home *** CD-ROM | disk | FTP | other *** search
| Unknown | 1998-08-12 | 594.8 KB |
open in: 
MacOS 8.1
|
Win98
|
DOS
view JSON data
|
view as text
This file was not able to be converted.
This format is not currently supported by dexvert.
hex view+--------+-------------------------+-------------------------+--------+--------+
|00000000| 37 00 00 10 6d 00 00 10 | 88 00 00 10 a8 15 08 55 |7...m...|.......U|
|00000010| 0f 4b 09 00 02 00 00 00 | 00 00 00 00 00 00 0f 0a |.K......|........|
|00000020| 00 58 02 00 00 e8 03 00 | 00 01 00 00 00 00 00 00 |.X......|........|
|00000030| 00 01 00 00 00 00 00 00 | 00 01 00 00 00 d0 02 00 |........|........|
|00000040| 00 d0 02 00 00 a0 05 00 | 00 a0 05 00 00 a0 05 00 |........|........|
|00000050| 00 a0 05 00 00 01 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000060| 00 00 5c 00 00 10 63 00 | 00 10 29 00 00 00 65 00 |..\...c.|..)...e.|
|00000070| 00 10 00 00 00 00 66 00 | 00 10 00 00 00 00 64 00 |......f.|......d.|
|00000080| 00 10 02 06 01 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000090| 00 5c 00 00 10 63 00 00 | 10 31 00 00 00 65 00 00 |.\...c..|.1...e..|
|000000a0| 10 00 00 00 00 66 00 00 | 10 00 00 00 00 64 00 00 |.....f..|.....d..|
|000000b0| 10 02 06 fd 00 00 10 82 | 2e 00 00 c6 41 00 00 00 |........|....A...|
|000000c0| 02 00 03 02 00 02 12 00 | 02 07 02 00 00 00 06 01 |........|........|
|000000d0| 0d 00 00 00 1c 8c 00 00 | 00 22 06 41 72 69 61 6c |........|.".Arial|
|000000e0| 00 02 00 04 02 02 07 04 | 00 00 00 05 00 06 01 08 |........|........|
|000000f0| 00 00 00 22 06 41 72 69 | 61 6c 00 02 00 04 04 02 |...".Ari|al......|
|00000100| 07 04 00 00 00 05 00 06 | 01 08 00 00 00 22 06 41 |........|.....".A|
|00000110| 72 69 61 6c 00 02 00 04 | 06 02 07 04 00 00 00 05 |rial....|........|
|00000120| 00 06 01 08 00 00 00 22 | 06 41 72 69 61 6c 00 02 |......."|.Arial..|
|00000130| 00 04 08 02 07 04 00 00 | 00 05 00 06 01 08 00 00 |........|........|
|00000140| 00 22 06 41 72 69 61 6c | 00 02 00 04 0a 02 07 04 |.".Arial|........|
|00000150| 00 00 00 05 00 06 01 08 | 00 00 00 22 06 41 72 69 |........|...".Ari|
|00000160| 61 6c 00 02 00 04 0c 02 | 07 04 00 00 00 05 00 06 |al......|........|
|00000170| 01 08 00 00 00 22 06 41 | 72 69 61 6c 00 02 00 04 |.....".A|rial....|
|00000180| 0e 02 07 04 00 00 00 05 | 00 06 01 08 00 00 00 22 |........|......."|
|00000190| 06 41 72 69 61 6c 00 02 | 00 04 10 02 07 06 00 00 |.Arial..|........|
|000001a0| 00 05 00 06 00 0f 01 19 | 00 00 00 1c 90 01 00 00 |........|........|
|000001b0| 1e 01 22 10 54 69 6d 65 | 73 20 4e 65 77 20 52 6f |..".Time|s New Ro|
|000001c0| 6d 61 6e 03 02 00 04 02 | 00 02 00 01 7b 00 00 00 |man.....|....{...|
|000001d0| b4 92 41 6e 74 69 2d 56 | 69 72 75 73 20 45 6e 63 |..Anti-V|irus Enc|
|000001e0| 79 63 6c 6f 70 65 64 69 | 61 20 28 57 69 6c 64 20 |yclopedi|a (Wild |
|000001f0| 6c 69 73 74 29 20 02 02 | 0f 00 00 00 1c 08 02 00 |list) ..|........|
|00000200| 00 1e 01 22 06 41 72 69 | 61 6c 00 04 00 00 04 08 |...".Ari|al......|
|00000210| 00 00 04 0c 00 00 04 10 | 00 00 04 14 00 00 04 18 |........|........|
|00000220| 00 00 04 1c 00 00 04 20 | 00 00 04 00 04 00 b4 6d |....... |.......m|
|00000230| 02 54 68 69 73 20 73 70 | 72 65 61 64 20 73 68 65 |.This sp|read she|
|00000240| 65 74 20 63 6f 6e 74 61 | 69 6e 73 20 74 68 65 20 |et conta|ins the |
|00000250| 4a 6f 65 20 77 65 6c 6c | 73 20 27 77 69 6c 64 20 |Joe well|s 'wild |
|00000260| 6c 69 73 74 27 20 63 75 | 72 72 65 6e 74 20 61 73 |list' cu|rrent as|
|00000270| 20 61 74 20 41 70 72 69 | 6c 20 27 39 38 2e 02 02 | at Apri|l '98...|
|00000280| 0d 00 00 00 1c 18 01 00 | 00 22 06 41 72 69 61 6c |........|.".Arial|
|00000290| 00 04 04 00 04 08 04 00 | 04 0c 04 00 04 10 04 00 |........|........|
|000002a0| 04 14 04 00 04 18 04 00 | 04 00 08 00 b4 45 02 41 |........|.....E.A|
|000002b0| 74 20 74 68 65 20 6d 6f | 6d 65 6e 74 20 74 68 65 |t the mo|ment the|
|000002c0| 72 65 20 61 72 65 20 6f | 76 65 72 20 31 38 2c 30 |re are o|ver 18,0|
|000002d0| 30 30 20 76 69 72 75 73 | 27 73 20 6f 66 20 77 68 |00 virus|'s of wh|
|000002e0| 69 63 68 20 31 31 31 30 | 20 61 72 65 20 63 6f 6e |ich 1110| are con|
|000002f0| 73 69 64 65 72 65 64 02 | 02 0d 00 00 00 1c 18 01 |sidered.|........|
|00000300| 00 00 22 06 41 72 69 61 | 6c 00 04 08 00 04 08 08 |..".Aria|l.......|
|00000310| 00 04 0c 08 00 04 10 08 | 00 04 14 08 00 04 18 08 |........|........|
|00000320| 00 04 00 0c 00 b4 15 02 | 74 6f 20 62 65 20 27 69 |........|to be 'i|
|00000330| 6e 20 74 68 65 20 77 69 | 6c 64 27 20 62 61 73 65 |n the wi|ld' base|
|00000340| 64 20 6f 6e 20 72 65 63 | 65 6e 74 20 72 65 70 6f |d on rec|ent repo|
|00000350| 72 74 73 20 74 6f 20 61 | 6e 74 69 2d 76 69 72 75 |rts to a|nti-viru|
|00000360| 73 20 76 65 6e 64 6f 72 | 73 2e 02 02 0d 00 00 00 |s vendor|s.......|
|00000370| 1c 18 01 00 00 22 06 41 | 72 69 61 6c 00 04 0c 00 |.....".A|rial....|
|00000380| 04 08 0c 00 04 0c 0c 00 | 04 10 0c 00 04 14 0c 00 |........|........|
|00000390| 04 18 0c 00 04 00 10 00 | b4 5d 02 50 6c 65 61 73 |........|.].Pleas|
|000003a0| 65 20 6e 6f 74 65 20 74 | 68 61 74 20 74 68 65 20 |e note t|hat the |
|000003b0| 77 69 6c 64 20 6c 69 73 | 74 20 63 68 61 6e 67 65 |wild lis|t change|
|000003c0| 73 20 65 76 65 72 79 20 | 6d 6f 6e 74 68 2c 20 74 |s every |month, t|
|000003d0| 68 69 73 20 73 70 72 65 | 61 64 73 68 65 65 74 20 |his spre|adsheet |
|000003e0| 73 68 6f 75 6c 64 02 02 | 0d 00 00 00 1c 18 01 00 |should..|........|
|000003f0| 00 22 06 41 72 69 61 6c | 00 04 10 00 04 08 10 00 |.".Arial|........|
|00000400| 04 0c 10 00 04 10 10 00 | 04 14 10 00 04 18 10 00 |........|........|
|00000410| 04 00 14 00 b4 ba 6f 6e | 6c 79 20 62 65 20 63 6f |......on|ly be co|
|00000420| 6e 73 69 64 65 72 65 64 | 20 61 20 27 73 6e 61 70 |nsidered| a 'snap|
|00000430| 73 68 6f 74 27 20 6f 66 | 20 41 70 72 69 6c 20 31 |shot' of| April 1|
|00000440| 39 39 38 2e 02 02 0d 00 | 00 00 1c 18 01 00 00 22 |998.....|......."|
|00000450| 06 41 72 69 61 6c 00 04 | 14 00 04 08 14 00 04 0c |.Arial..|........|
|00000460| 14 00 04 10 14 00 04 14 | 14 00 04 18 14 00 04 00 |........|........|
|00000470| 18 00 a4 85 02 4e 6f 74 | 65 3a 20 49 20 73 74 72 |.....Not|e: I str|
|00000480| 6f 6e 67 6c 79 20 72 65 | 63 6f 6d 6d 65 6e 64 20 |ongly re|commend |
|00000490| 75 73 69 6e 67 20 73 65 | 61 72 63 68 20 74 6f 20 |using se|arch to |
|000004a0| 67 65 74 20 74 68 65 20 | 62 65 73 74 20 6f 75 74 |get the |best out|
|000004b0| 20 6f 66 20 74 68 69 73 | 20 73 70 72 65 61 64 73 | of this| spreads|
|000004c0| 68 65 65 74 2e 04 18 00 | 04 08 18 00 04 0c 18 00 |heet....|........|
|000004d0| 04 10 18 00 04 14 18 00 | 04 18 18 00 04 00 1c 00 |........|........|
|000004e0| a4 65 02 50 61 75 6c 20 | 47 61 72 74 73 69 64 65 |.e.Paul |Gartside|
|000004f0| 20 20 20 20 20 68 74 74 | 70 3a 2f 2f 77 77 77 2e | htt|p://www.|
|00000500| 70 61 75 6c 2d 67 2e 64 | 65 6d 6f 6e 2e 63 6f 2e |paul-g.d|emon.co.|
|00000510| 75 6b 20 20 20 20 20 67 | 61 72 74 79 40 70 61 75 |uk g|arty@pau|
|00000520| 6c 2d 67 2e 64 65 6d 6f | 6e 2e 63 6f 2e 75 6b 04 |l-g.demo|n.co.uk.|
|00000530| 1c 00 04 08 1c 00 04 0c | 1c 00 04 10 1c 00 04 14 |........|........|
|00000540| 1c 00 04 18 1c 00 04 00 | 20 00 a4 12 4e 61 6d 65 |........| ...Name|
|00000550| 04 20 00 a4 12 54 79 70 | 65 08 20 00 a4 1e 49 6e |. ...Typ|e. ...In|
|00000560| 66 65 63 74 73 0c 20 00 | a4 1a 47 72 6f 77 74 68 |fects. .|..Growth|
|00000570| 10 20 00 a4 2e 44 65 73 | 63 72 69 70 74 69 6f 6e |. ...Des|cription|
|00000580| 14 20 00 04 18 20 00 04 | 1c 20 00 00 20 20 00 00 |. ... ..|. .. ..|
|00000590| 00 24 00 b4 ba 20 28 4d | 63 41 66 65 65 27 73 20 |.$... (M|cAfee's |
|000005a0| 53 43 41 4e 20 63 61 6c | 6c 73 20 69 74 20 53 54 |SCAN cal|ls it ST|
|000005b0| 4f 4e 45 44 2e 4d 49 43 | 48 45 4c 4c 41 4e 47 45 |ONED.MIC|HELLANGE|
|000005c0| 4c 4f 29 02 02 10 00 00 | 00 22 0e 4d 53 20 53 61 |LO).....|.".MS Sa|
|000005d0| 6e 73 20 53 65 72 69 66 | 03 04 24 00 b4 46 42 6f |ns Serif|..$..FBo|
|000005e0| 6f 74 20 73 65 63 74 6f | 72 20 76 69 72 75 73 02 |ot secto|r virus.|
|000005f0| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00000600| 65 72 69 66 03 08 24 00 | b4 dd 03 54 68 65 20 62 |erif..$.|...The b|
|00000610| 6f 6f 74 20 73 65 63 74 | 6f 72 20 6f 66 20 66 6c |oot sect|or of fl|
|00000620| 6f 70 70 79 20 64 69 73 | 6b 73 20 61 6e 64 20 74 |oppy dis|ks and t|
|00000630| 68 65 20 70 61 72 74 69 | 74 69 6f 6e 20 73 65 63 |he parti|tion sec|
|00000640| 74 6f 72 20 6f 66 20 68 | 61 72 64 20 64 69 73 6b |tor of h|ard disk|
|00000650| 73 2c 20 77 68 65 6e 20 | 74 68 65 20 50 43 20 69 |s, when |the PC i|
|00000660| 73 20 62 6f 6f 74 65 64 | 20 66 72 6f 6d 20 61 6e |s booted| from an|
|00000670| 20 69 6e 66 65 63 74 65 | 64 20 66 6c 6f 70 70 79 | infecte|d floppy|
|00000680| 20 64 69 73 6b 2e 02 02 | 10 00 00 00 22 0e 4d 53 | disk...|....".MS|
|00000690| 20 53 61 6e 73 20 53 65 | 72 69 66 03 0c 24 00 b4 | Sans Se|rif..$..|
|000006a0| 06 2d 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |.-......|".MS San|
|000006b0| 73 20 53 65 72 69 66 03 | 10 24 00 b4 fd 07 4f 6e |s Serif.|.$....On|
|000006c0| 20 74 68 65 20 68 61 72 | 64 20 64 69 73 6b 2c 20 | the har|d disk, |
|000006d0| 74 68 65 20 6f 72 69 67 | 69 6e 61 6c 20 70 61 72 |the orig|inal par|
|000006e0| 74 69 74 69 6f 6e 20 73 | 65 63 74 6f 72 20 69 73 |tition s|ector is|
|000006f0| 20 72 65 2d 6c 6f 63 61 | 74 65 64 20 74 6f 20 63 | re-loca|ted to c|
|00000700| 79 6c 69 6e 64 65 72 20 | 30 2c 20 68 65 61 64 20 |ylinder |0, head |
|00000710| 30 2c 20 73 65 63 74 6f | 72 20 37 2e 20 20 49 74 |0, secto|r 7. It|
|00000720| 20 75 73 65 73 20 73 74 | 65 61 6c 74 68 20 74 6f | uses st|ealth to|
|00000730| 20 63 6f 6e 63 65 61 6c | 20 69 74 73 65 6c 66 20 | conceal| itself |
|00000740| 77 68 65 6e 20 6d 65 6d | 6f 72 79 20 72 65 73 69 |when mem|ory resi|
|00000750| 64 65 6e 74 2e 3c 70 3e | 0d 0a 54 68 65 20 76 69 |dent.<p>|..The vi|
|00000760| 72 75 73 20 75 73 65 73 | 20 31 4b 62 20 6f 66 20 |rus uses| 1Kb of |
|00000770| 52 41 4d 2e 20 20 54 68 | 69 73 20 69 73 20 76 69 |RAM. Th|is is vi|
|00000780| 73 69 62 6c 65 20 77 68 | 65 6e 20 75 73 69 6e 67 |sible wh|en using|
|00000790| 20 74 68 65 20 44 4f 53 | 20 63 6f 6d 6d 61 6e 64 | the DOS| command|
|000007a0| 20 4d 45 4d 20 28 77 68 | 69 63 68 20 72 65 70 6f | MEM (wh|ich repo|
|000007b0| 72 74 73 20 6c 65 73 73 | 20 74 68 61 6e 02 02 10 |rts less| than...|
|000007c0| 00 00 00 22 0e 4d 53 20 | 53 61 6e 73 20 53 65 72 |...".MS |Sans Ser|
|000007d0| 69 66 03 14 24 00 14 02 | 06 10 00 00 00 22 0e 4d |if..$...|.....".M|
|000007e0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 02 16 04 |S Sans S|erif....|
|000007f0| 18 24 00 04 00 28 00 b4 | 1a 31 2d 69 6e 2d 38 02 |.$...(..|.1-in-8.|
|00000800| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00000810| 65 72 69 66 03 04 28 00 | b4 2e 46 69 6c 65 20 76 |erif..(.|..File v|
|00000820| 69 72 75 73 2e 02 02 10 | 00 00 00 22 0e 4d 53 20 |irus....|...".MS |
|00000830| 53 61 6e 73 20 53 65 72 | 69 66 03 08 28 00 b4 1d |Sans Ser|if..(...|
|00000840| 04 54 68 65 20 6e 65 78 | 74 20 75 6e 69 6e 66 65 |.The nex|t uninfe|
|00000850| 63 74 65 64 20 43 4f 4d | 20 66 69 6c 65 2c 20 69 |cted COM| file, i|
|00000860| 6e 20 74 68 65 20 63 75 | 72 72 65 6e 74 20 64 69 |n the cu|rrent di|
|00000870| 72 65 63 74 6f 72 79 20 | 6f 72 20 61 63 63 65 73 |rectory |or acces|
|00000880| 73 65 64 20 76 69 61 20 | 74 68 65 20 50 41 54 48 |sed via |the PATH|
|00000890| 2c 20 6f 6e 20 65 78 65 | 63 75 74 69 6f 6e 20 6f |, on exe|cution o|
|000008a0| 66 20 61 6e 20 69 6e 66 | 65 63 74 65 64 20 66 69 |f an inf|ected fi|
|000008b0| 6c 65 20 69 6e 20 61 6e | 79 20 64 69 72 65 63 74 |le in an|y direct|
|000008c0| 6f 72 79 2e 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |ory.....|..".MS S|
|000008d0| 61 6e 73 20 53 65 72 69 | 66 03 0c 28 00 b4 2a 36 |ans Seri|f..(..*6|
|000008e0| 34 38 20 62 79 74 65 73 | 2e 02 02 10 00 00 00 22 |48 bytes|......."|
|000008f0| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 10 |.MS Sans| Serif..|
|00000900| 28 00 b4 fd 07 4f 6e 65 | 2d 69 6e 2d 65 69 67 68 |(....One|-in-eigh|
|00000910| 74 20 69 6e 66 65 63 74 | 69 6f 6e 73 20 6d 61 6b |t infect|ions mak|
|00000920| 65 20 74 68 65 20 66 69 | 6c 65 20 75 6e 75 73 61 |e the fi|le unusa|
|00000930| 62 6c 65 20 62 79 20 70 | 61 74 63 68 69 6e 67 20 |ble by p|atching |
|00000940| 63 6f 64 65 20 66 6f 72 | 20 61 20 72 65 2d 62 6f |code for| a re-bo|
|00000950| 6f 74 20 61 74 20 74 68 | 65 20 62 65 67 69 6e 6e |ot at th|e beginn|
|00000960| 69 6e 67 20 6f 66 20 74 | 68 65 20 66 69 6c 65 2e |ing of t|he file.|
|00000970| 20 45 76 65 6e 74 75 61 | 6c 6c 79 20 43 4f 4d 4d | Eventua|lly COMM|
|00000980| 41 4e 44 2e 43 4f 4d 20 | 69 73 20 69 6e 66 65 63 |AND.COM |is infec|
|00000990| 74 65 64 2c 20 73 6f 20 | 74 68 61 74 20 77 68 65 |ted, so |that whe|
|000009a0| 6e 65 76 65 72 20 74 68 | 65 20 50 43 20 69 73 20 |never th|e PC is |
|000009b0| 73 74 61 72 74 65 64 20 | 75 70 20 69 74 20 6a 75 |started |up it ju|
|000009c0| 73 74 20 6b 65 65 70 73 | 20 72 65 2d 62 6f 6f 74 |st keeps| re-boot|
|000009d0| 69 6e 67 2e 20 54 68 65 | 20 73 65 63 6f 6e 64 73 |ing. The| seconds|
|000009e0| 20 66 69 65 6c 64 20 6f | 66 20 74 68 65 20 64 69 | field o|f the di|
|000009f0| 72 65 63 74 6f 72 79 20 | 69 73 20 75 73 65 64 20 |rectory |is used |
|00000a00| 74 6f 20 73 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |to s....|..".MS S|
|00000a10| 61 6e 73 20 53 65 72 69 | 66 03 14 28 00 14 02 06 |ans Seri|f..(....|
|00000a20| 10 00 00 00 22 0e 4d 53 | 20 53 61 6e 73 20 53 65 |....".MS| Sans Se|
|00000a30| 72 69 66 03 02 16 04 18 | 28 00 04 00 2c 00 b4 26 |rif.....|(...,..&|
|00000a40| 31 30 20 50 61 73 74 20 | 33 02 02 10 00 00 00 22 |10 Past |3......"|
|00000a50| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 04 |.MS Sans| Serif..|
|00000a60| 2c 00 b4 6e 4d 65 6d 6f | 72 79 20 72 65 73 69 64 |,..nMemo|ry resid|
|00000a70| 65 6e 74 20 66 69 6c 65 | 20 76 69 72 75 73 2e 02 |ent file| virus..|
|00000a80| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00000a90| 65 72 69 66 03 08 2c 00 | b4 5d 02 43 4f 4d 20 66 |erif..,.|.].COM f|
|00000aa0| 69 6c 65 73 20 6f 6e 20 | 65 78 65 63 75 74 69 6f |iles on |executio|
|00000ab0| 6e 2e 20 4f 6e 6c 79 20 | 66 69 6c 65 73 20 62 65 |n. Only |files be|
|00000ac0| 74 77 65 65 6e 20 34 20 | 61 6e 64 20 36 34 2c 34 |tween 4 |and 64,4|
|00000ad0| 39 36 20 62 79 74 65 73 | 20 61 72 65 20 69 6e 66 |96 bytes| are inf|
|00000ae0| 65 63 74 65 64 2e 02 02 | 10 00 00 00 22 0e 4d 53 |ected...|....".MS|
|00000af0| 20 53 61 6e 73 20 53 65 | 72 69 66 03 0c 2c 00 b4 | Sans Se|rif..,..|
|00000b00| 2a 37 34 38 20 62 79 74 | 65 73 2e 02 02 10 00 00 |*748 byt|es......|
|00000b10| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|00000b20| 03 10 2c 00 b4 fd 07 4f | 6e 20 74 68 65 20 32 32 |..,....O|n the 22|
|00000b30| 6e 64 20 6f 66 20 65 61 | 63 68 20 6d 6f 6e 74 68 |nd of ea|ch month|
|00000b40| 2c 20 74 68 65 20 50 43 | 20 72 65 2d 62 6f 6f 74 |, the PC| re-boot|
|00000b50| 73 2e 20 4f 6e 20 76 61 | 72 69 6f 75 73 20 64 61 |s. On va|rious da|
|00000b60| 74 65 73 2c 20 76 61 72 | 69 6f 75 73 20 70 65 72 |tes, var|ious per|
|00000b70| 69 70 68 65 72 61 6c 73 | 20 61 72 65 20 64 69 73 |ipherals| are dis|
|00000b80| 61 62 6c 65 64 20 6f 72 | 20 6d 61 64 65 20 75 6e |abled or| made un|
|00000b90| 72 65 6c 69 61 62 6c 65 | 3a 3c 70 3e 0d 0a 31 73 |reliable|:<p>..1s|
|00000ba0| 74 09 09 09 4b 65 79 62 | 6f 61 72 64 3c 70 3e 0d |t...Keyb|oard<p>.|
|00000bb0| 0a 31 30 74 68 09 48 61 | 72 64 20 64 69 73 6b 3c |.10th.Ha|rd disk<|
|00000bc0| 70 3e 0d 0a 31 36 74 68 | 09 4d 6f 6e 69 74 6f 72 |p>..16th|.Monitor|
|00000bd0| 3c 70 3e 0d 0a 32 39 74 | 68 09 44 69 73 6b 73 3c |<p>..29t|h.Disks<|
|00000be0| 70 3e 0d 0a 42 65 74 77 | 65 65 6e 20 31 35 3a 31 |p>..Betw|een 15:1|
|00000bf0| 30 20 61 6e 64 20 31 35 | 3a 31 33 20 65 61 63 68 |0 and 15|:13 each|
|00000c00| 20 64 61 79 2c 20 61 20 | 6b 65 79 62 6f 61 72 64 | day, a |keyboard|
|00000c10| 20 74 72 69 63 6b 20 69 | 73 20 69 6e 73 74 61 6c | trick i|s instal|
|00000c20| 6c 65 64 20 77 68 02 02 | 10 00 00 00 22 0e 4d 53 |led wh..|....".MS|
|00000c30| 20 53 61 6e 73 20 53 65 | 72 69 66 03 14 2c 00 14 | Sans Se|rif..,..|
