Threat Description

DA'BOYS

Details

Category: Malware
Type:
Platform: W32

Summary



Unlike most other boot sector infectors, the DA'BOYS virus overwrites the DOS boot sector. It does not make a copy or move the boot sector to another sector. It will infect disks in drive A: or B: It works with 360kB, 720kB, 1.2MB, 1.44MB or 2.88MB disks.

When a disk is booted with the DA'BOYS virus, it will load itself into lower DOS memory. CHKDSK will not show a decrease in available memory. Then the virus will infect the DOS boot sector of the hard disk and overwrites the "Non-System ... " text string with it's own code.

The text string "DA'BOYS" appears in the virus code but is not displayed. If the Goldbug virus is also present in the system, it hides the presence of the DA'BOYS virus from the Windows 3.1 startup routine.



Removal



DA'BOYS can be removed from diskettes and hard disks with the DOS SYS command.



SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More