4

In a moment of desperation and without thinking, I executed an .exe file purporting to be a pirated version of a hard-to-find program, forgetting that I had no real-time antivirus active. A few seconds later Malwarebytes (the free version, so not real-time) had been removed from the system. I then hurriedly tried to do a System Restore but sure enough, found that my boot sector had been wiped.

Thankfully, I was able to restore back from backups to a working system within a few hours, but this sobering experience has left me wondering: what exactly is the purpose of such a destructive virus?

I can understand ransomware, cryptominers, or malware that turns my computer into part of a botnet, but what motivation would a malware developer have to wipe out a system's boot sector? What's the endgame to doing so? As a bonus question, is there known active malware that goes further and wipes out a user's actual data?

Improve this question
1
  • Somebody might write a piece of malware for fun, others might do it out of spite/grudge and others might do it simply because they can. These are just the first justifications that popped into my head. Asking why people write malware that are only destructive to the system that they infect, is like asking why isn't there world peace? - understanding why people do what they do is not as simple as one might think. The answer is usually: because they can.
    – Soutzikevich
    Commented Jan 28, 2020 at 20:03

1 Answer 1

Reset to default
7

Some people think that breaking stuff is funny (or, in other words, they do it "for teh lulz"). It's possible there's some other explanations, of course - maybe they have an ethical objection to software piracy and think anybody who attempts it deserves to have their system wrecked, maybe the program attempted (or would have attempted, if given more time?) to exfiltrate your data (for identity theft or similar) rather than just delete it and nuking the boot sector was just an unrelated "make the nastiest malware possible" target, maybe the malware was going to replace your boot sector with one that ave very low-level persistent access to your OS and it was either incompatible with your machine or didn't have time to finish that task... Lots of possibilities.

There are absolutely no lack of malicious programs that combine wanton destruction with attempts to either gain money or send some sort of message (political, social, or simply an "I'm better than you" brag). Obviously for some common types of malware, like botnets including cryptominers, you want the target machine to remain operational; making it unbootable is contrary to that goal. On the other hand, if the goal was data/identity theft, preventing you from getting back online for a while may give the attacker more time to run amok with everything from your Amazon.com account to your social security number (or equivalent). I recommend changing your passwords and watching your credit score (or freezing it) for a while.

As a side note, antivirus is not a safeguard against this kind of thing. Antivirus is a last-ditch attempt to deflect the bullet you've already shot at your own foot, and it's not very reliable about it. If you get to the point where you think "if only I'd had a real-time AV running..." you've already screwed up, massively. Don't expect AV to save you. If the malware is old enough, and insufficiently obfuscated, and not bypassing the scans in some way, it will probably work, but it's like setting up a camera that does facial recognition of everybody approaching the house and checks against a police database. There's so many ways to avoid it...

Also, all versions of Windows released in the last ~10 years (so, the only ones still supported and receiving security patches) have built-in AV (with real-time scanning). If you don't want to use those, there are a number of free third-party options too...

Improve this answer
1
  • +1 for highlighting the reality of AV products using an excellent analogy. Some of the "next-generation" AV products show real potential in combating novel/uncommon malware using AI, but currently they come with a different set of challenges - including more false positives.
    – Unencoded
    Commented Jun 23, 2020 at 21:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .