home *** CD-ROM | disk | FTP | other *** search
| Unknown | 1993-08-29 | 1.6 MB |
open in: 
MacOS 8.1
|
Win98
|
DOS
view JSON data
|
view as text
This file was not able to be converted.
This format is not currently supported by dexvert.
hex view+--------+-------------------------+-------------------------+--------+--------+
|00000000| ee 0c 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000010| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000020| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000030| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000040| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000050| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000060| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000070| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000080| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000090| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000100| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000110| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000120| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000130| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000140| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000150| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000160| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000170| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000180| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000190| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000200| 54 68 65 20 31 30 20 50 | 61 73 74 20 33 2c 20 6f |The 10 P|ast 3, o|
|00000210| 72 20 37 34 38 2c 20 76 | 69 72 75 73 20 77 61 73 |r 748, v|irus was|
|00000220| 20 73 75 62 6d 69 74 74 | 65 64 20 69 6e 20 4e 6f | submitt|ed in No|
|00000230| 76 65 6d 62 65 72 2c 20 | 31 39 39 32 2e 20 20 54 |vember, |1992. T|
|00000240| 68 69 73 0a 0d 76 69 72 | 75 73 20 77 61 73 20 61 |his..vir|us was a|
|00000250| 63 74 75 61 6c 6c 79 20 | 69 73 6f 6c 61 74 65 64 |ctually |isolated|
|00000260| 20 6d 75 63 68 20 65 61 | 72 6c 69 65 72 2c 20 69 | much ea|rlier, i|
|00000270| 6e 20 65 61 72 6c 79 20 | 31 39 39 31 2e 20 20 31 |n early |1991. 1|
|00000280| 30 20 50 61 73 74 20 33 | 0a 0d 69 73 20 61 20 6d |0 Past 3|..is a m|
|00000290| 65 6d 6f 72 79 20 72 65 | 73 69 64 65 6e 74 20 69 |emory re|sident i|
|000002a0| 6e 66 65 63 74 6f 72 20 | 6f 66 20 2e 43 4f 4d 20 |nfector |of .COM |
|000002b0| 70 72 6f 67 72 61 6d 73 | 2c 20 69 6e 63 6c 75 64 |programs|, includ|
|000002c0| 69 6e 67 0a 0d 43 4f 4d | 4d 41 4e 44 2e 43 4f 4d |ing..COM|MAND.COM|
|000002d0| 2e 0a 0d 0a 0d 54 68 65 | 20 66 69 72 73 74 20 74 |.....The| first t|
|000002e0| 69 6d 65 20 61 20 70 72 | 6f 67 72 61 6d 20 69 6e |ime a pr|ogram in|
|000002f0| 66 65 63 74 65 64 20 77 | 69 74 68 20 74 68 65 20 |fected w|ith the |
|00000300| 31 30 20 50 61 73 74 20 | 33 20 76 69 72 75 73 20 |10 Past |3 virus |
|00000310| 69 73 0a 0d 65 78 65 63 | 75 74 65 64 2c 20 74 68 |is..exec|uted, th|
|00000320| 69 73 20 76 69 72 75 73 | 20 77 69 6c 6c 20 69 6e |is virus| will in|
|00000330| 73 74 61 6c 6c 20 69 74 | 73 65 6c 66 20 6d 65 6d |stall it|self mem|
|00000340| 6f 72 79 20 72 65 73 69 | 64 65 6e 74 20 69 6e 20 |ory resi|dent in |
|00000350| 6c 6f 77 0a 0d 61 76 61 | 69 6c 61 62 6c 65 20 73 |low..ava|ilable s|
|00000360| 79 73 74 65 6d 20 6d 65 | 6d 6f 72 79 2c 20 68 6f |ystem me|mory, ho|
|00000370| 6f 6b 69 6e 67 20 69 6e | 74 65 72 72 75 70 74 73 |oking in|terrupts|
|00000380| 20 32 31 20 61 6e 64 20 | 36 42 2e 20 20 54 6f 74 | 21 and |6B. Tot|
|00000390| 61 6c 0a 0d 73 79 73 74 | 65 6d 20 61 6e 64 20 61 |al..syst|em and a|
|000003a0| 76 61 69 6c 61 62 6c 65 | 20 66 72 65 65 20 6d 65 |vailable| free me|
|000003b0| 6d 6f 72 79 2c 20 61 73 | 20 6d 65 61 73 75 72 65 |mory, as| measure|
|000003c0| 64 20 62 79 20 74 68 65 | 20 44 4f 53 20 43 48 4b |d by the| DOS CHK|
|000003d0| 44 53 4b 0a 0d 70 72 6f | 67 72 61 6d 2c 20 77 69 |DSK..pro|gram, wi|
|000003e0| 6c 6c 20 6e 6f 74 20 62 | 65 20 61 6c 74 65 72 65 |ll not b|e altere|
|000003f0| 64 2e 0a 0d 0a 0d 4f 6e | 63 65 20 74 68 65 20 31 |d.....On|ce the 1|
|00000400| 30 20 50 61 73 74 20 33 | 20 76 69 72 75 73 20 69 |0 Past 3| virus i|
|00000410| 73 20 6d 65 6d 6f 72 79 | 20 72 65 73 69 64 65 6e |s memory| residen|
|00000420| 74 2c 20 69 74 20 77 69 | 6c 6c 20 69 6e 66 65 63 |t, it wi|ll infec|
|00000430| 74 20 2e 43 4f 4d 0a 0d | 70 72 6f 67 72 61 6d 73 |t .COM..|programs|
|00000440| 2c 20 69 6e 63 6c 75 64 | 69 6e 67 20 43 4f 4d 4d |, includ|ing COMM|
|00000450| 41 4e 44 2e 43 4f 4d 2c | 20 77 68 65 6e 20 74 68 |AND.COM,| when th|
|00000460| 65 79 20 61 72 65 20 65 | 78 65 63 75 74 65 64 2e |ey are e|xecuted.|
|00000470| 20 20 49 6e 66 65 63 74 | 65 64 0a 0d 70 72 6f 67 | Infect|ed..prog|
|00000480| 72 61 6d 73 20 77 69 6c | 6c 20 68 61 76 65 20 61 |rams wil|l have a|
|00000490| 20 66 69 6c 65 20 6c 65 | 6e 67 74 68 20 69 6e 63 | file le|ngth inc|
|000004a0| 72 65 61 73 65 20 6f 66 | 20 37 34 38 20 62 79 74 |rease of| 748 byt|
|000004b0| 65 73 20 77 69 74 68 20 | 74 68 65 0a 0d 76 69 72 |es with |the..vir|
|000004c0| 75 73 20 62 65 69 6e 67 | 20 6c 6f 63 61 74 65 64 |us being| located|
|000004d0| 20 61 74 20 74 68 65 20 | 65 6e 64 20 6f 66 20 74 | at the |end of t|
|000004e0| 68 65 20 66 69 6c 65 2e | 20 20 54 68 65 20 70 72 |he file.| The pr|
|000004f0| 6f 67 72 61 6d 27 73 20 | 64 61 74 65 20 61 6e 64 |ogram's |date and|
