0

Is it possible to check the MBR of the boot drive of Ubuntu for viruses within my Ubuntu?

Is there any good software to do this? I heard ClamAV does not check for MBR viruses.

4
  • 1
    Why do you think you have a virus? Apr 6, 2012 at 23:03
  • We live in an unsafe world. If the PC has had Windows on it, it may have MBR infections.
    – david6
    Apr 7, 2012 at 1:10
  • Note Using Linux is now the preferred method of finding and removing stubborn (MBR, stealth, etc.) malware. Most of the leading vendors now have a standalone (free) download, that targets Windows malware but is actually using Linux to operate.
    – david6
    Apr 7, 2012 at 1:11
  • @UriHerrera I want to check it with a tool/method. You do not know if you do not check. I have several Windows tools which can do that. But I have not Windows installed natively. I did not get any good answer till now. Apr 10, 2012 at 18:28

2 Answers 2

3

Based on some internet research:

1) The code of a virus in MBR would be so tiny that it is hard to detect (1).

2) A reasonable approach would be to compare your MBR before and after an infection. That is what some antivirus do (2).

3) You could copy your MBR to a file with something like sudo dd if=/dev/sda of=mbr.bin bs=512 count=1 then check the file, which is a binary, with an Hex Editor like Bless.

5
  • ok, this is maybe technical interesting. But I want an automated method to check for MBR virus. Apr 10, 2012 at 18:29
  • I believe that there is only two automated ways: one compares your MBR before and after an infection and other compares your MBR with what it is expected to be from a list of defaults MBRs.
    – desgua
    Apr 11, 2012 at 1:46
  • 1
    Note that the dd command needs to be run from a LiveCD. If you run it after executing the MBR code, you'll be looking at a pristine MBR served up by the virus disk I/O hook, and not the actual MBR.
    – Ben Voigt
    Mar 31, 2014 at 20:26
  • @BenVoigt wow, thx on the info!! Mar 21, 2017 at 3:55
  • it only extracts the 1st 512 bytes of the MBR, or is it the full MBR? if so, is the MBR always 512 bytes on every RW media type? Mar 21, 2017 at 4:12
-1

Yes, most viruses / malware actually target Windows/Intel ('Wintel').

So many of the Ubuntu AV solutions mostly look for (and find) Wintel malware.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .