I found this article which talks about a rootkit which infects the VBR and creates a virtual file system in unallocated space between partitions. I know that there are MBR rootkits which cannot be deleted by simple reformat the partition and to get rid of them you have to overwrite first 512 bytes of the drive or to repartition the drive, deleting partion table and creating a new one. However this article talks about VBR, not MBR, and there is written that reformat the partition and reinstall the OS can't delete the malware. The VBR is the first sector of a partition and, according to various sites on the web, it is created when you format a partition. Of course if you just reformat the partition the virtual file system will stay in the unallocated space, but without the infected VBR nothing can execute code from it. Can someone explain how is it possible for this malware to survive an OS reinstall?

  • An MBR-style OS installation typically rewrites the boot sector (the "volume boot record"), and may rewrite the partition table, and may rewrite the file system metadata ("formatting" a partition), but typically doesn't touch anything outside of partitions. What exactly do you mean by "survive"? Are you interested only in MBR-style booting, or are answers discussing EFI-style booting fair game?
    – user
    Dec 20 '17 at 13:32
  • Only the MBR is executable (has executable code). Any space in between partitions will not be executed, so malware cannot hide there.
    – forest
    Dec 20 '17 at 13:42
  • @MichaelKjörling This malware works just on MBR-style booting according to the article, and there is written "unless the bootkit and virtual file components are removed, the malware will execute and load every time the system starts even if the operating system partition has been wiped and the OS is reinstalled." If, like you said, an OS reinstallation typically rewrites the volume boot record, I can't understand how this bootkit can be executed even if the OS has been reinstalled.
    – zack
    Dec 20 '17 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.