Loa Duong Virus

Virus Name: Loa Duong Aliases: Lao Duong V Status: Common Discovered: May, 1991 Symptoms: BSC; Hard disk boot sector corruption; decrease in total system and available free memory; music; directory corruption Origin: Thailand Eff Length: N/A Type Code: BRtM - Resident Boot Sector Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAVDX, VAlert, NAV, PCScan, ChAV Removal Instructions: M-Disk General Comments: The Loa Duong virus was isolated in May, 1991 in Thailand. Loa Duong is a memory resident infector of the hard disk and floppy disk boot sectors. When a diskette infected with the Loa Duong virus is booted, Loa Duong will install itself memory resident at the top of system memory but below the 640K DOS boundary. Interrupt 12's return will be moved. Total system and available memory, as measured by the DOS CHKDSK program, will decrease by 1,024 bytes. The system hard disk C: drive's boot sector will be infected at this time. Once Loa Duong is memory resident, it will infect any non-write protected diskettes which are exposed to the system. A DIR command, such as DIR A: will be enough to infect the diskette. The Loa Duong virus stores the C: drive's original boot sector at Side 0, Cylinder 0, Sector 8. On high density 5.25" diskettes, the original boot sector will be stored at sector 28. On double density 5.25" diskettes, the original boot sector will be stored at sector 11. Since the sector used to store the original boot sector on diskettes is the last sector of the root directory, any file entries which were originally in this sector will be lost. Loa Duong activates each time 128 disk accesses have occurred, at which point it will play a Laotian funeral dirge on the system speaker.