Which malware technique involves moving the MBR and duplicating itself to the original MBR location?

Which malware technique involves moving the MBR and duplicating itself to the original MBR location?

• A. Shadow file
• B. Boot Sector Virus
• C. Ransomware
• D. Pwdump

Answer: (B)

Infection at boot time by manipulating the Master Boot Record. This technique targets code that runs before the operating system loads, so the malware can start before any security measures kick in. By moving the MBR to a different location and placing a copy of itself in the original MBR area, the virus ensures it will execute during the next boot while maintaining a foothold in the system. The relocated MBR loads first, giving the malicious code control over startup, and the copy in the original location helps preserve persistence and concealment. This is a characteristic behavior of boot sector/MBR viruses, designed to survive reboots and evade early detection. Other options don’t fit this behavior: a shadow file concept isn’t about boot-time startup manipulation; ransomware targets files after the OS loads to encrypt them; and pwdump is a tool for extracting password hashes, not a boot-time infection technique.

Infection at boot time by manipulating the Master Boot Record. This technique targets code that runs before the operating system loads, so the malware can start before any security measures kick in. By moving the MBR to a different location and placing a copy of itself in the original MBR area, the virus ensures it will execute during the next boot while maintaining a foothold in the system. The relocated MBR loads first, giving the malicious code control over startup, and the copy in the original location helps preserve persistence and concealment. This is a characteristic behavior of boot sector/MBR viruses, designed to survive reboots and evade early detection.

Other options don’t fit this behavior: a shadow file concept isn’t about boot-time startup manipulation; ransomware targets files after the OS loads to encrypt them; and pwdump is a tool for extracting password hashes, not a boot-time infection technique.