Solved

antiCMOS A virus removal

Posted on 1997-02-05
1
1,814 Views
Last Modified: 2013-12-27
null
0
Comment
Question by:gmcdc
1 Comment
 
LVL 2

Accepted Solution

by:
helper earned 100 total points
ID: 1598516
You may be experiencing a false report.  If the McAffee located
the virus, it should have, in my opinion also have deleted the
virus, and by using a clean disk to reboot, well I assume you
scanned that also.  Its often a good idea to use more than one
AV program.  You can try Norton AV by going to:

  http://www.symantec   
OR F-Prot from DataFellows:  http://www.datafellows.com

  More info on Lenart if you don't already have it:

AntiCMOS

Aliases:            Lenart
Known Strains:      AntiCMOS.A and AntiCMOS.B
Infection Length:   512 bytes

Area of Infection: Floppy Boot Sectors and Master Boot Records
Likelihood:        Common
Region Reported:   Hong Kong
Keys:              Wild, Memory Resident

Technical Notes:

The AntiCMOS virus is a simple Master Boot Record (MBR), DOS Boot
Sector (DBS) infecting virus which will only spread to a system when there is an attempt to boot the system from an infected floppy disk.

Note that there is little difference between the .A and .B strains. Other than the triggered event, they are identical.

During the start of the boot process, the AntiCMOS virus first reduces the total amount of conventional memory by 2k (CHKDSK will report 653,312 on infected systems), loads itself into memory, redirects the BIOS Disk I/O Services Interrupt 13h and returns control to the system for further processing of the boot strap.

With the virus now active in memory, all disk reads of exactly one sector using the BIOS Disk I/O services are now filtered out. Upon request of such a service the virus first checks to see if the trigger requirements of the viruses payload have been met.

AntiCMOS.A
If the trigger conditions hold true then AntiCMOS.A will make
modifications to the systems CMOS data (a bug within the program's the trigger routine will more than likely never be executed). However, if the trigger condition is not met the MBR (when dealing with the hard drives) or the DBS (when dealing with floppy disks) is read into memory, infected, and then written back to the drive.

AntiCMOS.B
If the trigger conditions hold true then AntiCMOS.B will generate
sounds from the PC speaker (a bug within the program's the trigger routine will more than likely never be executed). However, if the trigger condition is not met the MBR (when dealing with the hard drives) or the DBS (when dealing with floppy disks) is read into memory, infected, and then written back to the drive.

 Hope this helps...


0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We recently endured a series of broadcast storms that caused our ISP to shut us down for brief periods of time. After going through a multitude of tests, we determined that the issue was related to Intel NIC drivers on some new HP desktop computers …
this article is a guided solution for most of the common server issues in server hardware tasks we are facing in our routine job works. the topics in the following article covered are, 1) dell hardware raidlevel (Perc) 2) adding HDD 3) how t…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question