In depth look at how a boot sector virus infects a computer

A boot sector virus infects a computer when the computer is booted up from an infected disk. This sequence is explain in detail at http://www.funducode.com/freec/misc_c/new_misc_c19/Article19.htm, and has been reproduced in part here:

  1. Once the system boot up sequence has been determined, and there is an infected floppy disk in the disk drive, the computer can be infected.

  2. The contents of the boot sector on the floppy disk are loaded into memory, and control is passed to it. With a floppy disk, the Bootstrap Loader Program does this loading. In the case of a hard disk booting up, the Master Boot Program accomplishes this. Since the floppy is infected, the virus would be loaded into memory, and control would be passed to it.

  3. The virus is loaded into memory at the place where the normal Disk Bootstrap Program is loaded. Eventually, the virus will have to bring the Disk Bootstrap program into memory because it is the program which knows how to load the file IO.SYS.

  4. The virus loads the Disk Bootstrap Program at a fixed location in memory, making the first copy of the virus. Control is then handed over to the Disk Bootstrap Program.

  5. The Disk Bootstrap Program loads the file IO.SYS, and the system continues to boot into DOS.

By the time DOS is loaded, the virus is active in memory, and will be every time the computer boots afterwards, as the virus writes itself to the computer's Master Boot Record.