Gargoyle it is nearly impossible to deny access to the hard drive! In Windoze and Linus boxes there is a swap file (another favorite hiding place for naughty code!) where excess current memory 'pages' are kept. The swap file is on disk not in ram!
Rebooting the machine normaly deletes that file, but some viri have been found which survive the reboot in the swap file. In these cases windoze may reload but complain a lot. If not it will go into safe mode and complain less.