Question

how a boot sector virus work?

Answer 1

A boot sector virus is a type of virus that infects the boot sector of floppy disks or the Master Boot Record (MBR) of hard disks (some infect the boot sector of the hard disk instead of the MBR). The infected code runs when the system is booted from an infected disk, but once loaded it will infect other floppy disks when accessed in the infected computer. While boot sector viruses infect at a BIOS level, they use DOS commands to spread to other floppy disks. For this reason, they started to fade from the scene after the appearance of Windows 95 (which made little use of DOS instructions). Today, there are programs known as ‘bootkits’ that write their code to the MBR as a means of loading early in the boot process and then concealing the actions of malware running under Windows. However, they are not designed to infect removable media.

The only absolute criteria for a boot sector is that it must contain 0x55 and 0xAA as its last two bytes. If this signature is not present or is corrupted, the computer may display an error message and refuse to boot. Problems with the sector may be due to physical drive corruption or the presence of a boot sector virus.

Answer 2

A boot sector virus is a computer virus that infects a storage device's master boot record (MBR). It is not mandatory that a boot sector virus successfully boot the victim's PC to infect it. As a result, even non-bootable media can trigger the spread of boot sector viruses. These viruses copy their infected code either to the floppy disk's boot sector or to the hard disk's partition table. During start-up, the virus gets loaded to the computer's memory. As soon as the virus is saved to the memory, it infects the non-infected disks used by the system.

The propagation of boot sector viruses has become very rare since the decline of floppy disks. Also, present-day operating systems include boot-sector safeguards that make it difficult for boot sector viruses to infect them.