What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A coronavirus-themed Windows wiper reported in 2020 could leave a computer unable to start by overwriting its master boot record (MBR). SonicWall’s March 31, 2020 analysis says this sample backed up the original MBR before replacing it, but that detail is not a guarantee of easy recovery. Separate reports described similarly named ransomware with different behaviors, including file encryption and attempts to delete recovery data.
What the MBR-overwriting malware did
The MBR is boot information used when a computer starts. If it is overwritten or damaged, Windows may no longer load, even if files elsewhere on the disk remain intact. SonicWall’s March 31, 2020 analysis describes one coronavirus-themed sample that staged several changes before it overwrote the MBR.
Before the restart
According to SonicWall, execution dropped helper files into a temporary folder. A batch file identified itself as “coronovirus Installer,” created and hid a folder named COVID-19, disabled Task Manager and User Account Control, changed the wallpaper and its settings, and added registry entries for persistence. The victim was notified before restarting. A later executable displayed a mock virus window with a nonfunctional “Remove virus” button. These are findings for the sample SonicWall analyzed, not behaviors established for every coronavirus-themed threat. (SonicWall analysis)
After the restart
SonicWall says another binary overwrote the MBR after reboot, having first backed up the original MBR. The malware also wrote a taunting message to the disk, which its bootstrap code displayed at startup. An MBR overwrite can stop the operating system from booting; backing up the original record does not by itself establish that the computer or its files are safe or recoverable.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Why another test saw a different result
Trend Micro also described a coronavirus-themed sample that backed up the original MBR and could make a machine unbootable. In Trend Micro’s manual test, however, the MBR was not overwritten after reboot in a closed, offline environment. The report suggests internet connectivity may have been necessary, but presents that only as a possibility—not a confirmed requirement. (Trend Micro analysis)
How the similarly named CoronaVirus ransomware differed
Reports from 2020 also used “CoronaVirus” for ransomware incidents. Those reports describe separate threats and should not be treated as a single sequence of actions by the SonicWall MBR-wiper sample.
Rank #2
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Report | File encryption | MBR behavior | Recovery-material behavior | Delivery details documented |
|---|---|---|---|---|
| NHS England Digital alert | Encrypted files matching a hard-coded extension list | An April 2, 2020 update said it attempted to delete the MBR | Not stated in the cited alert details | Described delivery from a spoofed WiseCleaner optimization-utility page alongside the KPOT stealer |
| VMware notification, March 31, 2020 | Described ransomware; file encryption is not specified in the cited details | Reported that the ransomware overwrote the MBR | Deleted volume shadow copies; the report documents commands to delete shadow copies and backups | A phishing site led to a downloader for KPOT and ransomware |
These distinctions come from the individual reports: NHS England Digital and VMware. They do not establish a comparative ranking of prevalence, damage, or recovery success.
What to do if a computer will not boot after malware
Regaining boot access is only one part of recovery. A repaired boot record does not prove the malware has been removed, and it does not restore encrypted or deleted files.
Rank #3
- 【Upgraded version】 - The mirror logo strip is combined with the striped non-slip design. The rounded corners of the shell are more suitable for holding. The strips play a heat dissipation function to ensure a stable and fast transmission process.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Separate the affected machine from the network
NHS England Digital advises disconnecting infected systems. If accounts may have been exposed, reset their credentials using a clean device rather than the affected computer. (NHS England Digital guidance)
Use recovery media cautiously
Tom’s Guide reported that source-code analysis found a Ctrl+Alt+Esc startup shortcut intended to restore the MBR backup for the sample it discussed. This is a sample-specific secondary report, not a dependable recovery method for every infection or variant. (Tom’s Guide report on the shortcut)
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Tom’s Guide also says Windows installation media can be used to boot into a rescue configuration, and that creating the media may require a separate working computer. A USB flash drive may be useful for preparing that media; the cited reporting does not establish a required capacity or model. After boot repair, scan and clean the drive. (Tom’s Guide recovery guidance)
Restore files from backups and verify recovery
For a broader ransomware incident, NHS England Digital advises restoring affected files from backups, keeping at least one backup offline, and testing both backups and recovery plans. MBR repair, malware cleanup, and restoring lost or encrypted files are distinct tasks; completing one does not complete the others. (NHS England Digital guidance)
Best Value
- 【Plug-and-Play Expandability】 With no software to install, just plug it in and the drive is ready to use in Windows（For Mac，first format the drive and select the ExFat format.
- 【Fast Data Transfers 】The external hard drives with the USB 3.0 cable to provide super fast transfer speed. The theoretical read speed is as high as 110MB/s-133MB/s, and the write speed is as high as 103MB/s.
- 【High capacity in a small enclosure 】The small, lightweight design offers up to 500GB capacity, offering ample space for storing large files, multimedia content, and backups with ease. Weighing only 0.35 Lbs, it's easy to carry "
- 【Wide Compatibility】Supports PS4 5/xbox one/Windows/Linux/Mac and other operating systems, ensuring seamless integration with game consoles,various laptops and desktops .
- Important Notes for PS/Xbox Gaming Devices: You can play last-gen games (PS4 / Xbox One) directly from an external hard drive. However, to play current-gen games (PS5 / Xbox Series X|S), you must copy them to the console's internal SSD first. The external drive is great for keeping your library on hand, but it can't run the new games.
What is known about the threat today
The cited accounts document coronavirus-themed wipers and ransomware reported in 2020. They do not establish that the specific MBR-wiper sample remains active or prevalent in 2026. The evidence supports describing what those reports observed, not treating the name “coronavirus malware” as one current, uniform threat.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
