How do I remove them from internal hard drives and USB sticks? Can they infect MicroSD cards as well or anything else? DVD? cd?
Heard it's possible to do with a live CD via formatting. What are best methods?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Consider using a tool that can clean your MBR, like Boot Repair Disk. Make sure to wipe the MBR, and not repair it, as generally you can't know if the malware would be removed by repairing.
I guess it is fair to assume that if you have a writable MBR, it could be infected. Thus, yes, an attacker could infect MicroSD cards. DVD/CD (optical drives) function differently (see UDF and ISO 9660), they do not use a MBR.
For the creation of a Live CD, it's best to use dedicated software as it takes care of different variations, be it hardware/firmware or configuration, such as OS or partitioning.
So, if you need to make sure you have removed any possible malware on the drive:
Both steps are necessary, because these are two logically different steps and generally doing one does not affect the other.
All you'll need to do is boot up a LiveCD or Windows installation or whatever OS you prefer and format both USB and HDD that will resolve a typical rootkit.
Rootkit is just for hiding particular malware but yes it can infect any form media such as MicroSD, USB, CD, DVD, BIOS and so on. It can get more complex by infecting routers by re-writing the firmware on there. Ofcourse, extremely rare and would have to be programmed for that particularly version of the router. BIOS is also another rare rootkit.
Some good reading articles for you:
I found this out, The following command from the Linux terminal window as root will erase the mbr
sudo dd if=/dev/zero of=/dev/sda bs=512 count=1 This will erase the first sector (512 bytes) of the hard drive /dev/sda . Be sure that this is the right drive to erase! So, keep your external backup drive disconnected, to avoid any bad error.
To erase anything before the (former) first partition of the drive, located at the 1st MiB, you can erase 2048 sectors: This is for the case a virus used that area to store any info.
sudo dd if=/dev/zero of=/dev/sda bs=512 count=2048
So only the second command is necessary.
The only GUI way to delete the mbr would be to make a new partition table. This affects the master boot sector only. However, because there was such a virus history, it is safer to clean a few more, not just the mbr.
Still doesn't delete the Volume Boot Record, which can also be infected.