System and method for booting alternate MBR in event of virus attack

• US 20080046781A1
• Filed: 03/29/2006
• Published: 02/21/2008
• Est. Priority Date: 03/29/2006
• Status: Active Grant

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Inventors: Davis, Mark, Goodman, Steven, Childs, Philip, Springfield, Randall, Freeman, Joseph, Waltermann, Rod
• Granted Patent: US 7,757,112 B2
• Time in Patent Office: Days
• US Class Current: 714/15
• CPC Class Codes: G06F 11/1417 Boot up procedures
• CPC Class Codes: G06F 11/1666 where the redundant component is memory or memory area
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

In the event of a virally infected MBR on a hard disk drive that might prevent booting, a service MBR in a hidden protected area (HPA) can be used to boot a service O.S., and then the service MBR can be replaced with a previously backed-up MBR, also in the HPA, to mount any missing partitions.

Claims

1. A computer medium storing logic comprising:

receiving a boot interrupt signal;

overwriting a current master boot record (MBR) with a service MBR;

using the service MBR, booting a service operating system; and

replacing the service MBR with a previously backed-up MBR.

2. The medium of claim 1, wherein the logic further comprises:

at least in part by accessing the previously backed-up MBR, mounting any partitions not mounted when using the service MBR.

3. The medium of claim 1, wherein the service MBR and previously backed-up MBR are stored in a secondary storage in a hidden partition area (HPA).

4. The medium of claim 1, wherein the logic further comprises:

backing up the current MBR prior to overwriting it with the service MBR.

5. The medium of claim 4, wherein the current MBR is backed up only if a MBR backup table is first determined to be valid.

6. The medium of claim 1, wherein the current MBR is overwritten with the service MBR only if the service MBR is first determined to be valid.

7. The medium of claim 1, wherein the previously backed-up MBR is one of plural previously backed-up MBRs, the previously backed-up MBRs being stored on a secondary storage in a HPA thereof.

8. The medium of claim 7, wherein the logic further comprises:

backing up a current MBR if the current MBR changes by overwriting an oldest one of the previously backed-up MBRs with the current MBR.

9. The medium of claim 8, wherein the logic further comprises modifying the service MBR at least if a partition table in the current MBR changes.

12. The system of claim 1, wherein the current MBR is backed up to the secondary storage prior to overwriting it with the service MBR.

13. The system of claim 12, wherein the current MBR is backed up only if a MBR backup table is first determined to be valid.

10. A computer system, comprising:

at least one boot loader;

at least one secondary storage storing at least a user operating system (UOS) and a service operating system (SOS); and

at least one main memory, the boot loader being configured to execute a boot sequence at least in part by accessing a current master boot record (MBR) to load an operating system from the secondary storage into the main memory, the boot loader, at least in part in response to a boot interrupt signal, replacing the current MBR with a service MBR stored on the secondary storage, loading the SOS, replacing the service MBR with a previously backed-up MBR on the secondary storage, and then using the previously backed-up MBR to mount any unmounted partitions.

11. The system of claim 10, wherein the service MBR and previously backed-up MBR are stored in the secondary storage in a hidden partition area (HPA).

14. The system of claim 10, wherein the current MBR is replaced with the service MBR only if the service MBR is first determined to be valid.

15. The system of claim 10, wherein the previously backed-up MBR is one of plural previously backed-up MBRs, the previously backed-up MBRs being stored on the secondary storage.

16. The system of claim 15, wherein a current MBR is backed up if the current MBR changes by overwriting an oldest one of the previously backed-up MBRs with the current MBR.

17. The system of claim 16, wherein the service MBR is modified at least if a partition table in the current MBR changes.

18. A computer system, comprising:

means for replacing a virally infected current master boot record (MBR) with a service MBR stored in a hidden protected area (HPA) of a secondary storage;

means for mounting at least one partition into a main memory using the service MBR;

means for overwriting the service MBR with a previously backed-up MBR; and

means for using the previously backed-up MBR to mount at least one partition not mounted by using the service MBR.

19. The system of claim 18, wherein the current MBR is replaced with the service MBR only if the service MBR is first determined to be valid.

20. The system of claim 19, wherein the previously backed-up MBR is one of plural previously backed-up MBRs, the previously backed-up MBRs being stored on the secondary storage, a current MBR being backed up if the current MBR changes by overwriting an oldest one of the previously backed-up MBRs with the current MBR.

21. The system of claim 20, wherein the service MBR is modified at least if a partition table in the current MBR changes.