Swedish Disaster Virus


 Virus Name:  Swedish Disaster 
 Aliases: 
 V Status:    Rare 
 Discovered:  January, 1991 
 Symptoms:    BSC; Master boot sector altered; 
              Decrease in system and available free memory 
 Origin:      Sweden 
 Eff Length:  N/A 
 Type Code:   BRhX - Resident Boot Sector & Master Boot Sector Infector 
 Detection Method:  ViruScan, F-Prot, NAV, Sweep, AVTK, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV 
 Removal Instructions:  MDisk/P 
 
 General Comments: 
       The Swedish Disaster was isolated in January, 1991.  This virus 
       appears to be from Sweden.  It is a memory resident infector of 
       floppy boot sectors and the hard disk master boot sector 
       (partition table). 
 
       When the system is booted from a diskette whose boot sector is 
       infected with the Swedish Disaster virus, the virus will infect the 
       system hard disk's master boot sector, with the original hard disk 
       master boot sector moved to side 0, cylinder 0, sector 6.  The virus 
       will also install itself memory resident at the top of system memory 
       but below the 640K DOS boundary.  Total system memory will decrease 
       by 2,048 bytes, available free memory will be 6,944 bytes less than 
       what is expected by the user.  Interrupt 12's return will have been 
       moved by the virus. 
 
       After Swedish Disaster is memory resident, the virus will infect 
       all non-write protected diskettes which are accessed on the 
       system.  On 360K 5.25" diskettes, the original boot sector will 
       have been moved to sector 11, which is normally a part of the root 
       directory.  This means that if the disk originally had directory 
       entries in that sector, they will be lost. 
 
       The following text string can be found at the end of the boot 
       sector of infected diskettes, as well as within the master boot 
       sector on infected hard disks: 
 
               "The Swedish Disaster" 
 
       Diskettes infected with the Swedish Disaster can be disinfected by 
       powering off the system and rebooting from a write-protected, 
       original DOS diskette.  The DOS SYS command can then be used to 
       replace the boot sector on infected diskettes.  For hard disks, the 
       MDisk/P program will remove this virus, though the above text 
       string will remain in the master boot sector. 
 
       See:   Stoned 

Show viruses from discovered during that infect .

Main Page