Category: Malware

Type: Virus

Aliases: Devil


The Devil virus is a reasonably simple diskette and Master Boot Record infector. It is only able to infect a hard disk when you try to boot the machine from an infected diskette. At this time Devil infects the Main Boot Record, and after that it will go resident to high DOS memory during every boot-up from the hard disk.


Devil can be disinfected from hard drives by booting clean and giving command "FDISK /MBR". Floppies can be disinfected with the FIXBOOT program provided with F-Secure anti-virus products.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Once Devil gets resident to memory, it will infect practicly all non-writeprotected diskettes used in the machine. Devil-virus is also a stealth virus - if you try to examine an infected boot record, it will show you the original clean one instead.

This virus has one nasty side effect; all floppy diskettes that are infected cannot be read by DOS unless the virus is active in memory. This is due to the fact that the virus overwrites part of the floppy disks Boot Parameter Block (BPB) with the text "(c) Devil". As DOS needs the information stored in the BPB to determine the diskette type DOS cannot read the diskette anymore. When the virus is active in memory all diskette boot sector read requests are intercepted by the virus. The virus then modifies the read request parameters so that the real boot sector (or MBR) is read instead of the infected one.

The original MBR is stored in a static position at cylinder 0, sector 4, head 0. Original FBR is stored at the last sector of root directory.

The virus deems an FBR or MBR to be infected if the word at offset 0C2h is equal to 7C00h.

The virus has two static text strings: "(c) Devil" and "v3.0".