|00000500| 0a 0d 74 69 6d 65 20 69 | 6e 20 74 68 65 20 44 4f |..time i|n the DO|
|00000510| 53 20 64 69 73 6b 20 64 | 69 72 65 63 74 6f 72 79 |S disk d|irectory|
|00000520| 20 6c 69 73 74 69 6e 67 | 20 77 69 6c 6c 20 6e 6f | listing| will no|
|00000530| 74 20 62 65 20 61 6c 74 | 65 72 65 64 2e 20 20 4e |t be alt|ered. N|
|00000540| 6f 0a 0d 74 65 78 74 20 | 73 74 72 69 6e 67 73 20 |o..text |strings |
|00000550| 61 72 65 20 76 69 73 69 | 62 6c 65 20 77 69 74 68 |are visi|ble with|
|00000560| 69 6e 20 74 68 65 20 76 | 69 72 61 6c 20 63 6f 64 |in the v|iral cod|
|00000570| 65 2e 0a 0d 0a 0d 54 68 | 65 20 31 30 20 50 61 73 |e.....Th|e 10 Pas|
|00000580| 74 20 33 20 76 69 72 75 | 73 20 61 63 74 69 76 61 |t 3 viru|s activa|
|00000590| 74 65 73 20 62 65 74 77 | 65 65 6e 20 31 35 3a 31 |tes betw|een 15:1|
|000005a0| 30 20 61 6e 64 20 31 35 | 3a 31 33 20 28 33 3a 30 |0 and 15|:13 (3:0|
|000005b0| 30 50 4d 20 61 6e 64 0a | 0d 33 3a 31 35 50 4d 29 |0PM and.|.3:15PM)|
|000005c0| 20 65 76 65 72 79 20 64 | 61 79 2c 20 61 74 20 77 | every d|ay, at w|
|000005d0| 68 69 63 68 20 74 69 6d | 65 20 69 74 20 77 69 6c |hich tim|e it wil|
|000005e0| 6c 20 63 61 75 73 65 20 | 74 68 65 20 22 43 74 72 |l cause |the "Ctr|
|000005f0| 6c 22 20 6f 72 20 22 53 | 68 69 66 74 22 0a 0d 6b |l" or "S|hift"..k|
|00000600| 65 79 73 20 74 6f 20 62 | 65 20 69 6e 76 6f 6b 65 |eys to b|e invoke|
|00000610| 73 20 6f 63 63 61 73 73 | 69 6f 6e 61 6c 6c 79 20 |s occass|ionally |
|00000620| 77 68 65 6e 20 74 68 65 | 20 73 79 73 74 65 6d 20 |when the| system |
|00000630| 75 73 65 72 20 65 6e 74 | 65 72 73 20 61 0a 0d 63 |user ent|ers a..c|
|00000640| 68 61 72 61 63 74 65 72 | 20 6f 6e 20 74 68 65 20 |haracter| on the |
|00000650| 73 79 73 74 65 6d 20 6b | 65 79 62 6f 61 72 64 2e |system k|eyboard.|
|00000660| 20 20 41 73 20 61 20 72 | 65 73 75 6c 74 2c 20 74 | As a r|esult, t|
|00000670| 68 65 20 63 68 61 72 61 | 63 74 65 72 20 69 6e 70 |he chara|cter inp|
|00000680| 75 74 0a 0d 6d 61 79 20 | 6e 6f 74 20 62 65 20 74 |ut..may |not be t|
|00000690| 68 65 20 73 61 6d 65 20 | 61 73 20 77 68 61 74 20 |he same |as what |
|000006a0| 74 68 65 20 75 73 65 72 | 20 69 6e 74 65 6e 64 65 |the user| intende|
|000006b0| 64 2e 20 20 41 64 64 69 | 74 69 6f 6e 61 6c 6c 79 |d. Addi|tionally|
|000006c0| 2c 20 69 74 0a 0d 65 69 | 74 68 65 72 20 64 69 73 |, it..ei|ther dis|
|000006d0| 61 62 6c 65 73 20 6f 72 | 20 69 6e 74 65 72 66 65 |ables or| interfe|
|000006e0| 72 73 20 77 69 74 68 20 | 74 68 65 20 66 75 6e 63 |rs with |the func|
|000006f0| 74 69 6f 6e 69 6e 67 20 | 6f 66 20 74 68 65 20 66 |tioning |of the f|
|00000700| 6f 6c 6c 6f 77 69 6e 67 | 0a 0d 64 65 76 69 63 65 |ollowing|..device|
|00000710| 73 20 6f 6e 20 74 68 65 | 20 64 61 79 73 20 6f 66 |s on the| days of|
|00000720| 20 61 6e 79 20 6d 6f 6e | 74 68 20 69 6e 64 69 63 | any mon|th indic|
|00000730| 61 74 65 64 20 62 65 6c | 6f 77 3a 0a 0d 0a 0d 20 |ated bel|ow:.... |
|00000740| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 31 | | 1|
|00000750| 73 74 20 64 61 79 20 6f | 66 20 61 6e 79 20 6d 6f |st day o|f any mo|
|00000760| 6e 74 68 20 2d 20 6b 65 | 79 62 6f 61 72 64 0a 0d |nth - ke|yboard..|
|00000770| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 31 | | 1|
|00000780| 30 74 68 20 64 61 79 20 | 6f 66 20 61 6e 79 20 6d |0th day |of any m|
|00000790| 6f 6e 74 68 20 2d 20 73 | 79 73 74 65 6d 20 68 61 |onth - s|ystem ha|
|000007a0| 72 64 20 64 69 73 6b 0a | 0d 20 20 20 20 20 20 20 |rd disk.|. |
|000007b0| 20 20 20 20 20 20 20 20 | 31 36 74 68 20 64 61 79 | |16th day|
|000007c0| 20 6f 66 20 61 6e 79 20 | 6d 6f 6e 74 68 20 2d 20 | of any |month - |
|000007d0| 73 79 73 74 65 6d 20 6d | 6f 6e 69 74 6f 72 2f 64 |system m|onitor/d|
|000007e0| 69 73 70 6c 61 79 0a 0d | 20 20 20 20 20 20 20 20 |isplay..| |
|000007f0| 20 20 20 20 20 20 20 32 | 39 74 68 20 64 61 79 20 | 2|9th day |
|00000800| 6f 66 20 61 6e 79 20 6d | 6f 6e 74 68 20 2d 20 64 |of any m|onth - d|
|00000810| 69 73 6b 20 64 72 69 76 | 65 73 0a 0d 0a 0d 4f 6e |isk driv|es....On|
|00000820| 20 74 68 65 20 32 32 6e | 64 20 64 61 79 20 6f 66 | the 22n|d day of|
|00000830| 20 61 6e 79 20 6d 6f 6e | 74 68 2c 20 75 6e 65 78 | any mon|th, unex|
|00000840| 70 65 63 74 65 64 20 73 | 79 73 74 65 6d 20 72 65 |pected s|ystem re|
|00000850| 62 6f 6f 74 73 20 6d 61 | 79 20 6f 63 63 75 72 2e |boots ma|y occur.|
|00000860| 0a 0d 0a 0d 1a 1a 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000870| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000880| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000890| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000008a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000008b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000008c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000008d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000008e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000008f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000900| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000910| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000920| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000930| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000940| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000950| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000960| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000970| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000980| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000990| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000009a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000009b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000009c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000009d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000009e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000009f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000a00| 54 68 65 20 35 4c 6f 20 | 76 69 72 75 73 20 77 61 |The 5Lo |virus wa|
