Microsoft has warned that the malware it calls Popureb has received a clever update that means there is only one sure way to remove it: reinstalling Windows.
The latest version of the malicious code, Trojan:Win32/Popureb.E, has added a driver component that prevents malicious data from being changed, Microsoft said in an advisory last week.
Popureb stores part of its data in the hard drive’s master boot record (MBR), the sector where code is stored to bootstrap the operating system, wrote Chun Feng, an engineer with the Microsoft Malware Protection Centre, in the advisory. That makes it effectively invisible to the operating system as well as to security software.
“The driver component protects the data in an unusual way,” wrote Feng. “If it finds the write operation is trying to overwrite the MBR or the disk sectors containing malicious code, it simply replaces the write operation with a read operation. The operation will still succeed, however, the data will never actually be written onto the disk.”
The result is another layer of complexity that makes Popureb effectively impossible to remove, according to Feng.
As a result, Microsoft is advising that users will need to restore their systems via a recovery CD, which returns Windows to its factory settings.
“If your system does get infected with Trojan:Win32/Popureb.E, we advise you to fix the MBR and then use a recovery CD to restore your system to a pre-infected state (as sometimes restoring a system may not restore the MBR),” Feng wrote. “To fix the MBR, we advise that you use the System Recovery Console, which supports a command called ‘fixmbr’.”
Malicious programs that bury themselves in the innards of the operating system to conceal their presence, called rootkits, have become part of the arsenal of malicious programmers in recent years.
Earlier this month, a Kaspersky researcher found that rootkit-based financial malware was being spread via Amazon Web Services.
Rootkits have spread to mobile devices as well.
In March, Google removed more than 50 malicious apps from its Android Market and issued a security patch, after eventually admitting multiple malware attacks that compromised a number of Android-powered handsets last week.
The infected apps contained rootkit malware called DroidDream, which can take command of a mobile handset, send personal details to a remote server, download and execute new code.
Targetting AWS, Microsoft? British competition regulator soon to announce “behavioural” remedies for cloud sector
Move to Elon Musk rival. Former senior executive at X joins Sam Altman's venture formerly…
Bitcoin price rises towards $100,000, amid investor optimism of friendlier US regulatory landscape under Donald…
Judge Kaplan praises former FTX CTO Gary Wang for his co-operation against Sam Bankman-Fried during…
Explore the future of work with the Silicon In Focus Podcast. Discover how AI is…
Executive hits out at the DoJ's “staggering proposal” to force Google to sell off its…
View Comments
While reinstalling Windows is painfully fun, here's a better solution.. USE UBUNTU or LINUX MINT for email, web browsing purposes. You won't be bothered by viruses nor the continual system slowdowns inherent in most Windows operating systems.. also, Linux is FREE.
Just google "Ubuntu" or "Linux Mint".
Just for the record there is free software out there that does clean this Master boot record & Rootkit virus. I use them in my computer virus removal business Microcola.com in Bath. This virus is one of many which we can disinfect out off systems. McAfee, Norton, Avira, AVG have all let this virus through their systems. Business computers can not be reinstalled quickly so I have to clean this virus quickly off systems.