Your Computer Is Now Stoned (...Again!): The Rise of MBR Rootkits

The war against invisible malware has been taken down to a new battleground, the lowest level seen so far in the wild: the Master Boot Record. The MBR rootkit, a.k.a. Mebroot, appeared in the wild in December 2007 and rapidly evolved from earlier beta versions to a fully working malware product. The Mebroot rootkit uses techniques never before seen in modern threats and so it can be considered the next generation of stealth rootkit and kernel infector, written by professional malware developers and clearly not for fun. The most notable characteristic of Mebroot is the fact that it replaces the system's Master Boot Record with malicious code that owns the machine completely from the boot, before the operating system itself gets loaded.