%%File: VIRS0659.TXT
%%Name/Aliases: Quox, Stealth 2 Boot
%%Platform: PC/MS-DOS
%%Type: Boot sector., 
%%Disk Location: Floppy disk boot sector., Hard disk partition table.
%%Features: Stealth
%%Damage: Corrupts floppy disk boot sector, Overwrites sectors on the 
Hard Disk., No damage, only replicates.
%%Size: Overlays boot sector, no increase,  Installs itself in the top 
1K of the base memory
%%See Also: 
%%Notes: 1. When a system is booted from an infected disk the virus 
installs itself on the Master Boot Sector. Also, when a  clean floppy 
disk is inserted  into an infected machine, any attempt to access the 
boot sector  results in infecting the disk.
2. Its known function is only replication ( No deliberate damage or side 
effect).
3. The occupies a single disk sector  of 512 bytes which replaces the 
Master Boot Sector of the hard disk or the DOS Boot Sector on a floppy 
disk.
4. The virus take advantage of the DOS FDISK program that partitions the 
disk. It locates the Boot Sector and installs itself. Any version of DOS 
that does not comply with the conventions are safe from infection, 
because the infection routine  fails to locate the Boot Sector and its 
aborted.
5. When an infected 1.4 MByte 3.5-inch disks is accessed by an clean 
system. The disk becomes unreadable under DOS and the message " General 
failure error ' is given. This failure is caused by  MS-DOS operating 
system, not the virus.
6. Disinfecting a  fixed disk must be done by booting from write-
protected system diskette. Using the DOS command FDISK/MBR or disk 
editor to restore the Boot Sector  saved by the virus. Floppy disks are 
sanitized by reformatting the disk or  by  copying  the boot sector from 
a clean disk  of the exact same type. For unreadable disk, data are 
recovered by copying  the boot sector of a clean to the infected disk.