Some Common PC-DOS Viruses and What They Mean To You

1.8 The Disk Killer Virus

Also known as the Ogre, the Disk Killer virus is a boot-sector infector that can be very destructive. Like the Bouncing Ball virus, the Disk Killer infects diskette boot sectors and DOS boot sectors on hard disks. When a machine is booted from an infected diskette or hard disk, the virus loads itself into memory, and infects any diskette or hard disk that is later read from (until the next reboot or power off). If an infected machine is left on for about 48 hours without a reboot, the next read to a disk or diskette will cause a message to be displayed, and all data on the boot disk (or diskette) will be scrambled. (There may be variants of the virus in which the details of the activation conditions are different.)

1.8.1 Spread

The spread characteristics of the Disk Killer are very similar to those of the Stoned and the Bouncing Ball.

1.8.2 Symptoms

Due to a bug in the virus, diskettes will sometimes be improperly infected, and either fail to boot or contain damaged files. Attempts to format a diskette in an infected machine will also sometimes fail. Infected disks and diskettes will also show a number of bad sectors and reduced total memory, if a utility like CHKDSK is used. All these symptoms may be overlooked, however, if they do occur, and anti-virus software is the most reliable test.

1.8.3 Damage

When the virus activates, it displays a message like:

  Disk Killer -- Version 1.00 by COMPUTER OGRE 04/01/1989
 
  Warning!   Don't turn off the power or remove the diskette
  while Disk Killer is processing!
 
  PROCESSING
 
  Now you can turn off the power.   I wish you luck.

and then scrambles all data on the disk or diskette that was last booted from. If the computer is powered down immediately after the first part of the message appears, the data-scrambling will not occur. On the other hand, if the scrambling is allowed to run to completion, it may be possible to recover the data with a program specifically designed to unscramble Disk-Killer-damaged disks. The best solution, however, is to detect the virus before it has a chance to activate!

1.8.4 Protection

The Disk Killer is reasonably well-understood and simple to detect, and any good anti-virus program will catch it. Perhaps because it is so destructive, it seems not to be as widespread in the world as it once was.

[ Top of Page | Previous Page | Next Page | Table of Contents ]

back to index