117 lines
5.2 KiB
Plaintext
117 lines
5.2 KiB
Plaintext
======================
|
|
Soupy Virus Source
|
|
By The Attitude Adjuster
|
|
and
|
|
AccuPunk
|
|
======================
|
|
|
|
With the release of this virus marks the absolute end for all
|
|
boring direct-action COM infectors from Virulent Graffiti... if some pop
|
|
up in the future, bearing our name, and do not have revolutionary or
|
|
funny activation stages, they are NOT from us...
|
|
|
|
Anyway, I am at a loss as to why I should use anything but the DOC
|
|
I wrote for this, but, here's what Patti says, and what I say, you compare
|
|
and contrast who does it better!
|
|
|
|
==========================================================================
|
|
Virus Name: Soupy
|
|
Aliases:
|
|
V Status: New
|
|
Discovered: January, 1993
|
|
Symptoms: .COM file growth; TSR; message; system hangs
|
|
Origin: United States
|
|
Eff Length: 1,072 Bytes
|
|
Type Code: PRC - Parasitic Resident .COM Infector
|
|
Detection Method: Novi 1.15a+, CPAV/N
|
|
Removal Instructions: Delete infected files
|
|
|
|
General Comments:
|
|
The Soupy virus was submitted in January, 1993, and is from the
|
|
United States. Soupy is a non-resident, direct action infector
|
|
of .COM programs, but not COMMAND.COM. In the case of advanced
|
|
infections, it may install a portion of itself memory resident in
|
|
order to facilitate the activation mechanism in the virus.
|
|
|
|
When a program infected with the Soupy virus is executed, the
|
|
Soupy virus will infect one .COM file located in the current
|
|
directory, as well as update a counter within the viral code.
|
|
Programs infected with the Soupy virus will have a file length
|
|
increase of 1,072 bytes with the virus being located at the end
|
|
of the file. The program's date and time in the DOS disk directory
|
|
listing will not be altered.
|
|
|
|
The Soupy virus activates once the counter within the viral code
|
|
has reached 11, indicating the 11th generation of the virus has
|
|
been reached. At this time, the virus will install a portion of
|
|
itself in memory of 736 bytes, hooking interrupt 08. Once the
|
|
memory resident portion of the virus has been installed, it will
|
|
display the following messages one at a time every three minutes:
|
|
|
|
"Unsuspecting user, 12 o'clock!"
|
|
"Get ready... 'cause... THERE'S A VIRUS IN YOUR SOUP!"
|
|
"From the guys that brought you Lythyum, Radyum, and
|
|
VioLite comes:"
|
|
"The Soupy Virus, (k) 1992 VG Enterprises,
|
|
216/513/602/904/703"
|
|
"By The Attitude Adjuster & AccuPunk!"
|
|
"Hurry! Hire an Anti-Virus Professional!
|
|
Increase Wallet Space!"
|
|
"...hmmm, ya' know, I think I''ll halt now..."
|
|
|
|
Once the last message above is displayed, the system will be
|
|
halted or hung. The above messages are encrypted within the
|
|
Soupy viral code, as are the following additional text strings:
|
|
|
|
"[Soupy] The Attitude Adjuster & AccuPunk,
|
|
VG 08/23/92 to 12/02/92"
|
|
"*.COM"
|
|
"Bad command or file name"
|
|
|
|
==========================================================================
|
|
...and now me...
|
|
|
|
==========================================================================
|
|
Virus Name: Soupy
|
|
Aliases: Virus in Your Soup
|
|
Author: The Attitude Adjuster & AccuPunk
|
|
Group: Virulent Graffiti
|
|
Scan ID:
|
|
V Status: Frozen to Death
|
|
Discovery: See, we were in this guy's disk box...
|
|
Symptoms: .COM files altered; Messages;
|
|
Orgin: West Bumblefuck, Ohio
|
|
Eff Length: 1073 Bytes
|
|
Res Length: 736 Bytes
|
|
Type Code: Parasitic Non-Resident .COM Infector
|
|
Detection Method:
|
|
Removal Instructions: Delete infected files
|
|
|
|
General Comments:
|
|
|
|
The Soupy virus is a self-encrypting direct action infector
|
|
of .COM programs. The virus, upon execution, will search the
|
|
current directory for an uninfected .COM program. If none
|
|
are found, the virus will restore the host file and continue
|
|
execution.
|
|
|
|
The Soupy virus mantains an infection counter. When this counter
|
|
reaches 11, the virus will check for a copy of itself in memory,
|
|
and if not found, make itself the owner of INT 8 and go
|
|
resident.
|
|
|
|
Approximately every 3 minutes, the virus will display the next
|
|
of 7 messages, finally causing the machine to do a dynamic
|
|
halt on the final message.
|
|
|
|
==========================================================================
|
|
And, just to get the story straight, I wrote all the resident
|
|
stuff out of boredom, and, the COM engine was what AccuPunk presented as
|
|
his coding example to join the group. I just optomized the code, and added
|
|
my residency, and I was ready to go...
|
|
|
|
This virus sucks... mainly because I didn't know enough back then,
|
|
but, that has all changed...
|
|
|
|
==========================================================================
|