Is it possible to check the MBR of the boot drive of Ubuntu for viruses within my Ubuntu?

Is there any good software to do this? I heard ClamAV does not check for MBR viruses.

  • 1
    Why do you think you have a virus? – Uri Herrera Apr 6 '12 at 23:03
  • We live in an unsafe world. If the PC has had Windows on it, it may have MBR infections. – david6 Apr 7 '12 at 1:10
  • Note Using Linux is now the preferred method of finding and removing stubborn (MBR, stealth, etc.) malware. Most of the leading vendors now have a standalone (free) download, that targets Windows malware but is actually using Linux to operate. – david6 Apr 7 '12 at 1:11
  • @UriHerrera I want to check it with a tool/method. You do not know if you do not check. I have several Windows tools which can do that. But I have not Windows installed natively. I did not get any good answer till now. – therealmarv Apr 10 '12 at 18:28

Based on some internet research:

1) The code of a virus in MBR would be so tiny that it is hard to detect (1).

2) A reasonable approach would be to compare your MBR before and after an infection. That is what some antivirus do (2).

3) You could copy your MBR to a file with something like sudo dd if=/dev/sda of=mbr.bin bs=512 count=1 then check the file, which is a binary, with an Hex Editor like Bless.

  • ok, this is maybe technical interesting. But I want an automated method to check for MBR virus. – therealmarv Apr 10 '12 at 18:29
  • I believe that there is only two automated ways: one compares your MBR before and after an infection and other compares your MBR with what it is expected to be from a list of defaults MBRs. – desgua Apr 11 '12 at 1:46
  • 1
    Note that the dd command needs to be run from a LiveCD. If you run it after executing the MBR code, you'll be looking at a pristine MBR served up by the virus disk I/O hook, and not the actual MBR. – Ben Voigt Mar 31 '14 at 20:26
  • @BenVoigt wow, thx on the info!! – Aquarius Power Mar 21 '17 at 3:55
  • it only extracts the 1st 512 bytes of the MBR, or is it the full MBR? if so, is the MBR always 512 bytes on every RW media type? – Aquarius Power Mar 21 '17 at 4:12

Yes, most viruses / malware actually target Windows/Intel ('Wintel').

So many of the Ubuntu AV solutions mostly look for (and find) Wintel malware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.