Nasty ransomware overwrites your PC's master boot record

[Brink]

It’s hard enough for non-technical users to deal with ransomware infections: understanding public-key cryptography, connecting to the Tor anonymity network and paying with Bitcoin cryptocurrency. A new malicious program now makes it even more difficult by completely locking victims out of their computers.

The new Petya ransomware overwrites the master boot record (MBR) of the affected PCs, leaving their operating systems in an unbootable state, researchers from antivirus firm Trend Micro said in a blog post.

The MBR is the code stored in the first sectors of a hard disk drive. It contains information about the disk’s partitions and launches the operating system’s boot loader. Without a proper MBR, the computer doesn’t know which partitions contain an OS and how to start it.

Trend Micro researchers say Petya is distributed through spam emails that masquerade as job applications. This suggests that its creators target businesses in particular, with the messages being directed at human resources departments.

The emails have a link to a shared Dropbox folder that contains a self-extracting archive posing as the applicant’s CV and a fake photo. If the archive is downloaded and executed, the ransomware is installed.

The malicious program will rewrite the computer’s MBR and and will trigger a critical Windows error that will cause the computer to reboot—a condition known as a Blue Screen of Death (BSOD).

Following this initial reboot, the rogue MBR code will display a fake Windows check disk operation that normally occurs after a hard disk error, according to computer experts from popular tech support forum BleepingComputer.com.

During this operation, the ransomware actually encrypts the master file table (MFT). This is a special file on NTFS partitions that contains information about every other file: their name, size and mapping to the hard disk sectors...

Read more: This nasty ransomware overwrites your PC's master boot record | PCWorld

 

[whs]

One more reason to approach the internet only with Linux - either as double boot or virtual machine.

 

[Brink]

Linux is not immune from viruses either though.

 

[whs]

Linux is not immune from viruses either though.

That is correct. But chances of catching a Linux malware are a lot smaller than in Windows. And if you run in a virtual machine, that is easily replaced from a backup copy.

 

[groze]

Actually, wouldn't a good Macrium reflect image backup work? It restores the MBR and track 0.

Whs, I know you are fan of Linux and I like Linux. However, my elderly mother was using Seamonkey on Linux. Clicked on on those ads that says 25 things you didn't know about whatever. Guess what happened, Linux operating system froze as well as the browser. I had to do a hard boot. As a safety precaution, I restored from a backup image. I have a certain procedure I do to prevent the virus or maleware from hiding. My Linux system is 64 bit.

Would the ransomware effect systems that have a GUID Partition Table (GPT) with secure boot on or off?

 

[whs]

I am not really a Linux fan. I just know that under certain configurations your chances for survival increase when you use Linux rather than Windows, Especially if you run it from a virtual partition which is dedicated to browsing. If that goes on the blink, you just roll in a backup. And since you do only browsing there, you cannot really lose a lot - maybe some updates which I very often do not install anyhow.

Would this effect system that have a GUID Partition Table (GPT) with secure
boot not enabled?

I did not really understand what this question referred to.

 

[Lady Fitzgerald]

Actually, wouldn't a good Macrium reflect image backup work? It restores the MBR and track 0...

Yes, it would. Sadly, not many people make frequent images.

 

[RoasterMen]

Linux is not immune from viruses either though.

That is correct. But chances of catching a Linux malware are a lot smaller than in Windows. And if you run in a virtual machine, that is easily replaced from a backup copy.

If more people migrate to Linux, then it'll be a hotspot.

 

[whs]

You may be right. But that is unlikely going to happen. And placing a virus in Linux is not quite as easy as in Windows.

 

[mjf]

Actually, wouldn't a good Macrium reflect image backup work? It restores the MBR and track 0.

Yes along with the MFT and everything else.
It strikes me that ransomeware and any other malware can be a problem for
1) system images stored on other internal HDDs
2) your internally connected data drives that may not be as regularly backed up as they should(guilty)
3) that brief period of time your external system image backup drives are connected.

If your BIOS/UEFI firmware can get attacked you could be in a more tricky situation.

 

[groze]

MJF

Since, the version of Macrium reflect I use quit working through windows due to a windows update. I backup & restore my system using Macrium Rescue media. It does take a little longer backing up though.

