Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I imagine that bootkits and other malware can install themselves in the MBR and be invisible to antivirus software running after the MBR was executed.

Is there any way to execute an antivirus scan on the MBR in a way that no known MBR malware could prevent this?

share|improve this question
    
Use a bootable CD, like the Kaspersky one: support.kaspersky.com/viruses/rescuedisk –  James Sep 10 '13 at 16:13
    
many AV systems allow you to create a boot disk for offline scanning. support.kaspersky.com/4162 Most AV systems do scan the MBR and boot sector, so unless you are looking at a root kit situation, a normal scan is probably sufficient. –  Frank Thomas Sep 10 '13 at 16:15
    
@FrankThomas: That is the exact tool I linked to. Kaspersky also do TDSSKiller which is specifically designed to remove this kind of Malware and is also free: support.kaspersky.com/2727. Just be sure to rename it as some malware will try to block it. –  James Sep 10 '13 at 16:17
    
indubitably. we were writing at the same time, and great minds do indeed think alike. –  Frank Thomas Sep 10 '13 at 16:30
    
@James Why didn't you post it as an answer? –  Jader Dias Sep 10 '13 at 17:02

1 Answer 1

up vote 0 down vote accepted

There aren't any well known AVs that could scan for virus in MBR.some applications out there claims they does it , but i don't know how much they are successful at it (for eg:TDSSKiller.exe utility )

But you can always rewrite your MBR using bootsect.You can gain more insights about fixing MBR via this article

share|improve this answer
    
"The main feature of a bootkit is that it cannot be detected by standard means of an operating system because all its components reside outside of the standard file systems. Some types of bootkits hide even the fact that the MBR has been compromised by returning the legitimate copy of the MBR when an attempt to read it has been made. " -support.kaspersky.com/2727 –  Ash Sep 10 '13 at 16:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.