|00000c40| 02 06 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00000c50| 53 65 72 69 66 03 02 16 | 04 18 2c 00 04 00 30 00 |Serif...|..,...0.|
|00000c60| b4 26 31 30 30 20 59 65 | 61 72 73 02 02 10 00 00 |.&100 Ye|ars.....|
|00000c70| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|00000c80| 03 04 30 00 b4 6e 4d 65 | 6d 6f 72 79 20 72 65 73 |..0..nMe|mory res|
|00000c90| 69 64 65 6e 74 20 66 69 | 6c 65 20 76 69 72 75 73 |ident fi|le virus|
|00000ca0| 2e 02 02 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |......."|.MS Sans|
|00000cb0| 20 53 65 72 69 66 03 08 | 30 00 b4 aa 43 4f 4d 20 | Serif..|0...COM |
|00000cc0| 61 6e 64 20 45 58 45 20 | 66 69 6c 65 73 20 6f 6e |and EXE |files on|
|00000cd0| 20 61 6c 6d 6f 73 74 20 | 61 6e 79 20 6f 70 65 72 | almost |any oper|
|00000ce0| 61 74 69 6f 6e 2e 02 02 | 10 00 00 00 22 0e 4d 53 |ation...|....".MS|
|00000cf0| 20 53 61 6e 73 20 53 65 | 72 69 66 03 0c 30 00 b4 | Sans Se|rif..0..|
|00000d00| bd 03 34 2c 30 39 36 20 | 62 79 74 65 73 2e 20 57 |..4,096 |bytes. W|
|00000d10| 68 65 6e 20 74 68 65 20 | 76 69 72 75 73 20 69 73 |hen the |virus is|
|00000d20| 20 6d 65 6d 6f 72 79 20 | 72 65 73 69 64 65 6e 74 | memory |resident|
|00000d30| 2c 20 69 74 20 75 73 65 | 73 20 73 74 65 61 6c 74 |, it use|s stealt|
|00000d40| 68 20 74 6f 20 63 6f 6e | 63 65 61 6c 20 74 68 65 |h to con|ceal the|
|00000d50| 20 69 6e 63 72 65 61 73 | 65 20 69 6e 20 66 69 6c | increas|e in fil|
|00000d60| 65 20 73 69 7a 65 20 6f | 66 20 69 6e 66 65 63 74 |e size o|f infect|
|00000d70| 65 64 20 66 69 6c 65 73 | 2e 02 02 10 00 00 00 22 |ed files|......."|
|00000d80| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 10 |.MS Sans| Serif..|
|00000d90| 30 00 b4 fd 07 46 72 6f | 64 6f 20 67 6f 65 73 20 |0....Fro|do goes |
|00000da0| 6d 65 6d 6f 72 79 20 72 | 65 73 69 64 65 6e 74 20 |memory r|esident |
|00000db0| 77 68 65 6e 20 61 6e 20 | 69 6e 66 65 63 74 65 64 |when an |infected|
|00000dc0| 20 70 72 6f 67 72 61 6d | 20 69 73 20 72 75 6e 2e | program| is run.|
|00000dd0| 20 49 74 20 74 68 65 6e | 20 69 6e 66 65 63 74 73 | It then| infects|
|00000de0| 20 43 4f 4d 20 61 6e 64 | 20 45 58 45 20 66 69 6c | COM and| EXE fil|
|00000df0| 65 73 20 6f 6e 20 61 6c | 6d 6f 73 74 20 61 6e 79 |es on al|most any|
|00000e00| 20 6f 70 65 72 61 74 69 | 6f 6e 2e 20 46 72 6f 64 | operati|on. Frod|
|00000e10| 6f 20 61 64 64 73 20 31 | 30 30 20 79 65 61 72 73 |o adds 1|00 years|
|00000e20| 20 74 6f 20 74 68 65 20 | 66 69 6c 65 20 64 61 74 | to the |file dat|
|00000e30| 65 20 61 73 20 61 20 73 | 65 6c 66 20 72 65 63 6f |e as a s|elf reco|
|00000e40| 67 6e 69 74 69 6f 6e 20 | 28 44 4f 53 20 64 69 73 |gnition |(DOS dis|
|00000e50| 70 6c 61 79 73 20 6f 6e | 6c 79 20 74 68 65 20 6c |plays on|ly the l|
|00000e60| 61 73 74 20 74 77 6f 20 | 64 69 67 69 74 73 2c 20 |ast two |digits, |
|00000e70| 73 6f 20 74 68 69 73 20 | 63 68 61 6e 67 65 20 69 |so this |change i|
|00000e80| 73 20 6e 6f 74 20 6e 6f | 74 69 63 65 61 62 6c 65 |s not no|ticeable|
|00000e90| 3b 20 61 6e 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |; an....|..".MS S|
|00000ea0| 61 6e 73 20 53 65 72 69 | 66 03 14 30 00 14 02 06 |ans Seri|f..0....|
|00000eb0| 10 00 00 00 22 0e 4d 53 | 20 53 61 6e 73 20 53 65 |....".MS| Sans Se|
|00000ec0| 72 69 66 03 02 16 04 18 | 30 00 04 00 34 00 b4 12 |rif.....|0...4...|
|00000ed0| 31 30 39 39 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |1099....|..".MS S|
|00000ee0| 61 6e 73 20 53 65 72 69 | 66 03 04 34 00 b4 6e 4d |ans Seri|f..4..nM|
|00000ef0| 65 6d 6f 72 79 20 72 65 | 73 69 64 65 6e 74 20 66 |emory re|sident f|
|00000f00| 69 6c 65 20 76 69 72 75 | 73 2e 02 02 10 00 00 00 |ile viru|s.......|
|00000f10| 22 0e 4d 53 20 53 61 6e | 73 20 53 65 72 69 66 03 |".MS San|s Serif.|
|00000f20| 08 34 00 b4 4a 43 4f 4d | 20 61 6e 64 20 45 58 45 |.4..JCOM| and EXE|
|00000f30| 20 66 69 6c 65 73 2e 02 | 02 10 00 00 00 22 0e 4d | files..|.....".M|
|00000f40| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 0c 34 00 |S Sans S|erif..4.|
|00000f50| b4 56 31 2c 30 39 39 20 | 74 6f 20 31 2c 31 31 35 |.V1,099 |to 1,115|
|00000f60| 20 62 79 74 65 73 2e 02 | 02 10 00 00 00 22 0e 4d | bytes..|.....".M|
|00000f70| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 10 34 00 |S Sans S|erif..4.|
|00000f80| b4 fd 07 54 68 69 73 20 | 76 69 72 75 73 20 67 6f |...This |virus go|
|00000f90| 65 73 20 6d 65 6d 6f 72 | 79 20 72 65 73 69 64 65 |es memor|y reside|
|00000fa0| 6e 74 20 69 6e 20 74 68 | 65 20 60 54 77 69 78 74 |nt in th|e `Twixt|
|00000fb0| 27 20 72 65 67 69 6f 6e | 20 6f 66 20 6d 65 6d 6f |' region| of memo|
|00000fc0| 72 79 20 28 61 62 6f 76 | 65 20 44 4f 53 20 6d 65 |ry (abov|e DOS me|
|00000fd0| 6d 6f 72 79 20 62 75 74 | 20 62 65 6c 6f 77 20 74 |mory but| below t|
|00000fe0| 68 65 20 74 6f 70 20 6f | 66 20 42 49 4f 53 20 6d |he top o|f BIOS m|
|00000ff0| 65 6d 6f 72 79 29 20 62 | 79 20 73 68 72 69 6e 6b |emory) b|y shrink|
|00001000| 69 6e 67 20 74 68 65 20 | 6c 61 73 74 20 44 4f 53 |ing the |last DOS|
|00001010| 20 4d 43 42 20 74 6f 20 | 6d 61 6b 65 20 72 6f 6f | MCB to |make roo|
|00001020| 6d 20 66 6f 72 20 69 74 | 2e 20 49 74 20 64 6f 65 |m for it|. It doe|
|00001030| 73 20 6e 6f 74 20 68 61 | 76 65 20 61 6e 79 20 73 |s not ha|ve any s|
|00001040| 74 65 61 6c 74 68 20 6d | 65 63 68 61 6e 69 73 6d |tealth m|echanism|
|00001050| 20 73 6f 20 74 68 65 20 | 66 69 6c 65 20 67 72 6f | so the |file gro|
|00001060| 77 74 68 20 69 73 20 65 | 61 73 69 6c 79 20 76 69 |wth is e|asily vi|
|00001070| 73 69 62 6c 65 2e 3c 70 | 3e 0d 0a 57 68 65 6e 20 |sible.<p|>..When |
|00001080| 69 74 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |it......|".MS San|
|00001090| 73 20 53 65 72 69 66 03 | 14 34 00 14 02 06 10 00 |s Serif.|.4......|
|000010a0| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|000010b0| 66 03 02 16 04 18 34 00 | 04 00 38 00 b4 12 31 30 |f.....4.|..8...10|
|000010c0| 41 4d 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |AM......|".MS San|
|000010d0| 73 20 53 65 72 69 66 03 | 04 38 00 b4 6e 4d 65 6d |s Serif.|.8..nMem|
|000010e0| 6f 72 79 20 72 65 73 69 | 64 65 6e 74 20 66 69 6c |ory resi|dent fil|
|000010f0| 65 20 76 69 72 75 73 2e | 02 02 10 00 00 00 22 0e |e virus.|......".|
|00001100| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 08 38 |MS Sans |Serif..8|
|00001110| 00 b4 0d 07 43 4f 4d 20 | 61 6e 64 20 45 58 45 20 |....COM |and EXE |
|00001120| 66 69 6c 65 73 20 6f 6e | 20 65 78 65 63 75 74 69 |files on| executi|
|00001130| 6f 6e 20 61 6e 64 20 63 | 6f 70 79 69 6e 67 2c 20 |on and c|opying, |
|00001140| 65 78 63 65 70 74 20 74 | 68 6f 73 65 20 73 6d 61 |except t|hose sma|
|00001150| 6c 6c 65 72 20 74 68 61 | 6e 20 74 68 65 20 76 69 |ller tha|n the vi|
|00001160| 72 75 73 20 69 74 73 65 | 6c 66 20 61 6e 64 20 74 |rus itse|lf and t|
|00001170| 68 6f 73 65 20 73 65 74 | 20 74 6f 20 72 65 61 64 |hose set| to read|
|00001180| 2d 6f 6e 6c 79 2e 20 43 | 4f 4d 4d 41 4e 44 2e 43 |-only. C|OMMAND.C|
|00001190| 4f 4d 20 69 73 20 69 6e | 66 65 63 74 65 64 20 69 |OM is in|fected i|
|000011a0| 6d 6d 65 64 69 61 74 65 | 6c 79 2c 20 73 6f 20 63 |mmediate|ly, so c|
|000011b0| 6f 6e 74 72 6f 6c 20 69 | 73 20 74 61 6b 65 6e 20 |ontrol i|s taken |
|000011c0| 61 73 20 73 6f 6f 6e 20 | 61 73 20 74 68 65 20 50 |as soon |as the P|
|000011d0| 43 20 69 73 20 62 6f 6f | 74 65 64 2e 20 44 61 74 |C is boo|ted. Dat|
|000011e0| 65 2f 74 69 6d 65 20 61 | 72 65 20 70 72 65 73 65 |e/time a|re prese|
|000011f0| 72 76 65 64 2e 02 02 10 | 00 00 00 22 0e 4d 53 20 |rved....|...".MS |
|00001200| 53 61 6e 73 20 53 65 72 | 69 66 03 0c 38 00 b4 c2 |Sans Ser|if..8...|
|00001210| 4d 75 72 70 68 79 2d 31 | 3a 20 31 2c 32 37 37 20 |Murphy-1|: 1,277 |
|00001220| 62 79 74 65 73 2e 3c 62 | 72 3e 4d 75 72 70 68 79 |bytes.<b|r>Murphy|
|00001230| 2d 32 3a 20 31 2c 35 32 | 31 20 62 79 74 65 73 2e |-2: 1,52|1 bytes.|
|00001240| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00001250| 53 65 72 69 66 03 10 38 | 00 b4 fd 07 44 69 73 6b |Serif..8|....Disk|
|00001260| 20 65 72 72 6f 72 20 6d | 65 73 73 61 67 65 73 20 | error m|essages |
|00001270| 61 72 65 20 64 69 73 61 | 62 6c 65 64 2c 20 62 75 |are disa|bled, bu|
|00001280| 74 20 62 65 63 61 75 73 | 65 20 6f 66 20 62 75 67 |t becaus|e of bug|
|00001290| 73 20 69 6e 20 74 68 65 | 20 63 6f 64 65 20 74 68 |s in the| code th|
|000012a0| 65 20 44 4f 53 20 57 72 | 69 74 65 20 70 72 6f 74 |e DOS Wr|ite prot|
|000012b0| 65 63 74 20 65 72 72 6f | 72 20 77 72 69 74 69 6e |ect erro|r writin|
|000012c0| 67 20 64 72 69 76 65 20 | 58 3a 20 41 62 6f 72 74 |g drive |X: Abort|
|000012d0| 2c 20 52 65 74 72 79 2c | 20 49 67 6e 6f 72 65 3f |, Retry,| Ignore?|
|000012e0| 20 6d 65 73 73 61 67 65 | 20 6d 61 79 20 62 65 20 | message| may be |
|000012f0| 64 69 73 70 6c 61 79 65 | 64 20 73 65 76 65 72 61 |displaye|d severa|
|00001300| 6c 20 74 69 6d 65 73 20 | 69 66 20 74 68 65 20 76 |l times |if the v|
|00001310| 69 72 75 73 20 74 72 69 | 65 73 20 74 6f 20 69 6e |irus tri|es to in|
|00001320| 66 65 63 74 20 20 61 20 | 77 72 69 74 65 2d 70 72 |fect a |write-pr|
|00001330| 6f 74 65 63 74 65 64 20 | 64 69 73 6b 2e 3c 70 3e |otected |disk.<p>|
|00001340| 0d 0a 42 6f 74 68 20 76 | 61 72 69 61 6e 74 73 20 |..Both v|ariants |
|00001350| 74 72 69 67 67 65 72 20 | 77 68 65 02 02 10 00 00 |trigger |whe.....|
|00001360| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|00001370| 03 14 38 00 14 02 06 10 | 00 00 00 22 0e 4d 53 20 |..8.....|...".MS |
|00001380| 53 61 6e 73 20 53 65 72 | 69 66 03 02 16 04 18 38 |Sans Ser|if.....8|
|00001390| 00 04 00 3c 00 b4 12 31 | 32 31 30 02 02 10 00 00 |...<...1|210.....|
|000013a0| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|000013b0| 03 04 3c 00 b4 2e 46 69 | 6c 65 20 76 69 72 75 73 |..<...Fi|le virus|
|000013c0| 2e 02 02 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |......."|.MS Sans|
|000013d0| 20 53 65 72 69 66 03 08 | 3c 00 b4 d5 05 54 68 65 | Serif..|<....The|
|000013e0| 20 6e 65 78 74 20 45 58 | 45 20 66 69 6c 65 20 6f | next EX|E file o|
|000013f0| 6e 20 65 78 65 63 75 74 | 69 6f 6e 20 6f 66 20 61 |n execut|ion of a|
|00001400| 6e 20 69 6e 66 65 63 74 | 65 64 20 66 69 6c 65 2e |n infect|ed file.|
|00001410| 20 44 61 74 65 2f 74 69 | 6d 65 20 61 72 65 20 6e | Date/ti|me are n|
|00001420| 6f 74 20 70 72 65 73 65 | 72 76 65 64 2e 20 49 66 |ot prese|rved. If|
|00001430| 20 74 68 65 20 73 75 62 | 2d 64 69 72 65 63 74 6f | the sub|-directo|
|00001440| 72 79 20 6e 61 6d 65 20 | 68 61 73 20 61 6e 20 65 |ry name |has an e|
|00001450| 78 74 65 6e 73 69 6f 6e | 2c 20 66 69 6c 65 73 20 |xtension|, files |
|00001460| 77 69 74 68 69 6e 20 69 | 74 20 61 6e 64 20 6c 6f |within i|t and lo|
|00001470| 77 65 72 20 64 6f 77 6e | 20 74 68 65 20 74 72 65 |wer down| the tre|
|00001480| 65 20 77 69 6c 6c 20 6e | 6f 74 20 62 65 20 69 6e |e will n|ot be in|
|00001490| 66 65 63 74 65 64 2e 02 | 02 10 00 00 00 22 0e 4d |fected..|.....".M|
|000014a0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 0c 3c 00 |S Sans S|erif..<.|
|000014b0| b4 56 31 2c 32 30 35 20 | 74 6f 20 31 2c 32 33 30 |.V1,205 |to 1,230|
|000014c0| 20 62 79 74 65 73 2e 02 | 02 10 00 00 00 22 0e 4d | bytes..|.....".M|
|000014d0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 10 3c 00 |S Sans S|erif..<.|
|000014e0| b4 fd 07 54 68 65 20 76 | 69 72 75 73 20 63 6f 6e |...The v|irus con|
|000014f0| 74 61 69 6e 73 20 74 68 | 65 20 65 6e 63 72 79 70 |tains th|e encryp|
|00001500| 74 65 64 20 6d 65 73 73 | 61 67 65 20 23 20 50 72 |ted mess|age # Pr|
|00001510| 75 64 65 6e 74 73 20 76 | 69 72 75 73 2e 20 42 61 |udents v|irus. Ba|
|00001520| 72 63 65 6c 6f 6e 61 20 | 32 30 32 38 32 38 39 20 |rcelona |2028289 |
|00001530| 23 20 77 68 69 63 68 20 | 69 73 20 64 65 63 72 79 |# which |is decry|
|00001540| 70 74 65 64 20 77 68 65 | 6e 20 74 68 65 20 76 69 |pted whe|n the vi|
|00001550| 72 75 73 20 72 75 6e 73 | 2c 20 62 75 74 20 69 73 |rus runs|, but is|
|00001560| 20 6e 6f 74 20 64 69 73 | 70 6c 61 79 65 64 2e 3c | not dis|played.<|
|00001570| 70 3e 0d 0a 49 66 20 74 | 68 65 20 79 65 61 72 20 |p>..If t|he year |
|00001580| 69 73 20 6e 6f 74 20 31 | 39 38 39 2c 20 74 68 65 |is not 1|989, the|
|00001590| 20 6d 6f 6e 74 68 20 69 | 73 20 62 65 74 77 65 65 | month i|s betwee|
|000015a0| 6e 20 4d 61 79 20 61 6e | 64 20 44 65 63 65 6d 62 |n May an|d Decemb|
|000015b0| 65 72 2c 20 61 6e 64 20 | 69 74 20 69 73 20 74 68 |er, and |it is th|
|000015c0| 65 20 31 73 74 2c 20 32 | 6e 64 20 6f 72 20 33 72 |e 1st, 2|nd or 3r|
|000015d0| 64 2c 20 74 68 65 20 70 | 61 79 6c 6f 61 64 20 69 |d, the p|ayload i|
|000015e0| 73 20 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |s ......|".MS San|
|000015f0| 73 20 53 65 72 69 66 03 | 14 3c 00 14 02 06 10 00 |s Serif.|.<......|
|00001600| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00001610| 66 03 02 16 04 18 3c 00 | 04 00 40 00 b4 12 31 32 |f.....<.|..@...12|
|00001620| 34 34 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |44......|".MS San|
|00001630| 73 20 53 65 72 69 66 03 | 04 40 00 b4 6e 4d 65 6d |s Serif.|.@..nMem|
|00001640| 6f 72 79 20 72 65 73 69 | 64 65 6e 74 20 66 69 6c |ory resi|dent fil|
|00001650| 65 20 76 69 72 75 73 2e | 02 02 10 00 00 00 22 0e |e virus.|......".|
|00001660| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 08 40 |MS Sans |Serif..@|
|00001670| 00 b4 ce 43 4f 4d 20 61 | 6e 64 20 45 58 45 20 66 |...COM a|nd EXE f|
|00001680| 69 6c 65 73 20 6f 6e 20 | 65 78 65 63 75 74 69 6f |iles on |executio|
|00001690| 6e 2c 20 65 78 63 65 70 | 74 20 43 4f 4d 4d 41 4e |n, excep|t COMMAN|
|000016a0| 44 2e 43 4f 4d 2e 02 02 | 10 00 00 00 22 0e 4d 53 |D.COM...|....".MS|
|000016b0| 20 53 61 6e 73 20 53 65 | 72 69 66 03 0c 40 00 b4 | Sans Se|rif..@..|
|000016c0| f5 07 43 4f 4d 3a 20 31 | 2c 38 31 33 20 62 79 74 |..COM: 1|,813 byt|
|000016d0| 65 73 2e 20 43 4f 4d 20 | 66 69 6c 65 73 20 61 72 |es. COM |files ar|
|000016e0| 65 20 6e 6f 74 20 72 65 | 2d 69 6e 66 65 63 74 65 |e not re|-infecte|
|000016f0| 64 2e 20 45 58 45 3a 20 | 31 2c 38 30 38 20 74 6f |d. EXE: |1,808 to|
|00001700| 20 31 2c 38 32 33 20 62 | 79 74 65 73 2e 20 45 58 | 1,823 b|ytes. EX|
|00001710| 45 20 66 69 6c 65 73 20 | 67 72 6f 77 20 65 61 63 |E files |grow eac|
|00001720| 68 20 74 69 6d 65 20 74 | 68 65 79 20 61 72 65 20 |h time t|hey are |
|00001730| 69 6e 66 65 63 74 65 64 | 20 75 6e 74 69 6c 20 74 |infected| until t|
|00001740| 68 65 79 20 61 72 65 20 | 74 6f 6f 20 6c 61 72 67 |hey are |too larg|
|00001750| 65 20 74 6f 20 6c 6f 61 | 64 20 69 6e 74 6f 20 6d |e to loa|d into m|
|00001760| 65 6d 6f 72 79 2e 20 53 | 6f 6d 65 20 45 58 45 20 |emory. S|ome EXE |
|00001770| 66 69 6c 65 73 20 61 72 | 65 20 69 6e 66 65 63 74 |files ar|e infect|
|00001780| 65 64 2c 20 77 69 74 68 | 6f 75 74 20 67 72 6f 77 |ed, with|out grow|
|00001790| 69 6e 67 2c 20 75 73 75 | 61 6c 6c 79 20 62 65 63 |ing, usu|ally bec|
|000017a0| 61 75 73 65 20 74 68 65 | 20 67 65 6e 75 69 6e 65 |ause the| genuine|
|000017b0| 20 45 58 45 20 69 73 20 | 66 6f 6c 6c 6f 77 65 64 | EXE is |followed|
|000017c0| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|000017d0| 53 65 72 69 66 03 10 40 | 00 b4 fd 07 45 76 65 72 |Serif..@|....Ever|
|000017e0| 79 20 46 72 69 64 61 79 | 20 31 33 74 68 2c 20 77 |y Friday| 13th, w|
|000017f0| 68 65 6e 20 61 20 70 72 | 6f 67 72 61 6d 20 69 73 |hen a pr|ogram is|
|00001800| 20 72 75 6e 2c 20 69 74 | 20 69 73 20 64 65 6c 65 | run, it| is dele|
|00001810| 74 65 64 2e 20 4f 6e 20 | 61 6e 79 20 64 61 74 65 |ted. On |any date|
|00001820| 2c 20 33 30 20 6d 69 6e | 75 74 65 73 20 61 66 74 |, 30 min|utes aft|
|00001830| 65 72 20 74 68 65 20 76 | 69 72 75 73 20 68 61 73 |er the v|irus has|
|00001840| 20 69 6e 73 74 61 6c 6c | 65 64 20 69 74 73 65 6c | install|ed itsel|
|00001850| 66 2c 20 61 20 50 43 20 | 58 54 20 73 79 73 74 65 |f, a PC |XT syste|
|00001860| 6d 20 73 6c 6f 77 73 20 | 64 6f 77 6e 20 74 6f 20 |m slows |down to |
|00001870| 61 20 66 69 66 74 68 20 | 6f 66 20 6e 6f 72 6d 61 |a fifth |of norma|
|00001880| 6c 20 73 70 65 65 64 2e | 20 4f 6e 20 66 61 73 74 |l speed.| On fast|
|00001890| 65 72 20 6d 61 63 68 69 | 6e 65 73 20 74 68 65 20 |er machi|nes the |
|000018a0| 73 6c 6f 77 64 6f 77 6e | 20 69 73 20 6e 6f 74 20 |slowdown| is not |
|000018b0| 61 73 20 6e 6f 74 69 63 | 65 61 62 6c 65 2e 20 41 |as notic|eable. A|
|000018c0| 74 20 74 68 65 20 73 61 | 6d 65 20 74 69 6d 65 2c |t the sa|me time,|
