|
Two common ways that a computer can contract an MBR or boot sector virus are: by starting up from an infected floppy disk; or by running an infected program, which causes the virus to drop an altered MBR or boot sector onto the hard disk. The malicious activity of an MBR or boot sector virus is typically contained after Windows XP Professional starts. If the virus payload (the malicious activity of the virus) does not run during system startup and if the virus does not alter the original MBR or boot sector, Windows XP Professional prevents the virus from self-replicating to other disks. During normal operation, Windows XP Professional is immune to viruses infecting these disk structures because it accesses physical disks only through protected-mode disk drivers. Viruses typically subvert the BIOS INT 13h disk access routines, which are ignored after Windows XP Professional starts. However, on computers with multiple-boot configurations, such as Windows XP Professional with Microsoft® MS-DOS®, Microsoft® Windows® 95, Microsoft® Windows® 98, or Microsoft® Windows® Millennium Edition (Me), an MBR or boot sector virus might infect the computer when you are running another operating system. If this happens, Windows XP Professional is vulnerable to damage. Viruses that execute their payload during startup are a threat to computers that are running Windows XP Professional because the virus executes before Windows XP Professional takes control of the computer. After Windows XP Professional activates the protected-mode disk drivers, the virus cannot copy itself to other hard disks or floppy disks because the BIOS mechanism on which the virus depends is not used for disk access. |