|00000a10| 73 20 73 75 62 6d 69 74 | 74 65 64 20 69 6e 20 4a |s submit|ted in J|
|00000a20| 61 6e 75 61 72 79 2c 20 | 31 39 39 33 2c 20 61 6e |anuary, |1993, an|
|00000a30| 64 20 69 73 20 6f 72 69 | 67 69 6e 61 6c 6c 79 0a |d is ori|ginally.|
|00000a40| 0d 66 72 6f 6d 20 50 6f | 6c 61 6e 64 2e 20 20 35 |.from Po|land. 5|
|00000a50| 4c 6f 20 69 73 20 61 20 | 6d 65 6d 6f 72 79 20 72 |Lo is a |memory r|
|00000a60| 65 73 69 64 65 6e 74 20 | 69 6e 66 65 63 74 6f 72 |esident |infector|
|00000a70| 20 6f 66 20 2e 45 58 45 | 20 70 72 6f 67 72 61 6d | of .EXE| program|
|00000a80| 73 2e 0a 0d 0a 0d 57 68 | 65 6e 20 74 68 65 20 66 |s.....Wh|en the f|
|00000a90| 69 72 73 74 20 35 4c 6f | 20 69 6e 66 65 63 74 65 |irst 5Lo| infecte|
|00000aa0| 64 20 70 72 6f 67 72 61 | 6d 20 69 73 20 65 78 65 |d progra|m is exe|
|00000ab0| 63 75 74 65 64 2c 20 74 | 68 65 20 35 4c 6f 20 76 |cuted, t|he 5Lo v|
|00000ac0| 69 72 75 73 20 77 69 6c | 6c 0a 0d 69 6e 73 74 61 |irus wil|l..insta|
|00000ad0| 6c 6c 20 69 74 73 65 6c | 66 20 6d 65 6d 6f 72 79 |ll itsel|f memory|
|00000ae0| 20 72 65 73 69 64 65 6e | 74 20 61 74 20 74 68 65 | residen|t at the|
|00000af0| 20 74 6f 70 20 6f 66 20 | 73 79 73 74 65 6d 20 6d | top of |system m|
|00000b00| 65 6d 6f 72 79 20 62 75 | 74 20 62 65 6c 6f 77 0a |emory bu|t below.|
|00000b10| 0d 74 68 65 20 36 34 30 | 4b 20 44 4f 53 20 62 6f |.the 640|K DOS bo|
|00000b20| 75 6e 64 61 72 79 2c 20 | 68 6f 6f 6b 69 6e 67 20 |undary, |hooking |
|00000b30| 69 6e 74 65 72 72 75 70 | 74 20 32 31 2e 20 20 4f |interrup|t 21. O|
|00000b40| 6e 63 65 20 6d 65 6d 6f | 72 79 20 72 65 73 69 64 |nce memo|ry resid|
|00000b50| 65 6e 74 2c 0a 0d 69 74 | 20 77 69 6c 6c 20 69 6e |ent,..it| will in|
|00000b60| 66 65 63 74 20 2e 45 58 | 45 20 70 72 6f 67 72 61 |fect .EX|E progra|
|00000b70| 6d 73 20 77 68 65 6e 20 | 74 68 65 79 20 61 72 65 |ms when |they are|
|00000b80| 20 65 78 65 63 75 74 65 | 64 2e 0a 0d 0a 0d 35 4c | execute|d.....5L|
|00000b90| 6f 20 69 6e 66 65 63 74 | 65 64 20 70 72 6f 67 72 |o infect|ed progr|
|00000ba0| 61 6d 73 20 77 69 6c 6c | 20 68 61 76 65 20 61 20 |ams will| have a |
|00000bb0| 66 69 6c 65 20 6c 65 6e | 67 74 68 20 69 6e 63 72 |file len|gth incr|
|00000bc0| 65 61 73 65 20 6f 66 20 | 31 2c 30 33 30 20 74 6f |ease of |1,030 to|
|00000bd0| 0a 0d 31 2c 30 34 30 20 | 62 79 74 65 73 20 77 69 |..1,040 |bytes wi|
|00000be0| 74 68 20 74 68 65 20 76 | 69 72 75 73 20 62 65 69 |th the v|irus bei|
|00000bf0| 6e 67 20 6c 6f 63 61 74 | 65 64 20 61 74 20 74 68 |ng locat|ed at th|
|00000c00| 65 20 65 6e 64 20 6f 66 | 20 74 68 65 20 66 69 6c |e end of| the fil|
|00000c10| 65 2e 20 20 54 68 65 0a | 0d 70 72 6f 67 72 61 6d |e. The.|.program|
|00000c20| 27 73 20 64 61 74 65 20 | 61 6e 64 20 74 69 6d 65 |'s date |and time|
|00000c30| 20 69 6e 20 74 68 65 20 | 44 4f 53 20 64 69 73 6b | in the |DOS disk|
|00000c40| 20 64 69 72 65 63 74 6f | 72 79 20 6c 69 73 74 69 | directo|ry listi|
|00000c50| 6e 67 20 77 69 6c 6c 20 | 68 61 76 65 0a 0d 62 65 |ng will |have..be|
|00000c60| 65 6e 20 75 70 64 61 74 | 65 64 20 74 6f 20 74 68 |en updat|ed to th|
|00000c70| 65 20 63 75 72 72 65 6e | 74 20 73 79 73 74 65 6d |e curren|t system|
|00000c80| 20 64 61 74 65 20 61 6e | 64 20 74 69 6d 65 2e 20 | date an|d time. |
|00000c90| 20 54 68 65 20 66 6f 6c | 6c 6f 77 69 6e 67 20 74 | The fol|lowing t|
|00000ca0| 65 78 74 0a 0d 73 74 72 | 69 6e 67 73 20 63 61 6e |ext..str|ings can|
|00000cb0| 20 62 65 20 66 6f 75 6e | 64 20 77 69 74 68 69 6e | be foun|d within|
|00000cc0| 20 74 68 65 20 76 69 72 | 61 6c 20 63 6f 64 65 20 | the vir|al code |
|00000cd0| 69 6e 20 61 6c 6c 20 35 | 4c 6f 20 69 6e 66 65 63 |in all 5|Lo infec|
|00000ce0| 74 65 64 0a 0d 70 72 6f | 67 72 61 6d 73 3a 0a 0d |ted..pro|grams:..|
|00000cf0| 0a 0d 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |.. | |
|00000d00| 20 22 39 32 2e 30 35 2e | 32 34 2e 35 6c 6f 2e 32 | "92.05.|24.5lo.2|
|00000d10| 2e 32 33 4d 5a 22 0a 0d | 20 20 20 20 20 20 20 20 |.23MZ"..| |
|00000d20| 20 20 20 20 20 20 20 22 | 3f 3f 3f 3f 3f 3f 3f 3f | "|????????|
|00000d30| 45 58 45 22 0a 0d 0a 0d | 0a 0d 0a 0d 1a 1a 00 00 |EXE"....|........|
|00000d40| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000d50| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000d60| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000d70| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000d80| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000d90| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000da0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000db0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000dc0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000dd0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000de0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000df0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000e00| 54 68 65 20 39 39 25 20 | 76 69 72 75 73 20 77 61 |The 99% |virus wa|
