Form.A
Analysis
- Viral body is 512 bytes
- Virus infects MBR and floppy boot records upon
boot, and remains memory resident
- If infected floppy is in pc upon boot, virus code
may be transferred to system MBR and become memory
resident at next system boot
- Unless a floppy is write-protected, it becomes
infected when accessed from an infected pc
- Virus hides its code in sectors on a floppy disk,
then marks 1,024 of these bytes as bad to prevent
the system from overwriting or clearing the virus
code
- Virus contains these strings-
"The FORM-Virus sends greetings to everyone who's reading this text.FORM doesn't destroy data! Don't panic! Fuckings go to Corinne."