Changu Mangu Virus

Virus Name: Changu Mangu Aliases: JKTK V Status: Rare Discovery: August, 1992 Symptoms: BSC; master boot sector altered; decrease in total system & available free memory Origin: India Eff Length: N/A Type Code: BRtX - Resident Boot Sector & Master Boot Sector Infector Detection Method: ViruScan, AVTK, F-Prot, IBMAV, NAVDX, Sweep, VAlert, PCScan, NAV, ChAV Removal Instructions: DOS SYS on infected diskettes, M-Disk/P on master boot sector, DOS FDISK /MBR for DOS 5.0 hard disks General Comments: The Changu Mangu, or JKTK, virus was submitted in August, 1992. It originally was isolated in India. Changu Mangu is a memory resident infector of the hard disk master boot sector (partition table) and 360K 5.25" diskette boot sectors. It does not infect the boot sector of high density diskettes. The first time the system is booted from a diskette infected with the Changu Mangu virus, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 10,240 bytes. Also at this time, the Changu Mangu virus will infect the hard disk master boot sector if it was not previously infected by the virus. Once the Changu Mangu virus is memory resident, it will infect the boot sector of non-write protected, 360K 5.25" diskettes when they are accessed. The original boot sector will have been moved to cylinder 39, side 1, sector 8. Changu Mangu doesn't appear to do anything besides replicate.