Boot record recovery

This disclosure relates generally to computer systems and, more particularly, to a method and system for detecting, and recovering from, computer viruses during the boot process. A method, computer system, and apparatus perform boot record recovery. When the boot record is known to be free, a snapshot copy of the boot record is stored in non-volatile memory. On boot-up, the current boot record is compared with its corresponding snapshot. If relevant differences exist between the two (indicating that the boot record has been modified), a message is reported to the user. The user may opt to boot from (optionally updating the snapshot) the modified boot record, or boot from (optionally restoring the boot record) the stored snapshot.