"Coronavirus" Malware can Destroy Your PC: What to Do

"Coronavirus" Malware can Destroy Your PC: What to Do

Easy way to recover deleted master boot records updated April 3. [A new strain of coronavirus is trying to kill your computer.

Of course, this is not a real biological coronavirus. According to SonicWall researchers who posted the report on Tuesday (March 31), this is malware that borrows the name of the coronavirus and the filename COVID-19.exe to scare victims, amuse its creators, and possibly generate publicity.

This digital coronavirus is transmitted via malicious web downloads, email attachments, or fake application updates. Once infected with this digital corona virus, the Windows PC will go through several steps before rebooting to a gray screen displaying the words "Your computer has been trashed" followed by a pop-up with an image of the actual corona virus.

The Master Boot Record (MBR), the section of the hard drive that tells the computer's hardware how to boot, is erased and the computer is essentially stuck on the gray screen.

Don't panic yet; the data on the C drive and other Windows partitions may still be intact. However, you will need to use special tools to restore the MBR and get rid of the malware.

Our sister site Laptop Mag explains how to repair the MBR; you will need to use Microsoft's own Windows installation media and boot the machine to the rescue configuration.

If you do not have a Windows installation disc or flash drive on hand, you will need another working PC to download and create the media.

After fixing the MBR, you will need to scan and clean the C drive with a bootable "rescue disk" antivirus software before returning to normal operations. Failure to do so could set off a time bomb placed on the hard drive by the Corona virus malware.

Norton, Sophos, and Trend Micro still offer updated rescue disk downloads. Again, you will need a separate PC to download the software and put it on a flash drive or optical disk.

UPDATE: avast researchers have looked at the source code of the "Corona Virus" malware and discovered that the developers have incorporated a failsafe mechanism to easily restore the original MBR.

The malware creates a backup before erasing the original MBR and accesses the backup through this keyboard action.

However, once the PC is successfully booted, the malware on the hard drive must be removed.

This can be done with regular antivirus software, but you will also need to find the folder "COVID-19" on your Windows primary drive (C drive for most people) and delete it.

Meanwhile, Bleeping Computer has discovered a variant of the same malware, this time called "RedMist," which displays a picture of a squid from "Sponge Bob" instead of the Coronavirus; like the "Coronavirus" malware, this malware also requires the startup " Ctrl" + "Alt" + "Esc" at startup.

The only way to prevent this malware from infecting your PC in the first place is to detect and stop it with the best antivirus program before it infects your PC; according to VirusTotal's latest snapshot, most major antivirus signature detection engines, already detect this malware.

As always, do not open email attachments before your antivirus software scans them. Don't click on random links that appear in social media, emails, text messages, or chat messages. The bad guys are out to get you.

Categories