Polyboot.B

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Polyboot.B
Threat Level Damage Distribution

Effects

Polyboot.B does not infect files and it has not any destructive effects in the computer. Polyboot.B has the following effects:

It infects the boot sector of floppy disks (Boot) and hard disks (Master Boot Record).
It infects all floppy disks used on the affected computer, provided that they are not write-protected.
It prevents the computer from starting up correctly.

Polyboot.B infects the boot sector of hard disks and floppy disks. It has the following routine:

It copies the original boot sector in the final sectors of the first track.
It copies the virus code to the first sectors of the disk.
By doing this, it goes memory resident. From then on, it can infect all floppy disks used on the computer.

Polyboot.B only spreads through floppy disks, in the following way:

It infects the hard disk of the computer, when it is booted from a floppy disk infected by the virus.
It infects all floppy disks used in the affected computer. These floppy disks will then infect other computers.

Other interesting characteristics of Polyboot.B are:

Part of its virus code is encrypted through a simple function with a one byte mask.
It uses stealth techniques in order to avoid being discovered. When it goes memory resident, it reduces the amount of conventional memory that can be seen from MS-DOS by two kilobytes. At the same time, it copies its virus code in the top of the conventional memory and it goes memory resident.
The code of Polyboot.B contains the following text: 31/03/98 WYX.