The Devil virus is a reasonably simple diskette and Master Boot Record
infector. It is only able to infect a hard disk when you try to boot
the machine from an infected diskette. At this time Devil infects
the Main Boot Record, and after that it will go resident to high
DOS memory during every boot-up from the hard disk.
Once Devil gets resident to memory, it will infect practicly all
non-writeprotected diskettes used in the machine. Devil-virus is also a
stealth virus - if you try to examine an infected boot record, it will
show you the original clean one instead.
This virus has one nasty side effect; all floppy diskettes that are
infected cannot be read by DOS unless the virus is active in memory.
This is due to the fact that the virus overwrites part of the floppy
disks Boot Parameter Block (BPB) with the text "(c) Devil". As DOS needs
the information stored in the BPB to determine the diskette type DOS
cannot read the diskette anymore. When the virus is active in memory all
diskette boot sector read requests are intercepted by the virus. The
virus then modifies the read request parameters so that the real boot
sector (or MBR) is read instead of the infected one.
The original MBR is stored in a static position at cylinder 0, sector 4,
head 0. Original FBR is stored at the last sector of root directory.
The virus deems an FBR or MBR to be infected if the word at offset 0C2h
is equal to 7C00h.
The virus has two static text strings: "(c) Devil" and "v3.0".
Devil can be disinfected from hard drives by booting clean and
giving command "FDISK /MBR". Floppies can be disinfected with
the FIXBOOT program provided with F-Secure anti-virus products.
[Analysis: Jeremy Gumbley, Command Software Systems UK]