|00000e10| 73 20 73 75 62 6d 69 74 | 74 65 64 20 69 6e 20 4e |s submit|ted in N|
|00000e20| 6f 76 65 6d 62 65 72 2c | 20 31 39 39 32 2e 20 20 |ovember,| 1992. |
|00000e30| 49 74 73 20 6f 72 69 67 | 69 6e 20 69 73 0a 0d 75 |Its orig|in is..u|
|00000e40| 6e 6b 6e 6f 77 6e 2c 20 | 62 75 74 20 69 74 20 61 |nknown, |but it a|
|00000e50| 70 70 65 61 72 73 20 74 | 6f 20 62 65 20 66 72 6f |ppears t|o be fro|
|00000e60| 6d 20 45 75 72 6f 70 65 | 2e 20 20 39 39 25 20 69 |m Europe|. 99% i|
|00000e70| 73 20 61 20 6e 6f 6e 2d | 72 65 73 69 64 65 6e 74 |s a non-|resident|
|00000e80| 0a 0d 64 69 72 65 63 74 | 20 61 63 74 69 6f 6e 20 |..direct| action |
|00000e90| 69 6e 66 65 63 74 6f 72 | 20 6f 66 20 2e 45 58 45 |infector| of .EXE|
|00000ea0| 20 70 72 6f 67 72 61 6d | 73 2e 0a 0d 0a 0d 57 68 | program|s.....Wh|
|00000eb0| 65 6e 20 61 20 70 72 6f | 67 72 61 6d 20 69 6e 66 |en a pro|gram inf|
|00000ec0| 65 63 74 65 64 20 77 69 | 74 68 20 39 39 25 20 69 |ected wi|th 99% i|
|00000ed0| 73 20 65 78 65 63 75 74 | 65 64 2c 20 74 68 65 20 |s execut|ed, the |
|00000ee0| 39 39 25 20 76 69 72 75 | 73 20 77 69 6c 6c 0a 0d |99% viru|s will..|
|00000ef0| 69 6e 66 65 63 74 20 6f | 6e 65 20 2e 45 58 45 20 |infect o|ne .EXE |
|00000f00| 70 72 6f 67 72 61 6d 20 | 6c 6f 63 61 74 65 64 20 |program |located |
|00000f10| 69 6e 20 74 68 65 20 63 | 75 72 72 65 6e 74 20 64 |in the c|urrent d|
|00000f20| 69 72 65 63 74 6f 72 79 | 20 6f 72 20 69 6e 20 74 |irectory| or in t|
|00000f30| 68 65 0a 0d 63 75 72 72 | 65 6e 74 20 64 72 69 76 |he..curr|ent driv|
|00000f40| 65 27 73 20 72 6f 6f 74 | 20 64 69 72 65 63 74 6f |e's root| directo|
|00000f50| 72 79 2e 20 20 49 6e 66 | 65 63 74 65 64 20 70 72 |ry. Inf|ected pr|
|00000f60| 6f 67 72 61 6d 73 20 77 | 69 6c 6c 20 68 61 76 65 |ograms w|ill have|
|00000f70| 20 61 20 66 69 6c 65 0a | 0d 6c 65 6e 67 74 68 20 | a file.|.length |
|00000f80| 69 6e 63 72 65 61 73 65 | 20 6f 66 20 38 32 31 20 |increase| of 821 |
|00000f90| 74 6f 20 38 33 35 20 62 | 79 74 65 73 20 77 69 74 |to 835 b|ytes wit|
|00000fa0| 68 20 74 68 65 20 76 69 | 72 75 73 20 62 65 69 6e |h the vi|rus bein|
|00000fb0| 67 20 6c 6f 63 61 74 65 | 64 20 61 74 0a 0d 74 68 |g locate|d at..th|
|00000fc0| 65 20 65 6e 64 20 6f 66 | 20 74 68 65 20 66 69 6c |e end of| the fil|
|00000fd0| 65 2e 20 20 54 68 65 20 | 70 72 6f 67 72 61 6d 27 |e. The |program'|
|00000fe0| 73 20 64 61 74 65 20 61 | 6e 64 20 74 69 6d 65 20 |s date a|nd time |
|00000ff0| 69 6e 20 74 68 65 20 44 | 4f 53 20 64 69 73 6b 0a |in the D|OS disk.|
|00001000| 0d 64 69 72 65 63 74 6f | 72 79 20 6c 69 73 74 69 |.directo|ry listi|
|00001010| 6e 67 20 77 69 6c 6c 20 | 61 70 70 65 61 72 20 74 |ng will |appear t|
|00001020| 6f 20 6e 6f 74 20 62 65 | 20 61 6c 74 65 72 65 64 |o not be| altered|
|00001030| 2c 20 62 75 74 20 74 68 | 65 20 66 69 6c 65 20 74 |, but th|e file t|
|00001040| 69 6d 65 0a 0d 73 65 63 | 6f 6e 64 73 20 77 69 6c |ime..sec|onds wil|
|00001050| 6c 20 68 61 76 65 20 62 | 65 65 6e 20 73 65 74 20 |l have b|een set |
|00001060| 74 6f 20 22 31 34 22 2e | 0a 0d 0a 0d 54 68 65 20 |to "14".|....The |
|00001070| 66 6f 6c 6c 6f 77 69 6e | 67 20 74 65 78 74 20 73 |followin|g text s|
|00001080| 74 72 69 6e 67 73 20 61 | 72 65 20 65 6e 63 72 79 |trings a|re encry|
|00001090| 70 74 65 64 20 77 69 74 | 68 69 6e 20 74 68 65 20 |pted wit|hin the |
|000010a0| 39 39 25 20 76 69 72 75 | 73 27 20 63 6f 64 65 3a |99% viru|s' code:|
|000010b0| 0a 0d 0a 0d 20 20 20 20 | 20 20 20 20 20 20 20 20 |.... | |
|000010c0| 20 20 20 22 48 65 74 20 | 39 39 25 2d 76 69 72 75 | "Het |99%-viru|
|000010d0| 73 20 68 65 65 66 74 20 | 74 6f 65 67 65 73 6c 61 |s heeft |toegesla|
|000010e0| 67 65 6e 2e 20 2e 20 2e | 22 0a 0d 20 20 20 20 20 |gen. . .|".. |
|000010f0| 20 20 20 20 20 20 20 20 | 20 20 22 54 68 69 73 20 | | "This |
|00001100| 69 73 20 6d 79 20 72 65 | 76 65 6e 67 65 20 45 2e |is my re|venge E.|
|00001110| 56 20 21 22 0a 0d 20 20 | 20 20 20 20 20 20 20 20 |V !".. | |
|00001120| 20 20 20 20 20 22 4f 72 | 69 67 69 6e 61 6c 6c 79 | "Or|iginally|
|00001130| 20 72 65 6c 65 61 73 65 | 64 20 36 20 41 70 72 69 | release|d 6 Apri|
|00001140| 6c 20 27 39 32 22 0a 0d | 20 20 20 20 20 20 20 20 |l '92"..| |
|00001150| 20 20 20 20 20 20 20 22 | 2a 2e 45 58 45 20 5c 2a | "|*.EXE \*|
|00001160| 20 5c 22 0a 0d 0a 0d 49 | 74 20 69 73 20 75 6e 6b | \"....I|t is unk|
|00001170| 6e 6f 77 6e 20 77 68 61 | 74 20 39 39 25 20 6d 61 |nown wha|t 99% ma|
|00001180| 79 20 64 6f 20 62 65 73 | 69 64 65 73 20 72 65 70 |y do bes|ides rep|
|00001190| 6c 69 63 61 74 65 2e 0a | 0d 0a 0d 1a 1a 00 00 00 |licate..|........|
|000011a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001200| 54 68 65 20 33 30 32 20 | 76 69 72 75 73 20 77 61 |The 302 |virus wa|
|00001210| 73 20 72 65 63 65 69 76 | 65 64 20 69 6e 20 53 65 |s receiv|ed in Se|
|00001220| 70 74 65 6d 62 65 72 2c | 20 31 39 39 32 2e 20 20 |ptember,| 1992. |
|00001230| 49 74 73 20 6f 72 69 67 | 69 6e 20 69 73 0a 0d 75 |Its orig|in is..u|
|00001240| 6e 6b 6e 6f 77 6e 2e 20 | 20 54 68 65 20 33 30 32 |nknown. | The 302|
|00001250| 20 76 69 72 75 73 20 69 | 73 20 61 20 6d 65 6d 6f | virus i|s a memo|
|00001260| 72 79 20 72 65 73 69 64 | 65 6e 74 20 69 6e 66 65 |ry resid|ent infe|
|00001270| 63 74 6f 72 20 6f 66 20 | 2e 43 4f 4d 0a 0d 70 72 |ctor of |.COM..pr|
