How do I remove them from internal hard drives and USB sticks? Can they infect MicroSD cards as well or anything else? DVD? cd?
Heard it's possible to do with a live CD via formatting. What are best methods?
Add a comment
|
3 Answers
Consider using a tool that can clean your MBR, like Boot Repair Disk. Make sure to wipe the MBR, and not repair it, as generally you can't know if the malware would be removed by repairing.
I guess it is fair to assume that if you have a writable MBR, it could be infected. Thus, yes, an attacker could infect MicroSD cards. DVD/CD (optical drives) function differently (see UDF and ISO 9660), they do not use a MBR.
For the creation of a Live CD, it's best to use dedicated software as it takes care of different variations, be it hardware/firmware or configuration, such as OS or partitioning.
So, if you need to make sure you have removed any possible malware on the drive:
- Create a clean MBR, practically redoing the partitioning of the drive.
- Format your new partition(s).
Both steps are necessary, because these are two logically different steps and generally doing one does not affect the other.
-
So any tools that are boot repair, or mbr repair should all restore an infected mbr to a clean state without the infection still present? i thought they were for fixing it if it was corrupt not working ect, i guess they are. Is it possible they could repair and not successfully remove the rootkit it manages to stick around?– AlisterCommented Jul 18, 2018 at 10:25
-
I thought dvd cd wouldn't be possible, as i was thinking no mbr, poster below said it's possible to put it on cd dvd, getting confused now, yeah good tip i already have live usbs ect that software looks good tho, writting iso to microsd cards, i'm thinking if formatting due to virus infections smart idea would be to always fix repair the mbr before reinstalling the os. Assuming you just wanted to remove the mbr create a new one and not repair is formatting the drive the best course of action?– AlisterCommented Jul 18, 2018 at 10:30
-
Sorry, I didn't clarify: to ensure that the MBR is clean, I would completely wipe and rewrite it anew. It's difficult to say if just repairing is going to catch all possible manipulations.– maptoCommented Jul 18, 2018 at 10:49
-
Notice that @Paul's response to CD, DVD or BIOS does not make explicit reference to MBR. So while they would be vulnerable in general, this cannot happen via MBR, as it is absent.– maptoCommented Jul 18, 2018 at 10:51
-
As for best course of action, I'd suggest wiping MBR first and then creating your partitions. This should reset anything writable on the drive. I've updated my answer with these clarifications.– maptoCommented Jul 18, 2018 at 10:55
All you'll need to do is boot up a LiveCD or Windows installation or whatever OS you prefer and format both USB and HDD that will resolve a typical rootkit.
Rootkit is just for hiding particular malware but yes it can infect any form media such as MicroSD, USB, CD, DVD, BIOS and so on. It can get more complex by infecting routers by re-writing the firmware on there. Ofcourse, extremely rare and would have to be programmed for that particularly version of the router. BIOS is also another rare rootkit.
Some good reading articles for you:
-
So basically just open gparted click and any drive click format and that's it? when i wasn't sure i found looked this up.– AlisterCommented Jul 18, 2018 at 10:16
-
To format just your MBR dd if=/dev/zero of=/dev/sda bs=446 count=1 Note the blocksize of 446 is supposed to erase everything up to your partition table, but not your partition table itself. To format (remove) your MBR & partition table dd if=/dev/zero of=/dev/sda bs=512 count=1 To format (remove) the 1st MB located before the MBR dd if=/dev/zero of=/dev/sda bs=512 count=2048– AlisterCommented Jul 18, 2018 at 10:16
-
So does simply choosing to reformat with any tool delete the mbr and partition table, then recreate it? by typical i assume you mean a "bootkit" interesting i didn't no there was a solution for badusb i was aware of it tho.– AlisterCommented Jul 18, 2018 at 10:21
-
I think CD and DVD can't be infected as the poster above suggested no mbr to infect.– AlisterCommented Jul 18, 2018 at 10:23
-
Also just saw the infection can infect either the mbr or the vbr there two different things that need to be fixed are they? do you no if bootkits effect android iphones as well?– AlisterCommented Jul 18, 2018 at 13:05
I found this out, The following command from the Linux terminal window as root will erase the mbr
sudo dd if=/dev/zero of=/dev/sda bs=512 count=1 This will erase the first sector (512 bytes) of the hard drive /dev/sda . Be sure that this is the right drive to erase! So, keep your external backup drive disconnected, to avoid any bad error.
To erase anything before the (former) first partition of the drive, located at the 1st MiB, you can erase 2048 sectors: This is for the case a virus used that area to store any info.
sudo dd if=/dev/zero of=/dev/sda bs=512 count=2048
So only the second command is necessary.
The only GUI way to delete the mbr would be to make a new partition table. This affects the master boot sector only. However, because there was such a virus history, it is safer to clean a few more, not just the mbr.
Still doesn't delete the Volume Boot Record, which can also be infected.