On Mon, 14 Jan 2008 00:55:01 +0000, Short Wave Sportfishing wrote:

On Mon, 14 Jan 2008 00:32:58 -0000, wrote:

A nasty little virus that installs in the MBR and steals banking login
details is starting to make it's way around. Because it's in the MBR,
anti-virus software can only alert you to it's presence, but can't
remove it.

Why?

Don't get me lying, but I believe the virus is a rootkit, and is running
all the while the OS is running. You could rewrite the MBR, but the
running rootkit code would just rewrite itself. Or so I believe. The
MBR has to be "fixed" while the OS is not running.




http://news.bbc.co.uk/2/hi/technology/7183008.stm

According to Symantec, running "fixmbr" command from within the Windows
Recovery Console will remove the virus, but to prevent infection, if
your BIOS has a MBR write-protection feature now is a good time to
enable it.

What is a Windows Recovery Console?

http://support.microsoft.com/kb/314058