McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Characteristics

Aragon is a memory resident, stealth, Master Boot Record (MBR)/Boot Sector infecting virus.

The first time the system is booted from an Aragon infected diskette, the Aragon virus becomes memory resident at the top of system memory but below the 640K DOS boundary. Interrupt 12's return is moved. Also at this time, the Aragon virus infects the hard disk's MBR. The original MBR is moved to side 0, cylinder 0, sector 9.

Once the Aragon virus is memory resident, it infects diskette boot sectors when an unwrite-protected diskette is accessed. In the case of 360K 5.25" diskettes, the original boot sector is moved to sector 11.

Additional Comments:
The Aragon virus was submitted in August, 1992. Its origin or point of isolation is unknown. Aragon is a memory resident stealth virus which infects the hard disk master boot sector (partition table) and the boot sectors on diskettes. It cannot be detected on the hard disk master boot sector when the virus is memory resident. The first time the system is booted from an Aragon infected diskette, the Aragon virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,024 bytes. Also at this time, the Aragon virus will infect the hard disk's master boot sector if it was not previously infected. The original master boot sector will have been moved to side 0, cylinder 0, sector 9. Once the Aragon virus is memory resident, it will infect diskette boot sectors when an unwrite-protected diskette is accessed for any reason. In the case of 360K 5.25" diskettes, the original boot sector will have been moved to sector 11. Aragon is a stealth virus. It will redirect any attempts to read the infected hard disk master boot sector so that the original, uninfected master boot sector stored by the virus will be shown instead. As such, no change in the master boot sector, or the viral infection itself, cannot be detected on the master boot sector when the virus is memory resident.

Symptoms

Aragon is a stealth virus. It will redirect any attempts to read the infected hard disk MBR so that the original, uninfected MBR stored by the virus is shown instead. As such, no change in the MBR, or the viral infection itself, cannot be detected on the MBR when the virus is memory resident.

Total system and available free memory decreases by 1,024 bytes.

Method of Infection

The only way to infect a computer with an MBR/Boot Sector infector is to attempt to boot from an infected floppy diskette. The boot sector of the diskette has the code to determine if the diskette is bootable, and to display the "Non-system disk or disk error" message. It is this code that harbors the infection. By the time the non-system disk error message comes up, the infection has occurred. Once the virus is executed, it will infect the hard drive's MBR and may become memory resident. With every subsequent boot, the virus will be loaded into memory and will attempt to infect floppy diskettes accessed by the machine.

Removal

Windows 95/98:
Note for Windows 9x systems - during the boot process a Windows95 created boot disk will access the hard drive for information. Because of this an image of the virus may be in memory but not active.

To remove the virus, follow the following steps:
- If you use the McAfee emergency disk, hit F8 at the starting Windows 95 message, and select Step-by-step Configuration. Say yes to everything except processing the autoexec.bat file.
- At the a:, type
BOOTSCAN C: /BOOT /CLEAN /NOMEM

Windows NT/2000:
Shut down the PC and turn the power off. Obtain or create a virus free boot disk and scan disk. After booting, at the A:\ prompt, execute the following command:
BOOTSCAN C: /boot /clean

Once the virus has been removed, remove all floppy diskettes from the computer and reboot from the hard drive.

This will also clean an NTFS Master Boot Record and allow Windows NT to successfully reboot from the hard disk drive. VirusScan for DOS will not be able to read the rest of the NTFS partition. After starting Windows, execute VirusScan or NetShield to detect and clean Windows NT file infections which may exist.

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Characteristics

Characteristics -

Aragon is a memory resident, stealth, Master Boot Record (MBR)/Boot Sector infecting virus.

The first time the system is booted from an Aragon infected diskette, the Aragon virus becomes memory resident at the top of system memory but below the 640K DOS boundary. Interrupt 12's return is moved. Also at this time, the Aragon virus infects the hard disk's MBR. The original MBR is moved to side 0, cylinder 0, sector 9.

Once the Aragon virus is memory resident, it infects diskette boot sectors when an unwrite-protected diskette is accessed. In the case of 360K 5.25" diskettes, the original boot sector is moved to sector 11.

Additional Comments:
The Aragon virus was submitted in August, 1992. Its origin or point of isolation is unknown. Aragon is a memory resident stealth virus which infects the hard disk master boot sector (partition table) and the boot sectors on diskettes. It cannot be detected on the hard disk master boot sector when the virus is memory resident. The first time the system is booted from an Aragon infected diskette, the Aragon virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,024 bytes. Also at this time, the Aragon virus will infect the hard disk's master boot sector if it was not previously infected. The original master boot sector will have been moved to side 0, cylinder 0, sector 9. Once the Aragon virus is memory resident, it will infect diskette boot sectors when an unwrite-protected diskette is accessed for any reason. In the case of 360K 5.25" diskettes, the original boot sector will have been moved to sector 11. Aragon is a stealth virus. It will redirect any attempts to read the infected hard disk master boot sector so that the original, uninfected master boot sector stored by the virus will be shown instead. As such, no change in the master boot sector, or the viral infection itself, cannot be detected on the master boot sector when the virus is memory resident.

Symptoms

Symptoms -

Aragon is a stealth virus. It will redirect any attempts to read the infected hard disk MBR so that the original, uninfected MBR stored by the virus is shown instead. As such, no change in the MBR, or the viral infection itself, cannot be detected on the MBR when the virus is memory resident.

Total system and available free memory decreases by 1,024 bytes.

Method of Infection

Method of Infection -

The only way to infect a computer with an MBR/Boot Sector infector is to attempt to boot from an infected floppy diskette. The boot sector of the diskette has the code to determine if the diskette is bootable, and to display the "Non-system disk or disk error" message. It is this code that harbors the infection. By the time the non-system disk error message comes up, the infection has occurred. Once the virus is executed, it will infect the hard drive's MBR and may become memory resident. With every subsequent boot, the virus will be loaded into memory and will attempt to infect floppy diskettes accessed by the machine.

Removal -

Removal -

Windows 95/98:
Note for Windows 9x systems - during the boot process a Windows95 created boot disk will access the hard drive for information. Because of this an image of the virus may be in memory but not active.

To remove the virus, follow the following steps:
- If you use the McAfee emergency disk, hit F8 at the starting Windows 95 message, and select Step-by-step Configuration. Say yes to everything except processing the autoexec.bat file.
- At the a:, type
BOOTSCAN C: /BOOT /CLEAN /NOMEM

Windows NT/2000:
Shut down the PC and turn the power off. Obtain or create a virus free boot disk and scan disk. After booting, at the A:\ prompt, execute the following command:
BOOTSCAN C: /boot /clean

Once the virus has been removed, remove all floppy diskettes from the computer and reboot from the hard drive.

This will also clean an NTFS Master Boot Record and allow Windows NT to successfully reboot from the hard disk drive. VirusScan for DOS will not be able to read the rest of the NTFS partition. After starting Windows, execute VirusScan or NetShield to detect and clean Windows NT file infections which may exist.

Variants

Variants -

N/A