| V-Sign | |
|---|---|
| Type | Boot sector virus |
| Creator | |
| Date Discovered | 1992.06 |
| Place of Origin | Turkey |
| Source Language | |
| Platform | DOS |
| Infection Length | 3 sectors |
| Reported Costs | |
V-Sign also known as Cansu and Sigalit is a boot sector virus from 1992. It is slightly polymorphic and displays an image after infecting 64 diskettes.
Behavior
When the system is booted from an infected diskette, V-Sign becomes memory resident, taking up 2,048 bytes. It installs itself in high memory, just below the DOS 640k boundary. The virus infects the hard disk as soon as the user accesses it.
V-Sign saves 38 bytes of the master boot record in its own code as it overwrites Side 0, Cylinder 0, Sector 1. Its code takes up two more sectors, so it places the rest of itself on Side 0, Cylinder 0, Sectors 4 and 5.
Diskettes are infected as they are accessed. It works the same way as when it infects a hard disk, except on the floppy, it stores its two other sectors on the last sectors of that disk's root directory (sectors 10 and 11 on 360k 5.25 inch floppies for example).
When the virus has infected 64 diskettes, it will display its "V Sign". At this time, it causes the system to hang.
Name and Origin
V-Sign most likely comes from Turkey, but India has also been considered a possible home country of this virus. It was first reported in Canada. V-Sign takes its name from the image it displays. Its other name, Sigalit is Hebrew for the violet plant. Cansu is a Turkish female name.
Effects
As V-sign is suspected to have come from Turkey or India, it is likely that it could be found wild there. How widespread it was in Canada is uncertain. Fujitsu Germany accidentally installed the virus in some printer disks.
Sources
McAfee Antivirus, V-Sign. 1992.06.15
F-Secure Antivirus. F-Secure Virus Descriptions : V-Sign.
Learn Hebrew Names. Sigalit - סִיגָלִית.