|00001280| 6f 67 72 61 6d 73 2c 20 | 69 6e 63 6c 75 64 69 6e |ograms, |includin|
|00001290| 67 20 43 4f 4d 4d 41 4e | 44 2e 43 4f 4d 2e 0a 0d |g COMMAN|D.COM...|
|000012a0| 0a 0d 57 68 65 6e 20 74 | 68 65 20 66 69 72 73 74 |..When t|he first|
|000012b0| 20 33 30 32 20 76 69 72 | 75 73 20 69 6e 66 65 63 | 302 vir|us infec|
|000012c0| 74 65 64 20 70 72 6f 67 | 72 61 6d 20 69 73 20 65 |ted prog|ram is e|
|000012d0| 78 65 63 75 74 65 64 2c | 20 74 68 65 20 33 30 32 |xecuted,| the 302|
|000012e0| 0a 0d 76 69 72 75 73 20 | 77 69 6c 6c 20 69 6e 73 |..virus |will ins|
|000012f0| 74 61 6c 6c 20 69 74 73 | 65 6c 66 20 6d 65 6d 6f |tall its|elf memo|
|00001300| 72 79 20 72 65 73 69 64 | 65 6e 74 20 61 73 20 61 |ry resid|ent as a|
|00001310| 20 6c 6f 77 20 73 79 73 | 74 65 6d 20 6d 65 6d 6f | low sys|tem memo|
|00001320| 72 79 0a 0d 54 53 52 20 | 6f 66 20 38 36 34 20 62 |ry..TSR |of 864 b|
|00001330| 79 74 65 73 2e 20 20 49 | 74 20 68 6f 6f 6b 73 20 |ytes. I|t hooks |
|00001340| 69 6e 74 65 72 72 75 70 | 74 20 32 31 2e 0a 0d 0a |interrup|t 21....|
|00001350| 0d 4f 6e 63 65 20 74 68 | 65 20 33 30 32 20 76 69 |.Once th|e 302 vi|
|00001360| 72 75 73 20 69 73 20 6d | 65 6d 6f 72 79 20 72 65 |rus is m|emory re|
|00001370| 73 69 64 65 6e 74 2c 20 | 69 74 20 77 69 6c 6c 20 |sident, |it will |
|00001380| 69 6e 66 65 63 74 20 2e | 43 4f 4d 20 70 72 6f 67 |infect .|COM prog|
|00001390| 72 61 6d 73 2c 0a 0d 69 | 6e 63 6c 75 64 69 6e 67 |rams,..i|ncluding|
|000013a0| 20 43 4f 4d 4d 41 4e 44 | 2e 43 4f 4d 2c 20 77 68 | COMMAND|.COM, wh|
|000013b0| 65 6e 20 74 68 65 79 20 | 61 72 65 20 65 78 65 63 |en they |are exec|
|000013c0| 75 74 65 64 2e 20 20 49 | 6e 66 65 63 74 65 64 20 |uted. I|nfected |
|000013d0| 70 72 6f 67 72 61 6d 73 | 0a 0d 77 69 6c 6c 20 68 |programs|..will h|
|000013e0| 61 76 65 20 61 20 66 69 | 6c 65 20 6c 65 6e 67 74 |ave a fi|le lengt|
|000013f0| 68 20 69 6e 63 72 65 61 | 73 65 20 6f 66 20 33 30 |h increa|se of 30|
|00001400| 32 20 62 79 74 65 73 20 | 77 69 74 68 20 74 68 65 |2 bytes |with the|
|00001410| 20 76 69 72 75 73 20 62 | 65 69 6e 67 0a 0d 6c 6f | virus b|eing..lo|
|00001420| 63 61 74 65 64 20 61 74 | 20 74 68 65 20 65 6e 64 |cated at| the end|
|00001430| 20 6f 66 20 74 68 65 20 | 66 69 6c 65 2e 20 20 54 | of the |file. T|
|00001440| 68 65 20 70 72 6f 67 72 | 61 6d 27 73 20 64 61 74 |he progr|am's dat|
|00001450| 65 20 61 6e 64 20 74 69 | 6d 65 20 69 6e 20 74 68 |e and ti|me in th|
|00001460| 65 0a 0d 44 4f 53 20 64 | 69 73 6b 20 64 69 72 65 |e..DOS d|isk dire|
|00001470| 63 74 6f 72 79 20 6c 69 | 73 74 69 6e 67 20 77 69 |ctory li|sting wi|
|00001480| 6c 6c 20 68 61 76 65 20 | 62 65 65 6e 20 75 70 64 |ll have |been upd|
|00001490| 61 74 65 64 20 74 6f 20 | 74 68 65 20 63 75 72 72 |ated to |the curr|
|000014a0| 65 6e 74 0a 0d 73 79 73 | 74 65 6d 20 64 61 74 65 |ent..sys|tem date|
|000014b0| 20 61 6e 64 20 74 69 6d | 65 20 77 68 65 6e 20 69 | and tim|e when i|
|000014c0| 6e 66 65 63 74 69 6f 6e | 20 6f 63 63 75 72 72 65 |nfection| occurre|
|000014d0| 64 2e 20 20 4e 6f 20 74 | 65 78 74 20 73 74 72 69 |d. No t|ext stri|
|000014e0| 6e 67 73 20 61 72 65 0a | 0d 76 69 73 69 62 6c 65 |ngs are.|.visible|
|000014f0| 20 6f 72 20 63 6f 6e 74 | 61 69 6e 65 64 20 69 6e | or cont|ained in|
|00001500| 20 74 68 65 20 76 69 72 | 61 6c 20 63 6f 64 65 2e | the vir|al code.|
|00001510| 0a 0d 0a 0d 54 68 65 20 | 33 30 32 20 76 69 72 75 |....The |302 viru|
|00001520| 73 20 64 6f 65 73 6e 27 | 74 20 64 6f 20 61 6e 79 |s doesn'|t do any|
|00001530| 74 68 69 6e 67 20 62 65 | 73 69 64 65 73 20 72 65 |thing be|sides re|
|00001540| 70 6c 69 63 61 74 65 2e | 0a 0d 0a 0d 0a 0d 0a 0d |plicate.|........|
|00001550| 1a 1a 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001560| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001570| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001580| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001590| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000015f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001600| 54 68 65 20 33 31 30 20 | 76 69 72 75 73 20 77 61 |The 310 |virus wa|
|00001610| 73 20 72 65 63 65 69 76 | 65 64 20 69 6e 20 4a 61 |s receiv|ed in Ja|
|00001620| 6e 75 61 72 79 2c 20 31 | 39 39 32 2e 20 20 49 74 |nuary, 1|992. It|
|00001630| 73 20 6f 72 69 67 69 6e | 20 69 73 20 75 6e 6b 6e |s origin| is unkn|
|00001640| 6f 77 6e 2e 0a 0d 54 68 | 69 73 20 76 69 72 75 73 |own...Th|is virus|
|00001650| 20 69 73 20 61 20 6d 65 | 6d 6f 72 79 20 72 65 73 | is a me|mory res|
|00001660| 69 64 65 6e 74 20 69 6e | 66 65 63 74 6f 72 20 6f |ident in|fector o|
|00001670| 66 20 2e 43 4f 4d 20 70 | 72 6f 67 72 61 6d 73 2c |f .COM p|rograms,|
|00001680| 20 69 6e 63 6c 75 64 69 | 6e 67 0a 0d 43 4f 4d 4d | includi|ng..COMM|
|00001690| 41 4e 44 2e 43 4f 4d 2e | 0a 0d 0a 0d 54 68 65 20 |AND.COM.|....The |
|000016a0| 66 69 72 73 74 20 74 69 | 6d 65 20 61 20 70 72 6f |first ti|me a pro|
|000016b0| 67 72 61 6d 20 69 6e 66 | 65 63 74 65 64 20 77 69 |gram inf|ected wi|
|000016c0| 74 68 20 33 31 30 20 69 | 73 20 65 78 65 63 75 74 |th 310 i|s execut|
|000016d0| 65 64 2c 20 74 68 65 20 | 33 31 30 0a 0d 76 69 72 |ed, the |310..vir|
|000016e0| 75 73 20 77 69 6c 6c 20 | 69 6e 73 74 61 6c 6c 20 |us will |install |
|000016f0| 69 74 73 65 6c 66 20 6d | 65 6d 6f 72 79 20 72 65 |itself m|emory re|
|00001700| 73 69 64 65 6e 74 20 69 | 6e 20 61 76 61 69 6c 61 |sident i|n availa|
