Virus Name: EDV
Aliases: Cursy, Stealth Virus
V Status: Common
Symptoms: BSC; master boot sector corruption; unusual system crashes
Eff Length: N/A
Type Code: BRX - Resident Boot Sector & Master Boot Sector Infector
Detection Method: ViruScan, NAV, F-Prot, Sweep, AVTK,
IBMAV, NAVDX, VAlert, PCScan, ChAV
Removal Instructions: MDisk/P, or NAV
The EDV, or Cursy, virus was first discovered in Le Havre, France in
1988 by Jean-Luc Nail. At that time, it was named the Cursy virus.
Later, in January 1990, it was isolated separately and named the EDV
virus. This virus is a memory resident infector of floppy diskette
boot sectors and hard disk master boot sector (partition table).
When a system is booted from a diskette infected with the EDV virus,
the virus will install itself memory resident at the top of high
system memory. The value returned by interrupt 12 will be decreased.
Once the virus is memory resident, any disk accessed by the system
will become infected. When the virus infects a diskette, it moves
the original boot sector to side 1, track 39, sector 8. After
moving the original boot sector, it then copies the virus's code to
absolute sector 0, the boot sector of the diskette.
EDV will also infect hard disk drives when they are accessed. In
the case of hard disks, the virus will move absolute sector 0 (the
master boot sector) to side 1, track 39, sector 8 as though it were
a 360K 5.25" floppy diskette. After moving the master boot sector,
it will then overwrite the master boot sector with the viral code.
Once the virus has infected six disks with the virus in memory, the
EDV virus will activate. Upon activation, the virus access the
keyboard interrupt to disable the keyboard and then will overwrite
the first 3 tracks of each disk on the system, starting with the
hard disks. After overwriting the disks, it will then display the
"That rings a bell, no? From Cursy"
Upon activation, the user must power off the machine and reboot from
a system diskette in order to regain any control over the machine.
The following identification string appears at the very end of the
boot sector on infected floppy disks and the master boot sector of
infected hard drives, though it cannot be seen if the virus is in
"MSDOS Vers. E.D.V."
Jean-Luc Nail has indicated that the EDV or Cursy virus is quite
common in the Le Havre area of France, although it is rare outside