New PC malware loads before Windows, is virtually impossible to detect

Re:New PC malware loads before Windows, is virtually impossi... by voltagex_ on Monday December 14, 2015 @01:33AM (#10729702)

https://www.fireeye.com/blog/threat-research/2015/12/fin1-ta... - it's an MBR (UEFI?) virus. "New", but not new.

[ Parent | on HN ]

Re:New PC malware loads before Windows, is virtually impossi... by acqq on Monday December 14, 2015 @04:50AM (#10730175)

"The installer will install the bootkit on any hard disk that has a MBR boot partition, regardless of the specific type of hard drive. However, if the partition uses the GUID Partition Table disk architecture, as opposed to the MBR partitioning scheme, the malware will not continue with the installation process."

It's a MBR attack and the modern Windows systems aren't typically MBR anymore.

[ Parent | on HN ]

Re:New PC malware loads before Windows, is virtually impossi... by waspleg on Monday December 14, 2015 @06:56AM (#10730520)

I don't know about you but my primary system disk is an SSD, which is far less than 2 TB... Guess what kind of partition it is (and guess which one it came with)?

I've found AOEMEI (?) to be good for converting other partitions from MBR to GPT but their shareware version won't do boot partitions without paying ;)

[ Parent | on HN ]

Re:New PC malware loads before Windows, is virtually impossi... by baghira on Monday December 14, 2015 @08:34AM (#10730869)

Windows will not boot in UEFI mode if the partition table is of MBR kind. One must manually enable the BIOS legacy mode, hence the comment on modern Windows systems (younger than 4 years, say).

[ Parent | on HN ]