With school closed due to the Coronavirus pandemic, some kids are creating malware to keep themselves occupied. Such is the case with a variety of new MBRLocker variants being released, including one with a Coronavirus theme.
MBRLockers are programs that replace the ‘master boot record’ of a computer so that it prevents the operating system from starting and displays a ransom note or other message instead.
Some MBRLockers such as Petya and GoldenEye also encrypt the table that contains the partition information for your drives, thus making it impossible to access your files or rebuild the MBR without entering a code or paying a ransom.
Thankfully, the analysis by Avast shows that a bypass has been added to the custom MBR code that allows you to restore your original Master Boot Record so that you can boot normally. This can be done by pressing the CTRL+ALT+ESC keys at the same time.
Further research by BleepingComputer has discovered another variant from the same developer called ‘RedMist’. When installed, instead of showing the Coronavirus image, it shows an image of Squidward stating “Squidward is watching you”.
Mitigation: Windows 10 users should still be especially careful of running any programs shared by other people, especially on Discord, without first scanning them using VirusTotal. Or a Locally manage up to date Antivirus program “Do not Execute until your sure the Program is legit and not infected”