Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Larandor on April 03, 2009, 09:52:14 AM

Title: Does the Boot Time Scan check the MBR?
Post by: Larandor on April 03, 2009, 09:52:14 AM
Hi,

I was recently trying to install debian and forgot to turn off Boot Sector Protection in the BIOS. As such the first attempt to install on the same hard disk as windows failed utterly with an "Operating System Not Detected Error Message." Now installing it on a second non OS hard drive allowed me to boot back into windows via the grub bootloader but I received the error message "BootSector Write. Virus! Continue Y/N". Now I can't see where such an attack would actually originate from since I scanned the debian install disk before I used it but I believe this message was from the BootSector Protection.

Disabling it seemed to now allow me to boot into windows via grub, and subsequent attempts to boot via disk 1 (windows only) rather than disk 2(grub+ debian) now booted straight into windows. As such I suspect the write may have just been windows or grub or somesuch trying to fix the fubared mbr on disk 1. However I would like to check to be on the safe side. I ran a Boot Time scan with Avast which came back clean, but I wanted to confirm - does Avast check the boot sector/mbr in it's boot time scan so I can be sure that it's clean and the error message was a bit of a false alarm?

Many thanks for your help. :)
Title: Re: Does the Boot Time Scan check the MBR?
Post by: Lisandro on April 03, 2009, 03:11:02 PM
Does Avast check the boot sector/mbr in it's boot time scan
As far I know, yes. Also it is checked by the antirootkit scanning performed automatically 8 minutes after logon.
Title: Re: Does the Boot Time Scan check the MBR?
Post by: martosurf on April 05, 2009, 06:29:19 PM
Don't worry. "BootSector Write. Virus! Continue Y/N" is the warning message that appears everytime CMOS detect a boot-sector writing operation when the Boot Sector Protection function is turned on.

Regards