P-Check Virus (25-July-1992)
Entry...............: P-Check Virus
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: April 1992
              where.: 
Classification......: System (bootsector/partition table (MBR)) virus,
                         stealth
Length of Virus.....: Length on medium: 512 Bytes (=1 sector)
--------------------- Preconditions -----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 
Computer model(s)...: IBM PC and compatibles
--------------------- Attributes --------------------------------------
Easy Identification.: Memory decreased by 1 kBytes after infection;
                         no plain text in bootsector or MBR, like 
                         "Non system disk..." or "Bad partition....".
Type of infection...: Boot sectors and partition table of media.
Infection Trigger...: Booting from an infected disk will infect the 
                         hard disk; from this time, all read accesses
                         to the boot sector of any physical drive will
                         infect the medium in this drive.
Storage media affected: All media: Floppy disk, hard disk.
Interrupts hooked...: INT 09, INT 13.
Damage..............: Transient/Permanent damage:
                      Some built-in mechanism simulates a parity error
                         message on the screen after 1 hour of opera-
                         tion plus an additional hour for each infec-
                         tion: the more infections, the longer till 
                         the parity check display.
                      The parity error simulation switches to 40 x 25 
                         mode, displays 'PARITY CHECK' and then halts 
                         the processor.
                      Virus constantly garbles the INT01&INT03 entries, 
                         so that debug will not work; this is not tied 
                         to a trigger.
Damage Trigger......: The internal timer tick (not the CMOS clock) is 
                         used for timing. Trigger= 1+n hours after 
                         boot up (n=number of infections since booting)
Particularities.....: ---
Similarities........: ---
--------------------- Agents ------------------------------------------
Countermeasures.....: Up-to-date antiviral products.
                      Removal: SYS on floppies; FDISK /MBR (DOS 5.0)
Standard means......:
--------------------- Acknowledgement --------------------------------
Location............: Micro-BIT Virus Center, Univ Karlsruhe, Germany
Classification by...: Christoph Fischer (Klaus Brunnstein, VTC)
Documentation by....: Christoph Fischer
Date................: April-1992
Information Source..: ---

.