Guillon Virus

Virus Name: Guillon Aliases: V Status: Rare Discovered: October, 1991 Symptoms: BSC; Master Boot Sector Altered; decrease in total system and available free memory; possible FAT damage; internal stack overflow errors; system hangs Origin: Buenos Aires, Argentina Eff Length: N/A Type Code: BRX - Resident Boot Sector & Master Boot Sector Infector Detection Method: ViruScan, F-Prot, AVTK, IBMAV, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV Removal Instructions: M-Disk /P, or DOS SYS on infected system diskettes General Comments: The Guillon virus was discovered in Buenos Aires, Argentina in October, 1991. Guillon is a memory resident infector of the hard disk master boot sector (partition table) and the boot sector of diskettes. It will only replicate to diskettes when it has become memory resident from the system being booted from an infected diskette, but not when it is booted from an infected hard disk. When the system is booted from a diskette infected with the Guillon virus, Guillon will become memory resident, as well as infect the hard disk master boot sector. Total system and available free memory, as measured by the DOS CHKDSK program, will have decreased by 4,096 bytes. At this point, the Guillon virus will infect any non-write protected diskette exposed to the system. The Guillon virus expects diskettes to be 360K double density diskettes, and any other diskette size and format may result in damage to the file allocation table, corrupting programs and data files. When the system is later booted from the system hard disk, the Guillon virus will become memory resident as well, however it will not infect diskettes accessed on the system. At this time, total system and available free memory will have decreased by 6,144 plus bytes, the number increasing by approximately 2K each time the system is booted. Besides the decrease in total system memory, and corruption of diskettes, systems infected with Guillon will experience internal stack overflow errors with a system hang.