Parity_Boot (A) Virus

Strain:Parity_Boot Virus Strain
detected when:April 1992
Classification:System (bootsector/partition table (MBR)) virus, stealth
Length:Length on medium: 512 Bytes (=1 sector)


Operating System(s):MS-DOS
Computer model(s):IBM PC and compatibles


Easy identification:Memory decreased by 1 kBytes after infection; no plain text in bootsector or MBR, like "Non system disk..." or "Bad partition....".

Type of Infection:

Boot sectors and partition table of media.

Infection Technique:
Infection Trigger:Booting from an infected disk will infect the hard disk; from this time, all read accesses to the boot sector of any physical drive will infect the medium in this drive.
Storage Media affected:
Interrupts hooked:INT 09, INT 13.
Encoding Method:
Damage:Transient/Permanent damage: Some built-in mechanism simulates a parity error message on the screen after 1 hour of opera- tion plus an additional hour for each infec- tion: the more infections, the longer till the parity check display. The parity error simulation switches to 40 x 25 mode, displays 'PARITY CHECK' and then halts the processor. Virus constantly garbles the INT01&INT03 entries, so that debug will not work; this is not tied to a trigger.
Damage Trigger:The internal timer tick (not the CMOS clock) is used for timing. Trigger= 1+n hours after boot up (n=number of infections since booting).
Particularities:1) Message text "PARITY CHECK" is constantly encrypted with key 55h. 2) In summer 1993, virus (variant B) is "in the wild" in Germany.
Similarities:Parity_Boot Virus Strain: variants B,C


Countermeasures:Up-to-date antiviral products, e.g. McAfee Scan, Skulason F-PROT, Dr.Solomon FindViru. Remark: invoking Scan or F-PROT after another scanner having detected and deleted this virus may result in a "false positive" diagnosis as both scanners scan also DOS buffers (where virus would NOT reside) which may not be cleared by the AV product used before. Removal: SYS on floppies; FDISK /MBR (DOS 5.0)
Standard means:


Location:Micro-BIT Virus Center, Univ Karlsruhe, Germany
Classification by:Christoph Fischer (Klaus Brunnstein, VTC)
Documentation by:Christoph Fischer Klaus Brunnstein (VTC, update)
Date:April-1992 (original entry: P-Check) 31-July-1993 (update)
Information Source:reverse analysis of virus code

(c) 1996 Virus-Test-Center, University of Hamburg