Name         : Gandalf

     Aliases      : No Aliases

     Type/Size    : Boot/1024

     Clones       : No Clones

     Symptoms     : No Symptoms

     Discovered   : 29-12-91

     Way to infect: Boot infection

     Rating       : Less Dangerous

     Kickstarts   : 1.2/1.3

     Damage       : Overwrites boot.

     Removal      : Install boot.

     Comments     : Some  copies  pops up a requester while others makes a
                    display beep. Sometimes  Gandalf virus will format the
                    disk when counter is incremented to 7. DisplayAlert or
                    nothing before disk is running  ihibited.


                    The  Gandalf-Virus  uses the coolcapturevector to stay
                    resident  in  memory.  The  PutMsg-Vecto r is used to 
                    infect other disks. Additionally the ExitIntr()-Vector
                    is  used  to set the coolcapture and the DoIO()-Vector
                    always to the virusvalue.


                    In the decoded bootblock (eor-loop) you can read:

                    Gandalf`s Rache 1.5.90 - Ser.Nr. B00128 -
                    Hi Butonic & Angel!

A.D 03-94 & TBH 04-94