Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


DA'BOYS




Malware

W32

Summary

Unlike most other boot sector infectors, the DA'BOYS virus overwrites the DOS boot sector. It does not make a copy or move the boot sector to another sector. It will infect disks in drive A: or B: It works with 360kB, 720kB, 1.2MB, 1.44MB or 2.88MB disks.

When a disk is booted with the DA'BOYS virus, it will load itself into lower DOS memory. CHKDSK will not show a decrease in available memory. Then the virus will infect the DOS boot sector of the hard disk and overwrites the "Non-System ... " text string with it's own code.

The text string "DA'BOYS" appears in the virus code but is not displayed. If the Goldbug virus is also present in the system, it hides the presence of the DA'BOYS virus from the Windows 3.1 startup routine.



Disinfection & Removal

DA'BOYS can be removed from diskettes and hard disks with the DOS SYS command.









Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.