Parity Boot Virus

 Virus Name:  Parity Boot 
 V Status:    Rare 
 Discovered:  October, 1992 
 Symptoms:    BSC; master boot sector altered; decrease in total system & 
              available free memory; "PARITY CHECK" message & system hang; 
              possible root directory corruption 
 Origin:      Germany 
 Isolated:    Australia 
 Eff Length:  N/A 
 Type Code:   BRtX - Resident Boot Sector & Master Boot Sector Infector 
 Detection Method:  ViruScan, F-Prot, NAV, AVTK, IBMAV, 
                    Sweep, NAVDX, VAlert, PCScan, ChAV 
 Removal Instructions:  F-Prot, M-Disk/P and DOS SYS 
              on system diskettes 
 General Comments: 
       The Parity Boot virus was submitted in October, 1992 after being 
       isolated in Australia.  This virus is believed to have originated 
       in Germany.  Parity Boot is a memory resident infector of the 
       hard disk master boot sector (partition table) and diskette boot 
       sectors.  It is a stealth virus, redirecting attempts to read the 
       hard disk master boot sector and diskette boot sectors to the 
       original master boot sector and boot sector. 
       The first time the system is booted from a diskette infected with 
       the Parity Boot virus, this virus will infect the system hard disk's 
       master boot sector and become memory resident.  Total system and 
       available free memory, as indicated by the DOS CHKDSK program, will 
       have decreased by 1,024 bytes, and interrupt 12's return will have 
       been moved to 9FC0.  The virus will have copied the hard disk's 
       original master boot sector to Side 0, Cylinder 0, Sector 14 before 
       infecting the master boot sector at Side 0, Cylinder 0, Sector 1. 
       Once the Parity Boot virus is memory resident, it will infect non- 
       write protected diskettes when they are accessed. On 360K 5.25" 
       diskettes, the original boot sector will be located at sector 11. 
       On 1.2M 5.25" diskettes, the original boot sector will be located 
       at sector 28.  In both cases, these sectors are the last sector in 
       the root directory, and any directory entries originally located 
       in these sectors will be lost. 
       Systems infected with the Parity Boot virus may experience the 
       following message being displayed after keys are pressed on the 
       system keyboard: 
               "PARITY CHECK" 
       When this message occurs, the system will be hung, requiring the 
       user to reset the system. 
       Parity Boot is a stealth virus, it redirects attempts to read the 
       infected master boot sector and infected boot sectors to the 
       original, uninfected copies it stores. 

Show viruses from discovered during that infect .

Main Page