WXYC Virus

Virus Name: WXYC Aliases: V Status: Rare Discovered: October, 1992 Symptoms: BSC; master boot sector altered; decrease in total system & available free memory; diskette root directory damage Origin: Unknown Eff Length: N/A Type Code: BRtX - Resident Boot Sector & Master Boot Sector Infector Detection Method: ViruScan, NAV, F-Prot, IBMAV, ChAV, AVTK, Sweep, NAVDX, VAlert, PCScan Removal Instructions: M-Disk, or DOS SYS on system diskettes General Comments: The WXYC virus was submitted in October, 1992. WXYC is a memory resident infector of diskette boot sectors and the system hard disk master boot sector (partition table). It appears to be related to the Stoned virus. The first time the system is booted from a WXYC infected diskette, the WXYC virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,048 bytes. Also at this time, the virus will infect the system hard disk's master boot sector if it was not previously infected. The WXYC virus saves the original master boot sector at Side 0, Cylinder 0, Sector 3. Once the WXYC virus is memory resident, it will infect the boot sector of any non-write protected diskettes accessed on the system. On 360K 5.25" diskettes, the virus will save the original boot sector at Sector 11. On 1.2M 5.25" diskettes, the virus saves the original boot sector at Sector 28. In both cases, this is the last sector of the root directory, and any file directory entries originally in these sectors will be lost. The following text can be found within the viral code on infected hard disks and diskettes: "JAM WXYC" "WXYC rules this roost" See: Stoned