ID: IRCNE2011071168
Date: 2011-07-02
Computerworld - Microsoft yesterday clarified the advice it gave users whose Windows PCs are infected with a new, sophisticated rootkit that buries itself on the hard drive's boot sector.
Several security researchers agreed with Microsoft's revisions, but a noted botnet expert doubted that the advice guaranteed a clean PC.
Last week, the Microsoft Malware Protection Center (MMPC) highlighted a new Trojan, dubbed "Popureb," and said that the only way to eradicate the malware was to use a recovery disc.
Because a recovery disc returns Windows to its factory settings, Microsoft was essentially telling users that they needed reinstall Windows to completely clean an infected PC.
Malware like Popureb is especially difficult to detect and delete once it's on a system because it overwrites the hard drive's MBR, the first sector -- sector 0 -- where code is stored to bootstrap the operating system after the computer's BIOS does its start-up checks. Because it hides on the MBR, the rootkit installed by Popureb makes not only itself, but any follow-on malware installed by it later, invisible to both the operating system and security software.
Several security firms have also weighed in on the debate about whether users need to reinstall Windows.
"Reinstalling is definitely overkill for this malware problem," said Vikram Thakur, principal security response manager with Symantec, in an interview today. "It can be resolved simply by fixing the MBR via an external disk."
Symantec offers a tool to help users do that.
Named "Norton Bootable Discovery Tool," the free download creates a boot disc for starting up the PC without accessing the hard drive -- and thus without loading the infected MBR. Once the Windows machine boots using the recovery disc, the tool downloads new malware signatures -- the digital "fingerprints" antivirus software uses to detect threats -- sniffs out signs of infection and if necessary, cleans the MBR.
When you fix the MBR, you pretty much expose the threat itself to other applications, including antivirus applications," said Thakur. "They can then pick up on the threat, and delete it."
But an internationally-known botnet expert disagreed.
Joe Stewart, director of malware research at Dell SecureWorks, said that reinstalling Windows was the only way to insure that MBR rootkits and the additional malware they install are completely removed.
"Once you're infected, the best advice is to [reinstall] Windows and start over," said Stewart. "[MBR rootkits] download any number of other malware. How much of that are you going to catch? This puts the user in a tough position."
Marco Giuliani, the Webroot threat research analyst who published his own analysis of Popureb, cautioned that users may end up having to reinstall Windows after all.
"What is really a nightmare is that [Popureb] looks like it has bugs and sometimes it hangs the system during the reboot stage," Giuliani wrote on the Webroot blog. "This could become a problem that would require you to perform a full system reinstall."
Related Links:
Rootkit infection requires Windows reinstall
- 2