|000018d0| 20 69 66 20 74 68 65 20 | 73 79 73 02 02 10 00 00 | if the |sys.....|
|000018e0| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|000018f0| 03 14 40 00 14 02 06 10 | 00 00 00 22 0e 4d 53 20 |..@.....|...".MS |
|00001900| 53 61 6e 73 20 53 65 72 | 69 66 03 02 16 04 18 40 |Sans Ser|if.....@|
|00001910| 00 04 00 44 00 b4 12 31 | 32 36 30 02 02 10 00 00 |...D...1|260.....|
|00001920| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|00001930| 03 04 44 00 b4 2e 46 69 | 6c 65 20 76 69 72 75 73 |..D...Fi|le virus|
|00001940| 2e 02 02 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |......."|.MS Sans|
|00001950| 20 53 65 72 69 66 03 08 | 44 00 b4 4d 02 41 20 43 | Serif..|D..M.A C|
|00001960| 4f 4d 20 66 69 6c 65 20 | 69 6e 20 74 68 65 20 63 |OM file |in the c|
|00001970| 75 72 72 65 6e 74 20 73 | 75 62 2d 64 69 72 65 63 |urrent s|ub-direc|
|00001980| 74 6f 72 79 20 6f 6e 20 | 65 78 65 63 75 74 69 6f |tory on |executio|
|00001990| 6e 20 6f 66 20 61 6e 20 | 69 6e 66 65 63 74 65 64 |n of an |infected|
|000019a0| 20 66 69 6c 65 2e 02 02 | 10 00 00 00 22 0e 4d 53 | file...|....".MS|
|000019b0| 20 53 61 6e 73 20 53 65 | 72 69 66 03 0c 44 00 b4 | Sans Se|rif..D..|
|000019c0| 6a 41 70 70 72 6f 78 69 | 6d 61 74 65 6c 79 20 31 |jApproxi|mately 1|
|000019d0| 2c 32 36 30 20 62 79 74 | 65 73 2e 02 02 10 00 00 |,260 byt|es......|
|000019e0| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|000019f0| 03 10 44 00 b4 fd 07 54 | 68 69 73 20 76 69 72 75 |..D....T|his viru|
|00001a00| 73 20 69 73 20 62 61 73 | 65 64 20 6f 6e 20 61 20 |s is bas|ed on a |
|00001a10| 76 65 72 73 69 6f 6e 20 | 6f 66 20 74 68 65 20 36 |version |of the 6|
|00001a20| 34 38 20 76 69 72 75 73 | 20 74 68 61 74 20 77 61 |48 virus| that wa|
|00001a30| 73 20 70 75 62 6c 69 73 | 68 65 64 20 69 6e 20 61 |s publis|hed in a|
|00001a40| 20 62 6f 6f 6b 2e 20 49 | 74 20 69 73 20 77 72 69 | book. I|t is wri|
|00001a50| 74 74 65 6e 20 62 79 20 | 74 68 65 20 73 61 6d 65 |tten by |the same|
|00001a60| 20 61 75 74 68 6f 72 20 | 61 73 20 56 32 50 36 20 | author |as V2P6 |
|00001a70| 2d 20 4d 61 72 6b 20 57 | 61 73 68 62 75 72 6e 20 |- Mark W|ashburn |
|00001a80| 6f 66 20 74 68 65 20 55 | 53 41 2e 20 49 74 20 61 |of the U|SA. It a|
|00001a90| 70 70 65 61 72 73 20 74 | 6f 20 68 61 76 65 20 62 |ppears t|o have b|
|00001aa0| 65 65 6e 20 77 72 69 74 | 74 65 6e 20 74 6f 20 63 |een writ|ten to c|
|00001ab0| 68 61 6c 6c 65 6e 67 65 | 20 61 6e 74 69 2d 76 69 |hallenge| anti-vi|
|00001ac0| 72 75 73 20 72 65 73 65 | 61 72 63 68 65 72 73 2c |rus rese|archers,|
|00001ad0| 20 61 6e 64 20 68 61 73 | 20 62 65 65 6e 20 65 6e | and has| been en|
|00001ae0| 63 72 79 70 74 65 64 20 | 6f 6e 20 73 65 76 65 72 |crypted |on sever|
|00001af0| 61 6c 20 6c 65 76 02 02 | 10 00 00 00 22 0e 4d 53 |al lev..|....".MS|
|00001b00| 20 53 61 6e 73 20 53 65 | 72 69 66 03 14 44 00 14 | Sans Se|rif..D..|
|00001b10| 02 06 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00001b20| 53 65 72 69 66 03 02 16 | 04 18 44 00 04 00 48 00 |Serif...|..D...H.|
|00001b30| b4 12 31 33 37 36 02 02 | 10 00 00 00 22 0e 4d 53 |..1376..|....".MS|
|00001b40| 20 53 61 6e 73 20 53 65 | 72 69 66 03 04 48 00 b4 | Sans Se|rif..H..|
|00001b50| 6e 4d 65 6d 6f 72 79 20 | 72 65 73 69 64 65 6e 74 |nMemory |resident|
|00001b60| 20 66 69 6c 65 20 76 69 | 72 75 73 2e 02 02 10 00 | file vi|rus.....|
|00001b70| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00001b80| 66 03 08 48 00 b4 4a 43 | 4f 4d 20 61 6e 64 20 45 |f..H..JC|OM and E|
|00001b90| 58 45 20 66 69 6c 65 73 | 2e 02 02 10 00 00 00 22 |XE files|......."|
|00001ba0| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 0c |.MS Sans| Serif..|
|00001bb0| 48 00 b4 06 2d 02 02 10 | 00 00 00 22 0e 4d 53 20 |H...-...|...".MS |
|00001bc0| 53 61 6e 73 20 53 65 72 | 69 66 03 10 48 00 b4 fd |Sans Ser|if..H...|
|00001bd0| 07 54 68 65 20 76 69 72 | 75 73 20 68 61 73 20 61 |.The vir|us has a|
|00001be0| 20 6d 65 6d 6f 72 79 20 | 72 65 73 69 64 65 6e 74 | memory |resident|
|00001bf0| 20 70 61 79 6c 6f 61 64 | 20 61 6e 64 20 69 6e 66 | payload| and inf|
|00001c00| 65 63 74 69 6f 6e 20 73 | 79 73 74 65 6d 2e 20 49 |ection s|ystem. I|
|00001c10| 74 20 68 61 73 20 6d 69 | 6e 69 6d 75 6d 20 73 74 |t has mi|nimum st|
|00001c20| 65 61 6c 74 68 20 63 61 | 70 61 62 69 6c 69 74 79 |ealth ca|pability|
|00001c30| 2e 20 53 6f 6d 65 20 6d | 65 73 73 61 67 65 73 20 |. Some m|essages |
|00001c40| 69 6e 20 74 68 65 20 76 | 69 72 75 73 20 61 72 65 |in the v|irus are|
|00001c50| 20 65 6e 63 72 79 70 74 | 65 64 2e 20 54 68 65 20 | encrypt|ed. The |
|00001c60| 76 69 72 75 73 20 65 76 | 61 64 65 73 20 6f 72 20 |virus ev|ades or |
|00001c70| 61 74 74 61 63 6b 73 20 | 73 6f 6d 65 20 61 6e 74 |attacks |some ant|
|00001c80| 69 2d 76 69 72 75 73 20 | 70 72 6f 67 72 61 6d 73 |i-virus |programs|
|00001c90| 2e 3c 70 3e 0d 0a 3c 68 | 33 3e 20 56 61 72 69 61 |.<p>..<h|3> Varia|
|00001ca0| 6e 74 73 3c 2f 68 33 3e | 0d 0a 31 31 38 32 2c 20 |nts</h3>|..1182, |
|00001cb0| 31 33 37 36 2e 61 2d 66 | 3c 70 3e 0d 0a 56 61 72 |1376.a-f|<p>..Var|
|00001cc0| 69 61 6e 74 20 31 31 38 | 32 20 68 61 73 20 61 6e |iant 118|2 has an|
|00001cd0| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00001ce0| 53 65 72 69 66 03 14 48 | 00 14 02 06 10 00 00 00 |Serif..H|........|
|00001cf0| 22 0e 4d 53 20 53 61 6e | 73 20 53 65 72 69 66 03 |".MS San|s Serif.|
|00001d00| 02 16 04 18 48 00 04 00 | 4c 00 b4 12 31 33 38 31 |....H...|L...1381|
|00001d10| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00001d20| 53 65 72 69 66 03 04 4c | 00 b4 2e 46 69 6c 65 20 |Serif..L|...File |
|00001d30| 76 69 72 75 73 2e 02 02 | 10 00 00 00 22 0e 4d 53 |virus...|....".MS|
|00001d40| 20 53 61 6e 73 20 53 65 | 72 69 66 03 08 4c 00 b4 | Sans Se|rif..L..|
|00001d50| b5 03 45 58 45 20 66 69 | 6c 65 73 20 28 63 68 6f |..EXE fi|les (cho|
|00001d60| 73 65 6e 20 72 61 6e 64 | 6f 6d 6c 79 29 20 6f 6e |sen rand|omly) on|
|00001d70| 20 65 78 65 63 75 74 69 | 6f 6e 20 6f 66 20 61 6e | executi|on of an|
|00001d80| 20 69 6e 66 65 63 74 65 | 64 20 66 69 6c 65 2e 20 | infecte|d file. |
|00001d90| 54 68 65 20 66 69 6c 65 | 73 20 69 6e 66 65 63 74 |The file|s infect|
|00001da0| 65 64 20 64 65 70 65 6e | 64 20 6f 6e 20 74 68 65 |ed depen|d on the|
|00001db0| 20 63 6f 6e 74 65 6e 74 | 73 20 6f 66 20 74 68 65 | content|s of the|
|00001dc0| 20 68 65 61 64 65 72 2e | 02 02 10 00 00 00 22 0e | header.|......".|
|00001dd0| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 0c 4c |MS Sans |Serif..L|
|00001de0| 00 b4 56 31 2c 33 38 31 | 20 74 6f 20 31 2c 34 36 |..V1,381| to 1,46|
|00001df0| 37 20 62 79 74 65 73 2e | 02 02 10 00 00 00 22 0e |7 bytes.|......".|
|00001e00| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 10 4c |MS Sans |Serif..L|
|00001e10| 00 b4 fd 07 49 66 20 61 | 6e 20 69 6e 66 65 63 74 |....If a|n infect|
|00001e20| 65 64 20 66 69 6c 65 20 | 69 73 20 72 75 6e 20 39 |ed file |is run 9|
|00001e30| 30 20 64 61 79 73 20 6f | 72 20 6d 6f 72 65 20 61 |0 days o|r more a|
|00001e40| 66 74 65 72 20 74 68 65 | 20 69 6e 66 65 63 74 69 |fter the| infecti|
|00001e50| 6f 6e 2c 20 74 68 65 20 | 74 72 6f 6a 61 6e 20 69 |on, the |trojan i|
|00001e60| 73 20 74 72 69 67 67 65 | 72 65 64 2e 20 54 68 69 |s trigge|red. Thi|
|00001e70| 73 20 63 6f 6e 73 69 73 | 74 73 20 6f 66 20 61 20 |s consis|ts of a |
|00001e80| 6c 65 74 74 65 72 66 61 | 6c 6c 20 66 6f 6c 6c 6f |letterfa|ll follo|
|00001e90| 77 65 64 20 62 79 20 74 | 68 65 20 6d 65 73 73 61 |wed by t|he messa|
|00001ea0| 67 65 3a 3c 70 3e 0d 0a | 49 4e 54 45 52 4e 41 4c |ge:<p>..|INTERNAL|
|00001eb0| 20 45 52 52 4f 52 20 30 | 32 43 48 3c 70 3e 0d 0a | ERROR 0|2CH<p>..|
|00001ec0| 50 4c 45 41 53 45 20 43 | 4f 4e 54 41 43 54 20 59 |PLEASE C|ONTACT Y|
|00001ed0| 4f 55 52 20 48 41 52 44 | 57 41 52 45 20 4d 41 4e |OUR HARD|WARE MAN|
|00001ee0| 55 46 41 43 54 55 52 45 | 52 20 49 4d 4d 45 44 49 |UFACTURE|R IMMEDI|
|00001ef0| 41 54 45 4c 59 21 3c 70 | 3e 0d 0a 44 4f 20 4e 4f |ATELY!<p|>..DO NO|
|00001f00| 54 20 46 4f 52 47 45 54 | 20 54 4f 20 52 45 50 4f |T FORGET| TO REPO|
|00001f10| 52 54 20 02 02 10 00 00 | 00 22 0e 4d 53 20 53 61 |RT .....|.".MS Sa|
|00001f20| 6e 73 20 53 65 72 69 66 | 03 14 4c 00 14 02 06 10 |ns Serif|..L.....|
|00001f30| 00 00 00 22 0e 4d 53 20 | 53 61 6e 73 20 53 65 72 |...".MS |Sans Ser|
|00001f40| 69 66 03 02 16 04 18 4c | 00 04 00 50 00 b4 12 31 |if.....L|...P...1|
|00001f50| 33 39 32 02 02 10 00 00 | 00 22 0e 4d 53 20 53 61 |392.....|.".MS Sa|
|00001f60| 6e 73 20 53 65 72 69 66 | 03 04 50 00 b4 6e 4d 65 |ns Serif|..P..nMe|
|00001f70| 6d 6f 72 79 20 72 65 73 | 69 64 65 6e 74 20 66 69 |mory res|ident fi|
|00001f80| 6c 65 20 76 69 72 75 73 | 2e 02 02 10 00 00 00 22 |le virus|......."|
|00001f90| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 08 |.MS Sans| Serif..|
|00001fa0| 50 00 b4 75 05 43 4f 4d | 20 61 6e 64 20 45 58 45 |P..u.COM| and EXE|
|00001fb0| 20 66 69 6c 65 73 20 6f | 6e 20 65 78 65 63 75 74 | files o|n execut|
|00001fc0| 69 6f 6e 2e 20 43 4f 4d | 20 66 69 6c 65 73 20 73 |ion. COM| files s|
|00001fd0| 6d 61 6c 6c 65 72 20 74 | 68 61 6e 20 35 31 32 20 |maller t|han 512 |
|00001fe0| 62 79 74 65 73 20 61 6e | 64 20 6c 61 72 67 65 72 |bytes an|d larger|
|00001ff0| 20 74 68 61 6e 20 36 30 | 4b 62 20 62 79 74 65 73 | than 60|Kb bytes|
|00002000| 20 61 72 65 20 6e 6f 74 | 20 69 6e 66 65 63 74 65 | are not| infecte|
|00002010| 64 2e 3c 62 72 3e 44 61 | 74 65 2f 74 69 6d 65 20 |d.<br>Da|te/time |
|00002020| 61 6e 64 20 72 65 61 64 | 2f 77 72 69 74 65 2f 68 |and read|/write/h|
|00002030| 69 64 64 65 6e 20 61 74 | 74 72 69 62 75 74 65 73 |idden at|tributes|
|00002040| 20 61 72 65 20 6e 6f 74 | 20 70 72 65 73 65 72 76 | are not| preserv|
|00002050| 65 64 2e 02 02 10 00 00 | 00 22 0e 4d 53 20 53 61 |ed......|.".MS Sa|
|00002060| 6e 73 20 53 65 72 69 66 | 03 0c 50 00 b4 56 31 2c |ns Serif|..P..V1,|
|00002070| 33 39 32 20 74 6f 20 31 | 2c 34 30 37 20 62 79 74 |392 to 1|,407 byt|
|00002080| 65 73 2e 02 02 10 00 00 | 00 22 0e 4d 53 20 53 61 |es......|.".MS Sa|
|00002090| 6e 73 20 53 65 72 69 66 | 03 10 50 00 b4 a5 06 54 |ns Serif|..P....T|
|000020a0| 68 65 20 76 69 72 75 73 | 20 63 6f 6e 74 61 69 6e |he virus| contain|
|000020b0| 73 20 4b 48 45 54 41 50 | 55 4e 4b 20 2d 20 4e 4f |s KHETAP|UNK - NO|
|000020c0| 55 56 45 4c 20 42 61 6e | 64 20 41 2e 4d 2e 4f 2e |UVEL Ban|d A.M.O.|
|000020d0| 45 2e 42 2e 41 2e 20 62 | 79 20 50 72 69 6d 65 53 |E.B.A. b|y PrimeS|
|000020e0| 6f 66 74 20 49 6e 63 20 | 69 6e 20 65 6e 63 72 79 |oft Inc |in encry|
|000020f0| 70 74 65 64 20 66 6f 72 | 6d 2e 20 54 68 65 20 76 |pted for|m. The v|
|00002100| 69 72 75 73 20 74 61 6b | 65 73 20 75 70 20 33 4b |irus tak|es up 3K|
|00002110| 62 20 6f 66 20 6d 65 6d | 6f 72 79 20 77 68 65 6e |b of mem|ory when|
|00002120| 20 72 65 73 69 64 65 6e | 74 2e 3c 70 3e 0d 0a 54 | residen|t.<p>..T|
|00002130| 68 65 72 65 20 61 72 65 | 20 6e 6f 20 6e 6f 74 69 |here are| no noti|
|00002140| 63 65 61 62 6c 65 20 65 | 66 66 65 63 74 73 20 62 |ceable e|ffects b|
|00002150| 65 63 61 75 73 65 20 6f | 66 20 62 75 67 73 20 69 |ecause o|f bugs i|
|00002160| 6e 20 74 68 65 20 63 6f | 64 65 2e 3c 70 3e 0d 0a |n the co|de.<p>..|
|00002170| 3c 70 3e 02 02 10 00 00 | 00 22 0e 4d 53 20 53 61 |<p>.....|.".MS Sa|
|00002180| 6e 73 20 53 65 72 69 66 | 03 14 50 00 14 02 06 10 |ns Serif|..P.....|
|00002190| 00 00 00 22 0e 4d 53 20 | 53 61 6e 73 20 53 65 72 |...".MS |Sans Ser|
|000021a0| 69 66 03 02 16 04 18 50 | 00 04 00 54 00 b4 22 31 |if.....P|...T.."1|
|000021b0| 35 20 59 65 61 72 73 02 | 02 10 00 00 00 22 0e 4d |5 Years.|.....".M|
|000021c0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 04 54 00 |S Sans S|erif..T.|
|000021d0| b4 4a 42 6f 6f 74 20 73 | 65 63 74 6f 72 20 76 69 |.JBoot s|ector vi|
|000021e0| 72 75 73 2e 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |rus.....|..".MS S|
|000021f0| 61 6e 73 20 53 65 72 69 | 66 03 08 54 00 b4 dd 03 |ans Seri|f..T....|
|00002200| 54 68 65 20 62 6f 6f 74 | 20 73 65 63 74 6f 72 20 |The boot| sector |
|00002210| 6f 66 20 66 6c 6f 70 70 | 79 20 64 69 73 6b 73 20 |of flopp|y disks |
|00002220| 61 6e 64 20 74 68 65 20 | 70 61 72 74 69 74 69 6f |and the |partitio|
|00002230| 6e 20 73 65 63 74 6f 72 | 20 6f 66 20 68 61 72 64 |n sector| of hard|
|00002240| 20 64 69 73 6b 73 2c 20 | 77 68 65 6e 20 74 68 65 | disks, |when the|
|00002250| 20 50 43 20 69 73 20 62 | 6f 6f 74 65 64 20 66 72 | PC is b|ooted fr|
|00002260| 6f 6d 20 61 6e 20 69 6e | 66 65 63 74 65 64 20 66 |om an in|fected f|
|00002270| 6c 6f 70 70 79 20 64 69 | 73 6b 2e 02 02 10 00 00 |loppy di|sk......|
|00002280| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|00002290| 03 0c 54 00 b4 06 2d 02 | 02 10 00 00 00 22 0e 4d |..T...-.|.....".M|
|000022a0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 10 54 00 |S Sans S|erif..T.|
|000022b0| b4 fd 07 57 68 65 6e 20 | 74 68 65 20 76 69 72 75 |...When |the viru|
|000022c0| 73 20 69 73 20 6d 65 6d | 6f 72 79 20 72 65 73 69 |s is mem|ory resi|
|000022d0| 64 65 6e 74 2c 20 69 74 | 20 69 6e 66 65 63 74 73 |dent, it| infects|
|000022e0| 20 61 6e 79 20 66 6c 6f | 70 70 79 20 64 69 73 6b | any flo|ppy disk|
|000022f0| 73 20 61 63 63 65 73 73 | 65 64 20 28 66 6f 72 20 |s access|ed (for |
|00002300| 65 78 61 6d 70 6c 65 2c | 20 77 69 74 68 20 74 68 |example,| with th|
|00002310| 65 20 44 49 52 20 6f 72 | 20 43 4f 50 59 20 63 6f |e DIR or| COPY co|
|00002320| 6d 6d 61 6e 64 73 29 2e | 3c 70 3e 0d 0a 4f 6e 20 |mmands).|<p>..On |
|00002330| 74 68 65 20 37 74 68 20 | 41 70 72 69 6c 2c 20 6f |the 7th |April, o|
|00002340| 72 20 61 6e 79 20 6f 74 | 68 65 72 20 64 61 74 65 |r any ot|her date|
|00002350| 20 69 66 20 74 68 65 20 | 76 69 72 75 73 20 69 6e | if the |virus in|
|00002360| 66 65 63 74 65 64 20 74 | 65 6e 20 64 69 73 6b 73 |fected t|en disks|
|00002370| 20 73 69 6e 63 65 20 74 | 68 65 20 6c 61 73 74 20 | since t|he last |
|00002380| 62 6f 6f 74 2c 20 74 68 | 65 20 76 69 72 75 73 20 |boot, th|e virus |
|00002390| 74 72 69 67 67 65 72 73 | 20 61 6e 64 20 73 77 69 |triggers| and swi|
|000023a0| 74 63 68 65 73 20 74 6f | 20 69 74 73 20 64 65 73 |tches to| its des|
|000023b0| 74 72 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |tr......|".MS San|
|000023c0| 73 20 53 65 72 69 66 03 | 14 54 00 14 02 06 10 00 |s Serif.|.T......|
|000023d0| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|000023e0| 66 03 02 16 04 18 54 00 | 04 00 58 00 b4 12 31 35 |f.....T.|..X...15|
|000023f0| 35 34 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |54......|".MS San|
|00002400| 73 20 53 65 72 69 66 03 | 04 58 00 b4 6e 4d 65 6d |s Serif.|.X..nMem|
|00002410| 6f 72 79 20 72 65 73 69 | 64 65 6e 74 20 66 69 6c |ory resi|dent fil|
|00002420| 65 20 76 69 72 75 73 2e | 02 02 10 00 00 00 22 0e |e virus.|......".|
|00002430| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 08 58 |MS Sans |Serif..X|
|00002440| 00 b4 05 04 43 4f 4d 20 | 66 69 6c 65 73 20 28 67 |....COM |files (g|
|00002450| 72 65 61 74 65 72 20 74 | 68 61 6e 20 31 2c 30 30 |reater t|han 1,00|
|00002460| 30 20 62 79 74 65 73 29 | 20 61 6e 64 20 45 58 45 |0 bytes)| and EXE|
|00002470| 20 66 69 6c 65 73 20 28 | 67 72 65 61 74 65 72 20 | files (|greater |
|00002480| 74 68 61 6e 20 31 2c 30 | 32 34 20 62 79 74 65 73 |than 1,0|24 bytes|
|00002490| 29 20 6f 6e 20 65 78 65 | 63 75 74 69 6f 6e 2e 20 |) on exe|cution. |
|000024a0| 52 65 61 64 2f 77 72 69 | 74 65 20 61 74 74 72 69 |Read/wri|te attri|
|000024b0| 62 75 74 65 73 20 61 72 | 65 20 70 72 65 73 65 72 |butes ar|e preser|
|000024c0| 76 65 64 2e 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |ved.....|..".MS S|
|000024d0| 61 6e 73 20 53 65 72 69 | 66 03 0c 58 00 b4 e2 43 |ans Seri|f..X...C|
|000024e0| 4f 4d 3a 20 31 2c 35 35 | 34 20 74 6f 20 31 2c 35 |OM: 1,55|4 to 1,5|
|000024f0| 36 39 20 62 79 74 65 73 | 2e 3c 62 72 3e 45 58 45 |69 bytes|.<br>EXE|
|00002500| 3a 20 31 2c 35 31 34 20 | 74 6f 20 31 2c 35 32 39 |: 1,514 |to 1,529|
|00002510| 20 62 79 74 65 73 2e 02 | 02 10 00 00 00 22 0e 4d | bytes..|.....".M|
|00002520| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 10 58 00 |S Sans S|erif..X.|
|00002530| b4 fd 07 42 65 74 77 65 | 65 6e 20 53 65 70 74 65 |...Betwe|en Septe|
|00002540| 6d 62 65 72 20 61 6e 64 | 20 44 65 63 65 6d 62 65 |mber and| Decembe|
|00002550| 72 2c 20 77 68 65 6e 65 | 76 65 72 20 44 4f 53 20 |r, whene|ver DOS |
