AntiEXE Virus
Virus Name: AntiEXE
Aliases: CMOS4, NewBug
V Status: Common
Discovery: January, 1995
Symptoms: BSC; Master boot sector (partition table sector) altered;
decrease in total system & available free memory;
system will boot from hard disk if attempt made to boot from
non-system diskette; hard disk corruption;
.EXE file corruption
Origin: Russia
Eff Length: N/A
Type Code: BRhX - Resident Boot Sector & Master Boot Sector Infector
Detection Method: F-Prot, AVTK, IBMAV, ViruScan, Sweep,
NAV, NAVDX, VAlert, PCScan, ChAV
Removal Instructions: F-Prot
General Comments:
The AntiEXE virus was received in January, 1995, though it has been
reported from sites in North America for several months. It has
been reported as having originated in Russia. AntiEXE is a memory
resident stealth infector of diskette boot sectors as well as the
system hard disk master boot sector.
When the system is first booted from an AntiEXE infected diskette,
this virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. Total system and available
free memory, as indicated by the DOS CHKDSK program, will have
decreased by 1,024 bytes. Also at this time, the virus will over-
write the system hard disk master boot sector with its viral code.
Once the AntiEXE virus is memory resident, it will infect un-write
protected diskettes by infecting the diskette boot sector. The
original boot sector will have been saved in the last sector of the
root directory.
AntiEXE is a full stealth virus. When memory resident, any attempt
to view or access the system hard disk master boot sector or a
diskette boot sector will result in the virus displaying the
uninfected sector. As such, anti-viral programs are unable to
detect the presence of the virus on diskette when the virus is
memory resident. The virus also prevents its removal from the
system when memory resident by blocking attempts to write to the
system hard disk master boot sector and diskette boot sectors.
This virus can be destructive under one circumstance. If the user
presses the key combination