Thanks for the info, it's been helpful. It does bring me to other questions though.
When a typical Master Boot Record program fires up it gets dumped into memory address 0000:7c00. It then copies itself into address 0000:0600 and then load the windows boot partion into address 0000:7c00.
The MBR program at 0000:0600 is about 86 bytes, and the partition table resides at 0000:07be to 0000:07fd. This leaves 226 bytes to play with in the MBR program, (0000:06db to 0000:07bd.) I've 'altered and expanded' the MBR program in the past for specific needs.
So here's my question: When Windows XP, Win Server 2003, etc boot-up they start at 0000:7c00. Does the boot sequence wipe the memory at the lower address spaces thus stopping my alterations? Also, any 'keylogger' applications running within windows would be locked out of the 'ctrl+alt+del' login screen. That's why I need something running outside of the Win Enviornment. Any thoughts?
THanks in advance. You've been very helpful.