For restoring,
I first run MiniTool Partition Wizard Free from a boot cd or usb flash drive
Delete all partitions
Create NTFS partition for the full drive. I align the partition to MB
I then plug my usb flash hard drive in with the Macrium boot image
Then reboot the computer, hit f12 (May only work on some dell systems) to get the bios boot menu before it has a chance to boot up. Choose the Usb Flash hard drive, when it boots up--I choose the latest restore image and restore the computer. So far this method has not failed me-Knock on wood.

The reason I do it this way is Macrium has some issues restoring a multiple boot system.

 

[mjf]

Seems like a painful process. I don't multiboot from the one drive so maybe another Macrium user could comment on quirks with Macrium.

Macrium not working due to a Windows update would annoy me. I'm guessing you don't know what the update was or else you'd uninstall it. Ironically I always make a Macrium image before installing (important) updates in case they play up.

 

[groze]

Seems like a painful process. I don't multiboot from the one drive so maybe another Macrium user could comment on quirks with Macrium.

Macrium not working due to a Windows update would annoy me. I'm guessing you don't know what the update was or else you'd uninstall it. Ironically I always make a Macrium image before installing (important) updates in case they play up.

Your correct, I don't know which update. I haven't update Macrium because you can't use old backups and I don't know what features that you may lose. I don't mind the way I have to restore or backup my system that why I haven't asked for help.

 

[Alejandro85]

The good thing about this virus is that since it attacks the MBR, it must be run with administrator privileges to do something really nasty, so if one is careful about where you put your admin password, it seems reasonably easy to avoid trouble.
Unless the little thing exploit a bug in Windows itself :sarc:

Actually, wouldn't a good Macrium reflect image backup work? It restores the MBR and track 0.

No idea really, but it would be great to run a test on that. I still have my doubts if it backups the MBR and MFT or if it just copies the files in bulk. Has anyone actually tested trashing his MBR and see if it can be restored?

Would the ransomware effect systems that have a GUID Partition Table (GPT) with secure boot on or off?

My guess is that yes, they would too. The very first of a GPT is just a normal MBR after all (that just says "there is a GPT after this"), so it would still overwrite that.
Secure Boot would catch the infected disk, I suppose, and prevent starting of the compromised OS. The idea of it is preventing booting from anything but the factory OS, and a virus-made MBR certainly counts as that.

If your BIOS/UEFI firmware can get attacked you could be in a more tricky situation.

It can, actually. And it has been done previously (just look at the date):
Security researcher says new malware can affect your BIOS; communicate over the air | PCWorld

Anything with a firmware can be attacked this way. After all, if a program you download to update the firmware can do it, a properly writen virus can do so, too, for less good purposes. Good luck getting rid of those once your hard disk has a virus in its controller

 

[groze]

Originally Posted by groze
Actually, wouldn't a good Macrium reflect image backup work? It restores the MBR and track 0.

No idea really, but it would be great to run a test on that. I still have my doubts if it backups the MBR and MFT or if it just copies the files in bulk. Has anyone actually tested trashing his MBR and see if it can be restored

I had to read about MFT. If I am understanding it correctly, MFT should be backed up & restored as well. However, that could depend on how you back your system up. I do my backup outside of windows.

I also use the restore method listed in my other post because that gets grub2 boot manager restored correctly.

 

[michael diemer]

I use Linux as a double boot. I have Ubuntu and Zorin on one dedicated Linux drive, and Windows on two other dedicated drives. No interaction between the two op. systems. And like WHS, I use Linux only for browsing. So a crash is no problem, I just reinstall. I don't have any files on Linux to lose, except maybe a document or two. That's one computer. I use another one just for music. When I need to put Linux to sleep, it takes about 5 seconds. Then I just wake up the music machine. I have a mouse/keyboard combo so I can use it with both. I just move the dongle from one machine to the other. Works well for me, but I know others like virtual machines better.

 

[mjf]

Your correct, I don't know which update. I haven't update Macrium because you can't use old backups ....

If you are talking about restoring a Macrium V5 image using V6 then I believe you can. You cannot restore a V6 image with V5.

As I've said before Macrium V5 & V6 stores the MBR and gives you the option not to replace it when you perform a system image restore. Think about it....if you didn't store and replace the MBR you could never restore the image to a new drive and have it boot. Your MBR isn't generic because it contains your partition table.

If you are worried about your MBR getting corrupted then you can also back it up separately using this
TrojanHunter anti trojan - remove trojans, malware, adware and other malicious software
You can check if it has been altered using this simple hex editor's file comparison on the MBR backups.
https://mh-nexus.de/en/hxd/
Remember if you change your partition structure then of course your MBR will change.