Welcome to the Computer Security Wiki! You can help us by expanding stubs, create new articles and improve current articles.
You can also help us by logging-in or creating an account!


From Malware Wiki
Jump to: navigation, search

MultipleIssues.png This page has multiple issues. These issues most likely include issues with references and manual of style violations. Please help Malware Wiki by correcting these issues.

Most of this page uses content from Wikipedia. The original article was at Form (computer virus). The page may have contained some inaccurate or outdated information, so please rewrite some parts to avoid plagiarism.
The list of authors can be seen in the page history. As with Malware Wiki, the text of Wikipedia is available under the Creative Common Attribution-ShareAlike 3.0 License.
Remove this template when most of the Wikipedia content has been removed or the Wikipedia information is outnumbered by non-Wikipedia information.
TypeDOS virus
DateJune 1990
Alias(es)Form18, Forms
This box: view  talk  edit

Form is a DOS boot sector virus. Isolated in Switzerland in the summer of 1990, it became very common worldwide, arguably being the most common virus in the world for a period during the early 1990s.

The only notable characteristics of Form are that it infects the boot sector instead of the Master Boot Record and the clicking noises associated with some infections. Infections under Form can result in severe data damage if operating system characteristics are not identical to those Form assumes.

Form was listed as spreading by the WildList from the first ever version of the WildList in July 1993 until January 2006.

As with most boot viruses, a Form infection is a rare find in modern times. Since the advent of Microsoft Windows, boot viruses have become increasingly uncommon, including Form. Generally, Form infections are due to the use of floppy disks infected during the original pandemic that have since been taken out of storage.


When a computer is booted from an infected sector, Form goes resident, hooks the interrupt vector table, and runs the original boot sector which the virus has hidden in an area it flags as defective. It will subsequently infect any media inserted into the machine.

Form has a range of symptoms, most of which will not be evident in all infections.

  • Form's most famous side effect is a clicking noise produced by typing on the keyboard on the 18th of every month. However, this payload very rarely appears on modern computers, as it will not execute if a keyboard driver is installed.
  • Form consumes 2KB of memory, and the DOS MEM command reports that this memory is unavailable. This appears on all infections.
  • On floppy disks, 1 KB (2 bad sectors) will be reported. This appears in all infections.
  • The Form data sector contains the text "The FORM-Virus sends greetings to everyone who's reading this text. FORM doesn't destroy data! Don't panic! Fuckings go to Corinne." Additionally, some versions of Form have had this text removed.
  • Form makes the assumption that the active partition is a DOS FAT partition. If this is not true, such as under Windows NT, Form will overwrite in a way that may result in irreversible data loss.


Form has a number of variants. The widely documented versions are as follows.

  • Form.A is a common variant of the original, where the clicking payload occurs every day, as opposed to just the 18th.
  • Form.B is a minor variant of the original, with the clicking payload set for the 18th of each month instead of the 24th. It was a rare find in the field during the mid1990s, but has since become obsolete.
  • Form.C is a virtually undocumented, trivial variant of the original. It is suggested that Form.C is another minor variant of Form, except only activates in May. Like Form.B, it was documented as being discovered rarely in the wild during the mid-1990s.
  • Form.D is the most common version of Form besides the original. Some reports indicate that it affects the partition table in some way. It was a somewhat common virus in 1997 and 1998.
  • FormII is an undocumented variant.
  • Form-Canada is an undocumented variant.

External links


  1. http://www.wildlist.org/WildList/200601.htm