Form (computer virus)

<h2 id="infection">Infection</h2>
<p>Form infects the <a href="/facts/Boot_sector/YubeSECp">boot sector</a>. When a computer is booted from an infected sector, Form goes resident, hooks the <a href="/facts/Interrupt_vector_table/wq6sxJTo">interrupt vector table</a>, and runs the original boot sector which it has hidden in an area it flags as defective.  It will subsequently infect any media inserted into the machine.
</p>
<h2 id="symptoms">Symptoms</h2>
<p>Form has a range of symptoms, most of which will not be evident in all infections:
</p>
<ul><li>Form's most famous side effect is a clicking noise produced by typing on the keyboard on the 18th of every month. However, this payload very rarely appears on modern computers, as it will not execute if a keyboard <a href="/facts/Device_driver/rDYnHU1G">driver</a> is installed.</li>
<li>Form consumes 2KB of memory, and the DOS MEM command will report that this memory is unavailable. This appears on all infections.</li>
<li>On floppy disks, 1 KB (2 bad sectors) will be reported. This appears in all infections.</li>
<li>The Form data sector contains the text "The FORM-Virus sends greetings to everyone who's reading this text. FORM doesn't destroy data! Don't panic! Fuckings go to Corinne." Additionally, some versions of Form have had this text removed.</li>
<li>Form makes the assumption that the active partition is a <a href="/facts/DOS/6nkoK02J">DOS</a> <a href="/facts/File_Allocation_Table/uFvpmWxa">FAT</a> partition. If this is not true, such as under <a href="/facts/Windows_NT/EtccWvxQ">Windows NT</a>, Form will overwrite in a way that may result in irreversible data loss.</li></ul>
<h2 id="prevalence">Prevalence</h2>
<p>Form was listed as spreading by the WildList from the first ever version of the WildList in July 1993 until January 2006.<a class="footnote-ref" id="fnref:1" href="#fn:1"><sup>1</sup></a>
</p><p>As with most boot viruses, a Form infection is a rare find in modern times. Since the advent of <a href="/facts/Microsoft_Windows/bwhAhuSL">Windows</a>, boot viruses have become increasingly uncommon, including Form. Generally, Form infections are due to the use of <a href="/facts/Floppy_disk/rShxfuxa">floppy disks</a> infected during the original pandemic that have since been taken out of storage.
</p>
<h2 id="variants">Variants</h2>
<p>Form has a number of variants. The widely documented versions are as follows.
</p>
<ul><li>Form.A is a common variant of the original, where the clicking payload occurs every day, as opposed to just the 18th.</li>
<li>Form.B is a minor variant of the original, with the clicking payload set for the 24th of each month instead of the 18th.  It was a rare find in the field during the mid-1990s, but has since become extinct in the wild.</li>
<li>Form.C is a virtually undocumented, trivial variant of the original.  It is suggested that Form.C is another minor variant of Form, which only activates in May.  Like Form.B, it was documented as being discovered rarely in the wild during the mid-1990s.</li>
<li>Form.D  is the most common version of Form besides the original.  Some reports indicate that it affects the <a href="/facts/Partition_table/wrBk5RRS">partition table</a> in some way.  It was a somewhat common virus in 1997 and 1998.</li>
<li>FormII is an undocumented variant.</li>
<li>Form-Canada is an undocumented variant.</li></ul>
<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Stoned_(computer_virus)/aIcSQEEv">Stoned (computer virus)</a></li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="http://www.f-secure.com/v-descs/form.shtml">F-Secure</a></li>
<li><a href="https://web.archive.org/web/20060826053203/http://www.ciac.org/ciac/virdb/VIRS0429.TXT">CIAC</a>[<i>usurped</i>]</li>
<li><a href="https://www.sophos.com/virusinfo/analyses/form.html">Sophos</a></li>
<li><a href="http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=473">McAfee</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>"WildList January 2006". Archived from the original on 2022-03-08. Retrieved 2010-08-26. <a href="https://web.archive.org/web/20220308140916/http://www.wildlist.org/WildList/200601.htm" target="_blank">https://web.archive.org/web/20220308140916/http://www.wildlist.org/WildList/200601.htm</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
</ol>

Form (computer virus) open-in-new

Form (computer virus)