Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is it possible to check the MBR of the boot drive of Ubuntu for viruses within my Ubuntu?

Is there any good software to do this? I heard ClamAV does not check for MBR viruses.

share|improve this question
1  
Why do you think you have a virus? –  Uri Herrera Apr 6 '12 at 23:03
    
We live in an unsafe world. If the PC has had Windows on it, it may have MBR infections. –  david6 Apr 7 '12 at 1:10
    
Note Using Linux is now the preferred method of finding and removing stubborn (MBR, stealth, etc.) malware. Most of the leading vendors now have a standalone (free) download, that targets Windows malware but is actually using Linux to operate. –  david6 Apr 7 '12 at 1:11
    
@UriHerrera I want to check it with a tool/method. You do not know if you do not check. I have several Windows tools which can do that. But I have not Windows installed natively. I did not get any good answer till now. –  therealmarv Apr 10 '12 at 18:28
add comment

2 Answers

Based on some internet research:

1) The code of a virus in MBR would be so tiny that it is hard to detect (1).

2) A reasonable approach would be to compare your MBR before and after an infection. That is what some antivirus do (2).

3) You could copy your MBR to a file with something like sudo dd if=/dev/sda of=mbr.bin bs=512 count=1 then check the file, which is a binary, with an Hex Editor like Bless.

share|improve this answer
    
ok, this is maybe technical interesting. But I want an automated method to check for MBR virus. –  therealmarv Apr 10 '12 at 18:29
    
I believe that there is only two automated ways: one compares your MBR before and after an infection and other compares your MBR with what it is expected to be from a list of defaults MBRs. –  desgua Apr 11 '12 at 1:46
    
Note that the dd command needs to be run from a LiveCD. If you run it after executing the MBR code, you'll be looking at a pristine MBR served up by the virus disk I/O hook, and not the actual MBR. –  Ben Voigt Mar 31 at 20:26
add comment

Yes, most viruses / malware actually target Windows/Intel ('Wintel').

So many of the Ubuntu AV solutions mostly look for (and find) Wintel malware.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.