Microsoft has warned that the malware it calls Popureb has received a clever update that means there is only one sure way to remove it: reinstalling Windows.
The latest version of the malicious code, Trojan:Win32/Popureb.E, has added a driver component that prevents malicious data from being changed, Microsoft said in an advisory last week.
Popureb stores part of its data in the hard drive’s master boot record (MBR), the sector where code is stored to bootstrap the operating system, wrote Chun Feng, an engineer with the Microsoft Malware Protection Centre, in the advisory. That makes it effectively invisible to the operating system as well as to security software.
“The driver component protects the data in an unusual way,” wrote Feng. “If it finds the write operation is trying to overwrite the MBR or the disk sectors containing malicious code, it simply replaces the write operation with a read operation. The operation will still succeed, however, the data will never actually be written onto the disk.”
The result is another layer of complexity that makes Popureb effectively impossible to remove, according to Feng.
As a result, Microsoft is advising that users will need to restore their systems via a recovery CD, which returns Windows to its factory settings.
“If your system does get infected with Trojan:Win32/Popureb.E, we advise you to fix the MBR and then use a recovery CD to restore your system to a pre-infected state (as sometimes restoring a system may not restore the MBR),” Feng wrote. “To fix the MBR, we advise that you use the System Recovery Console, which supports a command called ‘fixmbr’.”
Malicious programs that bury themselves in the innards of the operating system to conceal their presence, called rootkits, have become part of the arsenal of malicious programmers in recent years.
Earlier this month, a Kaspersky researcher found that rootkit-based financial malware was being spread via Amazon Web Services.
Rootkits have spread to mobile devices as well.
In March, Google removed more than 50 malicious apps from its Android Market and issued a security patch, after eventually admitting multiple malware attacks that compromised a number of Android-powered handsets last week.
The infected apps contained rootkit malware called DroidDream, which can take command of a mobile handset, send personal details to a remote server, download and execute new code.
Nvidia to replace Intel this week on Dow Jones Industrial Average after years of turmoil…
Joby Aviation and Toyota Motor complete demonstration flight in Shizuoka as companies prepare to bring…
SK Hynix says Nvidia chief executive Jensen Huang asked if production of next-gen HBM4 memory…
Digital transformation is an ongoing journey, requiring continuous adaptation, strong leadership, and skilled talent to…
Australian computer scientist faces contempt-of-court claim after suing Jack Dorsey's Block and Bitcoin Core developers…
OpenAI's ChatGPT gets search features, putting it in direct competition with Microsoft and Google, amidst…
View Comments
While reinstalling Windows is painfully fun, here's a better solution.. USE UBUNTU or LINUX MINT for email, web browsing purposes. You won't be bothered by viruses nor the continual system slowdowns inherent in most Windows operating systems.. also, Linux is FREE.
Just google "Ubuntu" or "Linux Mint".
Just for the record there is free software out there that does clean this Master boot record & Rootkit virus. I use them in my computer virus removal business Microcola.com in Bath. This virus is one of many which we can disinfect out off systems. McAfee, Norton, Avira, AVG have all let this virus through their systems. Business computers can not be reinstalled quickly so I have to clean this virus quickly off systems.