Changu Mangu Virus
Virus Name: Changu Mangu
V Status: Rare
Discovery: August, 1992
Symptoms: BSC; master boot sector altered; decrease in total system &
available free memory
Eff Length: N/A
Type Code: BRtX - Resident Boot Sector & Master Boot Sector Infector
Detection Method: ViruScan, AVTK, F-Prot, IBMAV, NAVDX,
Sweep, VAlert, PCScan, NAV, ChAV
Removal Instructions: DOS SYS on infected diskettes, M-Disk/P on
master boot sector, DOS FDISK /MBR for DOS 5.0 hard disks
The Changu Mangu, or JKTK, virus was submitted in August, 1992.
It originally was isolated in India. Changu Mangu is a memory
resident infector of the hard disk master boot sector (partition
table) and 360K 5.25" diskette boot sectors. It does not infect
the boot sector of high density diskettes.
The first time the system is booted from a diskette infected
with the Changu Mangu virus, this virus will install itself
memory resident at the top of system memory but below the 640K
DOS boundary, moving interrupt 12's return. Total system and
available free memory, as indicated by the DOS CHKDSK program,
will have decreased by 10,240 bytes. Also at this time, the
Changu Mangu virus will infect the hard disk master boot sector if
it was not previously infected by the virus.
Once the Changu Mangu virus is memory resident, it will infect
the boot sector of non-write protected, 360K 5.25" diskettes when
they are accessed. The original boot sector will have been moved
to cylinder 39, side 1, sector 8.
Changu Mangu doesn't appear to do anything besides replicate.