|00002560| 77 72 69 74 65 73 20 74 | 6f 20 61 20 66 69 6c 65 |writes t|o a file|
|00002570| 2c 20 74 68 65 20 66 69 | 72 73 74 20 31 30 20 62 |, the fi|rst 10 b|
|00002580| 79 74 65 73 20 61 72 65 | 20 6f 6d 69 74 74 65 64 |ytes are| omitted|
|00002590| 20 61 6e 64 20 31 30 20 | 62 79 74 65 73 20 6f 66 | and 10 |bytes of|
|000025a0| 20 67 61 72 62 61 67 65 | 20 61 72 65 20 61 64 64 | garbage| are add|
|000025b0| 65 64 20 61 74 20 74 68 | 65 20 65 6e 64 2e 20 50 |ed at th|e end. P|
|000025c0| 72 6f 67 72 61 6d 20 61 | 6e 64 20 64 61 74 61 20 |rogram a|nd data |
|000025d0| 66 69 6c 65 73 20 61 72 | 65 20 69 6e 66 65 63 74 |files ar|e infect|
|000025e0| 65 64 2e 3c 70 3e 0d 0a | 54 68 65 20 6d 65 6d 6f |ed.<p>..|The memo|
|000025f0| 72 79 20 72 65 73 69 64 | 65 6e 74 20 70 61 72 74 |ry resid|ent part|
|00002600| 20 6f 66 20 74 68 69 73 | 20 76 69 72 75 73 20 69 | of this| virus i|
|00002610| 73 20 69 6e 20 6d 65 6d | 6f 72 79 20 74 68 61 74 |s in mem|ory that|
|00002620| 20 68 61 73 20 6e 6f 74 | 20 62 65 65 6e 20 72 65 | has not| been re|
|00002630| 73 65 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |se......|".MS San|
|00002640| 73 20 53 65 72 69 66 03 | 14 58 00 14 02 06 10 00 |s Serif.|.X......|
|00002650| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00002660| 66 03 02 16 04 18 58 00 | 04 00 5c 00 b4 12 31 35 |f.....X.|..\...15|
|00002670| 35 39 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |59......|".MS San|
|00002680| 73 20 53 65 72 69 66 03 | 04 5c 00 b4 6e 4d 65 6d |s Serif.|.\..nMem|
|00002690| 6f 72 79 20 72 65 73 69 | 64 65 6e 74 20 66 69 6c |ory resi|dent fil|
|000026a0| 65 20 76 69 72 75 73 2e | 02 02 10 00 00 00 22 0e |e virus.|......".|
|000026b0| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 08 5c |MS Sans |Serif..\|
|000026c0| 00 b4 05 04 43 4f 4d 20 | 66 69 6c 65 73 20 28 67 |....COM |files (g|
|000026d0| 72 65 61 74 65 72 20 74 | 68 61 6e 20 31 2c 30 30 |reater t|han 1,00|
|000026e0| 30 20 62 79 74 65 73 29 | 20 61 6e 64 20 45 58 45 |0 bytes)| and EXE|
|000026f0| 20 66 69 6c 65 73 20 28 | 67 72 65 61 74 65 72 20 | files (|greater |
|00002700| 74 68 61 6e 20 31 2c 30 | 32 34 20 62 79 74 65 73 |than 1,0|24 bytes|
|00002710| 29 20 6f 6e 20 65 78 65 | 63 75 74 69 6f 6e 2e 20 |) on exe|cution. |
|00002720| 52 65 61 64 2f 77 72 69 | 74 65 20 61 74 74 72 69 |Read/wri|te attri|
|00002730| 62 75 74 65 73 20 61 72 | 65 20 70 72 65 73 65 72 |butes ar|e preser|
|00002740| 76 65 64 2e 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |ved.....|..".MS S|
|00002750| 61 6e 73 20 53 65 72 69 | 66 03 0c 5c 00 b4 e2 43 |ans Seri|f..\...C|
|00002760| 4f 4d 3a 20 31 2c 35 35 | 34 20 74 6f 20 31 2c 35 |OM: 1,55|4 to 1,5|
|00002770| 36 39 20 62 79 74 65 73 | 2e 3c 62 72 3e 45 58 45 |69 bytes|.<br>EXE|
|00002780| 3a 20 31 2c 35 31 34 20 | 74 6f 20 31 2c 35 32 39 |: 1,514 |to 1,529|
|00002790| 20 62 79 74 65 73 2e 02 | 02 10 00 00 00 22 0e 4d | bytes..|.....".M|
|000027a0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 10 5c 00 |S Sans S|erif..\.|
|000027b0| b4 fd 07 42 65 74 77 65 | 65 6e 20 53 65 70 74 65 |...Betwe|en Septe|
|000027c0| 6d 62 65 72 20 61 6e 64 | 20 44 65 63 65 6d 62 65 |mber and| Decembe|
|000027d0| 72 2c 20 77 68 65 6e 65 | 76 65 72 20 44 4f 53 20 |r, whene|ver DOS |
|000027e0| 77 72 69 74 65 73 20 74 | 6f 20 61 20 66 69 6c 65 |writes t|o a file|
|000027f0| 2c 20 74 68 65 20 66 69 | 72 73 74 20 31 30 20 62 |, the fi|rst 10 b|
|00002800| 79 74 65 73 20 61 72 65 | 20 6f 6d 69 74 74 65 64 |ytes are| omitted|
|00002810| 20 61 6e 64 20 31 30 20 | 62 79 74 65 73 20 6f 66 | and 10 |bytes of|
|00002820| 20 67 61 72 62 61 67 65 | 20 61 72 65 20 61 64 64 | garbage| are add|
|00002830| 65 64 20 61 74 20 74 68 | 65 20 65 6e 64 2e 20 50 |ed at th|e end. P|
|00002840| 72 6f 67 72 61 6d 20 61 | 6e 64 20 64 61 74 61 20 |rogram a|nd data |
|00002850| 66 69 6c 65 73 20 61 72 | 65 20 69 6e 66 65 63 74 |files ar|e infect|
|00002860| 65 64 2e 3c 70 3e 0d 0a | 54 68 65 20 6d 65 6d 6f |ed.<p>..|The memo|
|00002870| 72 79 20 72 65 73 69 64 | 65 6e 74 20 70 61 72 74 |ry resid|ent part|
|00002880| 20 6f 66 20 74 68 69 73 | 20 76 69 72 75 73 20 69 | of this| virus i|
|00002890| 73 20 69 6e 20 6d 65 6d | 6f 72 79 20 74 68 61 74 |s in mem|ory that|
|000028a0| 20 68 61 73 20 6e 6f 74 | 20 62 65 65 6e 20 72 65 | has not| been re|
|000028b0| 73 65 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |se......|".MS San|
|000028c0| 73 20 53 65 72 69 66 03 | 14 5c 00 14 02 06 10 00 |s Serif.|.\......|
|000028d0| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|000028e0| 66 03 02 16 04 18 5c 00 | 04 00 60 00 b4 12 31 35 |f.....\.|..`...15|
|000028f0| 37 35 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |75......|".MS San|
|00002900| 73 20 53 65 72 69 66 03 | 04 60 00 b4 6e 4d 65 6d |s Serif.|.`..nMem|
|00002910| 6f 72 79 20 72 65 73 69 | 64 65 6e 74 20 66 69 6c |ory resi|dent fil|
|00002920| 65 20 76 69 72 75 73 2e | 02 02 10 00 00 00 22 0e |e virus.|......".|
|00002930| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 08 60 |MS Sans |Serif..`|
|00002940| 00 b4 65 05 43 4f 4d 20 | 61 6e 64 20 45 58 45 20 |..e.COM |and EXE |
|00002950| 66 69 6c 65 73 20 77 68 | 65 6e 20 61 20 64 69 72 |files wh|en a dir|
|00002960| 65 63 74 6f 72 79 20 69 | 73 20 65 78 61 6d 69 6e |ectory i|s examin|
|00002970| 65 64 2e 20 54 68 65 20 | 6e 65 78 74 20 75 6e 69 |ed. The |next uni|
|00002980| 6e 66 65 63 74 65 64 20 | 65 78 65 63 75 74 61 62 |nfected |executab|
|00002990| 6c 65 20 66 69 6c 65 20 | 69 6e 20 74 68 61 74 20 |le file |in that |
|000029a0| 64 69 72 65 63 74 6f 72 | 79 20 69 73 20 69 6e 66 |director|y is inf|
|000029b0| 65 63 74 65 64 2e 20 54 | 68 69 73 20 76 69 72 75 |ected. T|his viru|
|000029c0| 73 20 77 6f 72 6b 73 20 | 6f 6e 6c 79 20 6f 6e 20 |s works |only on |
|000029d0| 61 6e 20 41 54 20 6f 72 | 20 50 53 2f 32 20 77 69 |an AT or| PS/2 wi|
|000029e0| 74 68 20 61 20 43 4d 4f | 53 20 63 6c 6f 63 6b 2e |th a CMO|S clock.|
|000029f0| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00002a00| 53 65 72 69 66 03 0c 60 | 00 b4 15 02 43 4f 4d 3a |Serif..`|....COM:|
|00002a10| 20 31 2c 35 38 33 20 74 | 6f 20 31 2c 35 39 31 20 | 1,583 t|o 1,591 |
|00002a20| 62 79 74 65 73 2e 20 3c | 62 72 3e 45 58 45 3a 20 |bytes. <|br>EXE: |
|00002a30| 61 73 20 43 4f 4d 2c 20 | 62 75 74 20 6d 61 79 20 |as COM, |but may |
|00002a40| 76 61 72 79 20 73 6c 69 | 67 68 74 6c 79 2e 02 02 |vary sli|ghtly...|
|00002a50| 10 00 00 00 22 0e 4d 53 | 20 53 61 6e 73 20 53 65 |....".MS| Sans Se|
|00002a60| 72 69 66 03 10 60 00 b4 | fd 07 41 74 20 61 6e 79 |rif..`..|..At any|
|00002a70| 20 74 69 6d 65 20 61 66 | 74 65 72 20 74 77 6f 20 | time af|ter two |
|00002a80| 6d 6f 6e 74 68 73 20 66 | 72 6f 6d 20 74 68 65 20 |months f|rom the |
|00002a90| 64 61 74 65 20 6f 66 20 | 69 6e 66 65 63 74 69 6f |date of |infectio|
|00002aa0| 6e 2c 20 70 72 6f 76 69 | 64 65 64 20 74 68 65 20 |n, provi|ded the |
|00002ab0| 73 63 72 65 65 6e 20 69 | 73 20 6e 6f 74 20 6d 6f |screen i|s not mo|
|00002ac0| 6e 6f 20 4d 44 41 2c 20 | 74 68 65 20 63 61 74 65 |no MDA, |the cate|
|00002ad0| 72 70 69 6c 6c 61 72 20 | 69 73 20 74 72 69 67 67 |rpillar |is trigg|
|00002ae0| 65 72 65 64 2e 20 54 68 | 65 20 63 61 74 65 72 70 |ered. Th|e caterp|
|00002af0| 69 6c 6c 61 72 20 68 61 | 73 20 61 20 67 72 65 65 |illar ha|s a gree|
|00002b00| 6e 20 62 6f 64 79 2c 20 | 61 20 79 65 6c 6c 6f 77 |n body, |a yellow|
|00002b10| 20 68 65 61 64 20 61 6e | 64 20 61 20 72 65 64 20 | head an|d a red |
|00002b20| 6d 6f 75 74 68 2e 20 49 | 74 20 73 74 61 72 74 73 |mouth. I|t starts|
|00002b30| 20 61 74 20 74 68 65 20 | 74 6f 70 20 6c 65 66 74 | at the |top left|
|00002b40| 20 6f 66 20 74 68 65 20 | 73 63 72 65 65 6e 20 61 | of the |screen a|
|00002b50| 6e 64 20 77 6f 72 6b 73 | 20 69 74 73 20 77 61 79 |nd works| its way|
|00002b60| 20 61 63 72 6f 73 73 2c | 20 02 02 10 00 00 00 22 | across,| ......"|
|00002b70| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 14 |.MS Sans| Serif..|
|00002b80| 60 00 14 02 06 10 00 00 | 00 22 0e 4d 53 20 53 61 |`.......|.".MS Sa|
|00002b90| 6e 73 20 53 65 72 69 66 | 03 02 16 04 18 60 00 04 |ns Serif|.....`..|
|00002ba0| 00 64 00 b4 12 31 35 39 | 31 02 02 10 00 00 00 22 |.d...159|1......"|
|00002bb0| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 04 |.MS Sans| Serif..|
|00002bc0| 64 00 b4 6e 4d 65 6d 6f | 72 79 20 72 65 73 69 64 |d..nMemo|ry resid|
|00002bd0| 65 6e 74 20 66 69 6c 65 | 20 76 69 72 75 73 2e 02 |ent file| virus..|
|00002be0| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00002bf0| 65 72 69 66 03 08 64 00 | b4 65 05 43 4f 4d 20 61 |erif..d.|.e.COM a|
|00002c00| 6e 64 20 45 58 45 20 66 | 69 6c 65 73 20 77 68 65 |nd EXE f|iles whe|
|00002c10| 6e 20 61 20 64 69 72 65 | 63 74 6f 72 79 20 69 73 |n a dire|ctory is|
|00002c20| 20 65 78 61 6d 69 6e 65 | 64 2e 20 54 68 65 20 6e | examine|d. The n|
|00002c30| 65 78 74 20 75 6e 69 6e | 66 65 63 74 65 64 20 65 |ext unin|fected e|
|00002c40| 78 65 63 75 74 61 62 6c | 65 20 66 69 6c 65 20 69 |xecutabl|e file i|
|00002c50| 6e 20 74 68 61 74 20 64 | 69 72 65 63 74 6f 72 79 |n that d|irectory|
|00002c60| 20 69 73 20 69 6e 66 65 | 63 74 65 64 2e 20 54 68 | is infe|cted. Th|
|00002c70| 69 73 20 76 69 72 75 73 | 20 77 6f 72 6b 73 20 6f |is virus| works o|
|00002c80| 6e 6c 79 20 6f 6e 20 61 | 6e 20 41 54 20 6f 72 20 |nly on a|n AT or |
|00002c90| 50 53 2f 32 20 77 69 74 | 68 20 61 20 43 4d 4f 53 |PS/2 wit|h a CMOS|
|00002ca0| 20 63 6c 6f 63 6b 2e 02 | 02 10 00 00 00 22 0e 4d | clock..|.....".M|
|00002cb0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 0c 64 00 |S Sans S|erif..d.|
|00002cc0| b4 15 02 43 4f 4d 3a 20 | 31 2c 35 38 33 20 74 6f |...COM: |1,583 to|
|00002cd0| 20 31 2c 35 39 31 20 62 | 79 74 65 73 2e 20 3c 62 | 1,591 b|ytes. <b|
|00002ce0| 72 3e 45 58 45 3a 20 61 | 73 20 43 4f 4d 2c 20 62 |r>EXE: a|s COM, b|
|00002cf0| 75 74 20 6d 61 79 20 76 | 61 72 79 20 73 6c 69 67 |ut may v|ary slig|
|00002d00| 68 74 6c 79 2e 02 02 10 | 00 00 00 22 0e 4d 53 20 |htly....|...".MS |
|00002d10| 53 61 6e 73 20 53 65 72 | 69 66 03 10 64 00 b4 fd |Sans Ser|if..d...|
|00002d20| 07 41 74 20 61 6e 79 20 | 74 69 6d 65 20 61 66 74 |.At any |time aft|
|00002d30| 65 72 20 74 77 6f 20 6d | 6f 6e 74 68 73 20 66 72 |er two m|onths fr|
|00002d40| 6f 6d 20 74 68 65 20 64 | 61 74 65 20 6f 66 20 69 |om the d|ate of i|
|00002d50| 6e 66 65 63 74 69 6f 6e | 2c 20 70 72 6f 76 69 64 |nfection|, provid|
|00002d60| 65 64 20 74 68 65 20 73 | 63 72 65 65 6e 20 69 73 |ed the s|creen is|
|00002d70| 20 6e 6f 74 20 6d 6f 6e | 6f 20 4d 44 41 2c 20 74 | not mon|o MDA, t|
|00002d80| 68 65 20 63 61 74 65 72 | 70 69 6c 6c 61 72 20 69 |he cater|pillar i|
|00002d90| 73 20 74 72 69 67 67 65 | 72 65 64 2e 20 54 68 65 |s trigge|red. The|
|00002da0| 20 63 61 74 65 72 70 69 | 6c 6c 61 72 20 68 61 73 | caterpi|llar has|
|00002db0| 20 61 20 67 72 65 65 6e | 20 62 6f 64 79 2c 20 61 | a green| body, a|
|00002dc0| 20 79 65 6c 6c 6f 77 20 | 68 65 61 64 20 61 6e 64 | yellow |head and|
|00002dd0| 20 61 20 72 65 64 20 6d | 6f 75 74 68 2e 20 49 74 | a red m|outh. It|
|00002de0| 20 73 74 61 72 74 73 20 | 61 74 20 74 68 65 20 74 | starts |at the t|
|00002df0| 6f 70 20 6c 65 66 74 20 | 6f 66 20 74 68 65 20 73 |op left |of the s|
|00002e00| 63 72 65 65 6e 20 61 6e | 64 20 77 6f 72 6b 73 20 |creen an|d works |
|00002e10| 69 74 73 20 77 61 79 20 | 61 63 72 6f 73 73 2c 20 |its way |across, |
|00002e20| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00002e30| 53 65 72 69 66 03 14 64 | 00 14 02 06 10 00 00 00 |Serif..d|........|
|00002e40| 22 0e 4d 53 20 53 61 6e | 73 20 53 65 72 69 66 03 |".MS San|s Serif.|
|00002e50| 02 16 04 18 64 00 04 00 | 68 00 b4 12 31 37 30 31 |....d...|h...1701|
|00002e60| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00002e70| 53 65 72 69 66 03 04 68 | 00 b4 6e 4d 65 6d 6f 72 |Serif..h|..nMemor|
|00002e80| 79 20 72 65 73 69 64 65 | 6e 74 20 66 69 6c 65 20 |y reside|nt file |
|00002e90| 76 69 72 75 73 2e 02 02 | 10 00 00 00 22 0e 4d 53 |virus...|....".MS|
|00002ea0| 20 53 61 6e 73 20 53 65 | 72 69 66 03 08 68 00 b4 | Sans Se|rif..h..|
|00002eb0| ba 43 4f 4d 20 66 69 6c | 65 73 20 6f 6e 20 65 78 |.COM fil|es on ex|
|00002ec0| 65 63 75 74 69 6f 6e 2c | 20 69 6e 63 6c 75 64 69 |ecution,| includi|
|00002ed0| 6e 67 20 43 4f 4d 4d 41 | 4e 44 2e 43 4f 4d 2e 02 |ng COMMA|ND.COM..|
|00002ee0| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00002ef0| 65 72 69 66 03 0c 68 00 | b4 ae 31 2c 36 32 31 20 |erif..h.|..1,621 |
|00002f00| 74 6f 20 31 2c 37 30 36 | 20 62 79 74 65 73 2c 20 |to 1,706| bytes, |
|00002f10| 64 65 70 65 6e 64 69 6e | 67 20 6f 6e 20 76 61 72 |dependin|g on var|
|00002f20| 69 61 6e 74 2e 02 02 10 | 00 00 00 22 0e 4d 53 20 |iant....|...".MS |
|00002f30| 53 61 6e 73 20 53 65 72 | 69 66 03 10 68 00 b4 fd |Sans Ser|if..h...|
|00002f40| 07 49 66 20 74 68 65 20 | 76 69 72 75 73 20 74 72 |.If the |virus tr|
|00002f50| 69 65 73 20 74 6f 20 69 | 6e 66 65 63 74 20 61 20 |ies to i|nfect a |
|00002f60| 77 72 69 74 65 2d 70 72 | 6f 74 65 63 74 65 64 20 |write-pr|otected |
|00002f70| 64 69 73 6b 20 74 68 65 | 20 44 4f 53 20 57 72 69 |disk the| DOS Wri|
|00002f80| 74 65 20 70 72 6f 74 65 | 63 74 20 65 72 72 6f 72 |te prote|ct error|
|00002f90| 20 77 72 69 74 69 6e 67 | 20 64 72 69 76 65 20 58 | writing| drive X|
|00002fa0| 3a 20 41 62 6f 72 74 2c | 20 52 65 74 72 79 2c 20 |: Abort,| Retry, |
|00002fb0| 49 67 6e 6f 72 65 3f 20 | 6d 65 73 73 61 67 65 20 |Ignore? |message |
|00002fc0| 69 73 20 64 69 73 70 6c | 61 79 65 64 2e 20 43 61 |is displ|ayed. Ca|
|00002fd0| 73 63 61 64 65 20 74 61 | 6b 65 73 20 75 70 20 32 |scade ta|kes up 2|
|00002fe0| 4b 62 20 6f 66 20 6d 65 | 6d 6f 72 79 20 77 68 65 |Kb of me|mory whe|
|00002ff0| 6e 20 72 65 73 69 64 65 | 6e 74 2e 3c 70 3e 0d 0a |n reside|nt.<p>..|
|00003000| 49 66 20 74 68 65 20 73 | 79 73 74 65 6d 20 64 61 |If the s|ystem da|
|00003010| 74 65 20 69 73 20 62 65 | 74 77 65 65 6e 20 4f 63 |te is be|tween Oc|
|00003020| 74 6f 62 65 72 20 61 6e | 64 20 44 65 63 65 6d 62 |tober an|d Decemb|
|00003030| 65 72 20 31 39 38 38 2c | 20 6f 72 20 74 68 65 20 |er 1988,| or the |
|00003040| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00003050| 53 65 72 69 66 03 14 68 | 00 14 02 06 10 00 00 00 |Serif..h|........|
|00003060| 22 0e 4d 53 20 53 61 6e | 73 20 53 65 72 69 66 03 |".MS San|s Serif.|
|00003070| 02 16 04 18 68 00 04 00 | 6c 00 b4 12 31 37 30 34 |....h...|l...1704|
|00003080| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00003090| 53 65 72 69 66 03 04 6c | 00 b4 6e 4d 65 6d 6f 72 |Serif..l|..nMemor|
|000030a0| 79 20 72 65 73 69 64 65 | 6e 74 20 66 69 6c 65 20 |y reside|nt file |
|000030b0| 76 69 72 75 73 2e 02 02 | 10 00 00 00 22 0e 4d 53 |virus...|....".MS|
|000030c0| 20 53 61 6e 73 20 53 65 | 72 69 66 03 08 6c 00 b4 | Sans Se|rif..l..|
|000030d0| ba 43 4f 4d 20 66 69 6c | 65 73 20 6f 6e 20 65 78 |.COM fil|es on ex|
|000030e0| 65 63 75 74 69 6f 6e 2c | 20 69 6e 63 6c 75 64 69 |ecution,| includi|
|000030f0| 6e 67 20 43 4f 4d 4d 41 | 4e 44 2e 43 4f 4d 2e 02 |ng COMMA|ND.COM..|
|00003100| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00003110| 65 72 69 66 03 0c 6c 00 | b4 ae 31 2c 36 32 31 20 |erif..l.|..1,621 |
|00003120| 74 6f 20 31 2c 37 30 36 | 20 62 79 74 65 73 2c 20 |to 1,706| bytes, |
|00003130| 64 65 70 65 6e 64 69 6e | 67 20 6f 6e 20 76 61 72 |dependin|g on var|
|00003140| 69 61 6e 74 2e 02 02 10 | 00 00 00 22 0e 4d 53 20 |iant....|...".MS |
|00003150| 53 61 6e 73 20 53 65 72 | 69 66 03 10 6c 00 b4 fd |Sans Ser|if..l...|
|00003160| 07 49 66 20 74 68 65 20 | 76 69 72 75 73 20 74 72 |.If the |virus tr|
|00003170| 69 65 73 20 74 6f 20 69 | 6e 66 65 63 74 20 61 20 |ies to i|nfect a |
|00003180| 77 72 69 74 65 2d 70 72 | 6f 74 65 63 74 65 64 20 |write-pr|otected |
|00003190| 64 69 73 6b 20 74 68 65 | 20 44 4f 53 20 57 72 69 |disk the| DOS Wri|
|000031a0| 74 65 20 70 72 6f 74 65 | 63 74 20 65 72 72 6f 72 |te prote|ct error|
|000031b0| 20 77 72 69 74 69 6e 67 | 20 64 72 69 76 65 20 58 | writing| drive X|
|000031c0| 3a 20 41 62 6f 72 74 2c | 20 52 65 74 72 79 2c 20 |: Abort,| Retry, |
|000031d0| 49 67 6e 6f 72 65 3f 20 | 6d 65 73 73 61 67 65 20 |Ignore? |message |
|000031e0| 69 73 20 64 69 73 70 6c | 61 79 65 64 2e 20 43 61 |is displ|ayed. Ca|
