Fish Boot Virus
Virus Name: Fish Boot
Aliases: Chinese Fish
V Status: Rare
Discovered: March, 1992
Symptoms: Diskette boot sector altered; master boot sector altered;
system hangs; message; program execution failures
Origin: Taiwan
Isolated: Eastern United States
Eff Length: N/A
Type Code: BRaX - Resident Boot Sector & Master Boot Sector Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, PCScan,
NAV, IBMAV, NAVDX, VAlert, ChAV
Removal Instructions: MDisk /P or DOS 5.0 FDisk /MBR on hard disk,
DOS SYS on system diskettes
General Comments:
The Fish Boot virus was isolated in the Eastern United States in
March 1992. The virus appears to originally be from Taiwan.
Fish Boot is a memory resident infector of diskette boot sectors
and the hard disk master boot sector (partition table).
The first time the system is booted with a diskette infected with
the Fish Boot virus, this virus will install itself memory resident
in available free memory. Also at this time, the virus will
infect the system's hard disk master boot sector.
The Fish Boot virus infects the system hard disk's master boot sector
by first writing a copy of the virus starting at Side 0, Cylinder
0 Sector 8. The viral code is two sectors long. The original
master boot sector is then copied to Side 0, Cylinder 0, Sector 10.
The virus then infects the master boot sector located at Side 0,
Cylinder 0, Sector 1.
Once Fish Boot is memory resident, it will infect any non-write
protected diskette which is accessed on the system. On double
density 5.25 inch diskettes, the original boot sector will be
located at Side 0, Cylinder 39, Sector 3. The Fish Boot virus
code will be located in the original boot sector location, as well
as at Side 0, Cylinder 39, Sectors 1 and 2. On high density
5.25 inch diskettes, the original boot sector will be located at
Side 0, Cylinder 79, Sector 3, with the virus code being located
in the original boot sector location and Side 0, Cylinder 79,
Sectors 1 and 2.
Systems infected with the Fish Boot virus will notice that some
programs will no longer function properly, hanging the system
when they execute. At other times, the following message may be
displayed:
"Hello! I am FISH, please don't kill me.
Congratulation 80th year of the Republic Of
China Building, Fish will help to kill stone
Written by Fish in NTIT. TAIWAIN 80.10.18"
This message can be found on infected disks within the viral code
that is located outside of the original boot sector or master boot
sector location.
See: Generic Boot