|00001710| 62 6c 65 20 66 72 65 65 | 20 6d 65 6d 6f 72 79 2c |ble free| memory,|
|00001720| 0a 0d 68 6f 6f 6b 69 6e | 67 20 69 6e 74 65 72 72 |..hookin|g interr|
|00001730| 75 70 74 73 20 32 31 20 | 61 6e 64 20 36 33 20 69 |upts 21 |and 63 i|
|00001740| 6e 20 74 68 65 20 69 6e | 74 65 72 72 75 70 74 20 |n the in|terrupt |
|00001750| 61 72 65 61 2e 20 20 54 | 68 65 72 65 20 77 69 6c |area. T|here wil|
|00001760| 6c 20 62 65 0a 0d 6e 6f | 20 63 68 61 6e 67 65 20 |l be..no| change |
|00001770| 74 6f 20 74 6f 74 61 6c | 20 73 79 73 74 65 6d 20 |to total| system |
|00001780| 61 6e 64 20 61 76 61 69 | 6c 61 62 6c 65 20 66 72 |and avai|lable fr|
|00001790| 65 65 20 6d 65 6d 6f 72 | 79 20 61 73 20 69 6e 64 |ee memor|y as ind|
|000017a0| 69 63 61 74 65 64 20 62 | 79 0a 0d 74 68 65 20 44 |icated b|y..the D|
|000017b0| 4f 53 20 43 48 4b 44 53 | 4b 20 70 72 6f 67 72 61 |OS CHKDS|K progra|
|000017c0| 6d 2e 0a 0d 0a 0d 4f 6e | 63 65 20 74 68 65 20 33 |m.....On|ce the 3|
|000017d0| 31 30 20 76 69 72 75 73 | 20 69 73 20 6d 65 6d 6f |10 virus| is memo|
|000017e0| 72 79 20 72 65 73 69 64 | 65 6e 74 2c 20 69 74 20 |ry resid|ent, it |
|000017f0| 77 69 6c 6c 20 69 6e 66 | 65 63 74 20 2e 43 4f 4d |will inf|ect .COM|
|00001800| 20 70 72 6f 67 72 61 6d | 73 0a 0d 77 68 65 6e 20 | program|s..when |
|00001810| 74 68 65 79 20 61 72 65 | 20 65 78 65 63 75 74 65 |they are| execute|
|00001820| 64 2e 20 20 49 66 20 43 | 4f 4d 4d 41 4e 44 2e 43 |d. If C|OMMAND.C|
|00001830| 4f 4d 20 69 73 20 65 78 | 65 63 75 74 65 64 2c 20 |OM is ex|ecuted, |
|00001840| 69 74 20 77 69 6c 6c 20 | 62 65 63 6f 6d 65 0a 0d |it will |become..|
|00001850| 69 6e 66 65 63 74 65 64 | 2e 20 20 50 72 6f 67 72 |infected|. Progr|
|00001860| 61 6d 73 20 69 6e 66 65 | 63 74 65 64 20 77 69 74 |ams infe|cted wit|
|00001870| 68 20 74 68 65 20 33 31 | 30 20 76 69 72 75 73 20 |h the 31|0 virus |
|00001880| 77 69 6c 6c 20 68 61 76 | 65 20 61 20 66 69 6c 65 |will hav|e a file|
|00001890| 0a 0d 6c 65 6e 67 74 68 | 20 69 6e 63 72 65 61 73 |..length| increas|
|000018a0| 65 20 6f 66 20 33 31 30 | 20 62 79 74 65 73 20 77 |e of 310| bytes w|
|000018b0| 69 74 68 20 74 68 65 20 | 76 69 72 75 73 20 62 65 |ith the |virus be|
|000018c0| 69 6e 67 20 6c 6f 63 61 | 74 65 64 20 61 74 20 74 |ing loca|ted at t|
|000018d0| 68 65 20 65 6e 64 0a 0d | 6f 66 20 74 68 65 20 69 |he end..|of the i|
|000018e0| 6e 66 65 63 74 65 64 20 | 66 69 6c 65 2e 20 20 54 |nfected |file. T|
|000018f0| 68 65 20 70 72 6f 67 72 | 61 6d 27 73 20 64 61 74 |he progr|am's dat|
|00001900| 65 20 61 6e 64 20 74 69 | 6d 65 20 69 6e 20 74 68 |e and ti|me in th|
|00001910| 65 20 44 4f 53 20 64 69 | 73 6b 0a 0d 64 69 72 65 |e DOS di|sk..dire|
|00001920| 63 74 6f 72 79 20 6c 69 | 73 74 69 6e 67 20 77 69 |ctory li|sting wi|
|00001930| 6c 6c 20 6e 6f 74 20 68 | 61 76 65 20 62 65 65 6e |ll not h|ave been|
|00001940| 20 61 6c 74 65 72 65 64 | 2e 0a 0d 0a 0d 53 79 73 | altered|.....Sys|
|00001950| 74 65 6d 73 20 69 6e 66 | 65 63 74 65 64 20 77 69 |tems inf|ected wi|
|00001960| 74 68 20 74 68 65 20 33 | 31 30 20 76 69 72 75 73 |th the 3|10 virus|
|00001970| 20 77 69 6c 6c 20 6e 6f | 74 69 63 65 20 74 68 61 | will no|tice tha|
|00001980| 74 20 61 74 74 65 6d 70 | 74 73 20 74 6f 0a 0d 65 |t attemp|ts to..e|
|00001990| 78 65 63 75 74 65 20 70 | 72 6f 67 72 61 6d 73 20 |xecute p|rograms |
|000019a0| 66 72 6f 6d 20 77 72 69 | 74 65 20 70 72 6f 74 65 |from wri|te prote|
|000019b0| 63 74 65 64 20 64 69 73 | 6b 65 74 74 65 73 20 77 |cted dis|kettes w|
|000019c0| 69 6c 6c 20 72 65 73 75 | 6c 74 20 69 6e 20 61 0a |ill resu|lt in a.|
|000019d0| 0d 77 72 69 74 65 20 70 | 72 6f 74 65 63 74 20 65 |.write p|rotect e|
|000019e0| 72 72 6f 72 20 6d 65 73 | 73 61 67 65 20 62 65 69 |rror mes|sage bei|
|000019f0| 6e 67 20 64 69 73 70 6c | 61 79 65 64 20 62 79 20 |ng displ|ayed by |
|00001a00| 44 4f 53 2e 20 20 54 68 | 69 73 20 6f 63 63 75 72 |DOS. Th|is occur|
|00001a10| 73 0a 0d 62 65 63 61 75 | 73 65 20 74 68 65 20 76 |s..becau|se the v|
|00001a20| 69 72 75 73 20 64 6f 65 | 73 6e 27 74 20 63 68 65 |irus doe|sn't che|
|00001a30| 63 6b 20 66 6f 72 20 74 | 68 65 20 65 72 72 6f 72 |ck for t|he error|
|00001a40| 20 61 6e 64 20 70 72 6f | 70 65 72 6c 79 20 68 61 | and pro|perly ha|
|00001a50| 6e 64 6c 65 0a 0d 69 74 | 2e 0a 0d 0a 0d 1a 1a 00 |ndle..it|........|
|00001a60| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001a70| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001a80| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001a90| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001aa0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001ab0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001ac0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001ad0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001ae0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001af0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001b00| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001b10| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001b20| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001b30| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001b40| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001b50| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001b60| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001b70| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001b80| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001b90| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001ba0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001bb0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001bc0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001bd0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001be0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001bf0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001c00| 54 68 65 20 33 33 34 20 | 76 69 72 75 73 20 77 61 |The 334 |virus wa|
