MBR Filter is a simple disk filter for advanced users designed to block write access to the Master Boot Record (MBR). Video tutorial available.

The MBR is used for storing information related to how the storage device is partitioned, as well as details regarding the filesystem configuration on the device. MBR Filter prevents rootkits, bootkits, and ransomware, such as Petya Ransomware, from overriding the operating system’s boot loader. Ransomware, like Petya, overwrites and encrypt the victim’s Master File Table to coerce them into paying for an encryption key.

MBR Filter, once installed, requires the system to boot in Safe Mode to enable write access to make changes to the device. This prevents malicious software from writing to or modifying the contents of this section of the machine or any disks connected to the system. MBR Filter enables users to effectively protect their systems from various malware families and disrupts the operations of cyber criminals, making their malware ineffective. MBR Filter is provided in two formats usable on Windows based systems: open source which can be used and modified by anyone and a precompiled, signed driver executable that can be installed.



MBRFilter has been intentionally made difficult to remove to prevent malware from just disabling or removing this protection during the infection process. Test thoroughly before deploying within production environments.

The script runs and reboots without any user prompts, hence no screenshots. Note that this is NOT a tool for the novice or even intermediate user. The author warns that this is a third-party tool to use at your own risk. Screwing up your Master Boot Record could render your computer unbootable. As always, we have tested it and had no problems, but that's no guarantee.

To uninstall, you must remove the line MBRFilter from the UpperFilters registry key. You also might need to check for
HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318