Name         : Future Disaster

     Aliases      : No Aliases

     Type/Size    : Boot/1024

     Clones       : No Clones 

     Symptoms     : No Symptoms

     Discovered   : 17-07-91

     Way to infect: Boot infection

     Rating       : Dangerous

     Kickstarts   : Only 1.2

     Damage       : Overwrites boot + Rootblock.

     Removal      : Install boot.

     Comments     : If  you  are  booting  with a Future-Disaster infected
                    disk  the  virus  copies  itself  to  a memory-address
                    => $7FB00. Then the virus patches the BeginIO()-Vector
                    from the trackdisk.device.


                    This  patch isn`t used to infect disks, but to install
                    a  new patch in the DoIO()-Vector which is now used to
                    infect disks. Additionally the virus changes the Cool-
                    Capture-Vector to stay resdient.


                    After  the  7.th   infection  the  virus  destroys the
                    Rootblock  of  the disk + 55808 bytes behind block 880
                    (Rootblocktrack  79,  the surface in cylinder 40 which
                    contains  the  rootblock ).  Then  it installs memory-
                    gabrage in the bootblock (from address $10000). Such a
                    disk cannot be "healed".


                    You cannot read any texts in the bootblock.
 


    SHI - A.D 05-94

[Go back]