Form was a

boot sector virus A computer virus is a type of malware that, when executed, replicates itself by modifying other computer programs and inserting its own code into those programs. If this replication succeeds, the affected areas are then said to be "infected" wit ...

isolated in

Switzerland Switzerland, officially the Swiss Confederation, is a landlocked country located in west-central Europe. It is bordered by Italy to the south, France to the west, Germany to the north, and Austria and Liechtenstein to the east. Switzerland ...

in the summer of 1990 which became very common worldwide. The origin of Form is widely listed as Switzerland, but this may be an assumption based on its isolation locale. The only notable characteristics of Form are that it infects the

boot sector A boot sector is the disk sector, sector of a persistent data storage device (e.g., hard disk, floppy disk, optical disc, etc.) which contains machine code to be loaded into random-access memory (RAM) and then executed by a computer system's bui ...

instead of the

Master Boot Record A master boot record (MBR) is a type of boot sector in the first block of disk partitioning, partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond. The concept ...

(MBR) and the clicking noises associated with some infections. Infections under Form can result in severe data damage if operating system characteristics are not identical to those Form assumes. It is notable for arguably being the most common virus in the world for a period during the early 1990s.

Infection

Form infects the

. When a computer is booted from an infected sector, Form goes resident, hooks the

interrupt vector table An interrupt vector table (IVT) is a data structure that associates a list of interrupt handlers with a list of interrupt requests in a table of interrupt vectors. Each entry of the interrupt vector table, called an interrupt vector, is the addre ...

, and runs the original boot sector which it has hidden in an area it flags as defective. It will subsequently infect any media inserted into the machine.

Symptoms

Form has a range of symptoms, most of which will not be evident in all infections: *Form's most famous side effect is a clicking noise produced by typing on the keyboard on the 18th of every month. However, this payload very rarely appears on modern computers, as it will not execute if a keyboard driver is installed. *Form consumes 2KB of memory, and the DOS MEM command will report that this memory is unavailable. This appears on all infections. *On floppy disks, 1 KB (2 bad sectors) will be reported. This appears in all infections. *The Form data sector contains the text "The FORM-Virus sends greetings to everyone who's reading this text. FORM doesn't destroy data! Don't panic! Fuckings go to Corinne." Additionally, some versions of Form have had this text removed. *Form makes the assumption that the active partition is a

DOS DOS (, ) is a family of disk-based operating systems for IBM PC compatible computers. The DOS family primarily consists of IBM PC DOS and a rebranded version, Microsoft's MS-DOS, both of which were introduced in 1981. Later compatible syste ...

FAT In nutrition science, nutrition, biology, and chemistry, fat usually means any ester of fatty acids, or a mixture of such chemical compound, compounds, most commonly those that occur in living beings or in food. The term often refers specif ...

partition. If this is not true, such as under

Windows NT Windows NT is a Proprietary software, proprietary Graphical user interface, graphical operating system produced by Microsoft as part of its Windows product line, the first version of which, Windows NT 3.1, was released on July 27, 1993. Original ...

, Form will overwrite in a way that may result in irreversible data loss.

Prevalence

Form was listed as spreading by the WildList from the first ever version of the WildList in July 1993 until January 2006. As with most boot viruses, a Form infection is a rare find in modern times. Since the advent of

Windows Windows is a Product lining, product line of Proprietary software, proprietary graphical user interface, graphical operating systems developed and marketed by Microsoft. It is grouped into families and subfamilies that cater to particular sec ...

, boot viruses have become increasingly uncommon, including Form. Generally, Form infections are due to the use of

floppy disk A floppy disk or floppy diskette (casually referred to as a floppy, a diskette, or a disk) is a type of disk storage composed of a thin and flexible disk of a magnetic storage medium in a square or nearly square plastic enclosure lined with a ...

s infected during the original pandemic that have since been taken out of storage.

Variants

Form has a number of variants. The widely documented versions are as follows. * Form.A is a common variant of the original, where the clicking payload occurs every day, as opposed to just the 18th. * Form.B is a minor variant of the original, with the clicking payload set for the 24th of each month instead of the 18th. It was a rare find in the field during the mid-1990s, but has since become extinct in the wild. * Form.C is a virtually undocumented, trivial variant of the original. It is suggested that Form.C is another minor variant of Form, which only activates in May. Like Form.B, it was documented as being discovered rarely in the wild during the mid-1990s. * Form.D is the most common version of Form besides the original. Some reports indicate that it affects the

partition table Partition may refer to: Arts and entertainment Film and television * ''Partition'' (1987 film), directed by Ken McMullen * ''Partition'' (2007 film), directed by Vic Sarin * '' Partition: 1947'', or ''Viceroy's House'', a 2017 film Music * Par ...

in some way. It was a somewhat common virus in 1997 and 1998. * FormII is an undocumented variant. * Form-Canada is an undocumented variant.

References

External links