Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to check the MBR of the boot drive of Ubuntu for viruses within my Ubuntu?

Is there any good software to do this? I heard ClamAV does not check for MBR viruses.

share|improve this question
Why do you think you have a virus? – Uri Herrera Apr 6 '12 at 23:03
We live in an unsafe world. If the PC has had Windows on it, it may have MBR infections. – david6 Apr 7 '12 at 1:10
Note Using Linux is now the preferred method of finding and removing stubborn (MBR, stealth, etc.) malware. Most of the leading vendors now have a standalone (free) download, that targets Windows malware but is actually using Linux to operate. – david6 Apr 7 '12 at 1:11
@UriHerrera I want to check it with a tool/method. You do not know if you do not check. I have several Windows tools which can do that. But I have not Windows installed natively. I did not get any good answer till now. – therealmarv Apr 10 '12 at 18:28

Based on some internet research:

1) The code of a virus in MBR would be so tiny that it is hard to detect (1).

2) A reasonable approach would be to compare your MBR before and after an infection. That is what some antivirus do (2).

3) You could copy your MBR to a file with something like sudo dd if=/dev/sda of=mbr.bin bs=512 count=1 then check the file, which is a binary, with an Hex Editor like Bless.

share|improve this answer
ok, this is maybe technical interesting. But I want an automated method to check for MBR virus. – therealmarv Apr 10 '12 at 18:29
I believe that there is only two automated ways: one compares your MBR before and after an infection and other compares your MBR with what it is expected to be from a list of defaults MBRs. – desgua Apr 11 '12 at 1:46
Note that the dd command needs to be run from a LiveCD. If you run it after executing the MBR code, you'll be looking at a pristine MBR served up by the virus disk I/O hook, and not the actual MBR. – Ben Voigt Mar 31 '14 at 20:26

Yes, most viruses / malware actually target Windows/Intel ('Wintel').

So many of the Ubuntu AV solutions mostly look for (and find) Wintel malware.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.