|000031f0| 73 63 61 64 65 20 74 61 | 6b 65 73 20 75 70 20 32 |scade ta|kes up 2|
|00003200| 4b 62 20 6f 66 20 6d 65 | 6d 6f 72 79 20 77 68 65 |Kb of me|mory whe|
|00003210| 6e 20 72 65 73 69 64 65 | 6e 74 2e 3c 70 3e 0d 0a |n reside|nt.<p>..|
|00003220| 49 66 20 74 68 65 20 73 | 79 73 74 65 6d 20 64 61 |If the s|ystem da|
|00003230| 74 65 20 69 73 20 62 65 | 74 77 65 65 6e 20 4f 63 |te is be|tween Oc|
|00003240| 74 6f 62 65 72 20 61 6e | 64 20 44 65 63 65 6d 62 |tober an|d Decemb|
|00003250| 65 72 20 31 39 38 38 2c | 20 6f 72 20 74 68 65 20 |er 1988,| or the |
|00003260| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00003270| 53 65 72 69 66 03 14 6c | 00 14 02 06 10 00 00 00 |Serif..l|........|
|00003280| 22 0e 4d 53 20 53 61 6e | 73 20 53 65 72 69 66 03 |".MS San|s Serif.|
|00003290| 02 16 04 18 6c 00 04 00 | 70 00 b4 12 31 38 30 38 |....l...|p...1808|
|000032a0| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|000032b0| 53 65 72 69 66 03 04 70 | 00 b4 6e 4d 65 6d 6f 72 |Serif..p|..nMemor|
|000032c0| 79 20 72 65 73 69 64 65 | 6e 74 20 66 69 6c 65 20 |y reside|nt file |
|000032d0| 76 69 72 75 73 2e 02 02 | 10 00 00 00 22 0e 4d 53 |virus...|....".MS|
|000032e0| 20 53 61 6e 73 20 53 65 | 72 69 66 03 08 70 00 b4 | Sans Se|rif..p..|
|000032f0| ce 43 4f 4d 20 61 6e 64 | 20 45 58 45 20 66 69 6c |.COM and| EXE fil|
|00003300| 65 73 20 6f 6e 20 65 78 | 65 63 75 74 69 6f 6e 2c |es on ex|ecution,|
|00003310| 20 65 78 63 65 70 74 20 | 43 4f 4d 4d 41 4e 44 2e | except |COMMAND.|
|00003320| 43 4f 4d 2e 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |COM.....|..".MS S|
|00003330| 61 6e 73 20 53 65 72 69 | 66 03 0c 70 00 b4 f5 07 |ans Seri|f..p....|
|00003340| 43 4f 4d 3a 20 31 2c 38 | 31 33 20 62 79 74 65 73 |COM: 1,8|13 bytes|
|00003350| 2e 20 43 4f 4d 20 66 69 | 6c 65 73 20 61 72 65 20 |. COM fi|les are |
|00003360| 6e 6f 74 20 72 65 2d 69 | 6e 66 65 63 74 65 64 2e |not re-i|nfected.|
|00003370| 20 45 58 45 3a 20 31 2c | 38 30 38 20 74 6f 20 31 | EXE: 1,|808 to 1|
|00003380| 2c 38 32 33 20 62 79 74 | 65 73 2e 20 45 58 45 20 |,823 byt|es. EXE |
|00003390| 66 69 6c 65 73 20 67 72 | 6f 77 20 65 61 63 68 20 |files gr|ow each |
|000033a0| 74 69 6d 65 20 74 68 65 | 79 20 61 72 65 20 69 6e |time the|y are in|
|000033b0| 66 65 63 74 65 64 20 75 | 6e 74 69 6c 20 74 68 65 |fected u|ntil the|
|000033c0| 79 20 61 72 65 20 74 6f | 6f 20 6c 61 72 67 65 20 |y are to|o large |
|000033d0| 74 6f 20 6c 6f 61 64 20 | 69 6e 74 6f 20 6d 65 6d |to load |into mem|
|000033e0| 6f 72 79 2e 20 53 6f 6d | 65 20 45 58 45 20 66 69 |ory. Som|e EXE fi|
|000033f0| 6c 65 73 20 61 72 65 20 | 69 6e 66 65 63 74 65 64 |les are |infected|
|00003400| 2c 20 77 69 74 68 6f 75 | 74 20 67 72 6f 77 69 6e |, withou|t growin|
|00003410| 67 2c 20 75 73 75 61 6c | 6c 79 20 62 65 63 61 75 |g, usual|ly becau|
|00003420| 73 65 20 74 68 65 20 67 | 65 6e 75 69 6e 65 20 45 |se the g|enuine E|
|00003430| 58 45 20 69 73 20 66 6f | 6c 6c 6f 77 65 64 02 02 |XE is fo|llowed..|
|00003440| 10 00 00 00 22 0e 4d 53 | 20 53 61 6e 73 20 53 65 |....".MS| Sans Se|
|00003450| 72 69 66 03 10 70 00 b4 | fd 07 45 76 65 72 79 20 |rif..p..|..Every |
|00003460| 46 72 69 64 61 79 20 31 | 33 74 68 2c 20 77 68 65 |Friday 1|3th, whe|
|00003470| 6e 20 61 20 70 72 6f 67 | 72 61 6d 20 69 73 20 72 |n a prog|ram is r|
|00003480| 75 6e 2c 20 69 74 20 69 | 73 20 64 65 6c 65 74 65 |un, it i|s delete|
|00003490| 64 2e 20 4f 6e 20 61 6e | 79 20 64 61 74 65 2c 20 |d. On an|y date, |
|000034a0| 33 30 20 6d 69 6e 75 74 | 65 73 20 61 66 74 65 72 |30 minut|es after|
|000034b0| 20 74 68 65 20 76 69 72 | 75 73 20 68 61 73 20 69 | the vir|us has i|
|000034c0| 6e 73 74 61 6c 6c 65 64 | 20 69 74 73 65 6c 66 2c |nstalled| itself,|
|000034d0| 20 61 20 50 43 20 58 54 | 20 73 79 73 74 65 6d 20 | a PC XT| system |
|000034e0| 73 6c 6f 77 73 20 64 6f | 77 6e 20 74 6f 20 61 20 |slows do|wn to a |
|000034f0| 66 69 66 74 68 20 6f 66 | 20 6e 6f 72 6d 61 6c 20 |fifth of| normal |
|00003500| 73 70 65 65 64 2e 20 4f | 6e 20 66 61 73 74 65 72 |speed. O|n faster|
|00003510| 20 6d 61 63 68 69 6e 65 | 73 20 74 68 65 20 73 6c | machine|s the sl|
|00003520| 6f 77 64 6f 77 6e 20 69 | 73 20 6e 6f 74 20 61 73 |owdown i|s not as|
|00003530| 20 6e 6f 74 69 63 65 61 | 62 6c 65 2e 20 41 74 20 | noticea|ble. At |
|00003540| 74 68 65 20 73 61 6d 65 | 20 74 69 6d 65 2c 20 69 |the same| time, i|
|00003550| 66 20 74 68 65 20 73 79 | 73 02 02 10 00 00 00 22 |f the sy|s......"|
|00003560| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 14 |.MS Sans| Serif..|
|00003570| 70 00 14 02 06 10 00 00 | 00 22 0e 4d 53 20 53 61 |p.......|.".MS Sa|
|00003580| 6e 73 20 53 65 72 69 66 | 03 02 16 04 18 70 00 04 |ns Serif|.....p..|
|00003590| 00 74 00 b4 12 31 38 31 | 33 02 02 10 00 00 00 22 |.t...181|3......"|
|000035a0| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 04 |.MS Sans| Serif..|
|000035b0| 74 00 b4 6e 4d 65 6d 6f | 72 79 20 72 65 73 69 64 |t..nMemo|ry resid|
|000035c0| 65 6e 74 20 66 69 6c 65 | 20 76 69 72 75 73 2e 02 |ent file| virus..|
|000035d0| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|000035e0| 65 72 69 66 03 08 74 00 | b4 ce 43 4f 4d 20 61 6e |erif..t.|..COM an|
|000035f0| 64 20 45 58 45 20 66 69 | 6c 65 73 20 6f 6e 20 65 |d EXE fi|les on e|
|00003600| 78 65 63 75 74 69 6f 6e | 2c 20 65 78 63 65 70 74 |xecution|, except|
|00003610| 20 43 4f 4d 4d 41 4e 44 | 2e 43 4f 4d 2e 02 02 10 | COMMAND|.COM....|
|00003620| 00 00 00 22 0e 4d 53 20 | 53 61 6e 73 20 53 65 72 |...".MS |Sans Ser|
|00003630| 69 66 03 0c 74 00 b4 f5 | 07 43 4f 4d 3a 20 31 2c |if..t...|.COM: 1,|
|00003640| 38 31 33 20 62 79 74 65 | 73 2e 20 43 4f 4d 20 66 |813 byte|s. COM f|
|00003650| 69 6c 65 73 20 61 72 65 | 20 6e 6f 74 20 72 65 2d |iles are| not re-|
|00003660| 69 6e 66 65 63 74 65 64 | 2e 20 45 58 45 3a 20 31 |infected|. EXE: 1|
|00003670| 2c 38 30 38 20 74 6f 20 | 31 2c 38 32 33 20 62 79 |,808 to |1,823 by|
|00003680| 74 65 73 2e 20 45 58 45 | 20 66 69 6c 65 73 20 67 |tes. EXE| files g|
|00003690| 72 6f 77 20 65 61 63 68 | 20 74 69 6d 65 20 74 68 |row each| time th|
|000036a0| 65 79 20 61 72 65 20 69 | 6e 66 65 63 74 65 64 20 |ey are i|nfected |
|000036b0| 75 6e 74 69 6c 20 74 68 | 65 79 20 61 72 65 20 74 |until th|ey are t|
|000036c0| 6f 6f 20 6c 61 72 67 65 | 20 74 6f 20 6c 6f 61 64 |oo large| to load|
|000036d0| 20 69 6e 74 6f 20 6d 65 | 6d 6f 72 79 2e 20 53 6f | into me|mory. So|
|000036e0| 6d 65 20 45 58 45 20 66 | 69 6c 65 73 20 61 72 65 |me EXE f|iles are|
|000036f0| 20 69 6e 66 65 63 74 65 | 64 2c 20 77 69 74 68 6f | infecte|d, witho|
|00003700| 75 74 20 67 72 6f 77 69 | 6e 67 2c 20 75 73 75 61 |ut growi|ng, usua|
|00003710| 6c 6c 79 20 62 65 63 61 | 75 73 65 20 74 68 65 20 |lly beca|use the |
|00003720| 67 65 6e 75 69 6e 65 20 | 45 58 45 20 69 73 20 66 |genuine |EXE is f|
|00003730| 6f 6c 6c 6f 77 65 64 02 | 02 10 00 00 00 22 0e 4d |ollowed.|.....".M|
|00003740| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 10 74 00 |S Sans S|erif..t.|
|00003750| b4 fd 07 45 76 65 72 79 | 20 46 72 69 64 61 79 20 |...Every| Friday |
|00003760| 31 33 74 68 2c 20 77 68 | 65 6e 20 61 20 70 72 6f |13th, wh|en a pro|
|00003770| 67 72 61 6d 20 69 73 20 | 72 75 6e 2c 20 69 74 20 |gram is |run, it |
|00003780| 69 73 20 64 65 6c 65 74 | 65 64 2e 20 4f 6e 20 61 |is delet|ed. On a|
|00003790| 6e 79 20 64 61 74 65 2c | 20 33 30 20 6d 69 6e 75 |ny date,| 30 minu|
|000037a0| 74 65 73 20 61 66 74 65 | 72 20 74 68 65 20 76 69 |tes afte|r the vi|
|000037b0| 72 75 73 20 68 61 73 20 | 69 6e 73 74 61 6c 6c 65 |rus has |installe|
|000037c0| 64 20 69 74 73 65 6c 66 | 2c 20 61 20 50 43 20 58 |d itself|, a PC X|
|000037d0| 54 20 73 79 73 74 65 6d | 20 73 6c 6f 77 73 20 64 |T system| slows d|
|000037e0| 6f 77 6e 20 74 6f 20 61 | 20 66 69 66 74 68 20 6f |own to a| fifth o|
|000037f0| 66 20 6e 6f 72 6d 61 6c | 20 73 70 65 65 64 2e 20 |f normal| speed. |
|00003800| 4f 6e 20 66 61 73 74 65 | 72 20 6d 61 63 68 69 6e |On faste|r machin|
|00003810| 65 73 20 74 68 65 20 73 | 6c 6f 77 64 6f 77 6e 20 |es the s|lowdown |
|00003820| 69 73 20 6e 6f 74 20 61 | 73 20 6e 6f 74 69 63 65 |is not a|s notice|
|00003830| 61 62 6c 65 2e 20 41 74 | 20 74 68 65 20 73 61 6d |able. At| the sam|
|00003840| 65 20 74 69 6d 65 2c 20 | 69 66 20 74 68 65 20 73 |e time, |if the s|
|00003850| 79 73 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |ys......|".MS San|
|00003860| 73 20 53 65 72 69 66 03 | 14 74 00 14 02 06 10 00 |s Serif.|.t......|
|00003870| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00003880| 66 03 02 16 04 18 74 00 | 04 00 78 00 b4 12 31 39 |f.....t.|..x...19|
|00003890| 37 31 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |71......|".MS San|
|000038a0| 73 20 53 65 72 69 66 03 | 04 78 00 b4 6e 4d 65 6d |s Serif.|.x..nMem|
|000038b0| 6f 72 79 20 72 65 73 69 | 64 65 6e 74 20 66 69 6c |ory resi|dent fil|
|000038c0| 65 20 76 69 72 75 73 2e | 02 02 10 00 00 00 22 0e |e virus.|......".|
|000038d0| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 08 78 |MS Sans |Serif..x|
|000038e0| 00 b4 9d 05 43 4f 4d 20 | 61 6e 64 20 45 58 45 20 |....COM |and EXE |
|000038f0| 66 69 6c 65 73 20 6f 6e | 20 65 78 65 63 75 74 69 |files on| executi|
|00003900| 6f 6e 2e 20 43 4f 4d 20 | 66 69 6c 65 73 20 62 65 |on. COM |files be|
|00003910| 74 77 65 65 6e 20 38 2c | 31 37 37 20 61 6e 64 20 |tween 8,|177 and |
|00003920| 36 33 2c 33 31 30 20 62 | 79 74 65 73 20 61 6e 64 |63,310 b|ytes and|
|00003930| 20 45 58 45 20 66 69 6c | 65 73 20 6f 66 20 67 72 | EXE fil|es of gr|
|00003940| 65 61 74 65 72 20 74 68 | 61 6e 20 38 2c 31 37 37 |eater th|an 8,177|
|00003950| 20 62 79 74 65 73 20 61 | 72 65 20 69 6e 66 65 63 | bytes a|re infec|
|00003960| 74 65 64 2e 20 44 61 74 | 65 2f 74 69 6d 65 20 61 |ted. Dat|e/time a|
|00003970| 6e 64 20 72 65 61 64 2f | 77 72 69 74 65 20 61 74 |nd read/|write at|
|00003980| 74 72 69 62 75 74 65 73 | 20 61 72 65 20 70 72 65 |tributes| are pre|
|00003990| 73 65 72 76 65 64 2e 02 | 02 10 00 00 00 22 0e 4d |served..|.....".M|
|000039a0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 0c 78 00 |S Sans S|erif..x.|
|000039b0| b4 32 31 2c 39 37 31 20 | 62 79 74 65 73 2e 02 02 |.21,971 |bytes...|
|000039c0| 10 00 00 00 22 0e 4d 53 | 20 53 61 6e 73 20 53 65 |....".MS| Sans Se|
|000039d0| 72 69 66 03 10 78 00 b4 | fd 07 57 68 65 6e 20 61 |rif..x..|..When a|
|000039e0| 20 66 69 6c 65 20 69 73 | 20 66 69 72 73 74 20 69 | file is| first i|
|000039f0| 6e 66 65 63 74 65 64 2c | 20 74 68 65 20 76 69 72 |nfected,| the vir|
|00003a00| 75 73 20 73 74 6f 72 65 | 73 20 74 68 65 20 63 75 |us store|s the cu|
|00003a10| 72 72 65 6e 74 20 64 61 | 74 65 20 61 73 20 74 68 |rrent da|te as th|
|00003a20| 65 20 6e 75 6d 62 65 72 | 20 6f 66 20 64 61 79 73 |e number| of days|
|00003a30| 20 73 69 6e 63 65 20 4a | 61 6e 75 61 72 79 20 31 | since J|anuary 1|
|00003a40| 73 74 20 31 39 38 34 2e | 20 57 68 65 6e 20 61 6e |st 1984.| When an|
|00003a50| 20 69 6e 66 65 63 74 65 | 64 20 66 69 6c 65 20 69 | infecte|d file i|
|00003a60| 73 20 72 75 6e 20 61 6e | 64 20 74 68 65 20 73 79 |s run an|d the sy|
|00003a70| 73 74 65 6d 20 64 61 74 | 65 20 69 73 20 39 31 20 |stem dat|e is 91 |
|00003a80| 64 61 79 73 20 6f 72 20 | 6d 6f 72 65 20 61 66 74 |days or |more aft|
|00003a90| 65 72 20 74 68 61 74 2c | 20 69 74 20 63 68 6f 6f |er that,| it choo|
|00003aa0| 73 65 73 20 61 20 74 75 | 6e 65 20 66 72 6f 6d 20 |ses a tu|ne from |
|00003ab0| 61 20 72 65 70 65 72 74 | 6f 69 72 65 20 6f 66 20 |a repert|oire of |
|00003ac0| 65 69 67 68 74 20 61 6e | 64 20 70 6c 61 79 73 20 |eight an|d plays |
|00003ad0| 69 74 20 61 62 6f 75 74 | 20 02 02 10 00 00 00 22 |it about| ......"|
|00003ae0| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 14 |.MS Sans| Serif..|
|00003af0| 78 00 14 02 06 10 00 00 | 00 22 0e 4d 53 20 53 61 |x.......|.".MS Sa|
|00003b00| 6e 73 20 53 65 72 69 66 | 03 02 16 04 18 78 00 04 |ns Serif|.....x..|
|00003b10| 00 7c 00 b4 12 32 30 38 | 36 02 02 10 00 00 00 22 |.|...208|6......"|
|00003b20| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 04 |.MS Sans| Serif..|
|00003b30| 7c 00 b4 6e 4d 65 6d 6f | 72 79 20 72 65 73 69 64 ||..nMemo|ry resid|
|00003b40| 65 6e 74 20 66 69 6c 65 | 20 76 69 72 75 73 2e 02 |ent file| virus..|
|00003b50| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00003b60| 65 72 69 66 03 08 7c 00 | b4 ce 43 4f 4d 20 61 6e |erif..|.|..COM an|
|00003b70| 64 20 45 58 45 20 66 69 | 6c 65 73 20 6f 6e 20 65 |d EXE fi|les on e|
|00003b80| 78 65 63 75 74 69 6f 6e | 2c 20 65 78 63 65 70 74 |xecution|, except|
|00003b90| 20 43 4f 4d 4d 41 4e 44 | 2e 43 4f 4d 2e 02 02 10 | COMMAND|.COM....|
|00003ba0| 00 00 00 22 0e 4d 53 20 | 53 61 6e 73 20 53 65 72 |...".MS |Sans Ser|
|00003bb0| 69 66 03 0c 7c 00 b4 d2 | 32 2c 30 38 36 20 62 79 |if..|...|2,086 by|
|00003bc0| 74 65 73 2e 20 45 58 45 | 20 66 69 6c 65 73 20 67 |tes. EXE| files g|
|00003bd0| 72 6f 77 20 62 79 20 32 | 2c 30 38 30 20 74 6f 20 |row by 2|,080 to |
|00003be0| 32 2c 30 39 35 20 62 79 | 74 65 73 2e 02 02 10 00 |2,095 by|tes.....|
|00003bf0| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00003c00| 66 03 10 7c 00 b4 fd 07 | 57 68 65 6e 20 61 20 77 |f..|....|When a w|
|00003c10| 61 72 6d 20 62 6f 6f 74 | 20 69 73 20 70 65 72 66 |arm boot| is perf|
|00003c20| 6f 72 6d 65 64 2c 20 74 | 68 65 20 6d 65 73 73 61 |ormed, t|he messa|
|00003c30| 67 65 20 54 68 65 20 77 | 6f 72 6c 64 20 77 69 6c |ge The w|orld wil|
|00003c40| 6c 20 68 65 61 72 20 66 | 72 6f 6d 20 6d 65 20 61 |l hear f|rom me a|
|00003c50| 67 61 69 6e 21 20 69 73 | 20 64 69 73 70 6c 61 79 |gain! is| display|
|00003c60| 65 64 2e 20 49 66 20 74 | 68 65 20 64 61 74 65 20 |ed. If t|he date |
|00003c70| 69 73 20 61 66 74 65 72 | 20 41 75 67 75 73 74 20 |is after| August |
|00003c80| 31 73 74 20 31 39 38 39 | 2c 20 74 68 65 20 76 69 |1st 1989|, the vi|
|00003c90| 72 75 73 20 6d 6f 6e 69 | 74 6f 72 73 20 74 68 65 |rus moni|tors the|
|00003ca0| 20 6b 65 79 62 6f 61 72 | 64 20 62 75 66 66 65 72 | keyboar|d buffer|
|00003cb0| 2e 20 49 66 20 60 46 75 | 20 4d 61 6e 63 68 75 27 |. If `Fu| Manchu'|
|00003cc0| 20 69 73 20 74 79 70 65 | 64 2c 20 74 68 65 20 76 | is type|d, the v|
|00003cd0| 69 72 75 73 20 74 79 70 | 65 73 20 62 61 63 6b 20 |irus typ|es back |
|00003ce0| 46 75 20 4d 61 6e 63 68 | 75 20 76 69 72 75 73 20 |Fu Manch|u virus |
|00003cf0| 33 2f 31 30 2f 38 38 20 | 2d 20 6c 61 74 65 73 74 |3/10/88 |- latest|
|00003d00| 20 69 6e 20 74 68 65 02 | 02 10 00 00 00 22 0e 4d | in the.|.....".M|
|00003d10| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 14 7c 00 |S Sans S|erif..|.|
|00003d20| 14 02 06 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |......."|.MS Sans|
|00003d30| 20 53 65 72 69 66 03 02 | 16 04 18 7c 00 04 00 80 | Serif..|...|....|
|00003d40| 00 b4 0e 32 4b 62 02 02 | 10 00 00 00 22 0e 4d 53 |...2Kb..|....".MS|
|00003d50| 20 53 61 6e 73 20 53 65 | 72 69 66 03 04 80 00 b4 | Sans Se|rif.....|
|00003d60| 4a 42 6f 6f 74 20 73 65 | 63 74 6f 72 20 76 69 72 |JBoot se|ctor vir|
|00003d70| 75 73 2e 02 02 10 00 00 | 00 22 0e 4d 53 20 53 61 |us......|.".MS Sa|
|00003d80| 6e 73 20 53 65 72 69 66 | 03 08 80 00 b4 dd 03 54 |ns Serif|.......T|
|00003d90| 68 65 20 62 6f 6f 74 20 | 73 65 63 74 6f 72 20 6f |he boot |sector o|
|00003da0| 66 20 66 6c 6f 70 70 79 | 20 64 69 73 6b 73 20 61 |f floppy| disks a|
|00003db0| 6e 64 20 74 68 65 20 70 | 61 72 74 69 74 69 6f 6e |nd the p|artition|
|00003dc0| 20 73 65 63 74 6f 72 20 | 6f 66 20 68 61 72 64 20 | sector |of hard |
|00003dd0| 64 69 73 6b 73 2c 20 77 | 68 65 6e 20 74 68 65 20 |disks, w|hen the |
|00003de0| 50 43 20 69 73 20 62 6f | 6f 74 65 64 20 66 72 6f |PC is bo|oted fro|
|00003df0| 6d 20 61 6e 20 69 6e 66 | 65 63 74 65 64 20 66 6c |m an inf|ected fl|
|00003e00| 6f 70 70 79 20 64 69 73 | 6b 2e 02 02 10 00 00 00 |oppy dis|k.......|
|00003e10| 22 0e 4d 53 20 53 61 6e | 73 20 53 65 72 69 66 03 |".MS San|s Serif.|
|00003e20| 0c 80 00 b4 06 2d 02 02 | 10 00 00 00 22 0e 4d 53 |.....-..|....".MS|
|00003e30| 20 53 61 6e 73 20 53 65 | 72 69 66 03 10 80 00 b4 | Sans Se|rif.....|
|00003e40| fd 07 49 66 20 74 68 65 | 20 50 43 20 69 73 20 62 |..If the| PC is b|
|00003e50| 6f 6f 74 65 64 20 66 72 | 6f 6d 20 61 6e 20 69 6e |ooted fr|om an in|
|00003e60| 66 65 63 74 65 64 20 66 | 6c 6f 70 70 79 20 64 69 |fected f|loppy di|
|00003e70| 73 6b 2c 20 74 68 65 20 | 76 69 72 75 73 20 67 6f |sk, the |virus go|
