Edwin Virus


 Virus Name:  Edwin 
 Aliases: 
 V Status:    New 
 Discovered:  January, 1997 
 Symptoms:    Diskette & Hard Disk Boot Sectors Altered; 
              decrease in total system & available free memory; 
              possible loss of directory entries 
 Origin:      Unknown 
 Eff Length:  N/A 
 Type Code:   BRtD - Resident Diskette & Hard Disk Boot Sector Infector 
 Detection Method:  NAV, NAVDX, AVTK, ViruScan, PCScan 
 Removal Instructions:  DOS SYS command 
 
 General Comments: 
       The Edwin virus was received in January, 1997.  Its origin or point 
       of isolation is unknown.  Edwin is a memory resident infector of the 
       boot sectors of both the system hard disk and diskettes. 
 
       When the system is booted from an Edwin infected hard disk or 
       Edwin infected diskette, the Edwin virus will install itself memory 
       resident at the top of system memory but below the 640K DOS boundary, 
       moving interrupt 12's return.  Total system and available free 
       memory, as indicated by the DOS CHKDSK program from DOS 5.0, will 
       have decreased by 2,048 bytes. 
 
       Once the Edwin virus is memory resident, it will infect the system 
       hard disk partition's boot sector as well as the boot sector of 
       un-write protected diskettes when they are accessed.  This virus 
       places a portion of its viral code in the last two sectors of the 
       root directory on diskettes, and as a result, any directory entries 
       which were in these sectors will be lost. 
 
       Other than possible corruption of the root directory, resulting in 
       the loss of directory entries, this virus doesn't do anything besides 
       replicate. 

Show viruses from discovered during that infect .

Main Page