旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴� � VIRUS REPORT � � Disk Killer � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Synonyms: Ogre, Disk Ogre, Computer Ogre. Date of Origin: Spring, 1989. Host Machine: PC compatibles. Host Files: Remains resident. Infects both floppy and hard disk boot sectors. Increase in Size of Infected Files: n/a. Nature of Damage: Corrupts or overwrites boot sector. Affects system run-time operation. Corrupts program or overlay files. Corrupts data files. Formats or erases all/part of disk. Detected by: Scanv39+, F-Prot, IBM Scan, Pro-Scan. Removed by: MDISK, CleanUp, F-Prot, or DOS COPY and SYS commands. The Disk Killer is a boot sector virus that infects both hard disks and floppies. The first organization to report this virus was Birchwood systems in San Jose in early Summer, 1989. Additional reports were received from Washington, Oklahoma, Minnesota and Arizona. It was finally isolated at Wedge Systems in Milpitas, California. Disk Killer was isolated on September 26, 1989. The virus spreads by writing copies of itself to three unused clusters on either a floppy or hard disk, marking them as "bad" in the FAT to prevent overwriting. The boot sector is modified to execute the virus code during the boot, permitting it to infect any new disks exposed to the system. The virus counts the number of disks it has infected and does no harm until it has reached a predetermined limit. When the limit is reached or exceeded and the system is rebooted, this message is displayed: "Disk Killer <197> Version 1.00 by COMPUTER OGRE. Don't turn off the power or remove the diskettes while Disk Killer is processing! ... PROCESSING ... Now you can turn off the power. I wish you luck." During "processing", it writes clusters of a single character randomly all over the disk, effectively trashing it. Note that when the message is displayed, if the system is turned off immediately it may be possible to salvage some files on the disk using various utility programs, as this virus first destroys the boot sector, FATs, and root directory. The internal messages do not appear in sector zero, but are stored in sector 152 on floppy disks and an as yet undetermined location on hard disks. This had always added to the confusion over the virus because message remnants were sometimes discovered in the middle of executable files, and it was assumed that the virus was a COM or EXE infector. If your boot sector does not contain the standard DOS error messages, then immediately power down and clean out the boot. Infected boot sectors begin with FAEB. You can check boot sectors with a tool such as Norton's NU. If the DOS messages are not there (non-system disk; etc.), then the system is infected. MDISK will remove the virus. Disk Killer can be removed by using MDisk, or the DOS SYS command, to overwrite the boot sector on your hard disk or bootable floppies. On non-system floppies, files can be copied to non-infected floppies, followed by reformatting the infected floppies. Be sure to turn the system off, then reboot the system from a write-protected master diskette before attempting to remove the virus, or you will be reinfected by the virus in memory. �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� � This document was adapted from the book "Computer Viruses", � � which is copyright and distributed by the National Computer � � Security Association. It contains information compiled from � � many sources. To the best of our knowledge, all information � � presented here is accurate. � � � � Please send any updates or corrections to the NCSA, Suite 309, � � 4401-A Connecticut Ave NW, Washington, DC 20008. Or call our BBS � � and upload the information: (202) 364-1304. Or call us voice at � � (202) 364-8252. This version was produced May 22, 1990. � � � � The NCSA is a non-profit organization dedicated to improving � � computer security. Membership in the association is just $45 per � � year. Copies of the book "Computer Viruses", which provides � � detailed information on over 145 viruses, can be obtained from � � the NCSA. Member price: $44; non-member price: $55. � � � � The document is copyright (c) 1990 NCSA. � � � � This document may be distributed in any format, providing � � this message is not removed or altered. � 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠  Downloaded From P-80 International Information Systems 304-744-2253