Stealth_C

Virus Characteristics
Stealth_C is a memory resident, stealth virus which infects the system's 
Master Boot Record (MBR) and diskette Boot Sectors. 
Upon infection, Stealth_C will become memory resident at the top of system
memory but below the 640K DOS boundary. Stealth_C will also infect the
Master Boot Record at this time. 

Once the Stealth_C virus is memory resident, it will infect diskette
boot sectors when non-write protected diskettes are accessed. Upon 
infection, Stealth_C will move the original boot sector to the last sector
on the diskette. 
This virus is a full stealth virus, hiding the infection on the system'
hard disk and diskette boot sectors when the virus is memory resident. 
Therefore, it is important to be sure that the virus is not memory resident
before attempting to scan a possibly infected system or diskette(s). 

   Indications of Infection

Systems infected with Stealth_C may experience difficulty loading some
drivers and memory management software into memory, resulting in
operational difficulties with programs which access upper memory blocks,
such as Windows. It may also cause 32-bit disk or file access to be disabled. 

Stealth_C causes the total system and available free memory, to decrease by
4,096 bytes. 

   Method of Infection

The only way to infect a computer with an MBR/Boot Sector infector is to
attempt to boot from an infected floppy diskette. The boot sector of the
diskette has the code to determine if the diskette is bootable, and to 
display the "Non-system disk or disk error" message. It is this code that
harbors the infection. By the time the non-system disk error message comes
up, the infection has occurred.

Once the virus is executed, it will infect the hard drive's MBR and may
become memory resident. With every subsequent boot, the virus will be
loaded into memory and will attempt to infect floppy diskettes accessed
by the machine. 

   Removal

How To Clean Your System With VirusScan
Removal of Stealth_C

Additional Information

Hot Virus: Stealth_C
Top Master Boot Record/Boot Sector Infecting Viruses 

                   Prevention

Scan diskettes before using them to minimize the risk of infection. 

                   Virus Information


                   Discovery Date
                                       January, 1995
                       Origin
                                       United States
                       Length
                                       512 Bytes
                       Type
                                       Master Boot Record Infector
                                       Memory Resident
                                       Stealth
                       Prevalence
                                       Common

                    
                  Variants

                                                 Aliases

                  StealthBoot 
                  Stealth_Boot.A 
                  Stealth_Boot.B
                  Stealth_Boot.D 
                  Stealth_Boot.E
                  Stealth_Boot.F 
                  Stealth_Boot.G
                                                 Amse
                                                 Nops.B
                                                 Stelboo
                                                 PMBS

                       
 McAfee Associates
 2710 Walsh Avenue
 Santa Clara, CA
 95051-0963
 USA
 Phone: (408) 988-3832
 Fax: (408) 970-9727 
 
McAfee is a registered trademark of McAfee Associates, Inc. Other product
names and various content (including but not limited to audio, video, and
graphics) are trademarks of their respective owners.(c) McAfee. All rights
reserved, 1997.