Boot Sector Viruses & Rootkits Poised For Comeback

Ant writes "Ars Technica says Panda Labs' first quarter 2008 malware report raises a new concern, though it comes from a surprising direction. According to the company, boot sector viruses loaded with rootkits are poised to make a comeback. This honestly sounds a bit odd, considering how long it has been since a boot virus has topped the malware charts, but it's at least theoretically possible (pdf). Such viruses have a simple method of operation. The virus copies itself into the Master Boot Record (MBR) of a hard drive, and rewrites the actual MBR data in a different section of the drive. The report also covers a number of other topics and makes predictions about the types of attacks computer users may see in the future. Forecasting these trends is always tricky."

Comments

I can see it now

[oni]

GNU GRUB version 0.95 (638 lower / 288704K upper memory)

Ubuntu, kernel 2.6.12-9-386
Ubuntu, kernel 2.6.12-9-386 (recovery mode)
Ubuntu, memtest86+
Other operating systems:
Windows NT/2000/XP
omfgh4xorz-r00tk1tz3113

Use the up and down keys to select which entry is highlighted.
Press enter to boot the selected OS, 'e' to edit the commands
before booting, or 'c' for a command-line

hmm, something's not right here

Re:I can see it now

[maxch]

call me crazy, but that Windows entry seems suspicious.

Cool

[dedazo]

The last time any of my machines had anything resembling a virus, malware or trojans it came in a floppy boot sector and it was called "Natas" or something like that.

Bill Clinton was president, the Nasdaq was at 5,000 or something like that and I was smoking pot. Maybe we'll go back to the old days in more ways than one!

Bah!

[Well-Fed Troll]

I spit on thee, thou foul virus writing knaves.
Wilt it doth survive the lowly Format?
Truly I say unto thee, Real Men write CMOS infecting viruses.

Windows Malicious Software Removal Tool

[mrbluze]

Windows is a program which inserts code into the master boot record, often before the user has broken open the packaging of their new computer, resulting in loading of malicious code at power-on which causes the computer to phone-home and results in the gradual loss of available disk space on the affected drive. Multiple other vulnerabilities have also been reported.

Various removal tools are available free of charge. This is considered a critical and urgent update.