Swedish Disaster Virus
Virus Name: Swedish Disaster
Aliases:
V Status: Rare
Discovered: January, 1991
Symptoms: BSC; Master boot sector altered;
Decrease in system and available free memory
Origin: Sweden
Eff Length: N/A
Type Code: BRhX - Resident Boot Sector & Master Boot Sector Infector
Detection Method: ViruScan, F-Prot, NAV, Sweep, AVTK, IBMAV,
NAVDX, VAlert, PCScan, ChAV
Removal Instructions: MDisk/P
General Comments:
The Swedish Disaster was isolated in January, 1991. This virus
appears to be from Sweden. It is a memory resident infector of
floppy boot sectors and the hard disk master boot sector
(partition table).
When the system is booted from a diskette whose boot sector is
infected with the Swedish Disaster virus, the virus will infect the
system hard disk's master boot sector, with the original hard disk
master boot sector moved to side 0, cylinder 0, sector 6. The virus
will also install itself memory resident at the top of system memory
but below the 640K DOS boundary. Total system memory will decrease
by 2,048 bytes, available free memory will be 6,944 bytes less than
what is expected by the user. Interrupt 12's return will have been
moved by the virus.
After Swedish Disaster is memory resident, the virus will infect
all non-write protected diskettes which are accessed on the
system. On 360K 5.25" diskettes, the original boot sector will
have been moved to sector 11, which is normally a part of the root
directory. This means that if the disk originally had directory
entries in that sector, they will be lost.
The following text string can be found at the end of the boot
sector of infected diskettes, as well as within the master boot
sector on infected hard disks:
"The Swedish Disaster"
Diskettes infected with the Swedish Disaster can be disinfected by
powering off the system and rebooting from a write-protected,
original DOS diskette. The DOS SYS command can then be used to
replace the boot sector on infected diskettes. For hard disks, the
MDisk/P program will remove this virus, though the above text
string will remain in the master boot sector.
See: Stoned