Boot sector viruses are the types that infects or substitute their own code for either the DOS boot sector or the Master Boot Record (MBR) of a PC. The MBR is a small program that runs every time the computer starts up. It controls the boot sequence and determines which partition the computer boots from. The MBR generally resides on the first sector of the hard disk.
Since the MBR executes every time a computer is started, a boot sector virus is extremely dangerous. Once the boot code on the drive is infected, the virus will be loaded into memory on every startup. From memory, the boot virus can spread to every disk that the system reads. Boot sector viruses are typically very difficult to remove, as most antivirus programs cannot clean the MBR while Windows is running. In most cases, it takes bootable antivirus disks such as a Symantec/Norton AntiVirus (SAV/NAV) rescue set to properly remove a boot sector virus.
TYPES OF BOOT SECTOR VIRUSES
Here are the names of boot sector viruses which were created and first detected between 1982 to 1997:
- Elk Cloner (Created 1982)
- Brain (Created 1986)
- Stoned (Created 1987)
- Parity Boot virus (Detected 1980s)
- Denzuko (Detected 1988)
- Ping-Pong virus (aka Italian) (Detected 1988)
- Lamer Exterminator (Detected 1989)
- Michelangelo (Detected 1991)
- NoInt (Detected 1991)
- AntiCMOS (aka Lenart) (Detected 1994)
- Crazy_Boot (Detected 1995)
- AntiEXE (Detected 1995)
- Angelina (Detected 1995)
- Barrotes (aka Boot-347) (Detected 1997)
Symptoms
A boot sector virus can cause a variety of boot or data retrieval problems. In some cases, data disappear from entire partitions. In other cases, the computer suddenly becomes unstable. Often the infected computer fails to start up or to find the hard drive. Also, error messages such as “Invalid system disk” may become prevalent.
HOW BOOT SECTOR VIRUSES SPREADS
Boot sector viruses usually spreads through infected floppy disks. In the past, these were usually bootable disks, but this is no longer the case. A floppy disk does not need to be bootable to transmit a boot sector virus. Any disk can cause infection if it is in the drive when the computer boots up or shuts down. The virus can also be spread across networks from file downloads and from email file attachments. In most cases, all write-enabled floppies used on an infected PC will themselves pick up the boot sector virus.
In the past, setting the computer to boot first from the C: (hard) drive and then the A: (floppy) drive, or never to boot from the A: drive at all, was a reasonable precaution against boot sector viruses. This is no longer the case, as viruses are now more dangerous and spread in more ways.
You can configure some CMOS setups to prevent writing to the boot sector of the hard drive. This may be of some use against boot sector viruses. However, if you need to reinstall or upgrade the operating system, you will have to change the setting back to make the MBR writable again.
Precautions against boot sector viruses.
Prevention is usually a matter of vigilance and avoiding contact with unknown disks. The following suggestions will help keep your systems and data safe:
- The best protection against boot sector viruses is the same as against viruses in general: a good antivirus program with up-to-date virus definitions. Antivirus programs do two key things:
- Scan for and remove viruses in files on disks
- Monitor the operation of your computer for virus-like activity and look for known actions of specific viruses or general suspicious activity
Update your antivirus software and malware protection. Keep your antivirus software and malware protection up to date. New virus definitions are released regularly and these keep your PC informed on what to look for with new virus and malware-based threats. Good antivirus software also protects your boot sector and quickly detects if a virus is trying to interfere with it.
Be wary of physical media. Be careful about what USB sticks you place on your computer. This is one of the key ways in which you can be affected by a boot sector virus. Consider the source of the USB stick before using it, and never place it in your computer before you boot up the system.Be vigilant. Boot sector viruses can easily transmit between different computers on the same network. Be careful about what networks you connect your system to.Don’t download suspicious files.
Consider where you’re downloading files from and always run virus scans on them before opening them. Torrented files, in particular, can open you up to malware viruses that can lead to infecting your boot sector.
Drop your comment.
