Virus Name: Max
V Status: Rare
Discovered: June, 1992
Symptoms: BSC, Master Boot Sector altered, disk overwritten, decrease in
total system & available free memory
Origin: Buenos Aires, Argentina
Eff Length: N/A
Type Code: BRX - Resident Boot Sector & Master Boot Sector Infector
Detection Method: ViruScan, F-Prot, AVTK, NAV, IBMAV,
Sweep, NAVDX, VAlert, PCScan, ChAV
Removal Instructions: Delete infected files
The Max virus was isolated in Buenos Aires, Argentina in June 1992.
Max is a memory resident infector of diskette boot sectors and the
hard disk master boot sector (partition table). It is destructive
when it activates.
The first time a system is booted from a diskette infected with the
Max virus, the Max virus will become memory resident at the top of
system memory but below the 640K DOS boundary. Total system and
available free memory, as indicated by the DOS CHKDSK program, will
have decreased by 2,048 bytes. Also at this time, the Max virus
will infect the hard disk master boot sector. This virus is too
large to fit entirely within the master boot sector, so the extra
portion of the viral code will be written to Side 0, Cylinder 0,
Sector 2. The original master boot sector will be found at Side 0,
Cylinder 0, Sector 3.
Once the Max virus is memory resident, it will infect the boot
sector of any non-write protected diskette which is accessed on the
system. On 360K 5.25" diskettes, the extra portion of the viral
code and the original boot sector o f the diskette will be written
to the last two sectors of the diskette.
The Max virus activates on what would appear to a user as a random
basis. When it activates, it overwrites the current disk drive
with characters from the system's memory.