(This is a very non-technical description of the whole process. Feel free to comment and ask)
The mechanism in practice is the same in all systems and it has much to do with why these things are called viruses instead of, say, bacteria.
A virus is not "alive" in that it lacks essential machinery. What it does is hijack the machinery of a more complex entity such as a cell, and make it do its bidding -- the virus may be no more than a hijacking mechanism with the "bidding" list as payload.
A computer virus is very similar to this simple structure.
How does the hijacking work?
A computer system has to have a boot sequence - first you do this, then you do that, further instructions are here, then... - and an action sequence (which is used to launch programs).
For example when you try to run an executable file, the system opens the file, finds out what it needs (and complains if it can't fulfill those needs - "missing library" for example), finds out how to place all the components packed in the .exe file in memory, determines where to do it, updates the components with information about each other so that they can communicate, unpacks the components and places them in the prepared places in memory, and finally releases a measure of control to the component marked "first".
The virus hijacks this process by (two examples):
- locate the list of places where executable code is going to be activated
(MBR, boot sector, OS loader, OS stub, auto-executing scripts, boot processes, ...)
- inject itself into this list, so that the system has one more thing to do when it starts, and that thing is breathing life into the virus chrysalis. This can be done by modifying the OS's list of things to do, or by placing itself in some convenient place such as the
auto-run folder or Run registry branch in Windows. Anything placed there will be run at startup.
- or it can replace one of the components, saving it somewhere else. When the system activates the component believing it to be legit, the virus does its thing, then it also retrieves the hibernated component and activates it as if it was the system. So in effect the sequence is again one step longer, but "officially", from outside, the number of steps is unchanged.
The virus may also write itself inside the diagnostic routines of the OS so that they report nothing out of the ordinary. This process may be run very close to the hardware, so that the infection is very difficult to detect.
To infect executables the virus does the same in a slightly different way. It can modify the internal "manifest" of the file so that the system will actually run the virus. The virus will then extract from its bloated "body" the carcass of the original process, and activate it in turn. The user will see the desired process running and not notice the slight delay in activation.
Disinfection requires knowledge of the virus so that the original file can be extracted from the infected object, and used to replace it altogether.
More sophisticated ways of hiding exist: many executable files have internal areas that are mostly zeroes, used as temporary storage of one kind or another. The virus hides there, and only does a slight modification to the file so that the "first component" to be activated isn't the original one but the empty area where the virus now resides. Being "inside" the file, the file size is now unchanged. The virus, upon receiving control, will move itself to some other place, again zeroing back the area (in memory) where it was hiding, and pass control to the old "first component", which will then notice nothing amiss.
