43 lines
2.5 KiB
Plaintext
43 lines
2.5 KiB
Plaintext
***************************************************************************
|
|
* The 911 Virus *
|
|
* (An "Armagedon the Greek" Variant) *
|
|
***************************************************************************
|
|
* Commentary and disassembly by Black Wolf *
|
|
***************************************************************************
|
|
|
|
The 911 virus is a direct variant of the "Armagedon the GREEK"
|
|
virus, derived merely by changing the text within and the dialing string.
|
|
The virus' size is 1079 bytes, making the smallest carrier 1081 bytes. The
|
|
main effect of the virus is to dial "911" every once in a while if a modem
|
|
is present on com ports 1-4 (the original virus dialed the speaking clock
|
|
in Greece). It is a memory resident .COM infector.
|
|
|
|
When executed, the 911 virus checks for residency. If it is already
|
|
installed, it simply passes control to the host file, otherwise, it goes
|
|
memory resident, hooking Int 08h and Int 21h. When 911 goes resident, it
|
|
uses a rather strange way of doing it. It re-executes the program and uses
|
|
an Int 27 to go memory resident, but because of the second execution it does
|
|
not truly terminate and is still able to return control to the host.
|
|
|
|
Once memory resident, the 911 virus infect .COM files on execution
|
|
(whenever an Int 21, function 4bh is called) after checking if the file has
|
|
already been infected. The identification string the virus uses to check for
|
|
infection is the string "Support Your Police" located near the end of the
|
|
virus (the original was "Armagedon the GREEK").
|
|
|
|
The infection process is also somewhat strange, as the virus
|
|
allocates all unused memory for itself, the loads the entire victim file into
|
|
memory in one call. It then "infects" it in memory, and writes it back to
|
|
the disk. Afterwards, it releases the memory.
|
|
|
|
All of the dialing and timing is handled from the Int 08 (Timer
|
|
Click) handler. When activated, it will dial 911 (police/fire/emergency)
|
|
and wait for several seconds. It sends the commands to all ports 1-4, so
|
|
the results of hardware other than modems connected to these ports may be
|
|
unpredictable.
|
|
|
|
The storage bytes are found at the very end of the file, with the
|
|
first byte encrypted by adding 0bh to its value. Infected files may be
|
|
repaired by restoring these bytes to the beginning, unencrypting the first
|
|
one, and cutting the virus off the end of the host program.
|