GSLC · Question #334
Which of the following viruses replaces the boot sector data with its own malicious code?
The correct answer is C. MBR. An MBR (Master Boot Record) virus overwrites the boot sector with its own malicious code, executing before the operating system loads.
Question
Which of the following viruses replaces the boot sector data with its own malicious code?
Options
- AChernobyl
- BExplore.Zip
- CMBR
- DNimda
How the community answered
(22 responses)- C95% (21)
- D5% (1)
Why each option
An MBR (Master Boot Record) virus overwrites the boot sector with its own malicious code, executing before the operating system loads.
Chernobyl (CIH) is a file-infecting virus that overwrites the first megabyte of the hard drive and attempts to corrupt the BIOS flash, not primarily a boot sector replacer.
Explore.Zip (ZippedFiles worm) is a destructive worm that propagates via email and destroys local files, not a boot sector virus.
An MBR virus specifically targets and replaces the Master Boot Record - the first sector of a storage device that contains the bootloader code. By replacing this code with its own malicious instructions, the virus executes before the OS loads, giving it deep system control and making it harder to detect and remove. This class of virus predates partition awareness and is a foundational concept in boot-stage malware.
Nimda is a multi-vector worm that spreads through email, web servers, and network shares but does not replace the boot sector with its code.
Concept tested: MBR virus boot sector infection mechanism
Source: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/understanding-malware
Topics
Community Discussion
No community discussion yet for this question.