Exam 312-50v11 topic 1 question 111 discussion

A boot sector virus is a type of virus that infects the boot sector of floppy disks or the primary boot record of hard disks (some infect the boot sector of the hard disk instead of the primary boot record). The infected code runs when the system is booted from an infected disk, but once loaded it will infect other floppy disks when accessed in the infected computer. While boot sector viruses infect at a BIOS level, they use DOS commands to spread to other floppy disks. For this reason, they started to fade from the scene after the appearance of Windows 95 (which made little use of DOS instructions). Today, there are programs known as ‘bootkits’ that write their code to the primary boot record as a means of loading early in the boot process and then concealing the actions of malware running under Windows. However, they are not designed to infect removable media. The only absolute criteria for a boot sector is that it must contain 0x55 and 0xAA as its last two bytes. If this signature is not present or is corrupted, the computer may display an error message and refuse to boot. Problems with the sector may be due to physical drive corruption or the presence of a boot sector virus.

According to EC-Council Module07 Page 919 A boot sector virus moves MBR to another location on the hard disk and copies itself to the original location of MBR. When the system boots, first, the code executes and the control passes to the original MBR. I guess C is correct

The most common targets for a virus are the system sectors, which include the master boot record (MBR) and the DOS boot record system sectors. An OS executes code in these areas while booting. Every disk has some system sector. MBRs are the most virus-prone zones because all data will be lost if the MBR is corrupted. The DOS boot sector also executes during system booting. This is a crucial point of attack for viruses. The system sector consists of only 512 bytes of disk space. Therefore, system sector viruses conceal their code in some other disk space. The primary carriers of system or boot sector viruses are email attachments and removable media (USB drives). Such viruses reside in memory. Some sector viruses also spread through infected files, known as multipartite viruses. A boot sector virus moves MBR to another location on the hard disk and copies itself to the original location of MBR. When the system boots, the virus code executes, and then control passes to the original MBR. SG v12 p.1033

Types of Viruses System or Boot Sector Virus A boot sector virus moves MBR to another location on the hard disk and copies itself to the original location of MBR. When the system boots, first, the virus code executes and then control passes to the original MBR. (P.935/919)

https://userpages.umbc.edu/~dgorin1/432/viruses.htm see "How a boot virus takes control" for nice little diagram