About The Master Boot Record - Symantec 10551441 - AntiVirus Corporate Edition Client Manual

About the master boot record

There are three subclassifications of file viruses:
Memory-resident: Stay in memory as terminate-stay-resident (TSR)
■
programs and typically infect all executed files.
Direct action: Execute, infect other files, and unload.
■
Companion: Associate themselves with executable files without modifying
■
them. For example, the virus might create a companion file, Word.com, and
attach it to the Word.exe file. When the Word program opens, the infected
Word.com file executes, performs the virus activities, and then executes the
Word.exe file.
The damage that is caused by file viruses ranges from irritating, such as
displaying screen messages, to data destroying.
Macro viruses
Unlike other viruses, macro viruses do not infect program files; they infect
documents. Common targets for many macro viruses are word processors such
as Microsoft Word and Lotus AmiPro®, and spreadsheets like Microsoft Excel.
Word uses macros to perform actions such as formatting text and opening or
closing a document. Macro viruses can modify macros that are defined by the
Word application to perform malicious actions such as overwriting or redefining
default definitions in Word.
The damage that is caused by macro viruses can range from inserting unwanted
text into documents to significantly reducing the functionality of a computer.
Macro viruses that infect Word commonly target the macros that are associated
with the Normal.dot template. This template is global, so all of your Word files
can be infected.
The master boot record is contained on the first sector of a hard drive. Part of
the process of starting a computer includes giving control to the hard disk. Also,
a program is located in the first sector of the hard disk that enables the
operating system to load into random access memory (RAM).
Boot viruses can damage the master boot record by moving, overwriting, or
deleting it. For example, the Monkey virus moves the master boot record to the
hard drive's third sector, and then places its own code in the first sector. Moving
the master boot record makes starting from the hard drive impossible.
See "Boot viruses" on page 12.
Introducing Symantec AntiVirus
About viruses
13