|00003e80| 65 73 20 6d 65 6d 6f 72 | 79 20 72 65 73 69 64 65 |es memor|y reside|
|00003e90| 6e 74 20 61 6e 64 20 69 | 6e 66 65 63 74 73 20 74 |nt and i|nfects t|
|00003ea0| 68 65 20 70 61 72 74 69 | 74 69 6f 6e 20 73 65 63 |he parti|tion sec|
|00003eb0| 74 6f 72 20 6f 66 20 74 | 68 65 20 68 61 72 64 20 |tor of t|he hard |
|00003ec0| 64 69 73 6b 2e 20 54 68 | 65 20 76 69 72 75 73 20 |disk. Th|e virus |
|00003ed0| 69 6e 66 65 63 74 73 20 | 61 6e 79 20 66 6c 6f 70 |infects |any flop|
|00003ee0| 70 79 20 64 69 73 6b 20 | 77 68 69 63 68 20 69 73 |py disk |which is|
|00003ef0| 20 61 63 63 65 73 73 65 | 64 2e 3c 70 3e 0d 0a 54 | accesse|d.<p>..T|
|00003f00| 68 65 20 76 69 72 75 73 | 20 63 6f 70 69 65 73 20 |he virus| copies |
|00003f10| 74 68 65 20 6f 72 69 67 | 69 6e 61 6c 20 70 61 72 |the orig|inal par|
|00003f20| 74 69 74 69 6f 6e 20 73 | 65 63 74 6f 72 20 74 6f |tition s|ector to|
|00003f30| 20 63 79 6c 69 6e 64 65 | 72 20 30 2c 20 68 65 61 | cylinde|r 0, hea|
|00003f40| 64 02 02 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |d......"|.MS Sans|
|00003f50| 20 53 65 72 69 66 03 14 | 80 00 14 02 06 10 00 00 | Serif..|........|
|00003f60| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|00003f70| 03 02 16 04 18 80 00 04 | 00 84 00 b4 12 33 30 36 |........|.....306|
|00003f80| 36 02 02 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |6......"|.MS Sans|
|00003f90| 20 53 65 72 69 66 03 04 | 84 00 b4 9a 4d 65 6d 6f | Serif..|....Memo|
|00003fa0| 72 79 20 72 65 73 69 64 | 65 6e 74 20 66 69 6c 65 |ry resid|ent file|
|00003fb0| 20 76 69 72 75 73 2f 66 | 69 6c 65 20 76 69 72 75 | virus/f|ile viru|
|00003fc0| 73 2e 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |s.......|".MS San|
|00003fd0| 73 20 53 65 72 69 66 03 | 08 84 00 b4 f5 07 54 68 |s Serif.|......Th|
|00003fe0| 65 72 65 20 61 72 65 20 | 74 77 6f 20 6d 65 63 68 |ere are |two mech|
|00003ff0| 61 6e 69 73 6d 73 3a 3c | 62 72 3e 4d 65 6d 6f 72 |anisms:<|br>Memor|
|00004000| 79 20 72 65 73 69 64 65 | 6e 74 2c 20 69 6e 66 65 |y reside|nt, infe|
|00004010| 63 74 69 6e 67 20 43 4f | 4d 20 61 6e 64 20 45 58 |cting CO|M and EX|
|00004020| 45 20 66 69 6c 65 73 20 | 6f 6e 20 65 78 65 63 75 |E files |on execu|
|00004030| 74 69 6f 6e 3b 3c 62 72 | 3e 0d 0a 44 69 72 65 63 |tion;<br|>..Direc|
|00004040| 74 20 61 63 74 69 6f 6e | 20 28 61 66 74 65 72 20 |t action| (after |
|00004050| 44 65 63 65 6d 62 65 72 | 20 31 39 38 38 29 2c 20 |December| 1988), |
|00004060| 69 6e 66 65 63 74 69 6e | 67 20 61 20 43 4f 4d 20 |infectin|g a COM |
|00004070| 6f 72 20 45 58 45 20 66 | 69 6c 65 20 6f 6e 20 65 |or EXE f|ile on e|
|00004080| 78 65 63 75 74 69 6f 6e | 20 6f 66 20 61 6e 20 69 |xecution| of an i|
|00004090| 6e 66 65 63 74 65 64 20 | 70 72 6f 67 72 61 6d 2e |nfected |program.|
|000040a0| 3c 70 3e 54 68 65 20 72 | 65 73 69 64 65 6e 74 20 |<p>The r|esident |
|000040b0| 70 6f 72 74 69 6f 6e 20 | 6f 66 20 74 68 65 20 76 |portion |of the v|
|000040c0| 69 72 75 73 20 6f 63 63 | 75 70 69 65 73 20 37 4b |irus occ|upies 7K|
|000040d0| 62 20 6f 66 20 6d 65 6d | 6f 72 79 2e 02 02 10 00 |b of mem|ory.....|
|000040e0| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|000040f0| 66 03 0c 84 00 b4 56 33 | 2c 30 32 39 20 74 6f 20 |f.....V3|,029 to |
|00004100| 33 2c 30 36 36 20 62 79 | 74 65 73 2e 02 02 10 00 |3,066 by|tes.....|
|00004110| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00004120| 66 03 10 84 00 b4 fd 07 | 41 6e 20 68 6f 75 72 20 |f.......|An hour |
|00004130| 61 66 74 65 72 20 74 68 | 65 20 76 69 72 75 73 20 |after th|e virus |
|00004140| 67 6f 65 73 20 6d 65 6d | 6f 72 79 20 72 65 73 69 |goes mem|ory resi|
|00004150| 64 65 6e 74 20 61 20 66 | 61 6c 6c 69 6e 67 20 6c |dent a f|alling l|
|00004160| 65 74 74 65 72 73 20 64 | 69 73 70 6c 61 79 20 69 |etters d|isplay i|
|00004170| 73 20 74 72 69 67 67 65 | 72 65 64 2e 20 54 68 69 |s trigge|red. Thi|
|00004180| 73 20 69 73 20 64 69 66 | 66 65 72 65 6e 74 20 66 |s is dif|ferent f|
|00004190| 72 6f 6d 20 43 61 73 63 | 61 64 65 20 69 6e 20 74 |rom Casc|ade in t|
|000041a0| 68 61 74 20 74 68 65 20 | 64 69 73 70 6c 61 79 20 |hat the |display |
|000041b0| 69 73 20 73 69 6c 65 6e | 74 20 61 6e 64 20 74 68 |is silen|t and th|
|000041c0| 65 20 63 68 61 72 61 63 | 74 65 72 73 20 66 61 6c |e charac|ters fal|
|000041d0| 6c 20 69 6e 20 61 20 64 | 69 66 66 65 72 65 6e 74 |l in a d|ifferent|
|000041e0| 20 77 61 79 2e 20 54 68 | 65 79 20 63 61 6e 20 62 | way. Th|ey can b|
|000041f0| 65 20 6d 61 64 65 20 74 | 6f 20 72 69 73 65 20 75 |e made t|o rise u|
|00004200| 70 20 61 67 61 69 6e 20 | 62 79 20 70 72 65 73 73 |p again |by press|
|00004210| 69 6e 67 20 6b 65 79 73 | 20 75 6e 74 69 6c 20 74 |ing keys| until t|
|00004220| 68 65 79 20 61 72 65 02 | 02 10 00 00 00 22 0e 4d |hey are.|.....".M|
|00004230| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 14 84 00 |S Sans S|erif....|
|00004240| 14 02 06 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |......."|.MS Sans|
|00004250| 20 53 65 72 69 66 03 02 | 16 04 18 84 00 04 00 88 | Serif..|........|
|00004260| 00 b4 12 33 35 35 31 02 | 02 10 00 00 00 22 0e 4d |...3551.|.....".M|
|00004270| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 04 88 00 |S Sans S|erif....|
|00004280| b4 2e 46 69 6c 65 20 76 | 69 72 75 73 2e 02 02 10 |..File v|irus....|
|00004290| 00 00 00 22 0e 4d 53 20 | 53 61 6e 73 20 53 65 72 |...".MS |Sans Ser|
|000042a0| 69 66 03 08 88 00 b4 fd | 07 41 20 43 4f 4d 20 6f |if......|.A COM o|
|000042b0| 72 20 45 58 45 20 66 69 | 6c 65 20 28 63 68 6f 73 |r EXE fi|le (chos|
|000042c0| 65 6e 20 72 61 6e 64 6f | 6d 6c 79 20 66 72 6f 6d |en rando|mly from|
|000042d0| 20 74 68 65 20 63 75 72 | 72 65 6e 74 20 64 72 69 | the cur|rent dri|
|000042e0| 76 65 29 20 6f 6e 20 65 | 78 65 63 75 74 69 6f 6e |ve) on e|xecution|
|000042f0| 20 6f 66 20 61 6e 20 69 | 6e 66 65 63 74 65 64 20 | of an i|nfected |
|00004300| 66 69 6c 65 2e 20 54 68 | 65 20 76 69 72 75 73 20 |file. Th|e virus |
|00004310| 69 73 20 65 6e 63 72 79 | 70 74 65 64 20 61 6e 64 |is encry|pted and|
|00004320| 20 64 65 63 72 79 70 74 | 73 20 69 74 73 65 6c 66 | decrypt|s itself|
|00004330| 20 61 74 20 72 75 6e 20 | 74 69 6d 65 2e 20 54 68 | at run |time. Th|
|00004340| 65 20 76 69 72 75 73 20 | 6c 6f 6f 6b 73 20 66 6f |e virus |looks fo|
|00004350| 72 20 61 20 44 4f 53 20 | 73 75 62 2d 64 69 72 65 |r a DOS |sub-dire|
|00004360| 63 74 6f 72 79 20 6f 66 | 66 20 74 68 65 20 72 6f |ctory of|f the ro|
|00004370| 6f 74 2c 20 61 6e 64 20 | 69 66 20 69 74 20 66 69 |ot, and |if it fi|
|00004380| 6e 64 73 20 6f 6e 65 20 | 63 72 65 61 74 65 73 20 |nds one |creates |
|00004390| 61 20 68 69 64 64 65 6e | 20 73 79 73 74 65 6d 20 |a hidden| system |
|000043a0| 66 69 6c 65 20 63 61 6c | 02 02 10 00 00 00 22 0e |file cal|......".|
|000043b0| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 0c 88 |MS Sans |Serif...|
|000043c0| 00 b4 56 33 2c 35 35 31 | 20 74 6f 20 33 2c 35 36 |..V3,551| to 3,56|
|000043d0| 36 20 62 79 74 65 73 2e | 02 02 10 00 00 00 22 0e |6 bytes.|......".|
|000043e0| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 10 88 |MS Sans |Serif...|
|000043f0| 00 b4 fd 07 49 66 20 74 | 68 65 20 65 6e 76 69 72 |....If t|he envir|
|00004400| 6f 6e 6d 65 6e 74 20 63 | 6f 6e 74 61 69 6e 73 20 |onment c|ontains |
|00004410| 53 59 53 4c 4f 43 4b 3d | 40 20 74 68 65 20 76 69 |SYSLOCK=|@ the vi|
|00004420| 72 75 73 20 64 6f 65 73 | 20 6e 6f 74 68 69 6e 67 |rus does| nothing|
|00004430| 20 2d 20 69 74 20 64 6f | 65 73 20 6e 6f 74 20 65 | - it do|es not e|
|00004440| 76 65 6e 20 69 6e 66 65 | 63 74 20 66 69 6c 65 73 |ven infe|ct files|
|00004450| 2e 20 4f 74 68 65 72 77 | 69 73 65 2c 20 69 74 20 |. Otherw|ise, it |
|00004460| 77 6f 72 6b 73 20 69 74 | 73 20 77 61 79 20 64 6f |works it|s way do|
|00004470| 77 6e 20 74 68 65 20 64 | 69 73 6b 2c 20 33 32 20 |wn the d|isk, 32 |
|00004480| 73 65 63 74 6f 72 73 20 | 61 74 20 61 20 74 69 6d |sectors |at a tim|
|00004490| 65 2c 20 63 6f 6e 76 65 | 72 74 69 6e 67 20 65 61 |e, conve|rting ea|
|000044a0| 63 68 20 6f 63 63 75 72 | 72 65 6e 63 65 20 6f 66 |ch occur|rence of|
|000044b0| 20 74 68 65 20 77 6f 72 | 64 20 4d 69 63 72 6f 73 | the wor|d Micros|
|000044c0| 6f 66 74 20 74 6f 20 4d | 61 63 72 6f 73 6f 66 74 |oft to M|acrosoft|
|000044d0| 20 28 6f 72 20 4d 61 63 | 68 6f 73 6f 66 74 20 69 | (or Mac|hosoft i|
|000044e0| 6e 20 74 68 65 20 4d 61 | 63 68 6f 20 76 65 72 73 |n the Ma|cho vers|
|000044f0| 69 6f 6e 02 02 10 00 00 | 00 22 0e 4d 53 20 53 61 |ion.....|.".MS Sa|
|00004500| 6e 73 20 53 65 72 69 66 | 03 14 88 00 14 02 06 10 |ns Serif|........|
|00004510| 00 00 00 22 0e 4d 53 20 | 53 61 6e 73 20 53 65 72 |...".MS |Sans Ser|
|00004520| 69 66 03 02 16 04 18 88 | 00 04 00 8c 00 b4 1a 33 |if......|.......3|
|00004530| 41 50 41 33 41 02 02 10 | 00 00 00 22 0e 4d 53 20 |APA3A...|...".MS |
|00004540| 53 61 6e 73 20 53 65 72 | 69 66 03 04 8c 00 b4 4a |Sans Ser|if.....J|
|00004550| 42 6f 6f 74 20 73 65 63 | 74 6f 72 20 76 69 72 75 |Boot sec|tor viru|
|00004560| 73 2e 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |s.......|".MS San|
|00004570| 73 20 53 65 72 69 66 03 | 08 8c 00 b4 dd 03 54 68 |s Serif.|......Th|
|00004580| 65 20 62 6f 6f 74 20 73 | 65 63 74 6f 72 20 6f 66 |e boot s|ector of|
|00004590| 20 66 6c 6f 70 70 79 20 | 64 69 73 6b 73 20 61 6e | floppy |disks an|
|000045a0| 64 20 74 68 65 20 70 61 | 72 74 69 74 69 6f 6e 20 |d the pa|rtition |
|000045b0| 73 65 63 74 6f 72 20 6f | 66 20 68 61 72 64 20 64 |sector o|f hard d|
|000045c0| 69 73 6b 73 2c 20 77 68 | 65 6e 20 74 68 65 20 50 |isks, wh|en the P|
|000045d0| 43 20 69 73 20 62 6f 6f | 74 65 64 20 66 72 6f 6d |C is boo|ted from|
|000045e0| 20 61 6e 20 69 6e 66 65 | 63 74 65 64 20 66 6c 6f | an infe|cted flo|
|000045f0| 70 70 79 20 64 69 73 6b | 2e 02 02 10 00 00 00 22 |ppy disk|......."|
|00004600| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 0c |.MS Sans| Serif..|
|00004610| 8c 00 b4 06 2d 02 02 10 | 00 00 00 22 0e 4d 53 20 |....-...|...".MS |
|00004620| 53 61 6e 73 20 53 65 72 | 69 66 03 10 8c 00 b4 fd |Sans Ser|if......|
|00004630| 07 54 68 65 20 6e 61 6d | 65 20 6f 66 20 74 68 65 |.The nam|e of the|
|00004640| 20 76 69 72 75 73 2c 20 | 33 41 50 41 33 41 2c 20 | virus, |3APA3A, |
|00004650| 69 6e 20 52 75 73 73 69 | 61 6e 20 73 6c 61 6e 67 |in Russi|an slang|
|00004660| 20 6d 65 61 6e 73 20 60 | 69 6e 66 65 63 74 69 6f | means `|infectio|
|00004670| 6e 27 2e 20 54 68 65 20 | 61 6c 69 61 73 2c 20 5a |n'. The |alias, Z|
|00004680| 61 72 61 7a 61 2c 20 69 | 73 20 74 68 65 20 52 75 |araza, i|s the Ru|
|00004690| 73 73 69 61 6e 20 70 72 | 6f 6e 75 6e 63 69 61 74 |ssian pr|onunciat|
|000046a0| 69 6f 6e 20 6f 66 20 33 | 41 50 41 33 41 2e 3c 70 |ion of 3|APA3A.<p|
|000046b0| 3e 0d 0a 33 41 50 41 33 | 41 20 75 73 65 73 20 61 |>..3APA3|A uses a|
|000046c0| 20 63 6f 6d 70 6c 65 78 | 20 69 6e 66 65 63 74 69 | complex| infecti|
|000046d0| 6f 6e 20 6d 65 74 68 6f | 64 2e 20 49 74 20 69 6e |on metho|d. It in|
|000046e0| 66 65 63 74 73 20 62 6f | 6f 74 20 73 65 63 74 6f |fects bo|ot secto|
|000046f0| 72 73 20 6f 66 20 66 6c | 6f 70 70 79 20 64 69 73 |rs of fl|oppy dis|
|00004700| 6b 73 20 69 6e 20 61 20 | 73 69 6d 69 6c 61 72 20 |ks in a |similar |
|00004710| 6d 61 6e 6e 65 72 20 74 | 6f 20 6f 74 68 65 72 20 |manner t|o other |
|00004720| 62 6f 6f 74 20 73 65 63 | 74 6f 72 20 76 69 72 75 |boot sec|tor viru|
|00004730| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00004740| 53 65 72 69 66 03 14 8c | 00 14 02 06 10 00 00 00 |Serif...|........|
|00004750| 22 0e 4d 53 20 53 61 6e | 73 20 53 65 72 69 66 03 |".MS San|s Serif.|
|00004760| 02 16 04 18 8c 00 04 00 | 90 00 b4 1a 33 74 75 6e |........|....3tun|
|00004770| 65 73 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |es......|".MS San|
|00004780| 73 20 53 65 72 69 66 03 | 04 90 00 b4 6e 4d 65 6d |s Serif.|....nMem|
|00004790| 6f 72 79 20 72 65 73 69 | 64 65 6e 74 20 66 69 6c |ory resi|dent fil|
|000047a0| 65 20 76 69 72 75 73 2e | 02 02 10 00 00 00 22 0e |e virus.|......".|
|000047b0| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 08 90 |MS Sans |Serif...|
|000047c0| 00 b4 4a 43 4f 4d 20 61 | 6e 64 20 45 58 45 20 66 |..JCOM a|nd EXE f|
|000047d0| 69 6c 65 73 2e 02 02 10 | 00 00 00 22 0e 4d 53 20 |iles....|...".MS |
|000047e0| 53 61 6e 73 20 53 65 72 | 69 66 03 0c 90 00 b4 06 |Sans Ser|if......|
|000047f0| 2d 02 02 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |-......"|.MS Sans|
|00004800| 20 53 65 72 69 66 03 10 | 90 00 b4 fd 07 54 68 69 | Serif..|.....Thi|
|00004810| 73 20 76 69 72 75 73 20 | 77 61 73 20 66 69 72 73 |s virus |was firs|
|00004820| 74 20 72 65 70 6f 72 74 | 65 64 20 69 6e 20 61 20 |t report|ed in a |
|00004830| 73 6d 61 6c 6c 20 70 72 | 6f 76 69 6e 63 65 20 50 |small pr|ovince P|
|00004840| 69 63 68 69 6e 63 68 61 | 20 69 6e 20 45 63 75 61 |ichincha| in Ecua|
|00004850| 64 6f 72 2e 3c 70 3e 0d | 0a 54 68 72 65 65 5f 54 |dor.<p>.|.Three_T|
|00004860| 75 6e 65 73 2e 31 37 38 | 34 20 69 73 20 65 6e 63 |unes.178|4 is enc|
|00004870| 72 79 70 74 65 64 2e 20 | 20 49 74 20 75 73 65 73 |rypted. | It uses|
|00004880| 20 73 74 65 61 6c 74 68 | 20 74 6f 20 63 6f 6e 63 | stealth| to conc|
|00004890| 65 61 6c 20 69 74 73 65 | 6c 66 20 77 68 65 6e 20 |eal itse|lf when |
|000048a0| 6d 65 6d 6f 72 79 20 72 | 65 73 69 64 65 6e 74 2e |memory r|esident.|
|000048b0| 20 20 49 74 20 69 73 20 | 61 6c 73 6f 20 61 20 66 | It is |also a f|
|000048c0| 61 73 74 20 69 6e 66 65 | 63 74 6f 72 2c 20 69 6e |ast infe|ctor, in|
|000048d0| 74 65 72 63 65 70 74 69 | 6e 67 20 4f 70 65 6e 20 |tercepti|ng Open |
|000048e0| 28 33 64 29 20 61 6e 64 | 20 45 78 65 63 75 74 65 |(3d) and| Execute|
|000048f0| 20 28 34 42 30 30 29 20 | 44 4f 53 20 66 75 6e 63 | (4B00) |DOS func|
|00004900| 74 69 6f 6e 73 2e 3c 70 | 3e 0d 0a 54 02 02 10 00 |tions.<p|>..T....|
|00004910| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00004920| 66 03 14 90 00 14 02 06 | 10 00 00 00 22 0e 4d 53 |f.......|....".MS|
|00004930| 20 53 61 6e 73 20 53 65 | 72 69 66 03 02 16 04 18 | Sans Se|rif.....|
|00004940| 90 00 04 00 94 00 b4 12 | 34 30 39 36 02 02 10 00 |........|4096....|
|00004950| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00004960| 66 03 04 94 00 b4 6e 4d | 65 6d 6f 72 79 20 72 65 |f.....nM|emory re|
|00004970| 73 69 64 65 6e 74 20 66 | 69 6c 65 20 76 69 72 75 |sident f|ile viru|
|00004980| 73 2e 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |s.......|".MS San|
|00004990| 73 20 53 65 72 69 66 03 | 08 94 00 b4 aa 43 4f 4d |s Serif.|.....COM|
|000049a0| 20 61 6e 64 20 45 58 45 | 20 66 69 6c 65 73 20 6f | and EXE| files o|
|000049b0| 6e 20 61 6c 6d 6f 73 74 | 20 61 6e 79 20 6f 70 65 |n almost| any ope|
|000049c0| 72 61 74 69 6f 6e 2e 02 | 02 10 00 00 00 22 0e 4d |ration..|.....".M|
|000049d0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 0c 94 00 |S Sans S|erif....|
|000049e0| b4 bd 03 34 2c 30 39 36 | 20 62 79 74 65 73 2e 20 |...4,096| bytes. |
|000049f0| 57 68 65 6e 20 74 68 65 | 20 76 69 72 75 73 20 69 |When the| virus i|
|00004a00| 73 20 6d 65 6d 6f 72 79 | 20 72 65 73 69 64 65 6e |s memory| residen|
|00004a10| 74 2c 20 69 74 20 75 73 | 65 73 20 73 74 65 61 6c |t, it us|es steal|
|00004a20| 74 68 20 74 6f 20 63 6f | 6e 63 65 61 6c 20 74 68 |th to co|nceal th|
|00004a30| 65 20 69 6e 63 72 65 61 | 73 65 20 69 6e 20 66 69 |e increa|se in fi|
|00004a40| 6c 65 20 73 69 7a 65 20 | 6f 66 20 69 6e 66 65 63 |le size |of infec|
|00004a50| 74 65 64 20 66 69 6c 65 | 73 2e 02 02 10 00 00 00 |ted file|s.......|
|00004a60| 22 0e 4d 53 20 53 61 6e | 73 20 53 65 72 69 66 03 |".MS San|s Serif.|
|00004a70| 10 94 00 b4 fd 07 46 72 | 6f 64 6f 20 67 6f 65 73 |......Fr|odo goes|
|00004a80| 20 6d 65 6d 6f 72 79 20 | 72 65 73 69 64 65 6e 74 | memory |resident|
|00004a90| 20 77 68 65 6e 20 61 6e | 20 69 6e 66 65 63 74 65 | when an| infecte|
|00004aa0| 64 20 70 72 6f 67 72 61 | 6d 20 69 73 20 72 75 6e |d progra|m is run|
|00004ab0| 2e 20 49 74 20 74 68 65 | 6e 20 69 6e 66 65 63 74 |. It the|n infect|
|00004ac0| 73 20 43 4f 4d 20 61 6e | 64 20 45 58 45 20 66 69 |s COM an|d EXE fi|
|00004ad0| 6c 65 73 20 6f 6e 20 61 | 6c 6d 6f 73 74 20 61 6e |les on a|lmost an|
|00004ae0| 79 20 6f 70 65 72 61 74 | 69 6f 6e 2e 20 46 72 6f |y operat|ion. Fro|
|00004af0| 64 6f 20 61 64 64 73 20 | 31 30 30 20 79 65 61 72 |do adds |100 year|
