Loa Duong Virus
Virus Name: Loa Duong
Aliases: Lao Duong
V Status: Common
Discovered: May, 1991
Symptoms: BSC; Hard disk boot sector corruption; decrease in total
system and available free memory; music; directory
Eff Length: N/A
Type Code: BRtM - Resident Boot Sector Infector
Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAVDX,
VAlert, NAV, PCScan, ChAV
Removal Instructions: M-Disk
The Loa Duong virus was isolated in May, 1991 in Thailand. Loa
Duong is a memory resident infector of the hard disk and floppy
disk boot sectors.
When a diskette infected with the Loa Duong virus is booted, Loa
Duong will install itself memory resident at the top of system
memory but below the 640K DOS boundary. Interrupt 12's return
will be moved. Total system and available memory, as measured by
the DOS CHKDSK program, will decrease by 1,024 bytes. The system
hard disk C: drive's boot sector will be infected at this time.
Once Loa Duong is memory resident, it will infect any non-write
protected diskettes which are exposed to the system. A DIR
command, such as DIR A: will be enough to infect the diskette.
The Loa Duong virus stores the C: drive's original boot sector
at Side 0, Cylinder 0, Sector 8. On high density 5.25" diskettes,
the original boot sector will be stored at sector 28. On double
density 5.25" diskettes, the original boot sector will be stored
at sector 11. Since the sector used to store the original boot
sector on diskettes is the last sector of the root directory, any
file entries which were originally in this sector will be lost.
Loa Duong activates each time 128 disk accesses have occurred, at
which point it will play a Laotian funeral dirge on the system