MBRCheck

Overview

MBRCheck was a free security tool designed to detect and analyze the Master Boot Record (MBR) for signs of rootkits or unauthorized modifications. It was commonly used by malware analysts and security professionals to identify and repair infections that manipulated the MBR to gain persistence on a compromised system.

Features

• Scans and verifies the integrity of the Master Boot Record (MBR).
• Detects common MBR rootkits and unauthorized modifications.
• Displays the MBR hash and checks against a known database.
• Provides an option to restore the MBR to a default state.
• Portable and does not require installation.

Compatibility

MBRCheck was compatible with:

• Windows XP
• Windows Vista
• Windows 7

It is not required on modern Windows versions, as newer security mechanisms make MBR-based infections less common.

Usage

1. Download MBRCheck from a trusted security source.
2. Run the executable as an administrator (no installation required).
3. The tool scans and displays the MBR status.
4. If an anomaly is detected, the user can choose to restore the MBR.
5. Restart the system to apply changes.

Pros & Cons

Pros

• ✔ Lightweight and easy to use.
• ✔ Effective at detecting MBR-based rootkits.
• ✔ Portable (no installation required).

Cons

• ✘ Discontinued and no longer updated.
• ✘ Only useful for older Windows versions.
• ✘ Requires manual intervention for MBR restoration.

Alternative Software

• TDSSKiller – Rootkit detection and removal tool from Kaspersky.
• Bootkit Remover – Tool for detecting and removing bootkits.
• Malwarebytes Anti-Rootkit – Free tool for detecting and removing rootkits.

Developer

• Author: AD
• Status: Discontinued (No longer maintained)

External Links

• (No official website available)
• May be available on security forums and archives (use caution when downloading).