"Form" Virus (5-June-1990)
Entry.................. "Form" Virus
Alias(es).............. ---
Strain................. ---
Detected: when......... February 1990
          where........ Zuerich, Switzerland (reported to be very widely
                        spread amongst the Swiss schools in canton Zug)
Classification......... Boot sector virus
Length of Virus........ Exactly 03F9h bytes (approx. 2 sectors)
------------------------ Preconditions--------------------------------- 
Operating System(s).... MS-DOS
Version/Release........ Any
Computer models........ IBM-PS and compatibles
-------------------------- Attributes---------------------------------- 
Easy identification.... The boot sector will contain the following text
                        (amongst others): "The FORM-Virus sends 
                        greetings to everyone who's read this text.".
                        (See also: Damage)
Type of infection...... Direct action: at boot time the virus will
                               attempt to infect the hard disk.
                        Indirect: At every read from a floppy, an
                               attempt will be made to infect it.
Infection trigger...... Every read any time.
Media affected......... Any floppy and the first active partition on
                        a harddisk.
Interrupts hooked...... Int 13 (disk) and Int 9 (keyboard) on every
                        24th of the month.
Damage................. The virus makes the keys click and delays key
                        action slightly.
Particularities........ Economically programed. It is a rare example
                        of both direct and indirect action in the same
                        virus.
Similarities........... ---
---------------------------- Agents------------------------------------ 
Countermeasures........ 
 - ditto - successful.. Most checksumming programs that check the boot
                        sector.
Standard Means......... The text mentioned above will be found in a
                        cluster marked as bad. Disks can usually be
                        disinfected by booting from a write protected
                        clean boot disk, and using the SYS command on
                        any infected disk.
----------------------- Acknowledgements------------------------------- 
Location............... Virus Test Center, University of Hamburg, FRG
Classification by...... Morton Swimmer
Documentation by....... Morton Swimmer
Date................... 5-June-1990
Information source..... Ralf Brown's interrupt list.

.