Virus Name: FORM-Virus
Aliases: Form, Form Boot, FORM-18
V Status: Common
Discovered: June 1990
Symptoms: BSC; clicking noise from system speaker
Eff Length: N/A
Type Code: BR - Resident Boot Sector Infector
Detection Method: ViruScan, F-Prot, NAV, Sweep, AVTK,
IBMAV, NAVDX, VAlert, PCScan, ChAV
Removal Instructions: MDisk, NAV, or DOS SYS command
The FORM-Virus, or Form Boot, is a memory resident infector of
floppy and hard disk boot sectors. It was originally isolated in
When a system is first booted with a diskette infected with the
FORM-Virus, the virus will infect system memory as well as seek out
and infect the system's hard disk. The floppy boot may or may not
be successful, on the author's test system, a boot from floppy
diskette infected with FORM-Virus never succeeded, instead the system
would hang. It should be noted that the virus was received by the
author of this document as a binary file, and it may have been
damaged in some way.
The following text message is contained in the FORM-Virus
binary code as received by the author of this document:
"The FORM-Virus sends greetings to everyone who's reading
this text.FORM doesn't destroy data! Don't panic! Fuckings
go to Corinne."
These messages, however, may not appear in all cases. For example,
I did not find these messages anywhere on a hard disk infected with
Systems infected with the FORM-Virus in memory may notice that a
clicking noise may be emitted from the system speaker on the 24th
day of any month.
This virus can be removed with the same technique as used with many
boot sector infectors. First, power off the system and then boot
from a known clean write-protected boot diskette. The DOS SYS
command can then be used to recreate the boot sector. Alternately,
MDisk from McAfee Associates may be used to recreate the boot sector.
Known variant(s) of the FORM-Virus are:
Form II: Based on FORM-18, this variant was submitted in May
1992 from an unknown origin. It is functionally equivalent
to FORM-18, though altered to avoid detection by most anti-
Origin: Unknown May, 1992.
FORM-18: Similar to the FORM-Virus, FORM-18 activates on the 18th
day of the month, at which time clicking will be heard from
the system speaker on systems which have a system clock and
CMOS. Systems without a system clock will most likely not
have the clicking occur.
FORM-Canada: Similar to the FORM-18 variant, this variant is
a minor alteration. On diskettes, it locates the
remainder of the viral code and original boot sector in
the first two available, unused sectors on the diskette,
marking them as bad sectors.
Origin: Canada August, 1992.
Form.C: Received in February, 1998, this is another minor
variant of the FORM-Virus. It contains the same text
as the original virus.
Origin: Unknown February, 1998.