Internet Security

Common Computer Virus Basics 104-1

Boot Sector

Hard disk drives, floppy diskettes, and logical drives (partitions) all have boot sectors where critical drive information is stored. View also partition table, Master Boot Record, and multi-partite viruses.

Boot Sector or MBR Virus

A virus which infects the boot sector of a fixed or floppy disk. Any formatted disk (even one that is blank, or only contains text data, for example) may contain a boot sector virus. An attempt to boot from a diskette infected with a boot sector virus will cause the virus to become active in memory. This type of virus will place a copy of itself on the Master Boot Record (MBR) or the boot sector of the hard drive. Every time you boot your system from that point on, you will have the virus active in memory. These are the most common viruses. Any attempt to disinfect these viruses while a virus is active in memory will be defeated since it will re-write itself to the disk as soon as you remove it. Additionally, many of these are stealth viruses. For safety's sake, you should always attempt to disinfect these viruses after a cold boot to a write-protected diskette.

Circular Infection

A type of infection that occurs when 2 viruses infect the boot sector of a disk, rendering the disk unbootable. Removing one virus will generally cause a re-infection with the other virus. View also Boot Sector or MBR Virus.

CMOS

Complimentary Metal Oxide Semi-Conductor. Critical configuration information is stored in CMOS. Some viruses attempt to alter this data.

Companion Virus

A virus which infects executable files by creating a 'companion' file with the same name but an .COM extension. Since DOS executes .COM files, followed by .EXE files, and finally .BAT files, the virus loads before the executable file.

Cross-Linked Files

Cross-linking is a common phenomena rarely associated with viruses. It occurs when two files appear to share the same clusters on the disk.

Dropper

A dropper is a program containing a virus which has been compressed with PKLite, Diet, LZExe, etc. It has been designed to deposit the virus onto a hard disk, a floppy disk, a file, or into memory. The children of this process are not droppers.

You will find much more on this topic at WorldsLargestNetwork.com