Name         : Pardox 2

     Aliases      : No Aliases

     Type/Size    : Boot/1024

     Clones       : No Clones 

     Symptoms     : No Symptoms

     Discovered   : 08-04-91

     Way to infect: Boot infection

     Rating       : Harmless

     Kickstarts   : 1.2/1.3/2.0

     Damage       : Overwrites boot.

     Removal      : Install boot.

     Comments     : The Paradox 2 virus is a very harmless one. If you
                    are booting with an infected disk the virus copies
                    itself to address $7F000 and changes the KICK-
                    Vectors to stay resident in memory. After the next
                    reset the virus patches the DoIO()-Vector to infect
                    other disks. After the 1st infection the virus
                    additionally patches the ZERO-Page ($6C). This patch
                    increases a value by 2. If this value reaches 120000
                    the virus executes an endless-routine by showing
                    a white screen. The whole bootlock is crypted with
                    the $DFF006-Register.
                    In the bootblock (decrypted) you can read:

     "This is the second VIRUS by PARADOX - For swapping call: 42-455416"
                           "ask for Henrik Hansen"



     SHI - A.D 08-94

[Go back]