-----------------------------------------------------------------------------
 WildList Notes - (c)1995 Joe Wells - c1jwells@watson.ibm - wildlist@aol.com
-----------------------------------------------------------------------------

Virus Name:  Parity Boot.B

Aliases:     Parity

Infects:     MBR on first hard drive. DOS boot sector on floppy disks.

Disk Size:   1 sector.

Location:    MBR or boot sector. Original MBR is stored at cylinder 0, 
             sector 9, head 0. On floppy disks, the original boot sector 
             is stored in the last sector of the root directory.

Memory Size: The virus reserves 1k of memory by decrementing the available
             memory word at 40:13. On a 640k system the value will be 
             changed from 280h to 27Fh. Chkdsk will report 654336 bytes 
             (639k) of memory free.

Location:    In 1k reserved at top of conventional memory.

Special:     The virus is full stealth. Intercepts [CTRL] [ALT] [DEL].

Effects:     Prints message and hangs system.

Trigger:     One hour delay timer.

Messages:    "PARITY CHECK" displayed as triggered event. The message is
             encrypted by xoring with 55h and is thus not visible in an 
             infected boot or MBR sector.

Bugs:        [none]

Origin:      Possibly, Germany.

Notes:       Upon startup, the virus sets a one-hour delay timer. If, 
             during that hour, a floppy disk is infected, the virus 
             restarts the timer. If no floppies are infected, the virus 
             prints the message above and hangs the system. So each time 
             a floppy is infected the user gets another hour "reprieve".
    

