%%File: VIRS0576.TXT
%%Name/Aliases: Neuroquila, Neuro.Havoc, Havoc, Wedding, Stealth Boot.E
%%Platform: PC/MS-DOS
%%Type: Multipartite., 
%%Disk Location: Floppy disk boot sector., EXE application., Hard disk 
partition table.
%%Features: Stealth, Memory resident; TSR above TOM., Polymorphic, 
Encrypted
%%Damage: Corrupts hard disk partition table
%%Size: 4644-4675        
%%See Also: Tremor
%%Notes: The Neuroquila  virus infects EXE files, MBRs on harddisks and 
boot  sectors on floppies. The original MBR is encrypted.
The infected MBR does not contain a valid partition table, so removal of 
the virus from memory makes the hard drive unmountable. On Floppy disks, 
the virus formats an extra track to store the virus code.
 
The virus attempts to load into the UMB. If no space is available, it 
loads into the STACKS area.
 
The stealth capability hides all changes to the disk or filew while the 
virus is in memory.   

Neuroquila is  a retrovirus, and attacks  VIRSTOP.EXE,  DOSDATA.SYS, 
TBDRIVER, TBDISK, VSAFE,  and TBUTIL   
                                                                          
After several months, the virus displays  the following text:                                       
                                                                          
 <HAVOC> by Neurobasher'93/Germany -GRIPPED-BY-FEAR-UNTIL-DEATH-US-DO-
PART