The Devil virus is a reasonably simple diskette and Master Boot Record infector. It is only able to infect a hard disk when you try to boot the machine from an infected diskette. At this time Devil infects the Main Boot Record, and after that it will go resident to high DOS memory during every boot-up from the hard disk.
Devil can be disinfected from hard drives by booting clean and giving command "FDISK /MBR". Floppies can be disinfected with the FIXBOOT program provided with F-Secure anti-virus products.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Once Devil gets resident to memory, it will infect practicly all non-writeprotected diskettes used in the machine. Devil-virus is also a stealth virus - if you try to examine an infected boot record, it will show you the original clean one instead.
This virus has one nasty side effect; all floppy diskettes that are infected cannot be read by DOS unless the virus is active in memory. This is due to the fact that the virus overwrites part of the floppy disks Boot Parameter Block (BPB) with the text "(c) Devil". As DOS needs the information stored in the BPB to determine the diskette type DOS cannot read the diskette anymore. When the virus is active in memory all diskette boot sector read requests are intercepted by the virus. The virus then modifies the read request parameters so that the real boot sector (or MBR) is read instead of the infected one.
The original MBR is stored in a static position at cylinder 0, sector 4, head 0. Original FBR is stored at the last sector of root directory.
The virus deems an FBR or MBR to be infected if the word at offset 0C2h is equal to 7C00h.
The virus has two static text strings: "(c) Devil" and "v3.0".