76 lines
4.0 KiB
Plaintext
76 lines
4.0 KiB
Plaintext
|
|
ZipDevil 0.1
|
|
|
|
WARNING: ZipDevil is a virus. However, its only goal is to replicate and
|
|
spread itself. It does no damage to data or files!
|
|
|
|
ZipDevil is an attempt to reinvent the companion file virus. It takes
|
|
several somewhat elaborate measures to encourage its continued existance.
|
|
The author takes one here by posting this code.
|
|
|
|
ZipDevil is a non-resident spawner. After the infection (or infection
|
|
attempt), it runs the file the user intended along with the command
|
|
line arguments. It infects .EXE's using the companion file method. It is
|
|
capable of internally infecting .ZIP's as long as it can find PKZIP on the
|
|
host system.
|
|
|
|
When infecting a ZIP file, it chooses an .EXE file within the .ZIP to infect.
|
|
If there aren't any internal .EXE's or the .ZIP is already infected, ZipDevil
|
|
aborts the infection.
|
|
|
|
ZipDevil examines C:\AUTOEXEC.BAT for calls to executables. It infects these
|
|
files, and (if necessary (and possible)) modifies AUTOEXEC.BAT to ensure it
|
|
is run upon every bootup. In general, ZipDevil can only use .EXE's as host
|
|
programs, .COM files are not susceptable to the companion file method of
|
|
infection.
|
|
|
|
Unfortuantely for the 'Devil, in this day and age of Windows based programs,
|
|
the companion file method is of limited virulence. In response to this,
|
|
the virus specifically targets the call to Windows 3.1 found in most
|
|
AUTOEXEC's on systems running Windows 3.1. AUTOEXEC.BAT is modified to call
|
|
WIN.EXE instead of WIN.COM, and of course WIN.EXE is the file containing the
|
|
viral code; Unbeknownst to the user, ZipDevil does its business before
|
|
loading Windows as normal.
|
|
|
|
With Windows 95 systems, ZipDevil is only prolific if the user makes frequent
|
|
shells to DOS. It seems unlikely that ZipDevil will spread very far on most
|
|
Windows 95 machines. Future enhancements to alleviate this drawback are
|
|
expected. If you'd like to improve on the code, this is a prime area to do
|
|
so. (See the author's modification request below.)
|
|
|
|
The virus also has a self-cleaning mechanism. Create an empty file with path
|
|
and filename C:\EX.BAT. ZipDevil checks for this file and if it finds it, it
|
|
appends the DOS commands necessary to eradicate all the infections it makes
|
|
on your drive. For EX.BAT to work, PKZIP.EXE must be in your DOS path.
|
|
If EX.BAT does not exist, the virus makes no record of its work, and it will
|
|
probably be a tedious task to fully remove it from your system. (If
|
|
PKZIP.EXE was is your DOS path, then ZipDevil found it and you will have to
|
|
look in every ZIP file on your drive!)
|
|
|
|
Remember, ZipDevil can and will modify your AUTOEXEC.BAT file. Make a backup
|
|
before installing the virus. To fully remove all work the virus has done,
|
|
simply restore the backed up version of AUTOEXEC.BAT that you've made, and
|
|
run C:\EX.BAT.
|
|
|
|
ZipDevil is its own dropper. Compile and link the code, then simply run the
|
|
resultant .EXE executable. On a typical hard drive, there is a good chance
|
|
than one execution as a dropper will establish it.
|
|
|
|
The author encourages the spread of this virus to both knowing and unknowing
|
|
others either in the form of source code or as an executable. Modifications
|
|
are encouraged, but take the following to heart. Make modifications
|
|
carefully, and test the code. Never cause damage or disruptiveness out of
|
|
laziness. If your going to add a trigger mechanism to ZipDevil, do it
|
|
deliberately and soulfully. Think about what your doing and who you're
|
|
affecting.
|
|
|
|
------------------------------------------------------------------------
|
|
Of course, the author accepts no liability for the use or misuse of this
|
|
code. There is no copyright or legal restrictions on this code.
|
|
------------------------------------------------------------------------
|
|
|
|
Comments and bug reports can be posted to the usenet newsgroup
|
|
alt.comp.virus
|
|
And if you feel you've improved ZipDevil, please post the modified code to
|
|
alt.comp.virus.source.code
|