CyberGlossary

Malware

Boot Sector Virus

Also known as: MBR virus, VBR virus

Definition

A virus that infects the boot sector or master boot record of a disk so it runs before the operating system loads.

A boot sector virus replaces or modifies the code in the master boot record (MBR), volume boot record (VBR), or partition table of a storage device. Because this code runs at startup, the virus gains execution before the operating system and can intercept I/O, hide itself, and load additional payloads. Historically these viruses spread via infected floppy disks and later USB drives. Modern equivalents are called bootkits and target MBR/VBR or UEFI boot stages. Defences include Secure Boot, UEFI with measured boot, write protection for boot media, blocking autorun on removable media, full-disk encryption with boot integrity checks, and integrity verification of boot components.

Examples

  • Stoned and Michelangelo, classic MBR viruses spread via floppy disks.
  • Petya's MBR overwrite component that prevented Windows from booting.

Related terms