Microsoft: New Windows Malware Requires Re-Install
The Popureb Trojan has become so clever that removing it requires a fresh install of Windows
Microsoft has warned that the malware it calls Popureb has received a clever update that means there is only one sure way to remove it: reinstalling Windows.
The latest version of the malicious code, Trojan:Win32/Popureb.E, has added a driver component that prevents malicious data from being changed, Microsoft said in an advisory last week.
Master boot record malice
Popureb stores part of its data in the hard drive’s master boot record (MBR), the sector where code is stored to bootstrap the operating system, wrote Chun Feng, an engineer with the Microsoft Malware Protection Centre, in the advisory. That makes it effectively invisible to the operating system as well as to security software.
“The driver component protects the data in an unusual way,” wrote Feng. “If it finds the write operation is trying to overwrite the MBR or the disk sectors containing malicious code, it simply replaces the write operation with a read operation. The operation will still succeed, however, the data will never actually be written onto the disk.”
The result is another layer of complexity that makes Popureb effectively impossible to remove, according to Feng.
As a result, Microsoft is advising that users will need to restore their systems via a recovery CD, which returns Windows to its factory settings.
“If your system does get infected with Trojan:Win32/Popureb.E, we advise you to fix the MBR and then use a recovery CD to restore your system to a pre-infected state (as sometimes restoring a system may not restore the MBR),” Feng wrote. “To fix the MBR, we advise that you use the System Recovery Console, which supports a command called ‘fixmbr’.”
Malicious programs that bury themselves in the innards of the operating system to conceal their presence, called rootkits, have become part of the arsenal of malicious programmers in recent years.
Earlier this month, a Kaspersky researcher found that rootkit-based financial malware was being spread via Amazon Web Services.
Mobile mayhem
Rootkits have spread to mobile devices as well.
In March, Google removed more than 50 malicious apps from its Android Market and issued a security patch, after eventually admitting multiple malware attacks that compromised a number of Android-powered handsets last week.
The infected apps contained rootkit malware called DroidDream, which can take command of a mobile handset, send personal details to a remote server, download and execute new code.
