-----------------------------------------------------------------------------
 WildList Notes - (c)1995 Joe Wells - c1jwells@watson.ibm - wildlist@aol.com
-----------------------------------------------------------------------------

Virus Name:  AntiCMOS

Aliases:     Lenart.

Infects:     MBR on first hard drive. DOS boot sector on floppy disks.

Disk Size:   1 sector.

Location:    MBR or boot sector. Original MBR or boot 
             sector is not stored.
 
Memory Size: The virus reserves 2k of memory by modifying the 
             available memory word at 40:13. On a 640k system 
             the value will be changed from 280h to 27Eh.
 
             Chkdsk will report 653312 bytes (638k) of memory free.

Location:    In 2k reserved at top of conventional memory.

Special:     [none]

Effects:     Portions of the CMOS will be altered, depending on the 
             type of computer infected, this may be the number or type 
             of floppy, number or type of hard drives, the time of day.

Trigger:     Random. Based on timer count.

Messages:    [none]

Bugs:        The virus contains extensive code to locate the two system 
             files on a diskette and attempt to load them. Booting from 
             an infected floppy will infect the MBR, but the bootup 
             process is highly likely to hang before completion.

Origin:      Unknown. Probably only about a year old. 

Notes:       The virus is truly mediocre, just barely infective, and 
             extremely obvious. For such a virus to so quickly become 
             as commonly found as Michelangelo is utterly amazing. 

             Some have suggested that users must be totally oblivious 
             for the virus to have spread so widely. But if that were 
             the case, why aren't other stupid viruses just as common.
         
             So, maybe the opposite is true. Perhaps, it's not actually 
             as widespread as other common viruses. Maybe is so commonly 
             found because it's stupid and users aren't. The other 
             viruses could be far more common, but undetected.

             Whatever the truth is, there is no doubt that this virus 
             is indeed a widespread and represents a major problem 
             for users.




This page was created Thu Aug 12 00:15:33 EDT 1999


Using Linux
 version 2.0.32
 on an i586

Copyright (C) 1999 - Matarese.com