How to Protect Boot Sector from Viruses in Windows (122221)


The information in this article applies to:

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Datacenter Server
  • Microsoft Windows XP Home Edition
  • Microsoft Windows XP Professional
  • Microsoft Windows NT Server 3.1
  • Microsoft Windows NT Server 3.5
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Workstation 3.1
  • Microsoft Windows NT Workstation 3.5
  • Microsoft Windows NT Workstation 3.51
  • Microsoft Windows NT Workstation 4.0
  • Microsoft Windows NT Advanced Server
This article was previously published under Q122221

SUMMARY

When you start your computer with a floppy disk that is infected with a virus, Windows is not capable of detecting it, which is true with many operating systems. Some viruses, such as the FORMS virus, may infect the boot sector of your hard disk drive. This article discusses some methods of protecting the boot sector of the hard disk drive from viruses.

MORE INFORMATION

There is a misconception that if the partition of the hard disk drive is NTFS, the information in the partition is secure. NTFS, like other file systems such as File Allocation Table (FAT) and High Performance File System (HPFS), is not recognized until Windows starts the service for the file system. The boot sector is separate from the file system in that it is recognized by the system BIOS upon starting the computer.

In order to provide C2 level government security, the environment surrounding the system must meet the same level of security that Windows provides. The C2 standard requires physical security, such as locking the computer.

To protect your system from any type of virus infection in Windows and possibly recover the boot sector of the hard drive, use one of the following methods:
  • Remove any floppy disk in drive A after you shut down Windows.
  • Configure the system BIOS to disable floppy disk booting (no floppy seek) or change the order of the boot process to hard drive first.
  • Configure the system BIOS to enable system password protection.
  • To fix the boot sector, start the computer with a MS-DOS system disk and run the following command:

    fdisk /mbr

    WARNING: If your hard drive was prepared by a third-party disk manager program, such as Ontrack Disk Manager, then the fdisk /mbr command removes the overlay program of that third-party disk manager, such as the Overlay Manager, and the drive no longer starts. Therefore, you must make sure that the drive was not partitioned with a third-party disk manager program before you use this command.
  • Run the Repair utility to verify and recover Windows startup files.
The fdisk /mbr command works only on hard disk drives that are within the limitations of DOS. If you are accessing devices that are beyond the 1024 cylinder limit, you cannot run fdisk /mbr and you receive error code 1762.

If a virus has infected the Master Boot Record (MBR), you cannot run the Emergency Repair Disk until the virus is cleaned. Most virus programs have the same limitation as DOS so you cannot run a scan against the hard disk drive; however, DOS 6.22 Msav.exe will clean the MBR and RAM of the computer.
Modification Type:MajorLast Reviewed:5/6/2003
Keywords:kbusage KB122221
©2002 Microsoft Corporation. All rights reserved.