Safety 101: Viruses and solutions

 
 
 

How to remove a bootkit

Back to "Viruses and solutions"
2013 Aug 28 ID: 2727
 
 
 
 
­A bootkit is a type of malware that infects the Master Boot Record (MBR).

This infection method allows the malicious program to be executed before the operating system boots. As soon as BIOS (Basic Input Output System) selects an appropriate boot device (it can be a hard disk or a flash drive), the bootkit that resides in the MBR starts executing its code. Once the bootkit receives the control, it usually starts preparing itself (reads and decrypts its auxiliary files in its own file system that it has created somewhere in the unallocated disk space) and returns the control to the legitimate boot loader overseeing all stages of the boot process.

The main feature of a bootkit is that it cannot be detected by standard means of an operating system because all its components reside outside of the standard file systems.
Some types of bootkits hide even the fact that the MBR has been compromised by returning the legitimate copy of the MBR when an attempt to read it has been made.
A system infected with a bootkit can be cured with the TDSSKiller utility. 
 
 
 
 
 
 

List of malicious programs

 
 
 
 
 

How to disinfect a compromised system

 
 
 
 
 

How to use the utility

 
 
 
 
 

Command line keys for the TDSSKiller.exe utility

 
 
 
 
Did the provided info help you?
Yes No