Categories: PCSecurityWorkspace

Microsoft: New Windows Malware Requires Re-Install

Microsoft has warned that the malware it calls Popureb has received a clever update that means there is only one sure way to remove it: reinstalling Windows.

The latest version of the malicious code, Trojan:Win32/Popureb.E, has added a driver component that prevents malicious data from being changed, Microsoft said in an advisory last week.

Master boot record malice

Popureb stores part of its data in the hard drive’s master boot record (MBR), the sector where code is stored to bootstrap the operating system, wrote Chun Feng, an engineer with the Microsoft Malware Protection Centre, in the advisory. That makes it effectively invisible to the operating system as well as to security software.

“The driver component protects the data in an unusual way,” wrote Feng. “If it finds the write operation is trying to overwrite the MBR or the disk sectors containing malicious code, it simply replaces the write operation with a read operation. The operation will still succeed, however, the data will never actually be written onto the disk.”

The result is another layer of complexity that makes Popureb effectively impossible to remove, according to Feng.

As a result, Microsoft is advising that users will need to restore their systems via a recovery CD, which returns Windows to its factory settings.

“If your system does get infected with Trojan:Win32/Popureb.E, we advise you to fix the MBR and then use a recovery CD to restore your system to a pre-infected state (as sometimes restoring a system may not restore the MBR),” Feng wrote. “To fix the MBR, we advise that you use the System Recovery Console, which supports a command called ‘fixmbr’.”

Malicious programs that bury themselves in the innards of the operating system to conceal their presence, called rootkits, have become part of the arsenal of malicious programmers in recent years.

Earlier this month, a Kaspersky researcher found that rootkit-based financial malware was being spread via Amazon Web Services.

Mobile mayhem

Rootkits have spread to mobile devices as well.

In March, Google removed more than 50 malicious apps from its Android Market and issued a security patch, after eventually admitting multiple malware attacks that compromised a number of Android-powered handsets last week.

The infected apps contained rootkit malware called DroidDream, which can take command of a mobile handset, send personal details to a remote server, download and execute new code.

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

View Comments

  • While reinstalling Windows is painfully fun, here's a better solution.. USE UBUNTU or LINUX MINT for email, web browsing purposes. You won't be bothered by viruses nor the continual system slowdowns inherent in most Windows operating systems.. also, Linux is FREE.

    Just google "Ubuntu" or "Linux Mint".

  • Just for the record there is free software out there that does clean this Master boot record & Rootkit virus. I use them in my computer virus removal business Microcola.com in Bath. This virus is one of many which we can disinfect out off systems. McAfee, Norton, Avira, AVG have all let this virus through their systems. Business computers can not be reinstalled quickly so I have to clean this virus quickly off systems.

Recent Posts

UK’s CMA Readies Cloud Sector “Behavioural” Remedies – Report

Targetting AWS, Microsoft? British competition regulator soon to announce “behavioural” remedies for cloud sector

5 hours ago

Former Policy Boss At X Nick Pickles, Joins Sam Altman Venture

Move to Elon Musk rival. Former senior executive at X joins Sam Altman's venture formerly…

7 hours ago

Bitcoin Rises Above $96,000 Amid Trump Optimism

Bitcoin price rises towards $100,000, amid investor optimism of friendlier US regulatory landscape under Donald…

9 hours ago

FTX Co-Founder Gary Wang Spared Prison

Judge Kaplan praises former FTX CTO Gary Wang for his co-operation against Sam Bankman-Fried during…

9 hours ago