63 lines
3.2 KiB
Plaintext
63 lines
3.2 KiB
Plaintext
|
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>>>> Article From Evolution #3 - YAM '92
|
|||
|
|
|
|||
|
|
Article Title: The Greetings Virus
|
|||
|
|
Author: Admiral Bailey
|
|||
|
|
|
|||
|
|
|
|||
|
|
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ķ
|
|||
|
|
<EFBFBD> <20>/<2F> A Youth Against McAfee Production <20>\<5C> <20>
|
|||
|
|
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ľ
|
|||
|
|
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ķ
|
|||
|
|
<EFBFBD> <20>/<2F> Executable Information <20>\<5C> <20>
|
|||
|
|
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ķ
|
|||
|
|
<EFBFBD> Virus / Trojan Name : The Greetings Virus <20>
|
|||
|
|
<EFBFBD> Author / Modification By : Admiral Bailey <20>
|
|||
|
|
<EFBFBD> Language Used : Assembly Language [TASM 2.0] <20>
|
|||
|
|
<EFBFBD> Type of Virus / Trojan : Encrypted TSR com/exe infector. <20>
|
|||
|
|
<EFBFBD> Date Of Release : 1-2-93 <20>
|
|||
|
|
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ľ
|
|||
|
|
|
|||
|
|
Notes On Virus
|
|||
|
|
~~~~~~~~~~~~~~
|
|||
|
|
One of my latest quality releases. I actually spent time on this one to
|
|||
|
|
perk it up a bit. It's been my best so far. Hope you like it.
|
|||
|
|
|
|||
|
|
It is a TSR com and exe infector. It infects these files when they are
|
|||
|
|
run. On infection it preserves the files date, time, and attributes to help
|
|||
|
|
with stealth a bit. It is also encrypted. Tried to keep this encryption
|
|||
|
|
routine as small as possible.
|
|||
|
|
|
|||
|
|
When first run the virus will hook interrupts 8 (timer), 9 (keyboard), and
|
|||
|
|
21 (DOS). Then it will move itself into memory.
|
|||
|
|
|
|||
|
|
Thanks go to Dark Angel of P/S where I learned how to go resident in
|
|||
|
|
memory. (At least I'm honest) Without him I would still be at the
|
|||
|
|
non-resident stage right now. Even though those are fun to do every now and
|
|||
|
|
then.
|
|||
|
|
|
|||
|
|
The virus will probably use up 2236 bytes of memory. But I never actually
|
|||
|
|
checked. Any infected file will have a file increase of about 1118 bytes.
|
|||
|
|
|
|||
|
|
During the hours of 9am and 3pm (During school hours) a bouncing ball will
|
|||
|
|
appear on the screen. Well actually an asterisk. In text mode it will just
|
|||
|
|
erase its path on the screen and look normal. But when it graphics mode it
|
|||
|
|
will appear as big black blocks. Well on VGA that is. Also during this time
|
|||
|
|
when a reboot is called a message will appear on the screen and wait five
|
|||
|
|
seconds before the actual reboot. I'm not too sure how this works on
|
|||
|
|
different computers. Sometimes it will hang the computer after the message.
|
|||
|
|
|
|||
|
|
Look out for version two of Greetings. Its just about done. It will
|
|||
|
|
include most of the above but it will show the ball effect at a different
|
|||
|
|
time so infection is not so noticeable. Maybe when in graphics mode the ball
|
|||
|
|
will not be show. (Hey let the "Warez Puppies" have their final fun) Dir
|
|||
|
|
stealth will be included as recently I have learned how to do it also from
|
|||
|
|
Dark Angel of P/S. I learned most of my stuff from him. More stuff is added
|
|||
|
|
but that I can't bother to go into.
|
|||
|
|
|
|||
|
|
Source Code
|
|||
|
|
~~~~~~~~~~~
|
|||
|
|
The source code will be released as this virus gets around more. I worked
|
|||
|
|
hard on it and I'm not going to give up the source until it's scannable.
|
|||
|
|
|
|||
|
|
|