What Is a Boot Sector Virus? How It Works, Examples, Removal and Prevention

Key takeaways

• The boot sector is the first code a computer runs, so malware placed there starts before the OS and antivirus.
• Classic examples include Brain (1986), Stoned (1987) and Michelangelo (found 1991, famous for a 1992 scare).
• Modern descendants are bootkits and firmware malware, such as the BlackLotus UEFI bootkit reported in 2023.
• Prevention: Secure Boot, updated firmware, a firmware password, no booting from unknown USB drives and BitLocker or disk encryption.
• Removal needs clean boot media, since the infected disk cannot be trusted while it is running.

What is a boot sector virus?

A boot sector virus is malware that copies itself into the boot sector or master boot record (MBR) of a storage device. This is the small piece of code the computer's firmware runs first to start loading an operating system. Because the virus runs before Windows or Linux, it can load itself into memory and stay hidden from tools that start later.

How does it work?

1. Infection. You boot, or accidentally boot, from an infected floppy or USB drive. The virus code runs.
2. Takeover. It moves the original boot code elsewhere on the disk and puts its own code in the boot sector.
3. Resident in memory. It loads first on every start, then hands control to the real boot code so the computer seems normal.
4. Spread. It infects other disks inserted into the machine.

Historically, the main spreading method was sharing floppy disks. Today it would need physical or administrator access, a malicious USB boot, or a successful firmware attack.

Famous examples

Are boot sector viruses still a threat?

The classic floppy-era viruses are mostly history. The idea is not. Attackers still target the boot process because it gives deep control and survives reinstalling the operating system in some cases. Modern forms are called bootkits or UEFI/firmware malware. They are rarer and need more skill, but they are serious when they appear. Check the current status of any named threat in a source such as the National Vulnerability Database.

What are the symptoms?

• "Missing operating system" or a boot error after plugging in a USB drive
• Computer will not boot, or boots very slowly
• Strange messages at start-up
• Security tools disabled or unable to start
• Disk partitions disappear or show as empty

These can also be disk or hardware failures, so rule that out too.

How to remove it

1. Disconnect the machine from the network and remove unknown USB drives.
2. Boot from clean media, such as a Windows installation USB or a trusted security rescue disk made on a clean computer.
3. Scan from the rescue environment. Back up important files first, only the data, not programs.
4. Repair the boot record. In the Windows recovery command prompt, bootrec /fixmbr and bootrec /fixboot repair the boot record on MBR disks. bootrec /rebuildbcd rebuilds the boot configuration. On UEFI/GPT systems the process is different, so follow Microsoft's guidance on Microsoft Learn.
5. Update firmware and re-enable Secure Boot.
6. If in doubt, wipe. Repartition and reinstall, then restore data after scanning it.

On Linux you can back up your own MBR for future recovery with sudo dd if=/dev/sda of=mbr-backup.img bs=512 count=1. Check the disk name with lsblk first, because the wrong device name can destroy data.

How to prevent it

• Turn on Secure Boot and keep UEFI firmware up to date.
• Set a firmware (BIOS/UEFI) password and set the boot order to internal disk first.
• Do not boot from unknown USB drives, and disable USB boot on shared computers.
• Use full-disk encryption such as BitLocker and keep a recovery key.
• Keep operating system and security patches current.

Boot sector virus versus file virus

A file infector attaches to executable files and runs when you open them. A boot sector virus infects the boot area and runs at start-up, before the operating system. See our broader posts on types of viruses, what a virus is and the polymorphic virus.

Next steps

Next steps: to learn malware behaviour and defence, see our Cyber Security course, and compare with other virus types.

Related reading

• What Is LILO in Linux? Configuration and Working Explained