------------------------    
     Amiga Virus Encyclopedia    
     Sao Paulo Virus 
     ------------------------


     Name         : Sao Paulo

     Aliases      : No Aliases

     Type         : Bootblock
     
     Size         : 1024 bytes

     Symptoms     : No Symptoms

     Discovered   : ?

     Way to infect: Boot infection

     Rating       : Harmless

     Kickstarts   : 1.2 
                    1.3
                    2.0

     Damage       : Overwrites boot

     Removal      : Kickstart 1.2 & 1.3 : VT-Schutz v3.17
                    Kickstart all others: VirusZ III v1.04ß or higher, and also Xvs.library v33.47 or higher
     
     Visible text : SAO PAULO!     

     Comments     : The  SAO  PAULO  virus  is  located  in block 1 of the
                    Bootblock.  The first block just contains the modified
                    normal  DOS 1.3 Bootblock. This should proably confuse
                    the users. 

                    First  the  virus  copies itself to $7FC00 and patches
                    the   CoolCapture  and  the  DoIO()  Vector  from  the
                    exec.library. 

                    The  virus  checks  for  block  880  (this is only the
                    rootblock of DD-DISKS). So it`s very unlikely that the
                    virus infects HD-Disks.

     Test made by : Safe Hex International
     
     
     Ascii of Sao Paulo virus: