Queens Virus
Virus Name: Queens
Aliases: Micro Cop, Queensland
V Status: Rare
Discovery: February, 1992
Symptoms: Boot Sector Altered; Hard Disk inaccessible; decrease in
total system & available free memory; message & system hang
Origin: Queensland, Australia
Eff Length: N/A
Type Code: BRX - Resident Boot Sector & Master Boot Sector Infector
Detection Method: ViruScan, AVTK, IBMAV, F-Prot, PCScan,
Sweep, NAV, NAVDX, VAlert, ChAV
Removal Instructions: DOS SYS on System Diskettes
General Comments:
The Queens, or Queensland, virus was isolated in Queensland,
Australia in February, 1992. Queens is a memory resident infector
of diskette boot sectors and the hard disk master boot sector
(partition table).
When the system is booted from the first Queens infected diskette,
the Queens virus will become memory resident at the top of system
memory but below the 640K DOS boundary, moving interrupt 12's
return. Total system and available free memory, as indicated by
the DOS CHKDSK program, will have decreased by 2,048 bytes. Also
at this time, the virus will infect the system hard disk's
master boot sector.
Once the Queens virus is memory resident, it will infect the boot
sector of any non-write protected diskette which is accessed on the
system. The Queens virus is too large to fit entirely in the
boot sector, so a portion of the virus will be located elsewhere
on the diskette, along with the original boot sector.
On double density 5.25 inch diskettes, the virus will be located
in the original boot sector location, along with its continuation
in sector 10. The original boot sector will be located in sector
11.
On high density 5.25 inch diskettes, the virus will be located in
the original boot sector location, along with its continuation in
sector 27. The original boot sector will be located in sector 28.
Since the virus overwrites the last two sectors of the root
directory on diskettes, files which had their directory entries in
these sectors will become inaccessible.
On the system hard disk, Queens attempts to infect the hard disk
master boot sector. The infection occurs, but the system hard disk
will become inaccessible as a result.
Systems infected with the Queens virus may also notice that
occassionally the virus will blank the system display, reversing
the video, and display the following message at the bottom of the
screen:
"unauthorized software used --Micro Cops"
When this occurs, the system will be hung.
See: Generic Boot