Form (computer virus)
Form was a boot sector virus isolated in Switzerland in the summer of 1990 which became very common worldwide. The origin of Form is widely listed as Switzerland, but this may be an assumption based on its isolation locale. The only notable characteristics of Form are that it infects the boot sector instead of the Master Boot Record (MBR) and the clicking noises associated with some infections. Infections under Form can result in severe data damage if operating system characteristics are not identical to those Form assumes.
| Common name | Form |
|---|---|
| Technical name | Form |
| Aliases | Form18, Forms |
| Family | N/A |
| Classification | Virus |
| Type | DOS |
| Subtype | Boot sector virus |
| Isolation | June 1990 |
| Point of isolation | Switzerland |
| Point of origin | Switzerland (?) |
| Author(s) | Unknown |
It is notable for arguably being the most common virus in the world for a period during the early 1990s.
Infection
Form infects the boot sector. When a computer is booted from an infected sector, Form goes resident, hooks the interrupt vector table, and runs the original boot sector which it has hidden in an area it flags as defective. It will subsequently infect any media inserted into the machine.
Symptoms
Form has a range of symptoms, most of which will not be evident in all infections:
- Form's most famous side effect is a clicking noise produced by typing on the keyboard on the 18th of every month. However, this payload very rarely appears on modern computers, as it will not execute if a keyboard driver is installed.
- Form consumes 2KB of memory, and the DOS MEM command will report that this memory is unavailable. This appears on all infections.
- On floppy disks, 1 KB (2 bad sectors) will be reported. This appears in all infections.
- The Form data sector contains the text "The FORM-Virus sends greetings to everyone who's reading this text. FORM doesn't destroy data! Don't panic! Fuckings go to Corinne." Additionally, some versions of Form have had this text removed.
- Form makes the assumption that the active partition is a DOS FAT partition. If this is not true, such as under Windows NT, Form will overwrite in a way that may result in irreversible data loss.
Prevalence
Form was listed as spreading by the WildList from the first ever version of the WildList in July 1993 until January 2006.[1]
As with most boot viruses, a Form infection is a rare find in modern times. Since the advent of Windows, boot viruses have become increasingly uncommon, including Form. Generally, Form infections are due to the use of floppy disks infected during the original pandemic that have since been taken out of storage.
Variants
Form has a number of variants. The widely documented versions are as follows.
- Form.A is a common variant of the original, where the clicking payload occurs every day, as opposed to just the 18th.
- Form.B is a minor variant of the original, with the clicking payload set for the 24th of each month instead of the 18th. It was a rare find in the field during the mid-1990s, but has since become extinct in the wild.
- Form.C is a virtually undocumented, trivial variant of the original. It is suggested that Form.C is another minor variant of Form, which only activates in May. Like Form.B, it was documented as being discovered rarely in the wild during the mid-1990s.
- Form.D is the most common version of Form besides the original. Some reports indicate that it affects the partition table in some way. It was a somewhat common virus in 1997 and 1998.
- FormII is an undocumented variant.
- Form-Canada is an undocumented variant.