Is it possible to check the MBR of the boot drive of Ubuntu for viruses within my Ubuntu?
Is there any good software to do this? I heard ClamAV does not check for MBR viruses.
Is it possible to check the MBR of the boot drive of Ubuntu for viruses within my Ubuntu?
Is there any good software to do this? I heard ClamAV does not check for MBR viruses.
Based on some internet research:
1) The code of a virus in MBR would be so tiny that it is hard to detect (1).
2) A reasonable approach would be to compare your MBR before and after an infection. That is what some antivirus do (2).
3) You could copy your MBR to a file with something like sudo dd if=/dev/sda of=mbr.bin bs=512 count=1
then check the file, which is a binary, with an Hex Editor like Bless.
dd
command needs to be run from a LiveCD. If you run it after executing the MBR code, you'll be looking at a pristine MBR served up by the virus disk I/O hook, and not the actual MBR.
Mar 31, 2014 at 20:26
Yes, most viruses / malware actually target Windows/Intel ('Wintel').
So many of the Ubuntu AV solutions mostly look for (and find) Wintel malware.