Loa Duong Virus


 Virus Name:  Loa Duong 
 Aliases:     Lao Duong 
 V Status:    Common 
 Discovered:  May, 1991 
 Symptoms:    BSC; Hard disk boot sector corruption; decrease in total 
              system and available free memory; music; directory 
              corruption 
 Origin:      Thailand 
 Eff Length:  N/A 
 Type Code:   BRtM - Resident Boot Sector Infector 
 Detection Method:  ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAVDX, 
                    VAlert, NAV, PCScan, ChAV 
 Removal Instructions:  M-Disk 
 
 General Comments: 
       The Loa Duong virus was isolated in May, 1991 in Thailand.  Loa 
       Duong is a memory resident infector of the hard disk and floppy 
       disk boot sectors. 
 
       When a diskette infected with the Loa Duong virus is booted, Loa 
       Duong will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary.  Interrupt 12's return 
       will be moved.  Total system and available memory, as measured by 
       the DOS CHKDSK program, will decrease by 1,024 bytes.  The system 
       hard disk C: drive's boot sector will be infected at this time. 
 
       Once Loa Duong is memory resident, it will infect any non-write 
       protected diskettes which are exposed to the system.  A DIR 
       command, such as DIR A: will be enough to infect the diskette. 
 
       The Loa Duong virus stores the C: drive's original boot sector 
       at Side 0, Cylinder 0, Sector 8.  On high density 5.25" diskettes, 
       the original boot sector will be stored at sector 28.  On double 
       density 5.25" diskettes, the original boot sector will be stored 
       at sector 11.  Since the sector used to store the original boot 
       sector on diskettes is the last sector of the root directory, any 
       file entries which were originally in this sector will be lost. 
    
       Loa Duong activates each time 128 disk accesses have occurred, at 
       which point it will play a Laotian funeral dirge on the system 
       speaker. 

Show viruses from discovered during that infect .

Main Page