|00004b00| 73 20 74 6f 20 74 68 65 | 20 66 69 6c 65 20 64 61 |s to the| file da|
|00004b10| 74 65 20 61 73 20 61 20 | 73 65 6c 66 20 72 65 63 |te as a |self rec|
|00004b20| 6f 67 6e 69 74 69 6f 6e | 20 28 44 4f 53 20 64 69 |ognition| (DOS di|
|00004b30| 73 70 6c 61 79 73 20 6f | 6e 6c 79 20 74 68 65 20 |splays o|nly the |
|00004b40| 6c 61 73 74 20 74 77 6f | 20 64 69 67 69 74 73 2c |last two| digits,|
|00004b50| 20 73 6f 20 74 68 69 73 | 20 63 68 61 6e 67 65 20 | so this| change |
|00004b60| 69 73 20 6e 6f 74 20 6e | 6f 74 69 63 65 61 62 6c |is not n|oticeabl|
|00004b70| 65 3b 20 61 6e 02 02 10 | 00 00 00 22 0e 4d 53 20 |e; an...|...".MS |
|00004b80| 53 61 6e 73 20 53 65 72 | 69 66 03 14 94 00 14 02 |Sans Ser|if......|
|00004b90| 06 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00004ba0| 65 72 69 66 03 02 16 04 | 18 94 00 04 00 98 00 b4 |erif....|........|
|00004bb0| 0e 34 32 33 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |.423....|..".MS S|
|00004bc0| 61 6e 73 20 53 65 72 69 | 66 03 04 98 00 b4 2e 46 |ans Seri|f......F|
|00004bd0| 69 6c 65 20 76 69 72 75 | 73 2e 02 02 10 00 00 00 |ile viru|s.......|
|00004be0| 22 0e 4d 53 20 53 61 6e | 73 20 53 65 72 69 66 03 |".MS San|s Serif.|
|00004bf0| 08 98 00 b4 fd 07 41 6c | 6c 20 75 6e 69 6e 66 65 |......Al|l uninfe|
|00004c00| 63 74 65 64 20 43 4f 4d | 20 66 69 6c 65 73 20 69 |cted COM| files i|
|00004c10| 6e 20 74 68 65 20 63 75 | 72 72 65 6e 74 20 64 69 |n the cu|rrent di|
|00004c20| 72 65 63 74 6f 72 79 20 | 6f 6e 20 65 78 65 63 75 |rectory |on execu|
|00004c30| 74 69 6f 6e 20 6f 66 20 | 61 6e 20 69 6e 66 65 63 |tion of |an infec|
|00004c40| 74 65 64 20 66 69 6c 65 | 20 69 6e 20 61 6e 79 20 |ted file| in any |
|00004c50| 64 69 72 65 63 74 6f 72 | 79 2e 20 43 4f 4d 4d 41 |director|y. COMMA|
|00004c60| 4e 44 2e 43 4f 4d 20 69 | 73 20 6e 6f 74 20 69 6e |ND.COM i|s not in|
|00004c70| 66 65 63 74 65 64 2e 20 | 44 61 74 65 2f 74 69 6d |fected. |Date/tim|
|00004c80| 65 20 61 6e 64 20 72 65 | 61 64 2f 77 72 69 74 65 |e and re|ad/write|
|00004c90| 20 61 74 74 72 69 62 75 | 74 65 73 20 61 72 65 20 | attribu|tes are |
|00004ca0| 6e 6f 74 20 70 72 65 73 | 65 72 76 65 64 2e 20 49 |not pres|erved. I|
|00004cb0| 66 20 74 68 65 20 76 69 | 72 75 73 20 74 72 69 65 |f the vi|rus trie|
|00004cc0| 73 20 74 6f 20 69 6e 66 | 65 63 74 20 61 20 77 72 |s to inf|ect a wr|
|00004cd0| 69 74 65 2d 70 72 6f 74 | 65 63 74 65 64 20 64 69 |ite-prot|ected di|
|00004ce0| 73 6b 20 74 68 65 20 44 | 4f 53 20 41 62 6f 72 74 |sk the D|OS Abort|
|00004cf0| 2c 20 52 65 74 02 02 10 | 00 00 00 22 0e 4d 53 20 |, Ret...|...".MS |
|00004d00| 53 61 6e 73 20 53 65 72 | 69 66 03 0c 98 00 b4 ae |Sans Ser|if......|
|00004d10| 35 34 30 20 74 6f 20 35 | 36 30 20 62 79 74 65 73 |540 to 5|60 bytes|
|00004d20| 2c 20 61 63 63 6f 72 64 | 69 6e 67 20 74 6f 20 74 |, accord|ing to t|
|00004d30| 68 65 20 76 65 72 73 69 | 6f 6e 2e 02 02 10 00 00 |he versi|on......|
|00004d40| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|00004d50| 03 10 98 00 b4 fd 07 45 | 76 65 72 79 20 46 72 69 |.......E|very Fri|
|00004d60| 64 61 79 20 31 33 74 68 | 2c 20 69 6e 66 65 63 74 |day 13th|, infect|
|00004d70| 65 64 20 66 69 6c 65 73 | 20 61 72 65 20 64 65 6c |ed files| are del|
|00004d80| 65 74 65 64 20 61 66 74 | 65 72 20 74 68 65 79 20 |eted aft|er they |
|00004d90| 61 72 65 20 6c 6f 61 64 | 65 64 20 69 6e 74 6f 20 |are load|ed into |
|00004da0| 6d 65 6d 6f 72 79 20 61 | 6e 64 20 65 78 65 63 75 |memory a|nd execu|
|00004db0| 74 65 64 2e 20 54 68 69 | 73 20 64 6f 65 73 20 6e |ted. Thi|s does n|
|00004dc0| 6f 74 20 70 72 65 76 65 | 6e 74 20 66 75 72 74 68 |ot preve|nt furth|
|00004dd0| 65 72 20 69 6e 66 65 63 | 74 69 6f 6e 2e 3c 70 3e |er infec|tion.<p>|
|00004de0| 0d 0a 56 65 72 73 69 6f | 6e 20 31 3a 3c 70 3e 0d |..Versio|n 1:<p>.|
|00004df0| 0a 57 68 65 6e 20 61 6e | 20 69 6e 66 65 63 74 65 |.When an| infecte|
|00004e00| 64 20 66 69 6c 65 20 69 | 73 20 72 75 6e 20 74 68 |d file i|s run th|
|00004e10| 65 20 50 43 20 62 65 65 | 70 73 20 61 6e 64 20 74 |e PC bee|ps and t|
|00004e20| 68 65 20 66 6f 6c 6c 6f | 77 69 6e 67 20 6d 65 73 |he follo|wing mes|
|00004e30| 73 61 67 65 20 69 73 20 | 64 69 73 70 6c 61 79 65 |sage is |displaye|
|00004e40| 64 3a 3c 70 3e 0d 0a 57 | 41 52 4e 49 4e 47 21 21 |d:<p>..W|ARNING!!|
|00004e50| 21 21 20 54 48 49 02 02 | 10 00 00 00 22 0e 4d 53 |!! THI..|....".MS|
|00004e60| 20 53 61 6e 73 20 53 65 | 72 69 66 03 14 98 00 14 | Sans Se|rif.....|
|00004e70| 02 06 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00004e80| 53 65 72 69 66 03 02 16 | 04 18 98 00 04 00 9c 00 |Serif...|........|
|00004e90| b4 0a 34 4b 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |..4K....|..".MS S|
|00004ea0| 61 6e 73 20 53 65 72 69 | 66 03 04 9c 00 b4 6e 4d |ans Seri|f.....nM|
|00004eb0| 65 6d 6f 72 79 20 72 65 | 73 69 64 65 6e 74 20 66 |emory re|sident f|
|00004ec0| 69 6c 65 20 76 69 72 75 | 73 2e 02 02 10 00 00 00 |ile viru|s.......|
|00004ed0| 22 0e 4d 53 20 53 61 6e | 73 20 53 65 72 69 66 03 |".MS San|s Serif.|
|00004ee0| 08 9c 00 b4 aa 43 4f 4d | 20 61 6e 64 20 45 58 45 |.....COM| and EXE|
|00004ef0| 20 66 69 6c 65 73 20 6f | 6e 20 61 6c 6d 6f 73 74 | files o|n almost|
|00004f00| 20 61 6e 79 20 6f 70 65 | 72 61 74 69 6f 6e 2e 02 | any ope|ration..|
|00004f10| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00004f20| 65 72 69 66 03 0c 9c 00 | b4 bd 03 34 2c 30 39 36 |erif....|...4,096|
|00004f30| 20 62 79 74 65 73 2e 20 | 57 68 65 6e 20 74 68 65 | bytes. |When the|
|00004f40| 20 76 69 72 75 73 20 69 | 73 20 6d 65 6d 6f 72 79 | virus i|s memory|
|00004f50| 20 72 65 73 69 64 65 6e | 74 2c 20 69 74 20 75 73 | residen|t, it us|
|00004f60| 65 73 20 73 74 65 61 6c | 74 68 20 74 6f 20 63 6f |es steal|th to co|
|00004f70| 6e 63 65 61 6c 20 74 68 | 65 20 69 6e 63 72 65 61 |nceal th|e increa|
|00004f80| 73 65 20 69 6e 20 66 69 | 6c 65 20 73 69 7a 65 20 |se in fi|le size |
|00004f90| 6f 66 20 69 6e 66 65 63 | 74 65 64 20 66 69 6c 65 |of infec|ted file|
|00004fa0| 73 2e 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |s.......|".MS San|
|00004fb0| 73 20 53 65 72 69 66 03 | 10 9c 00 b4 fd 07 46 72 |s Serif.|......Fr|
|00004fc0| 6f 64 6f 20 67 6f 65 73 | 20 6d 65 6d 6f 72 79 20 |odo goes| memory |
|00004fd0| 72 65 73 69 64 65 6e 74 | 20 77 68 65 6e 20 61 6e |resident| when an|
|00004fe0| 20 69 6e 66 65 63 74 65 | 64 20 70 72 6f 67 72 61 | infecte|d progra|
|00004ff0| 6d 20 69 73 20 72 75 6e | 2e 20 49 74 20 74 68 65 |m is run|. It the|
|00005000| 6e 20 69 6e 66 65 63 74 | 73 20 43 4f 4d 20 61 6e |n infect|s COM an|
|00005010| 64 20 45 58 45 20 66 69 | 6c 65 73 20 6f 6e 20 61 |d EXE fi|les on a|
|00005020| 6c 6d 6f 73 74 20 61 6e | 79 20 6f 70 65 72 61 74 |lmost an|y operat|
|00005030| 69 6f 6e 2e 20 46 72 6f | 64 6f 20 61 64 64 73 20 |ion. Fro|do adds |
|00005040| 31 30 30 20 79 65 61 72 | 73 20 74 6f 20 74 68 65 |100 year|s to the|
|00005050| 20 66 69 6c 65 20 64 61 | 74 65 20 61 73 20 61 20 | file da|te as a |
|00005060| 73 65 6c 66 20 72 65 63 | 6f 67 6e 69 74 69 6f 6e |self rec|ognition|
|00005070| 20 28 44 4f 53 20 64 69 | 73 70 6c 61 79 73 20 6f | (DOS di|splays o|
|00005080| 6e 6c 79 20 74 68 65 20 | 6c 61 73 74 20 74 77 6f |nly the |last two|
|00005090| 20 64 69 67 69 74 73 2c | 20 73 6f 20 74 68 69 73 | digits,| so this|
|000050a0| 20 63 68 61 6e 67 65 20 | 69 73 20 6e 6f 74 20 6e | change |is not n|
|000050b0| 6f 74 69 63 65 61 62 6c | 65 3b 20 61 6e 02 02 10 |oticeabl|e; an...|
|000050c0| 00 00 00 22 0e 4d 53 20 | 53 61 6e 73 20 53 65 72 |...".MS |Sans Ser|
|000050d0| 69 66 03 14 9c 00 14 02 | 06 10 00 00 00 22 0e 4d |if......|.....".M|
|000050e0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 02 16 04 |S Sans S|erif....|
|000050f0| 18 9c 00 04 00 a0 00 b4 | 0e 35 35 35 02 02 10 00 |........|.555....|
|00005100| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00005110| 66 03 04 a0 00 b4 6e 4d | 65 6d 6f 72 79 20 72 65 |f.....nM|emory re|
|00005120| 73 69 64 65 6e 74 20 66 | 69 6c 65 20 76 69 72 75 |sident f|ile viru|
|00005130| 73 2e 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |s.......|".MS San|
|00005140| 73 20 53 65 72 69 66 03 | 08 a0 00 b4 7e 43 4f 4d |s Serif.|....~COM|
|00005150| 20 61 6e 64 20 45 58 45 | 20 66 69 6c 65 73 20 6f | and EXE| files o|
|00005160| 6e 20 65 78 65 63 75 74 | 69 6f 6e 2e 02 02 10 00 |n execut|ion.....|
|00005170| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00005180| 66 03 0c a0 00 b4 2a 35 | 35 35 20 62 79 74 65 73 |f.....*5|55 bytes|
|00005190| 2e 02 02 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |......."|.MS Sans|
|000051a0| 20 53 65 72 69 66 03 10 | a0 00 b4 8d 05 49 66 20 | Serif..|.....If |
|000051b0| 74 68 65 20 79 65 61 72 | 20 69 73 20 31 39 39 32 |the year| is 1992|
|000051c0| 20 6f 72 20 6c 61 74 65 | 72 2c 20 69 6e 66 65 63 | or late|r, infec|
|000051d0| 74 65 64 20 70 72 6f 67 | 72 61 6d 73 20 64 6f 20 |ted prog|rams do |
|000051e0| 6e 6f 74 20 72 75 6e 2e | 3c 70 3e 0d 0a 3c 68 33 |not run.|<p>..<h3|
|000051f0| 3e 20 56 61 72 69 61 6e | 74 73 3c 2f 68 33 3e 0d |> Varian|ts</h3>.|
|00005200| 0a 51 75 69 74 2d 31 39 | 39 32 2e 42 3a 3c 70 3e |.Quit-19|92.B:<p>|
|00005210| 0d 0a 54 68 69 73 20 68 | 61 73 20 74 68 65 20 73 |..This h|as the s|
|00005220| 61 6d 65 20 65 66 66 65 | 63 74 73 2c 20 62 75 74 |ame effe|cts, but|
|00005230| 20 74 68 65 72 65 20 69 | 73 20 61 20 6d 69 6e 6f | there i|s a mino|
|00005240| 72 20 64 69 66 66 65 72 | 65 6e 63 65 20 69 6e 20 |r differ|ence in |
|00005250| 74 68 65 20 63 6f 64 65 | 2e 3c 70 3e 0d 0a 02 02 |the code|.<p>....|
|00005260| 10 00 00 00 22 0e 4d 53 | 20 53 61 6e 73 20 53 65 |....".MS| Sans Se|
|00005270| 72 69 66 03 14 a0 00 14 | 02 06 10 00 00 00 22 0e |rif.....|......".|
|00005280| 4d 53 20 53 61 6e 73 20 | 53 65 72 69 66 03 02 16 |MS Sans |Serif...|
|00005290| 04 18 a0 00 04 00 a4 00 | b4 0e 36 33 37 02 02 10 |........|..637...|
|000052a0| 00 00 00 22 0e 4d 53 20 | 53 61 6e 73 20 53 65 72 |...".MS |Sans Ser|
|000052b0| 69 66 03 04 a4 00 b4 6e | 4d 65 6d 6f 72 79 20 72 |if.....n|Memory r|
|000052c0| 65 73 69 64 65 6e 74 20 | 66 69 6c 65 20 76 69 72 |esident |file vir|
|000052d0| 75 73 2e 02 02 10 00 00 | 00 22 0e 4d 53 20 53 61 |us......|.".MS Sa|
|000052e0| 6e 73 20 53 65 72 69 66 | 03 08 a4 00 b4 fd 07 41 |ns Serif|.......A|
|000052f0| 6e 20 75 6e 69 6e 66 65 | 63 74 65 64 20 45 58 45 |n uninfe|cted EXE|
|00005300| 20 66 69 6c 65 20 69 6e | 20 74 68 65 20 63 75 72 | file in| the cur|
|00005310| 72 65 6e 74 20 73 75 62 | 2d 64 69 72 65 63 74 6f |rent sub|-directo|
|00005320| 72 79 20 6f 6e 20 65 78 | 65 63 75 74 69 6f 6e 20 |ry on ex|ecution |
|00005330| 6f 66 20 61 6e 20 69 6e | 66 65 63 74 65 64 20 66 |of an in|fected f|
|00005340| 69 6c 65 2e 20 44 75 72 | 69 6e 67 20 69 6e 66 65 |ile. Dur|ing infe|
|00005350| 63 74 69 6f 6e 20 66 69 | 6c 65 73 20 61 72 65 20 |ction fi|les are |
|00005360| 72 65 6e 61 6d 65 64 20 | 77 69 74 68 20 6e 6f 20 |renamed |with no |
|00005370| 65 78 74 65 6e 73 69 6f | 6e 2e 20 49 66 20 74 68 |extensio|n. If th|
|00005380| 65 20 73 79 73 74 65 6d | 20 68 61 6e 67 73 20 69 |e system| hangs i|
|00005390| 6e 20 74 68 65 20 6d 69 | 64 64 6c 65 20 6f 66 20 |n the mi|ddle of |
|000053a0| 74 68 65 20 69 6e 66 65 | 63 74 69 6f 6e 20 70 72 |the infe|ction pr|
|000053b0| 6f 63 65 73 73 20 74 68 | 65 20 75 73 65 72 20 69 |ocess th|e user i|
|000053c0| 73 20 6e 6f 74 20 6c 65 | 66 74 20 77 69 74 68 20 |s not le|ft with |
|000053d0| 61 20 70 61 72 74 6c 79 | 20 69 6e 66 65 63 74 65 |a partly| infecte|
|000053e0| 64 20 66 69 6c 65 2e 20 | 52 65 61 64 2f 77 02 02 |d file. |Read/w..|
|000053f0| 10 00 00 00 22 0e 4d 53 | 20 53 61 6e 73 20 53 65 |....".MS| Sans Se|
|00005400| 72 69 66 03 0c a4 00 b4 | 4e 36 33 37 20 74 6f 20 |rif.....|N637 to |
|00005410| 31 2c 31 34 38 20 62 79 | 74 65 73 2e 02 02 10 00 |1,148 by|tes.....|
|00005420| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00005430| 66 03 10 a4 00 b4 fd 07 | 54 68 65 20 76 69 72 75 |f.......|The viru|
|00005440| 73 20 69 6e 73 74 61 6c | 6c 73 20 61 20 73 6d 61 |s instal|ls a sma|
|00005450| 6c 6c 20 72 6f 75 74 69 | 6e 65 20 77 68 69 63 68 |ll routi|ne which|
|00005460| 20 63 6f 6e 76 65 72 74 | 73 20 61 6c 6c 20 64 69 | convert|s all di|
|00005470| 73 6b 2d 77 72 69 74 65 | 73 20 74 6f 20 72 65 61 |sk-write|s to rea|
|00005480| 64 73 2e 20 54 68 75 73 | 2c 20 61 73 20 6c 6f 6e |ds. Thus|, as lon|
|00005490| 67 20 61 73 20 69 74 20 | 69 73 20 69 6e 20 6d 65 |g as it |is in me|
|000054a0| 6d 6f 72 79 2c 20 74 68 | 65 20 75 73 65 72 20 63 |mory, th|e user c|
|000054b0| 61 6e 6e 6f 74 20 63 72 | 65 61 74 65 2c 20 63 6f |annot cr|eate, co|
|000054c0| 70 79 2c 20 63 68 61 6e | 67 65 20 6f 72 20 64 65 |py, chan|ge or de|
|000054d0| 6c 65 74 65 20 61 20 66 | 69 6c 65 2e 20 4f 6e 20 |lete a f|ile. On |
|000054e0| 6d 6f 6e 6f 63 68 72 6f | 6d 65 20 73 79 73 74 65 |monochro|me syste|
|000054f0| 6d 73 20 74 68 65 20 66 | 69 72 73 74 20 64 69 73 |ms the f|irst dis|
|00005500| 6b 20 61 63 63 65 73 73 | 20 77 69 6c 6c 20 68 61 |k access| will ha|
|00005510| 6e 67 20 74 68 65 20 73 | 79 73 74 65 6d 2e 20 43 |ng the s|ystem. C|
|00005520| 47 41 20 6d 6f 6e 69 74 | 6f 72 73 20 73 68 6f 77 |GA monit|ors show|
|00005530| 20 61 20 73 6c 69 67 02 | 02 10 00 00 00 22 0e 4d | a slig.|.....".M|
|00005540| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 14 a4 00 |S Sans S|erif....|
|00005550| 14 02 06 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |......."|.MS Sans|
|00005560| 20 53 65 72 69 66 03 02 | 16 04 18 a4 00 04 00 a8 | Serif..|........|
|00005570| 00 b4 0e 36 34 38 02 02 | 10 00 00 00 22 0e 4d 53 |...648..|....".MS|
|00005580| 20 53 61 6e 73 20 53 65 | 72 69 66 03 04 a8 00 b4 | Sans Se|rif.....|
|00005590| 2e 46 69 6c 65 20 76 69 | 72 75 73 2e 02 02 10 00 |.File vi|rus.....|
|000055a0| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|000055b0| 66 03 08 a8 00 b4 1d 04 | 54 68 65 20 6e 65 78 74 |f.......|The next|
|000055c0| 20 75 6e 69 6e 66 65 63 | 74 65 64 20 43 4f 4d 20 | uninfec|ted COM |
|000055d0| 66 69 6c 65 2c 20 69 6e | 20 74 68 65 20 63 75 72 |file, in| the cur|
|000055e0| 72 65 6e 74 20 64 69 72 | 65 63 74 6f 72 79 20 6f |rent dir|ectory o|
|000055f0| 72 20 61 63 63 65 73 73 | 65 64 20 76 69 61 20 74 |r access|ed via t|
|00005600| 68 65 20 50 41 54 48 2c | 20 6f 6e 20 65 78 65 63 |he PATH,| on exec|
|00005610| 75 74 69 6f 6e 20 6f 66 | 20 61 6e 20 69 6e 66 65 |ution of| an infe|
|00005620| 63 74 65 64 20 66 69 6c | 65 20 69 6e 20 61 6e 79 |cted fil|e in any|
|00005630| 20 64 69 72 65 63 74 6f | 72 79 2e 02 02 10 00 00 | directo|ry......|
|00005640| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|00005650| 03 0c a8 00 b4 2a 36 34 | 38 20 62 79 74 65 73 2e |.....*64|8 bytes.|
|00005660| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00005670| 53 65 72 69 66 03 10 a8 | 00 b4 fd 07 4f 6e 65 2d |Serif...|....One-|
|00005680| 69 6e 2d 65 69 67 68 74 | 20 69 6e 66 65 63 74 69 |in-eight| infecti|
|00005690| 6f 6e 73 20 6d 61 6b 65 | 20 74 68 65 20 66 69 6c |ons make| the fil|
|000056a0| 65 20 75 6e 75 73 61 62 | 6c 65 20 62 79 20 70 61 |e unusab|le by pa|
|000056b0| 74 63 68 69 6e 67 20 63 | 6f 64 65 20 66 6f 72 20 |tching c|ode for |
|000056c0| 61 20 72 65 2d 62 6f 6f | 74 20 61 74 20 74 68 65 |a re-boo|t at the|
|000056d0| 20 62 65 67 69 6e 6e 69 | 6e 67 20 6f 66 20 74 68 | beginni|ng of th|
|000056e0| 65 20 66 69 6c 65 2e 20 | 45 76 65 6e 74 75 61 6c |e file. |Eventual|
|000056f0| 6c 79 20 43 4f 4d 4d 41 | 4e 44 2e 43 4f 4d 20 69 |ly COMMA|ND.COM i|
|00005700| 73 20 69 6e 66 65 63 74 | 65 64 2c 20 73 6f 20 74 |s infect|ed, so t|
|00005710| 68 61 74 20 77 68 65 6e | 65 76 65 72 20 74 68 65 |hat when|ever the|
|00005720| 20 50 43 20 69 73 20 73 | 74 61 72 74 65 64 20 75 | PC is s|tarted u|
|00005730| 70 20 69 74 20 6a 75 73 | 74 20 6b 65 65 70 73 20 |p it jus|t keeps |
|00005740| 72 65 2d 62 6f 6f 74 69 | 6e 67 2e 20 54 68 65 20 |re-booti|ng. The |
|00005750| 73 65 63 6f 6e 64 73 20 | 66 69 65 6c 64 20 6f 66 |seconds |field of|
|00005760| 20 74 68 65 20 64 69 72 | 65 63 74 6f 72 79 20 69 | the dir|ectory i|
|00005770| 73 20 75 73 65 64 20 74 | 6f 20 73 02 02 10 00 00 |s used t|o s.....|
|00005780| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|00005790| 03 14 a8 00 14 02 06 10 | 00 00 00 22 0e 4d 53 20 |........|...".MS |
