On hard (fixed) disk drives, the very first sector is the partition sector (often known as the Master Boot Record [MBR] or partition table).
A single physical disk can be partitioned into one or more logical disks. For example, you may have a physical drive partitioned into C: and D: logical disks so that your single physical disk appears (to DOS/Windows) to be two logical disks. The single partition sector contains the information that describes both logical disks. If the partition sector is damaged, then DOS/Windows may not even recognize that your disk exists.
The partition sector also contains a program that is executed every time you power up or boot your PC. The program part of the partition sector is often called the Master Boot Record (MBR) and this term is often used to include both the program half and data half of the sector. The MBR executes and reads the DOS boot sector that also contains a program. Many viruses in the past have planted their code in the MBR. Some of these leave the partition data alone; some hide it in another location on the disk; some even move and encrypt that information.
The NTFS and FAT partition sectors are similar in structure. They begin with a jump to the entry point of the loader code, followed by the BIOS Paramter Block which describes the geometry of the partition, and then followed by the initial program loader which locates, loads to memory, and then executes the partition’s actual startup code. The IPL is what a virus would try to modify to point to its own code instead of the original loader.
Note: It’s important to use a good anti-virus program to fix any MBR infections. Because some viruses move and encrypt the partition information, if you remove them from the MBR using generic DOS techniques (e.g., the DOS FDISK program with the MBR parameter) you can cause more problems than you had with the virus. In particular, that command only works on hard disk drives that are within the limitations of DOS. If you are accessing devices that are beyond the 1024 cylinder limit, you receive error code 1762. More on the perils of FDISK with the MBR parameter here.
 Miscellaneous Pages |
|
 |
 |
| Virus Plural | DOS Boot Sector |