Form was a

boot sector virus A computer virus is a type of computer program that, when executed, replicates itself by modifying other computer programs and inserting its own code. If this replication succeeds, the affected areas are then said to be "infected" with a comput ...

isolated in

Switzerland ). Swiss law does not designate a ''capital'' as such, but the federal parliament and government are installed in Bern, while other federal institutions, such as the federal courts, are in other cities (Bellinzona, Lausanne, Luzern, Neuchâtel ...

in the summer of 1990 which became very common worldwide. The origin of Form is widely listed as Switzerland, but this may be an assumption based on its isolation locale. The only notable characteristics of Form are that it infects the boot sector instead of the

Master Boot Record A master boot record (MBR) is a special type of boot sector at the very beginning of partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond. The concept of MBR ...

(MBR) and the clicking noises associated with some infections. Infections under Form can result in severe data damage if operating system characteristics are not identical to those Form assumes. It is notable for arguably being the most common virus in the world for a period during the early 1990s.

Infection

Form infects the boot sector. When a computer is booted from an infected sector, Form goes resident, hooks the

interrupt vector table An interrupt vector table (IVT) is a data structure that associates a list of interrupt handlers with a list of interrupt requests in a table of interrupt vectors. Each entry of the interrupt vector table, called an interrupt vector, is the addr ...

, and runs the original boot sector which it has hidden in an area it flags as defective. It will subsequently infect any media inserted into the machine.

Symptoms

Form has a range of symptoms, most of which will not be evident in all infections. *Form's most famous side effect is a clicking noise produced by typing on the keyboard on the 18th of every month. However, this payload very rarely appears on modern computers, as it will not execute if a keyboard driver is installed. *Form consumes 2KB of memory, and the DOS MEM command will report that this memory is unavailable. This appears on all infections. *On floppy disks, 1 KB (2 bad sectors) will be reported. This appears in all infections. *The Form data sector contains the text "The FORM-Virus sends greetings to everyone who's reading this text. FORM doesn't destroy data! Don't panic! Fuckings go to Corinne." Additionally, some versions of Form have had this text removed. *Form makes the assumption that the active partition is a

DOS DOS is shorthand for the MS-DOS and IBM PC DOS family of operating systems. DOS may also refer to: Computing * Data over signalling (DoS), multiplexing data onto a signalling channel * Denial-of-service attack (DoS), an attack on a communicat ...

FAT In nutrition science, nutrition, biology, and chemistry, fat usually means any ester of fatty acids, or a mixture of such chemical compound, compounds, most commonly those that occur in living beings or in food. The term often refers spec ...

partition. If this is not true, such as under

Windows NT Windows NT is a proprietary graphical operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs. Time-sharing operating systems sc ...

, Form will overwrite in a way that may result in irreversible data loss.

Prevalence

Form was listed as spreading by the WildList from the first ever version of the WildList in July 1993 until January 2006. As with most boot viruses, a Form infection is a rare find in modern times. Since the advent of

Windows Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...

, boot viruses have become increasingly uncommon, including Form. Generally, Form infections are due to the use of

floppy disk A floppy disk or floppy diskette (casually referred to as a floppy, or a diskette) is an obsolescent type of disk storage composed of a thin and flexible disk of a magnetic storage medium in a square or nearly square plastic enclosure lined w ...

s infected during the original pandemic that have since been taken out of storage.

Variants

Form has a number of variants. The widely documented versions are as follows. * Form.A is a common variant of the original, where the clicking payload occurs every day, as opposed to just the 18th. * Form.B is a minor variant of the original, with the clicking payload set for the 24th of each month instead of the 18th. It was a rare find in the field during the mid 1990s, but has since become extinct in the wild. * Form.C is a virtually undocumented, trivial variant of the original. It is suggested that Form.C is another minor variant of Form, which only activates in May. Like Form.B, it was documented as being discovered rarely in the wild during the mid-1990s. * Form.D is the most common version of Form besides the original. Some reports indicate that it affects the

partition table Disk partitioning or disk slicing is the creation of one or more regions on secondary storage, so that each region can be managed separately. These regions are called partitions. It is typically the first step of preparing a newly installed disk, ...

in some way. It was a somewhat common virus in 1997 and 1998. * FormII is an undocumented variant. * Form-Canada is an undocumented variant.

References

External links