System and method for booting alternate MBR in event of virus attack

• US 7,757,112 B2
• Filed: 03/29/2006
• Issued: 07/13/2010
• Est. Priority Date: 03/29/2006
• Status: Active Grant

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Inventors: Springfield, Randall Scott, Freeman, Joseph Wayne, Davis, Mark Charles, Goodman, Steven Dale, Childs, Philip Lee, Waltermann, Rod David
• Primary Examiner(s): Baderman; Scott T
• Assistant Examiner(s): KO, CHAE M
• Application Number:
  US11/394,278
• Publication Number:
  US 20080046781A1
• Time in Patent Office: 1,567 Days
• Field of Search: 713/2, 714/42
• US Class Current: 714/5.1
• CPC Class Codes: G06F 11/1417 Boot up procedures
• CPC Class Codes: G06F 11/1666 where the redundant component is memory or memory area
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

In the event of a virally infected MBR on a hard disk drive that might prevent booting, a service MBR in a hidden protected area (HPA) can be used to boot a service O.S., and then the service MBR can be replaced with a previously backed-up MBR, also in the HPA, to mount any missing partitions.

Claims

1. A computer medium storing logic comprising:

receiving a boot interrupt signal to interrupt a boot loader invoking a current master boot record (MBR);

in response to the boot interrupt signal, determining whether a data structure listing plural backed-up MBRs is valid;

in response to a determination that the data structure is valid, backing up the current MBR and furthermore overwriting a current master boot record (MBR) with a service MBR;

using the service MBR, booting a service operating system; and

replacing the service MBR with a previously backed-up MBR, wherein the current MBR is overwritten with the service MBR only if the service MBR is first determined to be valid;

in response to a determination that the data structure is not valid, testing at least one backed-up MBR by accessing a partition using a partition table of the backed-up MBR;

determining whether the partition has a valid partition header partition boot record (PBR) to ensure that the partition is the partition indicated in the partition table;

comparing data found in the partition to data in a most recent backup of the partition, and if at least the data found in the partition and the data in the most recent backup of the partition agree, replacing the current MBR with the backed-up MBR.

2. The medium of claim 1, wherein the logic further comprises:

at least in part by accessing the previously backed-up MBR, mounting any partitions not mounted when using the service MBR.

3. The medium of claim 1, wherein the service MBR and previously backed-up MBR are stored in a secondary storage in a hidden partition area (HPA).

4. The medium of claim 1, wherein the data structure is a MBR backup table and the current MBR is backed up only if the MBR backup table is first determined to be valid.

5. A computer system, comprising:

at least one boot loader;

at least one secondary storage storing at least a user operating system (UOS) and a service operating system (SOS); and

at least one main memory, the boot loader being configured to execute a boot sequence at least in part by accessing a current master boot record (MBR) to load an operating system from the secondary storage into the main memory, the boot loader, at least in part in response to a boot interrupt signal, replacing the current MBR with a service MBR stored on the secondary storage only if a data structure listing backed-up MBRs is first determined to be valid, loading the SOS, replacing the service MBR with a previously backed-up MBR on the secondary storage, and then using the previously backed-up MBR to mount any unmounted partitions, wherein the previously backed-up MBR is one of plural previously backed-up MBRs listed in the data structure, the previously backed-up MBRs being stored on the secondary storage;

in response to a determination that the data structure is not valid, testing at least one backed-up MBR by accessing a partition using a partition table of the backed-up MBR;

determining whether the partition has a valid partition header partition boot record (PBR) to ensure that the partition is the partition indicated in the partition table;

comparing data found in the partition to data in a most recent backup of the partition, and if at least the data found in the partition and the data in the most recent backup of the partition agree, replacing the current MBR with the backed-up MBR.

6. The system of claim 5, wherein the service MBR and previously backed-up MBR are stored in the secondary storage in a hidden partition area (HPA).

7. The system of claim 6, wherein the current MBR is backed up to the secondary storage prior to overwriting it with the service MBR.

8. The system of claim 7, wherein the current MBR is backed up only if a MBR backup table is first determined to be valid.

9. The system of claim 5, wherein the current MBR is replaced with the service MBR only if the service MBR is first determined to be valid.

10. The system of claim 5, wherein a current MBR is backed up if the current MBR changes by overwriting an oldest one of the previously backed-up MBRs with the current MBR.

11. The system of claim 10, wherein the service MBR is modified at least if a partition table in the current MBR changes.

12. A computer system, comprising:

means for replacing a virally infected current master boot record (MBR) with a service MBR stored in a hidden protected area (HPA) of a secondary storage but only if a data structure listing previously backed-up MBRs is first determined to be valid;

means for mounting at least one partition into a main memory using the service MBR;

means for overwriting the service MBR with a previously backed-up MBR; and

means for using the previously backed-up MBR to mount at least one partition not mounted by using the service MBR, wherein the previously backed-up MBR is one of plural previously backed-up MBRs, the previously backed-up MBRs being stored on the secondary storage, a current MBR being backed up if the current MBR changes by overwriting an oldest one of the previously backed-up MBRs with the current MBR;

in response to a determination that the data structure is not valid, testing at least one backed-up MBR by accessing a partition using a partition table of the backed-up MBR;

determining whether the partition has a valid partition header partition boot record (PBR) to ensure that the partition is the partition indicated in the partition table;

comparing data found in the partition to data in a most recent backup of the partition, and if at least the data found in the partition and the data in the most recent backup of the partition agree, replacing the current MBR with the backed-up MBR.

13. The system of claim 12, wherein the current MBR is replaced with the service MBR only if the service MBR is first determined to be valid.

14. The system of claim 12, wherein the service MBR is modified at least if a partition table in the current MBR changes.