Boot viruses.

Boot viruses operate after scheme which is identical for all viruses of this type. The algorithm of their operation is rather simple. As you switch the computer on the administrating of the computer are passing to bootstrap loader of permanent storage device. This program tests the device and in case test is completed successfully finds the data carrier. Let's take the flexible disk as data carrier; any flexible disk is divided into sectors and path. Some of the sectors are being used by operating system for some special needs and you can't save your data there, among these sectors we are interested at boot-sector that is charged with initialization. The boot-sector stores information about disk: quantity of sectors and paths. One of the sectors contains bootstrap loader that is loading the operating system and transfer it administration.

And now as for virus: virus consists of two parts head and tail, sometimes tail has no functions to perform. As soon as virus detects the uninfected information carrier it selects a sector and marks it as inaccessible for operating system. Usually selected sectors are marked as faulty; right to these sectors virus copies its tail and original boot-sector. The program of bootstrap loader is being replaced by so called head of the virus and creates chain of administration transmitting. After the whole work is done virus gets the administrating of flexible disk and possibility to manage datum in its own way.

As a rule viruses are able to infect not only boot-sectors of flexible disks but also boot-sectors of hard disks. Hard disks have two boot-sectors that store bootstrap loader programs and pass administration of the disk. When you switch in the computer the first program that administrates operating system is bootstrap loader of master boot record. In case when your hard disk is divided into several sectors there's only one which is marked as a boot sector. The MBR's bootstrap loader finds hard disk's boot-sector and passes administration to its bootstrap loader. So virus has both sectors to infect. In case of CD's infecting virus replaces program of booting by its code, usually virus removes original boot-sector to another sector. In case when the length of virus overrides the length of sector virus distributes itself among other sectors.

Some of the boot viruses copy themselves to the last sectors of the disk, as those sectors are used only in case of full occupancy of disk volume, which is almost impossible. Anywhere, such viruses cause the damage of file OS/2 file system that sometimes stores an active boot-sector and system information right in the last sectors. It's important to notice that viruses are unable for co-living, sometimes two different viruses copy themselves to the same sector and one damages another. As a result computer buzzes. No matter those modern operating systems co-operates to disk without referring to BIOS viruses still have an opportunity to capture administration of the computer after its rebooting. Such peculiarity of system's operating virus may stay at the boot-sector for a long time without damaging any information, but some day one will reboot his computer and virus will erase the whole information.