How Can We Protect our Computer with Free Security Solutions

[Deleted member 178]

With most image backup solutions the MBR gets backed up as well and as long as your image is clean you can get rid of boot rootkits as well.

But this malware infect the BIOS so it inject itself over and over into your newly restored MBR.

Known as Trojan.Mebromi, the rootkit reflashes the BIOS of computers it attacks to add malicious instructions that are executed early in a computer's boot-up sequence. The instructions, in turn, alter a computer's MBR, or master boot record, another system component that gets executed prior to the loading of the operating system of an infected machine. By corrupting the processes that run immediately after a PC starts, the malware stands a better chance of surviving attempts by antivirus programs to remove it.

http://www.theregister.co.uk/2011/09/14/bios_rootkit_discovered/

...The BIOS is now infected, and the dropper goes to its next step: infecting the Master Boot Record...

http://blog.webroot.com/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/

Jack's Thread of it on MalwareTips : http://malwaretips.com/Thread-Mebromi-BIOS-Virus-Out-in-the-Wild?highlight=mebromi

 

[bogdan]

True. The solution could be resetting your BIOS before restoring the backup image of your HDD. Luckily such malware are rare.

 

[Deleted member 178]

The solution could be resetting your BIOS before restoring the backup image of your HDD

Annoying to do it everytime ^^

Luckily such malware are rare.

Yep, lucky us

 

[Littlebits]

True. The solution could be resetting your BIOS before restoring the backup image of your HDD. Luckily such malware are rare.

Most PC techs can reset your BIOS without any problems on some motherboards all you have to do is remove the BIOS battery for 3 minutes and replace it and the BIOS will auto restore to factory defaults, BIOS malware completely deleted.

Thanks.

 

[Deleted member 178]

Exactly what i said, annoying to do, especially on a laptop (because i have a laptop) ^^

 

[Littlebits]

Some other things I forgot to add about BIOS malware.

It is extremely rare for a home system to get infected with one here is why:

1. They only target business, corporations, government, military systems, etc. They don't target home systems, the possibility is really slim that a home system would get infected with a BIOS malware. (Of if you are one of the malware collectors and like testing them that could cause an accidental infection).

2. Most modern motherboards have Antivirus protection, sometimes not enabled by default for compatibility. It is usually listed in the security section of your motherboard's BIOS setup. How this works is it puts a block on writing in the BIOS, where is hard drive has no access to the BIOS. I have this option enabled on my system but if you even need to flash or update your BIOS it will fail. You will have to disable this security feature to update or flash your BIOS. On some motherboard BIOS, you may have problems with this security feature enabled. Might follow the advice of your BIOS setup before enabling it, if it is disabled by default.

Good day.

 

[HeffeD]

Luckily such malware are rare.

Rare enough to not even be considered a threat...

Any malware that flashes your BIOS would have to target an extremely small subset of hardware. Not enough of a return to be worth developing for malware authors. Can you imagine trying to write specific malware for each mobo/chipset configuration?

 

[bogdan]

The BIOS is not needed as much nowadays since the OS can talk to the hardware on its own, but it is still used during the boot process and it is a little bit annoying that this not so crucial legacy stuff can host a dangerous infection. But yes, it is hard to write one because you have little space to work with and it requires deep knowledge. However they are introducing larger Extensible Firmware Interface (EFI) as a replacement for the old BIOS and that could lead to new threats unless there are some built-in security features.. I don't know.

 

[pcjunklist]

Windows 8 secure boot should hopefully fix any virus from making it's way to the bios.

 

[malbky]

Nope pcjunklist if the malware coded UEFI bios is signed by a leaked certificate or if a virus adds one more certificate to your list(it can be done, read the article on secure boot of windows8), then surely the malware bios can execute. As earth said EFI brings in new possibilities.