what is the difference between boot-sector virus and rootkits?

A rootkit works by changing the output of system actions. This could be by replacing standard commands such as ls with other tools. It can also be by modifying libraries or kernel code. Rootkits don't necessarily take advantage of an exploit, but rather the user. They may rely on another exploit to place them.

Boot sector viruses are a subset of rootkits, but the term is far older. It referred specifically to viruses that would alter to the boot sector of a hard drive to launch themselves on reboot. They have a connotation of harking from the era when MS DOS was still a substantial piece of the personal computing world. Being from simpler times, the viruses were often simpler and didn't always need booting to another OS instance to detect. Despite that, their launch early in the boot process could provide them with all the potential power that we associate with rootkits.

Even the technical difference between the terms is very muddled. It is possible that code could be considered just a rootkit, just a boot sector virus, or both. As far as colloquial speech goes, I think it is most common to refer to modern viruses that fit the definition of both as rootkits. I can't think of any notable contemporary malware that is considered to be merely a boot sector virus.

Tags:

Virus

Rootkits