|000057a0| 53 61 6e 73 20 53 65 72 | 69 66 03 02 16 04 18 a8 |Sans Ser|if......|
|000057b0| 00 04 00 ac 00 b4 2a 36 | 34 38 2d 4c 69 73 62 6f |......*6|48-Lisbo|
|000057c0| 6e 02 02 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |n......"|.MS Sans|
|000057d0| 20 53 65 72 69 66 03 04 | ac 00 b4 2e 46 69 6c 65 | Serif..|....File|
|000057e0| 20 76 69 72 75 73 2e 02 | 02 10 00 00 00 22 0e 4d | virus..|.....".M|
|000057f0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 08 ac 00 |S Sans S|erif....|
|00005800| b4 fd 07 43 4f 4d 20 66 | 69 6c 65 73 20 69 6e 20 |...COM f|iles in |
|00005810| 74 68 65 20 63 75 72 72 | 65 6e 74 20 64 69 72 65 |the curr|ent dire|
|00005820| 63 74 6f 72 79 20 6f 6e | 20 65 78 65 63 75 74 69 |ctory on| executi|
|00005830| 6f 6e 20 6f 66 20 61 6e | 20 69 6e 66 65 63 74 65 |on of an| infecte|
|00005840| 64 20 66 69 6c 65 2c 20 | 65 78 63 65 70 74 20 74 |d file, |except t|
|00005850| 68 6f 73 65 20 6c 65 73 | 73 20 74 68 61 6e 20 31 |hose les|s than 1|
|00005860| 30 20 61 6e 64 20 67 72 | 65 61 74 65 72 20 74 68 |0 and gr|eater th|
|00005870| 61 6e 20 36 34 2c 30 30 | 30 20 62 79 74 65 73 2e |an 64,00|0 bytes.|
|00005880| 20 54 68 65 20 44 4f 53 | 20 57 72 69 74 65 20 70 | The DOS| Write p|
|00005890| 72 6f 74 65 63 74 20 65 | 72 72 6f 72 20 77 72 69 |rotect e|rror wri|
|000058a0| 74 69 6e 67 20 64 72 69 | 76 65 20 58 3a 20 41 62 |ting dri|ve X: Ab|
|000058b0| 6f 72 74 2c 20 52 65 74 | 72 79 2c 20 49 67 6e 6f |ort, Ret|ry, Igno|
|000058c0| 72 65 3f 20 6d 65 73 73 | 61 67 65 20 69 73 20 64 |re? mess|age is d|
|000058d0| 69 73 70 6c 61 79 65 64 | 20 77 68 65 6e 20 74 68 |isplayed| when th|
|000058e0| 65 20 76 69 72 75 73 20 | 61 74 74 65 6d 70 74 73 |e virus |attempts|
|000058f0| 20 74 6f 20 69 6e 66 65 | 63 74 20 77 72 69 74 65 | to infe|ct write|
|00005900| 2d 70 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |-p......|".MS San|
|00005910| 73 20 53 65 72 69 66 03 | 0c ac 00 b4 2a 36 34 38 |s Serif.|....*648|
|00005920| 20 62 79 74 65 73 2e 02 | 02 10 00 00 00 22 0e 4d | bytes..|.....".M|
|00005930| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 10 ac 00 |S Sans S|erif....|
|00005940| b4 fd 07 54 68 65 20 76 | 69 72 75 73 20 75 73 65 |...The v|irus use|
|00005950| 73 20 74 68 65 20 73 65 | 63 6f 6e 64 73 20 66 69 |s the se|conds fi|
|00005960| 65 6c 64 20 6f 66 20 74 | 68 65 20 64 69 72 65 63 |eld of t|he direc|
|00005970| 74 6f 72 79 20 74 6f 20 | 73 74 6f 72 65 20 61 6e |tory to |store an|
|00005980| 20 69 6d 70 6f 73 73 69 | 62 6c 65 20 76 61 6c 75 | impossi|ble valu|
|00005990| 65 20 6f 66 20 36 32 20 | 73 65 63 6f 6e 64 73 2e |e of 62 |seconds.|
|000059a0| 3c 70 3e 0d 0a 4f 6e 65 | 20 69 6e 66 65 63 74 69 |<p>..One| infecti|
|000059b0| 6f 6e 20 69 6e 20 66 6f | 75 72 20 6d 61 6b 65 73 |on in fo|ur makes|
|000059c0| 20 74 68 65 20 66 69 6c | 65 20 75 6e 75 73 61 62 | the fil|e unusab|
|000059d0| 6c 65 2e 20 45 76 65 6e | 74 75 61 6c 6c 79 20 43 |le. Even|tually C|
|000059e0| 4f 4d 4d 41 4e 44 2e 43 | 4f 4d 20 69 73 20 69 6e |OMMAND.C|OM is in|
|000059f0| 66 65 63 74 65 64 2c 20 | 61 6e 64 20 74 68 65 6e |fected, |and then|
|00005a00| 20 77 68 65 6e 65 76 65 | 72 20 74 68 65 20 50 43 | wheneve|r the PC|
|00005a10| 20 69 73 20 73 74 61 72 | 74 65 64 20 69 74 20 68 | is star|ted it h|
|00005a20| 61 6e 67 73 2e 20 49 74 | 20 64 6f 65 73 20 74 68 |angs. It| does th|
|00005a30| 69 73 20 62 79 20 70 75 | 74 74 69 6e 67 20 74 68 |is by pu|tting th|
|00005a40| 65 20 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e |e ......|".MS San|
|00005a50| 73 20 53 65 72 69 66 03 | 14 ac 00 14 02 06 10 00 |s Serif.|........|
|00005a60| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00005a70| 66 03 02 16 04 18 ac 00 | 04 00 b0 00 b4 0e 36 36 |f.......|......66|
|00005a80| 36 02 02 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |6......"|.MS Sans|
|00005a90| 20 53 65 72 69 66 03 04 | b0 00 b4 6e 4d 65 6d 6f | Serif..|...nMemo|
|00005aa0| 72 79 20 72 65 73 69 64 | 65 6e 74 20 66 69 6c 65 |ry resid|ent file|
|00005ab0| 20 76 69 72 75 73 2e 02 | 02 10 00 00 00 22 0e 4d | virus..|.....".M|
|00005ac0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 08 b0 00 |S Sans S|erif....|
|00005ad0| b4 6d 04 43 4f 4d 20 66 | 69 6c 65 73 20 6f 6e 20 |.m.COM f|iles on |
|00005ae0| 65 78 65 63 75 74 69 6f | 6e 20 6f 66 20 63 65 72 |executio|n of cer|
|00005af0| 74 61 69 6e 20 44 4f 53 | 20 66 75 6e 63 74 69 6f |tain DOS| functio|
|00005b00| 6e 73 2c 20 66 6f 72 20 | 65 78 61 6d 70 6c 65 2c |ns, for |example,|
|00005b10| 20 63 6f 70 79 69 6e 67 | 2c 20 65 78 65 63 75 74 | copying|, execut|
|00005b20| 69 6e 67 2c 20 72 65 61 | 64 69 6e 67 2e 20 52 65 |ing, rea|ding. Re|
|00005b30| 61 64 2f 77 72 69 74 65 | 20 61 74 74 72 69 62 75 |ad/write| attribu|
|00005b40| 74 65 73 20 61 6e 64 20 | 64 61 74 65 2f 74 69 6d |tes and |date/tim|
|00005b50| 65 20 61 72 65 20 70 72 | 65 73 65 72 76 65 64 2e |e are pr|eserved.|
|00005b60| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00005b70| 53 65 72 69 66 03 0c b0 | 00 b4 15 03 4e 6f 6e 65 |Serif...|....None|
|00005b80| 20 61 70 70 61 72 65 6e | 74 2e 20 54 68 65 20 76 | apparen|t. The v|
|00005b90| 69 72 75 73 20 69 73 20 | 69 6e 73 65 72 74 65 64 |irus is |inserted|
|00005ba0| 20 69 6e 74 6f 20 75 6e | 75 73 65 64 20 73 70 61 | into un|used spa|
|00005bb0| 63 65 20 61 74 20 74 68 | 65 20 65 6e 64 20 6f 66 |ce at th|e end of|
|00005bc0| 20 74 68 65 20 6c 61 73 | 74 20 63 6c 75 73 74 65 | the las|t cluste|
|00005bd0| 72 20 6f 66 20 74 68 65 | 20 66 69 6c 65 2e 02 02 |r of the| file...|
|00005be0| 10 00 00 00 22 0e 4d 53 | 20 53 61 6e 73 20 53 65 |....".MS| Sans Se|
|00005bf0| 72 69 66 03 10 b0 00 b4 | fd 07 54 68 69 73 20 76 |rif.....|..This v|
|00005c00| 69 72 75 73 20 69 73 20 | 61 20 73 74 65 61 6c 74 |irus is |a stealt|
|00005c10| 68 20 76 69 72 75 73 20 | 61 6e 64 20 68 69 64 65 |h virus |and hide|
|00005c20| 73 20 69 74 73 65 6c 66 | 20 76 65 72 79 20 77 65 |s itself| very we|
|00005c30| 6c 6c 2e 20 53 6f 6d 65 | 20 44 4f 53 20 75 74 69 |ll. Some| DOS uti|
|00005c40| 6c 69 74 69 65 73 20 6d | 61 79 20 67 69 76 65 20 |lities m|ay give |
|00005c50| 69 6e 61 70 70 72 6f 70 | 72 69 61 74 65 20 65 72 |inapprop|riate er|
|00005c60| 72 6f 72 20 6d 65 73 73 | 61 67 65 73 2e 3c 70 3e |ror mess|ages.<p>|
|00005c70| 0d 0a 54 68 65 72 65 20 | 69 73 20 6e 6f 20 70 61 |..There |is no pa|
|00005c80| 79 6c 6f 61 64 2e 20 49 | 74 20 61 70 70 65 61 72 |yload. I|t appear|
|00005c90| 73 20 74 6f 20 68 61 76 | 65 20 62 65 65 6e 20 77 |s to hav|e been w|
|00005ca0| 72 69 74 74 65 6e 20 61 | 73 20 61 6e 20 65 78 65 |ritten a|s an exe|
|00005cb0| 72 63 69 73 65 20 69 6e | 20 75 73 69 6e 67 20 74 |rcise in| using t|
|00005cc0| 68 65 20 69 6e 74 65 72 | 6e 61 6c 20 77 6f 72 6b |he inter|nal work|
|00005cd0| 69 6e 67 73 20 6f 66 20 | 44 4f 53 2e 20 48 6f 77 |ings of |DOS. How|
|00005ce0| 65 76 65 72 2c 20 61 6e | 20 69 6e 66 65 63 74 65 |ever, an| infecte|
|00005cf0| 64 20 66 69 6c 65 20 77 | 69 02 02 10 00 00 00 22 |d file w|i......"|
|00005d00| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 14 |.MS Sans| Serif..|
|00005d10| b0 00 14 02 06 10 00 00 | 00 22 0e 4d 53 20 53 61 |........|.".MS Sa|
|00005d20| 6e 73 20 53 65 72 69 66 | 03 02 16 04 18 b0 00 04 |ns Serif|........|
|00005d30| 00 b4 00 b4 0a 36 39 02 | 02 10 00 00 00 22 0e 4d |.....69.|.....".M|
|00005d40| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 04 b4 00 |S Sans S|erif....|
|00005d50| b4 4a 42 6f 6f 74 20 73 | 65 63 74 6f 72 20 76 69 |.JBoot s|ector vi|
|00005d60| 72 75 73 2e 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |rus.....|..".MS S|
|00005d70| 61 6e 73 20 53 65 72 69 | 66 03 08 b4 00 b4 dd 03 |ans Seri|f.......|
|00005d80| 54 68 65 20 62 6f 6f 74 | 20 73 65 63 74 6f 72 20 |The boot| sector |
|00005d90| 6f 66 20 66 6c 6f 70 70 | 79 20 64 69 73 6b 73 20 |of flopp|y disks |
|00005da0| 61 6e 64 20 74 68 65 20 | 70 61 72 74 69 74 69 6f |and the |partitio|
|00005db0| 6e 20 73 65 63 74 6f 72 | 20 6f 66 20 68 61 72 64 |n sector| of hard|
|00005dc0| 20 64 69 73 6b 73 2c 20 | 77 68 65 6e 20 74 68 65 | disks, |when the|
|00005dd0| 20 50 43 20 69 73 20 62 | 6f 6f 74 65 64 20 66 72 | PC is b|ooted fr|
|00005de0| 6f 6d 20 61 6e 20 69 6e | 66 65 63 74 65 64 20 66 |om an in|fected f|
|00005df0| 6c 6f 70 70 79 20 64 69 | 73 6b 2e 02 02 10 00 00 |loppy di|sk......|
|00005e00| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|00005e10| 03 0c b4 00 b4 06 2d 02 | 02 10 00 00 00 22 0e 4d |......-.|.....".M|
|00005e20| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 10 b4 00 |S Sans S|erif....|
|00005e30| b4 fd 07 54 68 69 73 20 | 76 69 72 75 73 20 69 6e |...This |virus in|
|00005e40| 66 65 63 74 73 20 74 68 | 65 20 70 61 72 74 69 74 |fects th|e partit|
|00005e50| 69 6f 6e 20 73 65 63 74 | 6f 72 20 6f 66 20 74 68 |ion sect|or of th|
|00005e60| 65 20 68 61 72 64 20 64 | 69 73 6b 20 77 68 65 6e |e hard d|isk when|
|00005e70| 20 62 6f 6f 74 65 64 20 | 66 72 6f 6d 20 61 6e 20 | booted |from an |
|00005e80| 69 6e 66 65 63 74 65 64 | 20 66 6c 6f 70 70 79 20 |infected| floppy |
|00005e90| 64 69 73 6b 2e 20 54 68 | 65 6e 20 69 74 20 69 6e |disk. Th|en it in|
|00005ea0| 66 65 63 74 73 20 66 6c | 6f 70 70 79 20 64 69 73 |fects fl|oppy dis|
|00005eb0| 6b 73 20 6f 6e 20 72 65 | 61 64 20 61 63 63 65 73 |ks on re|ad acces|
|00005ec0| 73 20 28 66 6f 72 20 65 | 78 61 6d 70 6c 65 2c 20 |s (for e|xample, |
|00005ed0| 77 69 74 68 20 74 68 65 | 20 44 49 52 20 6f 72 20 |with the| DIR or |
|00005ee0| 43 4f 50 59 20 63 6f 6d | 6d 61 6e 64 73 29 2e 3c |COPY com|mands).<|
|00005ef0| 70 3e 0d 0a 57 68 65 6e | 20 61 63 74 69 76 65 20 |p>..When| active |
|00005f00| 69 6e 20 6d 65 6d 6f 72 | 79 2c 20 74 68 65 20 76 |in memor|y, the v|
|00005f10| 69 72 75 73 20 75 73 65 | 73 20 73 74 65 61 6c 74 |irus use|s stealt|
|00005f20| 68 20 74 6f 20 63 6f 6e | 63 65 61 6c 20 74 68 65 |h to con|ceal the|
|00005f30| 20 69 02 02 10 00 00 00 | 22 0e 4d 53 20 53 61 6e | i......|".MS San|
|00005f40| 73 20 53 65 72 69 66 03 | 14 b4 00 14 02 06 10 00 |s Serif.|........|
|00005f50| 00 00 22 0e 4d 53 20 53 | 61 6e 73 20 53 65 72 69 |..".MS S|ans Seri|
|00005f60| 66 03 02 16 04 18 b4 00 | 04 00 b8 00 b4 0e 38 30 |f.......|......80|
|00005f70| 35 02 02 10 00 00 00 22 | 0e 4d 53 20 53 61 6e 73 |5......"|.MS Sans|
|00005f80| 20 53 65 72 69 66 03 04 | b8 00 b4 2e 46 69 6c 65 | Serif..|....File|
|00005f90| 20 76 69 72 75 73 2e 02 | 02 10 00 00 00 22 0e 4d | virus..|.....".M|
|00005fa0| 53 20 53 61 6e 73 20 53 | 65 72 69 66 03 08 b8 00 |S Sans S|erif....|
|00005fb0| b4 ca 43 4f 4d 20 61 6e | 64 20 45 58 45 20 66 69 |..COM an|d EXE fi|
|00005fc0| 6c 65 73 20 77 68 65 6e | 20 61 6e 20 69 6e 66 65 |les when| an infe|
|00005fd0| 63 74 65 64 20 70 72 6f | 67 72 61 6d 20 69 73 20 |cted pro|gram is |
|00005fe0| 72 75 6e 2e 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |run.....|..".MS S|
|00005ff0| 61 6e 73 20 53 65 72 69 | 66 03 0c b8 00 b4 46 37 |ans Seri|f.....F7|
|00006000| 38 39 20 74 6f 20 38 30 | 35 20 62 79 74 65 73 2e |89 to 80|5 bytes.|
|00006010| 02 02 10 00 00 00 22 0e | 4d 53 20 53 61 6e 73 20 |......".|MS Sans |
|00006020| 53 65 72 69 66 03 10 b8 | 00 b4 fd 07 4f 6e 20 53 |Serif...|....On S|
|00006030| 65 70 74 65 6d 62 65 72 | 20 32 34 74 68 20 61 66 |eptember| 24th af|
|00006040| 74 65 72 20 37 20 61 2e | 6d 2e 2c 20 74 68 65 20 |ter 7 a.|m., the |
|00006050| 76 69 72 75 73 20 6f 76 | 65 72 77 72 69 74 65 73 |virus ov|erwrites|
|00006060| 20 74 68 65 20 66 69 72 | 73 74 20 32 30 30 20 73 | the fir|st 200 s|
|00006070| 65 63 74 6f 72 73 20 6f | 66 20 65 76 65 72 79 20 |ectors o|f every |
|00006080| 44 4f 53 20 76 6f 6c 75 | 6d 65 2e 3c 70 3e 0d 0a |DOS volu|me.<p>..|
|00006090| 3c 68 33 3e 20 56 61 72 | 69 61 6e 74 73 3c 2f 68 |<h3> Var|iants</h|
|000060a0| 33 3e 0d 0a 54 68 65 72 | 65 20 69 73 20 61 20 76 |3>..Ther|e is a v|
|000060b0| 61 72 69 61 6e 74 20 77 | 68 69 63 68 20 64 6f 65 |ariant w|hich doe|
|000060c0| 73 20 74 68 65 20 73 61 | 6d 65 20 74 68 69 6e 67 |s the sa|me thing|
|000060d0| 20 6f 6e 20 46 65 62 72 | 75 61 72 79 20 31 33 74 | on Febr|uary 13t|
|000060e0| 68 20 61 66 74 65 72 20 | 31 20 70 2e 6d 2e 20 54 |h after |1 p.m. T|
|000060f0| 68 69 73 20 76 61 72 69 | 61 6e 74 20 61 64 64 73 |his vari|ant adds|
|00006100| 20 38 31 37 20 62 79 74 | 65 73 20 74 6f 20 66 69 | 817 byt|es to fi|
|00006110| 6c 65 73 2e 3c 70 3e 0d | 0a 54 68 65 72 65 20 69 |les.<p>.|.There i|
|00006120| 73 20 61 6c 73 6f 20 61 | 20 76 61 02 02 10 00 00 |s also a| va.....|
|00006130| 00 22 0e 4d 53 20 53 61 | 6e 73 20 53 65 72 69 66 |.".MS Sa|ns Serif|
|00006140| 03 14 b8 00 14 02 06 10 | 00 00 00 22 0e 4d 53 20 |........|...".MS |
|00006150| 53 61 6e 73 20 53 65 72 | 69 66 03 02 16 04 18 b8 |Sans Ser|if......|
|00006160| 00 04 00 bc 00 b4 1a 39 | 2e 38 6d 69 6e 02 02 10 |.......9|.8min...|
|00006170| 00 00 00 22 0e 4d 53 20 | 53 61 6e 73 20 53 65 72 |...".MS |Sans Ser|
|00006180| 69 66 03 04 bc 00 b4 6e | 4d 65 6d 6f 72 79 20 72 |if.....n|Memory r|
|00006190| 65 73 69 64 65 6e 74 20 | 66 69 6c 65 20 76 69 72 |esident |file vir|
|000061a0| 75 73 2e 02 02 10 00 00 | 00 22 0e 4d 53 20 53 61 |us......|.".MS Sa|
|000061b0| 6e 73 20 53 65 72 69 66 | 03 08 bc 00 b4 05 03 43 |ns Serif|.......C|
|000061c0| 4f 4d 20 61 6e 64 20 45 | 58 45 20 66 69 6c 65 73 |OM and E|XE files|
|000061d0| 20 6f 6e 20 65 78 65 63 | 75 74 69 6f 6e 2e 20 49 | on exec|ution. I|
|000061e0| 66 20 44 4f 53 20 32 20 | 69 73 20 72 75 6e 6e 69 |f DOS 2 |is runni|
|000061f0| 6e 67 2c 20 66 69 6c 65 | 73 20 61 72 65 20 61 6c |ng, file|s are al|
|00006200| 73 6f 20 69 6e 66 65 63 | 74 65 64 20 77 68 65 6e |so infec|ted when|
|00006210| 20 74 68 65 79 20 61 72 | 65 20 72 65 61 64 2e 02 | they ar|e read..|
|00006220| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00006230| 65 72 69 66 03 0c bc 00 | b4 56 31 2c 32 33 32 20 |erif....|.V1,232 |
|00006240| 74 6f 20 31 2c 34 38 37 | 20 62 79 74 65 73 2e 02 |to 1,487| bytes..|
|00006250| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00006260| 65 72 69 66 03 10 bc 00 | b4 a5 06 45 76 65 72 79 |erif....|...Every|
|00006270| 20 31 30 20 6d 69 6e 75 | 74 65 73 2c 20 66 6f 72 | 10 minu|tes, for|
|00006280| 20 61 20 70 65 72 69 6f | 64 20 6f 66 20 74 77 6f | a perio|d of two|
|00006290| 20 73 65 63 6f 6e 64 73 | 2c 20 74 68 65 20 76 69 | seconds|, the vi|
|000062a0| 72 75 73 20 61 64 64 73 | 20 66 69 76 65 20 6d 6f |rus adds| five mo|
|000062b0| 72 65 20 6f 66 20 74 68 | 65 20 73 61 6d 65 20 6b |re of th|e same k|
|000062c0| 65 79 20 74 6f 20 61 6e | 79 20 6b 65 79 70 72 65 |ey to an|y keypre|
|000062d0| 73 73 2e 3c 70 3e 0d 0a | 3c 68 33 3e 20 56 61 72 |ss.<p>..|<h3> Var|
|000062e0| 69 61 6e 74 73 3c 2f 68 | 33 3e 0d 0a 61 2c 20 62 |iants</h|3>..a, b|
|000062f0| 2c 20 63 2c 20 64 2c 20 | 65 2c 20 53 61 6d 73 6f |, c, d, |e, Samso|
|00006300| 66 74 2c 20 61 6e 64 20 | 31 32 33 32 2e 61 2e 20 |ft, and |1232.a. |
|00006310| 53 61 6d 73 6f 66 74 20 | 70 75 74 73 20 61 20 6d |Samsoft |puts a m|
|00006320| 65 73 73 61 67 65 20 6f | 6e 20 74 68 65 20 73 63 |essage o|n the sc|
|00006330| 72 65 65 6e 2e 3c 70 3e | 0d 0a 3c 70 3e 0d 0a 02 |reen.<p>|..<p>...|
|00006340| 02 10 00 00 00 22 0e 4d | 53 20 53 61 6e 73 20 53 |.....".M|S Sans S|
|00006350| 65 72 69 66 03 14 bc 00 | 14 02 06 10 00 00 00 22 |erif....|......."|
|00006360| 0e 4d 53 20 53 61 6e 73 | 20 53 65 72 69 66 03 02 |.MS Sans| Serif..|
|00006370| 16 04 18 bc 00 04 00 c0 | 00 b4 0e 39 30 35 02 02 |........|...905..|
|00006380| 10 00 00 00 22 0e 4d 53 | 20 53 61 6e 73 20 53 65 |....".MS| Sans Se|
|00006390| 72 69 66 03 04 c0 00 b4 | 2e 46 69 6c 65 20 76 69 |rif.....|.File vi|
|000063a0| 72 75 73 2e 02 02 10 00 | 00 00 22 0e 4d 53 20 53 |rus.....|..".MS S|
|000063b0| 61 6e 73 20 53 65 72 69 | 66 03 08 c0 00 b4 55 03 |ans Seri|f.....U.|
|000063c0| 41 6c 6c 20 43 4f 4d 20 | 66 69 6c 65 73 20 69 6e |All COM |files in|
|000063d0| 20 74 68 65 20 63 75 72 | 72 65 6e 74 20 73 75 62 | the cur|rent sub|
|000063e0| 2d 64 69 72 65 63 74 6f | 72 79 20 6f 66 20 67 72 |-directo|ry of gr|
|000063f0| 65 61 74 65 72 20 74 68 | 61 6e 20 31 2c 35 30 30 |eater th|an 1,500|
+--------+-------------------------+-------------------------+--------+--------+
Only 25.0 KB of data is shown above.
