AntiEXE
Summary
AntiEXE is a virus that infects the master boot record (MBR) and DOS boot sectors (DBS). AntiEXE spreads only when there is an attempt to boot the system from an infected floppy disk. It is also known as: CMOS4, D3 and NewBugNew Bug.
Technical Details
During the boot process, AntiEXE loads the MBR into memory and checks for infection. If it determines that the MBR is not infected, then AntiEXE stores the uninfected MBR at cylinder 0, side 0, sector 13 on the hard disk. AntiEXE then places its virus code into the MBR and writes the infected MBR back to the hard disk at cylinder 0, side 0, sector 1.
After the boot process is complete and AntiEXE is active in memory, then AntiEXE displays its stealthing capabilities by redirecting any disk reads of the infected MBR or DBS to their clean counterparts. (On floppy disks, the original DBS is stored in the last sector of the root directory.) Along with stealthing the reads of the MBR or DBS during all disk-read operations, AntiEXE searches for a specific .exe file, whose identity remains unknown, and corrupts the file if it is found.
