I have read the definition for both and also read about a few examples for both the cases. I'm still not very sure what the difference is. Is the difference blurred or are there some specific characteristics that sets them apart from each other?

3 Answers 3


A rootkit works by changing the output of system actions. This could be by replacing standard commands such as ls with other tools. It can also be by modifying libraries or kernel code. Rootkits don't necessarily take advantage of an exploit, but rather the user. They may rely on another exploit to place them.

Boot sector viruses are a subset of rootkits, but the term is far older. It referred specifically to viruses that would alter to the boot sector of a hard drive to launch themselves on reboot. They have a connotation of harking from the era when MS DOS was still a substantial piece of the personal computing world. Being from simpler times, the viruses were often simpler and didn't always need booting to another OS instance to detect. Despite that, their launch early in the boot process could provide them with all the potential power that we associate with rootkits.

Even the technical difference between the terms is very muddled. It is possible that code could be considered just a rootkit, just a boot sector virus, or both. As far as colloquial speech goes, I think it is most common to refer to modern viruses that fit the definition of both as rootkits. I can't think of any notable contemporary malware that is considered to be merely a boot sector virus.

  • 2
    Rootkits don't necessarily provide privilege escalation. Really - I always thought that was the definition. A kit for becoming root. Nov 19, 2012 at 8:04
  • 2
    I suppose I worded that poorly. Will edit.
    – Jeff Ferland
    Nov 19, 2012 at 8:17
  • I always read 'rootkit' as 'a kit, running as root, for hiding other code'.
    – randomdude
    Nov 19, 2012 at 10:41

A boot sector virus that runs from the boot sector and doesn't bother hiding itself is just a boot sector virus.

A boot sector virus that actively protects its storage in the boot sector, hides itself from detection and actively intercepts scans attempting to detect its operation is part of a root-kit.

Boot Sector viruses have been around since Brain, the first MS-DOS virus created, and was easily scanned and removed.


A boot sector virus loads himself from the boot record then executes the real boot sector, which is saved to somewhere else on the disk. It doesn't really take care of hiding himself. There were problems if the same boot sector virus came because it didn't check the presence of the previous instance, so overwrote the real boot sector on the disk with previous instance of himself - so no boot possible until reinstalling at least the systemfiles. This kind of malware belongs to DOS-era.

A rootkit mainly hides processes, so it could download and install other malwares, backdoors etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .