91 lines
2.8 KiB
Plaintext
91 lines
2.8 KiB
Plaintext
|
----------------------------------------------
|
||
|
|
Rage - Transient/Stealth/Mutating/COM Infector
|
||
|
|
----------------------------------------------
|
||
|
|
Completed May 31, 1991
|
||
|
|
Written by Data Disruptor with special thanks to Zodiac
|
||
|
|
|
||
|
|
|
||
|
|
Order of Infection
|
||
|
|
------------------
|
||
|
|
(1) Current directory
|
||
|
|
(2) Root directory if no other files are found in (1)
|
||
|
|
|
||
|
|
Stealth (???)
|
||
|
|
-------------
|
||
|
|
o Will detect the presence of FluShot+ and VirexPC. Will not execute
|
||
|
|
under the influence of these utilities.
|
||
|
|
|
||
|
|
(Due to the makeup of Norton's Disk Monitor, I was unable to find a
|
||
|
|
way to detect it at present time)
|
||
|
|
|
||
|
|
Infection Size
|
||
|
|
--------------
|
||
|
|
o Infected files are increased by 575 bytes
|
||
|
|
o Files under 2000 bytes will not be infected
|
||
|
|
o Files over 63425 bytes will not be infected
|
||
|
|
|
||
|
|
Randomizer Routine
|
||
|
|
------------------
|
||
|
|
o Every time a file is infected, there is an approximate 1 in 16 chance
|
||
|
|
that a message;
|
||
|
|
|
||
|
|
"Pray for death - RABID '91"
|
||
|
|
|
||
|
|
will be printed.
|
||
|
|
|
||
|
|
Mutation
|
||
|
|
--------
|
||
|
|
o This virus encrypts itself differently every time it infects a file.
|
||
|
|
|
||
|
|
(Note: It is quite easy to develop a scan string for this virus as the
|
||
|
|
decryptor remains the same all the time. This will be remedied in
|
||
|
|
version 1.1 by encrypting the decryptor... If you get what I'm saying)
|
||
|
|
|
||
|
|
Destruction
|
||
|
|
-----------
|
||
|
|
o On the 13th of every month, Rage will clear the screen and display;
|
||
|
|
|
||
|
|
"Rage - RABID Int'nl Development Corp. '91
|
||
|
|
By Data Disruptor - Thanks to Zodiac"
|
||
|
|
|
||
|
|
It will then attempt to format all drives starting from drive C: on
|
||
|
|
through Z:, corrupting 255 sectors of each drive.
|
||
|
|
|
||
|
|
Identification
|
||
|
|
--------------
|
||
|
|
o If you fear that you have infected yourself, simply search for the
|
||
|
|
string;
|
||
|
|
|
||
|
|
Patricia Boon
|
||
|
|
|
||
|
|
which at no time is encrypted.
|
||
|
|
|
||
|
|
(My girlfriend thinks that I don't write viruses, therefore, I said
|
||
|
|
I'd prove to her that I do by putting her name in my next virus and
|
||
|
|
"spread her name around the world...")
|
||
|
|
|
||
|
|
Thoughts
|
||
|
|
--------
|
||
|
|
o Due to the appearance to the text "Patricia Boon", this virus will
|
||
|
|
more than likely be called, "Patricia", but seeing as how there
|
||
|
|
allready, unnoficially, is a virus called "Patricia", this may end
|
||
|
|
up being called "Patricia ][" or Flash Force's Nightmare name of
|
||
|
|
"Boon".
|
||
|
|
|
||
|
|
o Unless the virus-guru's successfully disassemble this virus, only
|
||
|
|
then will the name "Rage" come out. (Fortunately, McAffe is good at
|
||
|
|
that sort of thing)
|
||
|
|
|
||
|
|
Final Note
|
||
|
|
----------
|
||
|
|
o I am releasing the original virus in an infected MAKESTND.COM with
|
||
|
|
filesize 3128 bytes. Run the program, then hit CTRL-BREAK to
|
||
|
|
terminate.
|
||
|
|
|
||
|
|
---------------
|
||
|
|
|
||
|
|
That about wraps up this readme. If you have any questions, reach me on The
|
||
|
|
G Spot.
|
||
|
|
|
||
|
|
Disruptor
|
||
|
|
RABID '91
|