Boot Sector Virus.

A boot sector virus replaces or modifies the code in the master boot record (MBR), volume boot record (VBR), or partition table of a storage device. Because this code runs at startup, the virus gains execution before the operating system and can intercept I/O, hide itself, and load additional payloads. Historically these viruses spread via infected floppy disks and later USB drives. Modern equivalents are called bootkits and target MBR/VBR or UEFI boot stages. Defences include Secure Boot, UEFI with measured boot, write protection for boot media, blocking autorun on removable media, full-disk encryption with boot integrity checks, and integrity verification of boot components.

The lineage starts with Brain (1986), written by brothers Basit and Amjad Farooq Alvi in Lahore — the first PC virus and the first stealth virus, it hid the infected boot sector by redirecting reads to a clean copy. Stoned (1987) and its descendants, including the notorious Michelangelo, followed; Michelangelo lay dormant until 6 March each year, then overwrote the first sectors of the disk, and triggered a global media panic in 1992. The technique never fully died: NotPetya (June 2017) overwrote the MBR and encrypted the Master File Table to brick machines under the guise of ransomware, causing an estimated USD 10 billion in damage. Because modern firmware attacks bypass the OS entirely, mitigations moved into hardware — UEFI Secure Boot checks signatures on each boot component, and TPM-backed measured boot records hashes so a tampered boot chain can be detected by remote attestation. Even so, 2018's LoJax and 2022's BlackLotus bootkit showed attackers reaching the UEFI/ESP layer above the disk.

flowchart TD
  A[Infected floppy / USB / dropper] --> B[Overwrite MBR / VBR code]
  B --> C[Power on: firmware loads boot sector]
  C --> D[Virus code runs FIRST, before OS]
  D --> E[Hook disk I/O / hide original sector]
  D --> F[Load OS so system looks normal]
  E --> G[Spread to other boot media]
  H[Secure Boot + measured boot / TPM] -. blocks / detects .-> D