Hacker News new | ask | show | jobs
by JohnFen 960 days ago
That sort of attack has been around for a very, very long time.

> Th end solution ... destroy the box.

Or reformat the disk, or even just write over the boot sector with something else (proper boot code, zeros, or even garbage).

1 comments

Some viruses intercept the interrupt handler, detect if you're trying to write to the boot sector, then either fake a write or change the sector. I believe some forms of ParityBoot (B?) did this. So you need to be sure you're booting from a clean medium, which in the case of some of these boot viruses might not be that easy since a lot of your disks and floppies might have been infected already.

Some viruses also used extra space at the end of the partition table or the end of the disk to store themselves so they wouldn't be limited to the 512 byte limit (minus the metadata in the boot sector).