Name         : Sao Paulo

     Aliases      : No Aliases

     Type/Size    : Boot/1024

     Clones       : No Clones 

     Symptoms     : No Symptoms

     Discovered   : ?

     Way to infect: Boot infection

     Rating       : Harmless

     Kickstarts   : 1.2/1.3/2.0

     Damage       : Overwrites boot.

     Removal      : Install boot.

     Comments     : The  SAO  PAULO  virus  is  located  in block 1 of the
                    Bootblock.  The first block just contains the modified
                    normal  DOS 1.3 Bootblock. This should proably confuse
                    the users. 


                    First  the  virus  copies itself to $7FC00 and patches
                    the   CoolCapture  and  the  DoIO()  Vector  from  the
                    exec.library. 


                    The  virus  checks  for  block  880  (this is only the
                    rootblock of DD-DISKS). So it`s very unlikely that the
                    virus infects HD-Disks. In the 1 block you can read: 


                    "SAO PAULO!"

A.D 08-94