Parity Boot Virus
Virus Name: Parity Boot
Aliases:
V Status: Rare
Discovered: October, 1992
Symptoms: BSC; master boot sector altered; decrease in total system &
available free memory; "PARITY CHECK" message & system hang;
possible root directory corruption
Origin: Germany
Isolated: Australia
Eff Length: N/A
Type Code: BRtX - Resident Boot Sector & Master Boot Sector Infector
Detection Method: ViruScan, F-Prot, NAV, AVTK, IBMAV,
Sweep, NAVDX, VAlert, PCScan, ChAV
Removal Instructions: F-Prot, M-Disk/P and DOS SYS
on system diskettes
General Comments:
The Parity Boot virus was submitted in October, 1992 after being
isolated in Australia. This virus is believed to have originated
in Germany. Parity Boot is a memory resident infector of the
hard disk master boot sector (partition table) and diskette boot
sectors. It is a stealth virus, redirecting attempts to read the
hard disk master boot sector and diskette boot sectors to the
original master boot sector and boot sector.
The first time the system is booted from a diskette infected with
the Parity Boot virus, this virus will infect the system hard disk's
master boot sector and become memory resident. Total system and
available free memory, as indicated by the DOS CHKDSK program, will
have decreased by 1,024 bytes, and interrupt 12's return will have
been moved to 9FC0. The virus will have copied the hard disk's
original master boot sector to Side 0, Cylinder 0, Sector 14 before
infecting the master boot sector at Side 0, Cylinder 0, Sector 1.
Once the Parity Boot virus is memory resident, it will infect non-
write protected diskettes when they are accessed. On 360K 5.25"
diskettes, the original boot sector will be located at sector 11.
On 1.2M 5.25" diskettes, the original boot sector will be located
at sector 28. In both cases, these sectors are the last sector in
the root directory, and any directory entries originally located
in these sectors will be lost.
Systems infected with the Parity Boot virus may experience the
following message being displayed after keys are pressed on the
system keyboard:
"PARITY CHECK"
When this message occurs, the system will be hung, requiring the
user to reset the system.
Parity Boot is a stealth virus, it redirects attempts to read the
infected master boot sector and infected boot sectors to the
original, uninfected copies it stores.