When you start your computer with a floppy disk that is infected with a
virus, Windows is not capable of detecting it, which is true with many
operating systems. Some viruses, such as the FORMS virus, may infect the
boot sector of your hard disk drive. This article discusses some methods
of protecting the boot sector of the hard disk drive from viruses.
There is a misconception that if the partition of the hard disk drive is
NTFS, the information in the partition is secure. NTFS, like other file
systems such as File Allocation Table (FAT) and High Performance File
System (HPFS), is not recognized until Windows starts the service for
the file system. The boot sector is separate from the file system in that
it is recognized by the system BIOS upon starting the computer.
In order to provide C2 level government security, the environment
surrounding the system must meet the same level of security that Windows
provides. The C2 standard requires physical security, such as locking
To protect your system from any type of virus infection in
Windows and possibly recover the boot sector of the hard drive, use one of the following methods:
- Remove any floppy disk in drive A after you shut down Windows.
- Configure the system BIOS to disable floppy disk booting (no floppy seek) or change the order of the boot process to hard drive first.
- Configure the system BIOS to enable system password protection.
- To fix the boot sector, start the computer with a MS-DOS system disk and run the following command:
fdisk /mbrWARNING: If your hard drive was prepared by a third-party disk manager program, such as Ontrack Disk Manager, then the fdisk /mbr command removes the overlay program of that third-party disk manager, such as the Overlay Manager, and the drive no longer starts. Therefore, you must
make sure that the drive was not partitioned with a third-party disk manager program before you use this command.
- Run the Repair utility to verify and recover Windows startup files.
The fdisk /mbr
command works only on hard disk drives that are within the limitations of DOS. If you are accessing devices that are beyond the 1024 cylinder limit, you cannot run fdisk /mbr
and you receive error code 1762.
If a virus has infected the Master Boot Record (MBR), you cannot run the Emergency Repair Disk until the virus is cleaned. Most virus programs have the same limitation as DOS so you cannot run a scan against the hard disk drive; however, DOS 6.22 Msav.exe will clean the MBR and RAM of the computer.