Max Virus

Virus Name: Max Aliases: V Status: Rare Discovered: June, 1992 Symptoms: BSC, Master Boot Sector altered, disk overwritten, decrease in total system & available free memory Origin: Buenos Aires, Argentina Eff Length: N/A Type Code: BRX - Resident Boot Sector & Master Boot Sector Infector Detection Method: ViruScan, F-Prot, AVTK, NAV, IBMAV, Sweep, NAVDX, VAlert, PCScan, ChAV Removal Instructions: Delete infected files General Comments: The Max virus was isolated in Buenos Aires, Argentina in June 1992. Max is a memory resident infector of diskette boot sectors and the hard disk master boot sector (partition table). It is destructive when it activates. The first time a system is booted from a diskette infected with the Max virus, the Max virus will become memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,048 bytes. Also at this time, the Max virus will infect the hard disk master boot sector. This virus is too large to fit entirely within the master boot sector, so the extra portion of the viral code will be written to Side 0, Cylinder 0, Sector 2. The original master boot sector will be found at Side 0, Cylinder 0, Sector 3. Once the Max virus is memory resident, it will infect the boot sector of any non-write protected diskette which is accessed on the system. On 360K 5.25" diskettes, the extra portion of the viral code and the original boot sector o f the diskette will be written to the last two sectors of the diskette. The Max virus activates on what would appear to a user as a random basis. When it activates, it overwrites the current disk drive with characters from the system's memory.