|00001c10| 73 20 73 75 62 6d 69 74 | 74 65 64 20 69 6e 20 4d |s submit|ted in M|
|00001c20| 61 79 2c 20 31 39 39 32 | 2e 20 20 49 74 20 69 73 |ay, 1992|. It is|
|00001c30| 20 6f 72 69 67 69 6e 61 | 6c 6c 79 20 66 72 6f 6d | origina|lly from|
|00001c40| 0a 0d 45 6e 67 6c 61 6e | 64 2e 20 20 54 68 69 73 |..Englan|d. This|
|00001c50| 20 76 69 72 75 73 20 69 | 73 20 61 20 6e 6f 6e 2d | virus i|s a non-|
|00001c60| 72 65 73 69 64 65 6e 74 | 20 64 69 72 65 63 74 20 |resident| direct |
|00001c70| 61 63 74 69 6f 6e 20 69 | 6e 66 65 63 74 6f 72 20 |action i|nfector |
|00001c80| 6f 66 0a 0d 2e 43 4f 4d | 20 70 72 6f 67 72 61 6d |of...COM| program|
|00001c90| 73 2c 20 69 6e 63 6c 75 | 64 69 6e 67 20 43 4f 4d |s, inclu|ding COM|
|00001ca0| 4d 41 4e 44 2e 43 4f 4d | 2e 0a 0d 0a 0d 57 68 65 |MAND.COM|.....Whe|
|00001cb0| 6e 20 61 20 70 72 6f 67 | 72 61 6d 20 69 6e 66 65 |n a prog|ram infe|
|00001cc0| 63 74 65 64 20 77 69 74 | 68 20 74 68 65 20 33 33 |cted wit|h the 33|
|00001cd0| 34 20 76 69 72 75 73 20 | 69 73 20 65 78 65 63 75 |4 virus |is execu|
|00001ce0| 74 65 64 2c 20 74 68 65 | 20 33 33 34 20 76 69 72 |ted, the| 334 vir|
|00001cf0| 75 73 0a 0d 77 69 6c 6c | 20 63 68 65 63 6b 20 74 |us..will| check t|
|00001d00| 68 65 20 66 69 72 73 74 | 20 74 68 72 65 65 20 2e |he first| three .|
|00001d10| 43 4f 4d 20 70 72 6f 67 | 72 61 6d 73 20 69 6e 20 |COM prog|rams in |
|00001d20| 74 68 65 20 63 75 72 72 | 65 6e 74 20 64 69 72 65 |the curr|ent dire|
|00001d30| 63 74 6f 72 79 20 74 6f | 0a 0d 73 65 65 20 69 66 |ctory to|..see if|
|00001d40| 20 74 68 65 79 20 61 72 | 65 20 69 6e 66 65 63 74 | they ar|e infect|
|00001d50| 65 64 2e 20 20 57 68 65 | 6e 20 69 74 20 66 69 6e |ed. Whe|n it fin|
|00001d60| 64 73 20 74 68 65 20 66 | 69 72 73 74 20 75 6e 69 |ds the f|irst uni|
|00001d70| 6e 66 65 63 74 65 64 20 | 6f 66 0a 0d 74 68 65 73 |nfected |of..thes|
|00001d80| 65 20 74 68 72 65 65 20 | 2e 43 4f 4d 20 66 69 6c |e three |.COM fil|
|00001d90| 65 73 2c 20 69 74 20 77 | 69 6c 6c 20 69 6e 66 65 |es, it w|ill infe|
|00001da0| 63 74 20 69 74 2e 20 20 | 4f 6e 63 65 20 74 68 65 |ct it. |Once the|
|00001db0| 20 76 69 72 75 73 20 68 | 61 73 0a 0d 63 6f 6d 70 | virus h|as..comp|
|00001dc0| 6c 65 74 65 64 20 74 68 | 69 73 20 70 72 6f 63 65 |leted th|is proce|
|00001dd0| 73 73 2c 20 74 68 65 20 | 70 72 6f 67 72 61 6d 20 |ss, the |program |
|00001de0| 74 68 65 20 75 73 65 72 | 20 77 61 73 20 61 74 74 |the user| was att|
|00001df0| 65 6d 70 74 69 6e 67 20 | 74 6f 0a 0d 65 78 65 63 |empting |to..exec|
|00001e00| 75 74 65 20 77 69 6c 6c | 20 72 75 6e 2e 0a 0d 0a |ute will| run....|
|00001e10| 0d 50 72 6f 67 72 61 6d | 73 20 69 6e 66 65 63 74 |.Program|s infect|
|00001e20| 65 64 20 77 69 74 68 20 | 74 68 65 20 33 33 34 20 |ed with |the 334 |
|00001e30| 76 69 72 75 73 20 77 69 | 6c 6c 20 68 61 76 65 20 |virus wi|ll have |
|00001e40| 61 20 66 69 6c 65 20 6c | 65 6e 67 74 68 20 69 6e |a file l|ength in|
|00001e50| 63 72 65 61 73 65 0a 0d | 6f 66 20 33 33 34 20 62 |crease..|of 334 b|
|00001e60| 79 74 65 73 20 77 69 74 | 68 20 74 68 65 20 76 69 |ytes wit|h the vi|
|00001e70| 72 75 73 20 62 65 69 6e | 67 20 6c 6f 63 61 74 65 |rus bein|g locate|
|00001e80| 64 20 61 74 20 74 68 65 | 20 65 6e 64 20 6f 66 20 |d at the| end of |
|00001e90| 74 68 65 20 69 6e 66 65 | 63 74 65 64 0a 0d 66 69 |the infe|cted..fi|
|00001ea0| 6c 65 2e 20 20 54 68 65 | 20 70 72 6f 67 72 61 6d |le. The| program|
|00001eb0| 27 73 20 64 61 74 65 20 | 61 6e 64 20 74 69 6d 65 |'s date |and time|
|00001ec0| 20 69 6e 20 74 68 65 20 | 44 4f 53 20 64 69 73 6b | in the |DOS disk|
|00001ed0| 20 64 69 72 65 63 74 6f | 72 79 20 6c 69 73 74 69 | directo|ry listi|
|00001ee0| 6e 67 0a 0d 77 69 6c 6c | 20 68 61 76 65 20 62 65 |ng..will| have be|
|00001ef0| 65 6e 20 75 70 64 61 74 | 65 64 20 74 6f 20 74 68 |en updat|ed to th|
|00001f00| 65 20 73 79 73 74 65 6d | 20 64 61 74 65 20 61 6e |e system| date an|
|00001f10| 64 20 74 69 6d 65 20 77 | 68 65 6e 20 69 6e 66 65 |d time w|hen infe|
|00001f20| 63 74 69 6f 6e 0a 0d 6f | 63 63 75 72 72 65 64 2e |ction..o|ccurred.|
|00001f30| 20 20 4e 6f 20 74 65 78 | 74 20 73 74 72 69 6e 67 | No tex|t string|
|00001f40| 73 20 61 72 65 20 76 69 | 73 69 62 6c 65 20 77 69 |s are vi|sible wi|
|00001f50| 74 68 69 6e 20 74 68 65 | 20 76 69 72 61 6c 20 63 |thin the| viral c|
|00001f60| 6f 64 65 20 69 6e 0a 0d | 69 6e 66 65 63 74 65 64 |ode in..|infected|
|00001f70| 20 70 72 6f 67 72 61 6d | 73 2e 0a 0d 0a 0d 54 68 | program|s.....Th|
|00001f80| 65 20 33 33 34 20 76 69 | 72 75 73 20 64 6f 65 73 |e 334 vi|rus does|
|00001f90| 6e 27 74 20 61 70 70 65 | 61 72 20 74 6f 20 64 6f |n't appe|ar to do|
|00001fa0| 20 61 6e 79 74 68 69 6e | 67 20 62 65 73 69 64 65 | anythin|g beside|
|00001fb0| 73 20 72 65 70 6c 69 63 | 61 74 65 2e 0a 0d 0a 0d |s replic|ate.....|
