Virus Name: Guillon
V Status: Rare
Discovered: October, 1991
Symptoms: BSC; Master Boot Sector Altered; decrease in total system and
available free memory; possible FAT damage; internal stack
overflow errors; system hangs
Origin: Buenos Aires, Argentina
Eff Length: N/A
Type Code: BRX - Resident Boot Sector & Master Boot Sector Infector
Detection Method: ViruScan, F-Prot, AVTK, IBMAV,
Sweep, NAV, NAVDX, VAlert, PCScan, ChAV
Removal Instructions: M-Disk /P, or DOS SYS on infected system diskettes
The Guillon virus was discovered in Buenos Aires, Argentina in
October, 1991. Guillon is a memory resident infector of the hard
disk master boot sector (partition table) and the boot sector of
diskettes. It will only replicate to diskettes when it has become
memory resident from the system being booted from an infected
diskette, but not when it is booted from an infected hard disk.
When the system is booted from a diskette infected with the Guillon
virus, Guillon will become memory resident, as well as infect the
hard disk master boot sector. Total system and available free
memory, as measured by the DOS CHKDSK program, will have decreased
by 4,096 bytes.
At this point, the Guillon virus will infect any non-write
protected diskette exposed to the system. The Guillon virus
expects diskettes to be 360K double density diskettes, and any other
diskette size and format may result in damage to the file
allocation table, corrupting programs and data files.
When the system is later booted from the system hard disk, the
Guillon virus will become memory resident as well, however it will
not infect diskettes accessed on the system. At this time, total
system and available free memory will have decreased by 6,144 plus
bytes, the number increasing by approximately 2K each time the
system is booted.
Besides the decrease in total system memory, and corruption of
diskettes, systems infected with Guillon will experience internal
stack overflow errors with a system hang.