Another point are boot sector viruses and their detection: the anti virus software makes a picture of the actual boot sectors (at the moment of installation). Whenever the boot sector has changed the software alerts and asks the user if he wants to accept these changes or restore the old sector. This method is independently of the signature of the virus. However, the possibility of false positives is given due to the fact that if one installs another OS for example which writes information in the boot sector. In this case it is for no good to restore the boot sector, believe me :-)