87 lines
3.3 KiB
Plaintext
87 lines
3.3 KiB
Plaintext
|
06 Oct 89
|
|||
|
|
From: Samson Luk
|
|||
|
|
To: All
|
|||
|
|
Subj: To Remove the Marijuana (Stoned) Virus from HD
|
|||
|
|
|
|||
|
|
------------------------------------------------
|
|||
|
|
Below is an easy way to be followed step-by-step instructions for removing
|
|||
|
|
the Marijuana Virus from an infected hard disk without taking the time to:
|
|||
|
|
|
|||
|
|
a) wipe the disk clean by over-writing all files with zeros and ones,
|
|||
|
|
b) reformat the hard disk and
|
|||
|
|
c) then reload the hard disk from back-ups.
|
|||
|
|
|
|||
|
|
The following instructions was provided by Bill Kenny of Digital Dispatch
|
|||
|
|
Incorporated, producers of the anti-virus product, Data Physician:
|
|||
|
|
|
|||
|
|
First of all you need to verify that the version of the Marijuana virus
|
|||
|
|
that you are infected with is the same as the one that was used to write
|
|||
|
|
these instructions. I (Bill Kenny) have only seen one version, but that
|
|||
|
|
does not mean that other do not exist!
|
|||
|
|
|
|||
|
|
This virus can be removed using DEBUG, a program that comes with DOS.
|
|||
|
|
1) Go into DEBUG and type in the following (do not type the comments -
|
|||
|
|
the ";" and copy that follows):
|
|||
|
|
|
|||
|
|
R IP ;set the IP register
|
|||
|
|
100 ;the command prompt will be a ':', not a '-'
|
|||
|
|
A 100 ;this command starts the Assembler. The prompt for
|
|||
|
|
MOV DX,80 ;these lines will be xxxx:01xx, where the x's stand
|
|||
|
|
MOV CX,1 ;for some hex digit.
|
|||
|
|
MOV BX,200
|
|||
|
|
MOV AX,201
|
|||
|
|
INT 13
|
|||
|
|
;press "Return" on a blank line to exit the Assembler
|
|||
|
|
G 10E ;execute the above program. Upon return , the end of
|
|||
|
|
;the 2nd line (the first starts with AX=) should be
|
|||
|
|
;NC. If the end is CY, you have a problem and cannot
|
|||
|
|
;continue.
|
|||
|
|
D 38A 39F ;dump some memory. The right-hand side of the screen
|
|||
|
|
;should show "Your PC is now Stoned!"
|
|||
|
|
D 3A5 3B7 ;more memory. This should say "LEGALISE MARIJUANA!"
|
|||
|
|
U 200 201 ;show the first instruction. This should be
|
|||
|
|
;JMP 7C00:0005
|
|||
|
|
U 2E4 302 ;Some more code. THIS IS AN IMPORTANT SECTION!
|
|||
|
|
|
|||
|
|
2) The previous Unassemble command in step 1 above should have produced the
|
|||
|
|
following code:
|
|||
|
|
|
|||
|
|
xxxx:02E4 B80000 MOV AX,0000
|
|||
|
|
xxxx:02E7 CD13 INT 13
|
|||
|
|
xxxx:02E9 33C0 XOR AX,AX
|
|||
|
|
xxxx:02EB 8EC0 MOV ES,AX
|
|||
|
|
xxxx:02ED B80102 MOV AX,0201
|
|||
|
|
xxxx:02F0 BB007C MOV BX,7C00
|
|||
|
|
xxxx:02F3 2E CS:
|
|||
|
|
xxxx:02F4 803E080000 CMP BYTE PTR [0008],00
|
|||
|
|
xxxx:02F9 740B JZ 0306
|
|||
|
|
xxxx:02FB B90700 MOV CX,0007
|
|||
|
|
xxxx:02FE BA8000 MOV DX,0080
|
|||
|
|
xxxx:0301 CD13 INT 13
|
|||
|
|
|
|||
|
|
Note: The xxxx above will vary from system to system. These values are
|
|||
|
|
not important to the program.
|
|||
|
|
|
|||
|
|
3) If you do not have a match at any step above, DO NOT PROCEED!
|
|||
|
|
|
|||
|
|
4) To move the virus from your hard disk, enter the following into DEBUG.
|
|||
|
|
|
|||
|
|
R IP
|
|||
|
|
100
|
|||
|
|
A 100
|
|||
|
|
MOV DX,80
|
|||
|
|
MOV CX,7
|
|||
|
|
MOV BX,200
|
|||
|
|
MOV AX,201
|
|||
|
|
INT 13
|
|||
|
|
MOV DX,80
|
|||
|
|
MOV CX,1
|
|||
|
|
MOV BX,200
|
|||
|
|
MOV AX,301
|
|||
|
|
INT 13
|
|||
|
|
;press "Return" on a blank line to exit the Assembler
|
|||
|
|
G 11C ;execute the above program.
|
|||
|
|
|
|||
|
|
5) The Marijuana virus is now removed from your hard disk. You can reboot
|
|||
|
|
your system safely.
|
|||
|
|
|