Edwin Virus

Virus Name: Edwin Aliases: V Status: New Discovered: January, 1997 Symptoms: Diskette & Hard Disk Boot Sectors Altered; decrease in total system & available free memory; possible loss of directory entries Origin: Unknown Eff Length: N/A Type Code: BRtD - Resident Diskette & Hard Disk Boot Sector Infector Detection Method: NAV, NAVDX, AVTK, ViruScan, PCScan Removal Instructions: DOS SYS command General Comments: The Edwin virus was received in January, 1997. Its origin or point of isolation is unknown. Edwin is a memory resident infector of the boot sectors of both the system hard disk and diskettes. When the system is booted from an Edwin infected hard disk or Edwin infected diskette, the Edwin virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 2,048 bytes. Once the Edwin virus is memory resident, it will infect the system hard disk partition's boot sector as well as the boot sector of un-write protected diskettes when they are accessed. This virus places a portion of its viral code in the last two sectors of the root directory on diskettes, and as a result, any directory entries which were in these sectors will be lost. Other than possible corruption of the root directory, resulting in the loss of directory entries, this virus doesn't do anything besides replicate.