Form (computer virus)
Encyclopedia
Form was a boot sector virus isolated in Switzerland
in the summer of 1990 which became very common worldwide. The origin of Form is widely listed as Switzerland, but this may be an assumption based on its isolation locale. The only notable characteristics of Form are that it infects the boot sector
instead of the Master Boot Record
(MBR) and the clicking noises associated with some infections. Infections under Form can result in severe data damage if operating system characteristics are not identical to those Form assumes.
It is notable for arguably being the most common virus in the world for a period during the early 1990s.
. When a computer is booted from an infected sector, Form goes resident, hooks the interrupt vector table, and runs the original boot sector which it's hidden in an area it flags as defective. It will subsequently infect any media inserted into the machine.
As with most boot viruses, a Form infection is a rare find in modern times. Since the advent of Windows
, boot viruses have become increasingly uncommon, including Form. Generally, Form infections are due to the use of floppy disk
s infected during the original pandemic that have since been taken out of storage.
Switzerland
Switzerland name of one of the Swiss cantons. ; ; ; or ), in its full name the Swiss Confederation , is a federal republic consisting of 26 cantons, with Bern as the seat of the federal authorities. The country is situated in Western Europe,Or Central Europe depending on the definition....
in the summer of 1990 which became very common worldwide. The origin of Form is widely listed as Switzerland, but this may be an assumption based on its isolation locale. The only notable characteristics of Form are that it infects the boot sector
Boot sector
A boot sector or boot block is a region of a hard disk, floppy disk, optical disc, or other data storage device that contains machine code to be loaded into random-access memory by a computer system's built-in firmware...
instead of the Master Boot Record
Master boot record
A master boot record is a type of boot sector popularized by the IBM Personal Computer. It consists of a sequence of 512 bytes located at the first sector of a data storage device such as a hard disk...
(MBR) and the clicking noises associated with some infections. Infections under Form can result in severe data damage if operating system characteristics are not identical to those Form assumes.
It is notable for arguably being the most common virus in the world for a period during the early 1990s.
Infection
Form infects the boot sectorBoot sector
A boot sector or boot block is a region of a hard disk, floppy disk, optical disc, or other data storage device that contains machine code to be loaded into random-access memory by a computer system's built-in firmware...
. When a computer is booted from an infected sector, Form goes resident, hooks the interrupt vector table, and runs the original boot sector which it's hidden in an area it flags as defective. It will subsequently infect any media inserted into the machine.
Symptoms
Form has a range of symptoms, most of which will not be evident in all infections.- Form's most famous side effect is a clicking noise produced by typing on the keyboard on the 18th of every month. However, this payload very rarely appears on modern computers, as it will not execute if a keyboard driverDevice driverIn computing, a device driver or software driver is a computer program allowing higher-level computer programs to interact with a hardware device....
is installed. - Form consumes 2KB of memory, and the DOS MEM command will report that this memory is unavailable. This appears on all infections.
- On floppy disks, 1 KB (2 bad sectors) will be reported. This appears in all infections.
- The Form data sector contains the text "The FORM-Virus sends greetings to everyone who's reading this text. FORM doesn't destroy data! Don't panic! Fuckings go to Corinne." Additionally, some versions of Form have had this text removed.
- Form makes the assumption that the active partition is a DOSDOSDOS, short for "Disk Operating System", is an acronym for several closely related operating systems that dominated the IBM PC compatible market between 1981 and 1995, or until about 2000 if one includes the partially DOS-based Microsoft Windows versions 95, 98, and Millennium Edition.Related...
FATFile Allocation TableFile Allocation Table is a computer file system architecture now widely used on many computer systems and most memory cards, such as those used with digital cameras. FAT file systems are commonly found on floppy disks, flash memory cards, digital cameras, and many other portable devices because of...
partition. If this is not true, such as under Windows NTWindows NTWindows NT is a family of operating systems produced by Microsoft, the first version of which was released in July 1993. It was a powerful high-level-language-based, processor-independent, multiprocessing, multiuser operating system with features comparable to Unix. It was intended to complement...
, Form will overwrite in a way that may result in irreversible data loss.
Prevalence
Form was listed as spreading by the WildList from the first ever version of the WildList in July 1993 until January 2006.As with most boot viruses, a Form infection is a rare find in modern times. Since the advent of Windows
Microsoft Windows
Microsoft Windows is a series of operating systems produced by Microsoft.Microsoft introduced an operating environment named Windows on November 20, 1985 as an add-on to MS-DOS in response to the growing interest in graphical user interfaces . Microsoft Windows came to dominate the world's personal...
, boot viruses have become increasingly uncommon, including Form. Generally, Form infections are due to the use of floppy disk
Floppy disk
A floppy disk is a disk storage medium composed of a disk of thin and flexible magnetic storage medium, sealed in a rectangular plastic carrier lined with fabric that removes dust particles...
s infected during the original pandemic that have since been taken out of storage.
Variants
Form has a number of variants. The widely documented versions are as follows.- Form.A is a common variant of the original, where the clicking payload occurs every day, as opposed to just the 18th.
- Form.B is a minor variant of the original, with the clicking payload set for the 18th of each month instead of the 24th. It was a rare find in the field during the mid1990s, but has since become obsolete.
- Form.C is a virtually undocumented, trivial variant of the original. It is suggested that Form.C is another minor variant of Form, except only activates in May. Like Form.B, it was documented as being discovered rarely in the wild during the mid-1990s.
- Form.D is the most common version of Form besides the original. Some reports indicate that it affects the partition tablePartition tableThe term partition table is most commonly associated with partition table but it may be used generically to refer to other "formats" that divide a disk drive into partitions, such as: GUID Partition Table, Apple partition map, or BSD disklabel.An alternative term to generically refer to partition...
in some way. It was a somewhat common virus in 1997 and 1998. - FormII is an undocumented variant.
- Form-Canada is an undocumented variant.