Author Topic: MasterBootRecord Protection  (Read 944 times)

0 Members and 1 Guest are viewing this topic.

Offline fvmb

  • Full Member
  • ***
  • Posts: 117
  • Being a teacher implies that we stay learning!
MasterBootRecord Protection
« on: April 13, 2020, 10:06:11 PM »
Hi,

I would like to know what kind of MBR protection Avast uses to fight for example this kind of locker : https://www.bleepingcomputer.com/news/security/new-wiper-malware-impersonates-security-researchers-as-prank/

As far as MasterBootRecord modifications by malware,what kind of protection Avast uses?
Has Avast a protection like the  Cisco's MBRFilter code ?

Avast could backup the MBR status at installation time and provide for example a tool to restore to a previous point. I think its a good suggestion ;)

Kind Regards,
Filipe
« Last Edit: April 17, 2020, 12:54:44 PM by fvmb »

Offline r@vast

  • Avast team
  • Massive Poster
  • *
  • Posts: 2761
Re: MasterBootRecord Protection
« Reply #1 on: April 15, 2020, 05:01:43 PM »
Hi,
Avast Anti-rootkit protects MBR from malicious modifications. Before sector write the content is scanned by AV engine.

Offline fvmb

  • Full Member
  • ***
  • Posts: 117
  • Being a teacher implies that we stay learning!
Re: MasterBootRecord Protection
« Reply #2 on: April 17, 2020, 12:54:09 PM »
Hi,
Avast Anti-rootkit protects MBR from malicious modifications. Before sector write the content is scanned by AV engine.

Thank you for your reply.

Regards,
Filipe