AntiCMOS

AntiCMOS is an MBR/Boot Sector infector. When a user attempts to boot from an AntiCMOS infected diskette (the boot does not need to be successful), the virus will infect the system's hard disk MBR, however it does not become memory resident at this time. AntiCMOS becomes memory resident the next time the system is booted from the newly infected hard drive.

Additional Comments:
The AntiCMOS virus was received in April, 1995, though it has been reported from sites in North America for several months. AntiCMOS is a memory resident infector of diskette boot sectors as well as the system hard disk master boot sector. When the system is first booted from an AntiCMOS infected diskette, this virus will infect the system hard disk master boot sector. It does not become memory resident at this time. AntiCMOS becomes memory resident when the system is booted from the system hard disk. When the AntiCMOS virus is memory resident, total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,048 bytes. Once the AntiCMOS virus is memory resident, it will infect un-write protected diskettes by infecting the diskette boot sector when they are accessed, though it does not always infect the diskette. The AntiCMOS virus contains code to erase the CMOS or system setup information.

The only way to infect a computer with an MBR/Boot Sector infector is to attempt to boot from an infected floppy diskette. The boot sector of the diskette has the code to determine if the diskette is bootable, and to display the "Non-system disk or disk error" message. It is this code that harbors the infection. By the time the non-system disk error message comes up, the infection has occurred. Once the virus is executed, it will infect the hard drive's MBR and may become memory resident. With every subsequent boot, the virus will be loaded into memory and will attempt to infect floppy diskettes accessed by the machine.

Windows 95/98:
Note for Windows 9x systems - during the boot process a Windows95 created boot disk will access the hard drive for information. Because of this an image of the virus may be in memory but not active.

To remove the virus, follow the following steps:
- If you use the McAfee emergency disk, hit F8 at the starting Windows 95 message, and select Step-by-step Configuration. Say yes to everything except processing the autoexec.bat file.
- At the a:, type
BOOTSCAN C: /BOOT /CLEAN /NOMEM

Windows NT/2000:
Shut down the PC and turn the power off. Obtain or create a virus free boot disk and scan disk. After booting, at the A:\ prompt, execute the following command:
BOOTSCAN C: /boot /clean

Once the virus has been removed, remove all floppy diskettes from the computer and reboot from the hard drive.

This will also clean an NTFS Master Boot Record and allow Windows NT to successfully reboot from the hard disk drive. VirusScan for DOS will not be able to read the rest of the NTFS partition. After starting Windows, execute VirusScan or NetShield to detect and clean Windows NT file infections which may exist.

ANTICMOS C
AntiCMOS.B
AntiCMOS.A