INFECT.MBR-B
ALIASES:
Grub
PLATFORM:
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
INFORMATION EXPOSURE:
Threat Type: Others
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This memory resident Boot virus copies itself to memory (high memory) once it is executed, or when a system is booted using an infected disk.
TECHNICAL DETAILS
NOTES:
This Boot virus hooks Interrupt 13H, which is used by DOS for drive access routines. Services 2 and 3, used for Reading and Writing disk sectors, respectively. Thus the virus infects the boot sector of a disk that is being accessed, if the disk is a bootable disk. Once the boot sector is infected all disks that are accessed from the boot will also be infected.