386
Ubuntu, kernel 2.6.12-9-386 (recovery mode)
Ubuntu, memtest86+
Other operating systems:
Windows NT/2000/XP
omfgh4xorz-r00tk1tz3113

Use the up and down keys to select which entry is highlighted.
Press enter to boot the selected OS, 'e' to edit the commands
before booting, or 'c' for a command-line

hmm, something's not right here

Re:I can see it now

[ettlz]

hmm, something's not right here

Yep. The latest grub is 0.97.

Or are you talking about the space-munching change of layout?

Re:I can see it now

[maxch]

call me crazy, but that Windows entry seems suspicious.

Re:I can see it now

[Anonymous Coward]

Indeed. You misspelled Windows Vista.

Cool

[dedazo]

The last time any of my machines had anything resembling a virus, malware or trojans it came in a floppy boot sector and it was called "Natas" or something like that.

Bill Clinton was president, the Nasdaq was at 5,000 or something like that and I was smoking pot. Maybe we'll go back to the old days in more ways than one!

Re:Cool

[Abreu]

Well, I don't know about boot sector viruses or about pot, but theres a chance you might get a 'President Clinton' once more...

-

*Disclaimer: The above is a joke and not an endorsement or criticism of any US candidate... I am not USian and I don't really care much for american policies.

Re:Cool

[BlackSnake112]

I remember back in college (1992) I bought a box of 10 floppy disks. All 10 were infected (with ripper I think). I wrote to the disk company letting them know the numbers that were on the box. About three weeks later I got a huge box. It had over 1000 brand new floppies and a letter thanking me for letting them know about that issue. Also was an apology for getting infected disks. I didn't have to buy floppy disks for years.

Bah!

[Well-Fed Troll]

I spit on thee, thou foul virus writing knaves.
Wilt it doth survive the lowly Format?
Truly I say unto thee, Real Men write CMOS infecting viruses.

Windows Malicious Software Removal Tool

[mrbluze]

Windows is a program which inserts code into the master boot record, often before the user has broken open the packaging of their new computer, resulting in loading of malicious code at power-on which causes the computer to phone-home and results in the gradual loss of available disk space on the affected drive. Multiple other vulnerabilities have also been reported.

Various removal tools are available free of charge. This is considered a critical and urgent update.

great idea

[ILuvRamen]

And you know what really helps is writing detailed how-to theory articles, saying it's inevitable, and repeating how effective it could be. That will ensure that all these gloom and doom virus articles come true! That must be what all these authors want or something or they'd all shut up.