Macro Virus Table - Defense Technical Information Center

MS-DOS/PC-DOS Computer Viruses
Name: Bob
Aliases: Bob Type: Program.
Disk Location: COM application.
COMMAND.COM.
Features:
Damage: Size: 718 See Also:
Notes: This virus activates in January 1993.
Name: Bob Ross
Aliases: Bob Ross, Beta Type: Program.
Disk Location: Features:
Damage: Size: Polymorphic: each
infection different
See Also: Screaming Fist
virus
Notes: Rumor: written by the group PHALCON/SKISM (like Screaming Fist virus)
Polymorphic because it changes one byte in the middle of the decryption routine
Name: Bones
Aliases: Bones, Stoned-T, NOP Type: Boot sector.
Disk Location: Floppy disk boot sector. Features: Trashes the hard disk.
Hard disk partition table.
On the 7th of any month it reatrranges the data
on the hard disk.
Damage: Trashes the hard Size: Overlays boot sector, no See Also:
disk.
increase
On the 7th of any month it
reatrranges the data on the
hard disk.
Reduces RAM by 1K.
Notes: The virus is detected as Bones, Stoned-T, or NOP by different anti-virus products.
********VirHUNT 4.0E does not detect it***********
VirALERT does detect and stop the attempted infection, but VirHUNT 4.0E can not detect or
identify it.
F-PROT 2.16 calls it Bones
Norman calls it Bones
Vi-Spy 12 calls it Stoned-T
SCAN 2.14e calls it NOP
The virus uses stealth techniques, so most packages will not be able to detect it with the virus in
memory. Most packages did discover the virus string in memory though they could not see the
virus on disk.
The virus is very destructive. On the 7th of any month, it will rearrange the data on your hard
drive the first time you access an uninfected floppy. You can not recover from the destruction. All
data on the hard drive is lost.
Before it triggers, the virus can be removed by booting from a locked floppy and executing
FDISK /MBR to write a new master boot record.
May 21, 1998 CIAC Computer Virus Information Update 123
PC