|I don't wish to sound rude but I have to say that someone who was capable of studying viruses safely would not have to post this sort of question on a forum. That is more what I would associate with some script kiddie wanting to find out how to spread viruses.|
But I'm going to give you the benefit of the doubt and answer your question seriously.
Before you do anything else you must ensure that the computer that you know to be infected with viruses is disconnected from any network. Not to do so would not only be irresponsible but could well be a criminal offence in some countries (as you know the computer is infected you would be guilty of deliberately spreading malicious software).
To actually study how the viruses work you need intimate knowledge of the NT kernel (without knowing how the kernel works how can you study something that tries to disrupt that working?). Inside Windows NT is a good book for that purpose; no doubt there are newer editions that cover later versions of Windows.
Next you will need to install a debugging version of the kernel, so that you can study what is happening, and debugging tools. To make any use of these you must have an intimate knowledge of the C programming language and i386 assembler programming. Then you will be able to study what is actually happening when a virus does its work.
Be aware that, even with this knowledge and these tools, rootkits can easily hide from you.
As I said at the outset, I don't believe that anyone with the appropriate tools and knowledge would need to pose this question in the first place. And I have no intention of saying anything more which might be of use to anyone wishing to spread malicious software.