Popureb - a small rootkit with a big reputation
There has been a lot of discussion in recent weeks about some new variants of the Popureb rootkit that clobber your Master Boot Record (MBR).
Initial reports from Microsoft even suggested the only way to recover was to reinstall Windows, which fortunately is not true. SophosLabs Threat Researchers Mike Wood, Michele Freschi and Ahmed Zaki have published a technical paper that looks at the inner workings of Popureb.
In the paper they explain the four major components of the malware, including the methods used by the rootkit and driver used to protect it. To get all the details on Popureb and how to safely clean up infected computers, download "Popureb - a small rootkit with a big reputation."