|00001fc0| 1a 1a 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001fd0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001fe0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001ff0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002000| 54 68 65 20 33 33 37 20 | 76 69 72 75 73 20 77 61 |The 337 |virus wa|
|00002010| 73 20 72 65 63 65 69 76 | 65 64 20 66 72 6f 6d 20 |s receiv|ed from |
|00002020| 45 75 72 6f 70 65 20 69 | 6e 20 4d 61 79 2c 20 31 |Europe i|n May, 1|
|00002030| 39 39 31 2e 20 20 33 33 | 37 20 69 73 20 61 0a 0d |991. 33|7 is a..|
|00002040| 6d 65 6d 6f 72 79 20 72 | 65 73 69 64 65 6e 74 20 |memory r|esident |
|00002050| 69 6e 66 65 63 74 6f 72 | 20 6f 66 20 2e 43 4f 4d |infector| of .COM|
|00002060| 20 70 72 6f 67 72 61 6d | 73 2e 20 20 49 74 20 64 | program|s. It d|
|00002070| 6f 65 73 20 6e 6f 74 20 | 69 6e 66 65 63 74 0a 0d |oes not |infect..|
|00002080| 43 4f 4d 4d 41 4e 44 2e | 43 4f 4d 2e 0a 0d 0a 0d |COMMAND.|COM.....|
|00002090| 54 68 65 20 66 69 72 73 | 74 20 74 69 6d 65 20 61 |The firs|t time a|
|000020a0| 20 70 72 6f 67 72 61 6d | 20 69 6e 66 65 63 74 65 | program| infecte|
|000020b0| 64 20 77 69 74 68 20 33 | 33 37 20 69 73 20 65 78 |d with 3|37 is ex|
|000020c0| 65 63 75 74 65 64 2c 20 | 74 68 65 20 76 69 72 75 |ecuted, |the viru|
|000020d0| 73 0a 0d 77 69 6c 6c 20 | 69 6e 73 74 61 6c 6c 20 |s..will |install |
|000020e0| 69 74 73 65 6c 66 20 6d | 65 6d 6f 72 79 20 72 65 |itself m|emory re|
|000020f0| 73 69 64 65 6e 74 20 61 | 73 20 61 20 6c 6f 77 20 |sident a|s a low |
|00002100| 73 79 73 74 65 6d 20 6d | 65 6d 6f 72 79 20 54 53 |system m|emory TS|
|00002110| 52 20 6f 66 0a 0d 39 34 | 34 20 62 79 74 65 73 2e |R of..94|4 bytes.|
|00002120| 20 20 49 6e 74 65 72 72 | 75 70 74 20 32 31 20 77 | Interr|upt 21 w|
|00002130| 69 6c 6c 20 62 65 20 68 | 6f 6f 6b 65 64 20 62 79 |ill be h|ooked by|
|00002140| 20 74 68 65 20 76 69 72 | 75 73 2e 0a 0d 0a 0d 4f | the vir|us.....O|
|00002150| 6e 63 65 20 33 33 37 20 | 69 73 20 6d 65 6d 6f 72 |nce 337 |is memor|
|00002160| 79 20 72 65 73 69 64 65 | 6e 74 2c 20 69 74 20 77 |y reside|nt, it w|
|00002170| 69 6c 6c 20 69 6e 66 65 | 63 74 20 2e 43 4f 4d 20 |ill infe|ct .COM |
|00002180| 70 72 6f 67 72 61 6d 73 | 2c 20 6f 74 68 65 72 0a |programs|, other.|
|00002190| 0d 74 68 61 6e 20 43 4f | 4d 4d 41 4e 44 2e 43 4f |.than CO|MMAND.CO|
|000021a0| 4d 2c 20 77 68 65 6e 20 | 74 68 65 79 20 61 72 65 |M, when |they are|
|000021b0| 20 6f 70 65 6e 65 64 20 | 6f 72 20 65 78 65 63 75 | opened |or execu|
|000021c0| 74 65 64 2e 20 20 50 72 | 6f 67 72 61 6d 73 0a 0d |ted. Pr|ograms..|
|000021d0| 69 6e 66 65 63 74 65 64 | 20 77 69 74 68 20 33 33 |infected| with 33|
|000021e0| 37 20 77 69 6c 6c 20 69 | 6e 63 72 65 61 73 65 20 |7 will i|ncrease |
|000021f0| 69 6e 20 6c 65 6e 67 74 | 68 20 62 79 20 33 33 37 |in lengt|h by 337|
|00002200| 20 62 79 74 65 73 20 77 | 69 74 68 20 74 68 65 0a | bytes w|ith the.|
|00002210| 0d 76 69 72 75 73 20 62 | 65 69 6e 67 20 6c 6f 63 |.virus b|eing loc|
|00002220| 61 74 65 64 20 61 74 20 | 74 68 65 20 65 6e 64 20 |ated at |the end |
|00002230| 6f 66 20 69 6e 66 65 63 | 74 65 64 20 66 69 6c 65 |of infec|ted file|
|00002240| 73 2e 20 20 54 68 65 20 | 70 72 6f 67 72 61 6d 27 |s. The |program'|
|00002250| 73 0a 0d 64 61 74 65 20 | 61 6e 64 20 74 69 6d 65 |s..date |and time|
|00002260| 20 69 6e 20 74 68 65 20 | 64 69 73 6b 20 64 69 72 | in the |disk dir|
|00002270| 65 63 74 6f 72 79 20 77 | 69 6c 6c 20 6e 6f 74 20 |ectory w|ill not |
|00002280| 62 65 20 61 6c 74 65 72 | 65 64 2e 0a 0d 0a 0d 33 |be alter|ed.....3|
|00002290| 33 37 20 64 6f 65 73 20 | 6e 6f 74 20 64 6f 20 61 |37 does |not do a|
|000022a0| 6e 79 74 68 69 6e 67 20 | 62 65 73 69 64 65 73 20 |nything |besides |
|000022b0| 72 65 70 6c 69 63 61 74 | 65 2e 0a 0d 0a 0d 1a 1a |replicat|e.......|
|000022c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000022d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000022e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000022f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002300| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002310| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002320| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002330| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002340| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002350| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002360| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002370| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002380| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002390| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000023a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000023b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000023c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000023d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000023e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000023f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002400| 54 68 65 20 33 38 32 20 | 52 65 63 6f 76 65 72 79 |The 382 |Recovery|
|00002410| 20 76 69 72 75 73 20 77 | 61 73 20 69 73 6f 6c 61 | virus w|as isola|
|00002420| 74 65 64 20 69 6e 20 4a | 75 6c 79 20 31 39 39 30 |ted in J|uly 1990|
|00002430| 20 69 6e 20 54 61 69 77 | 61 6e 2e 20 20 49 74 20 | in Taiw|an. It |
|00002440| 69 73 0a 0d 61 20 6e 6f | 6e 2d 72 65 73 69 64 65 |is..a no|n-reside|
|00002450| 6e 74 20 67 65 6e 65 72 | 69 63 20 69 6e 66 65 63 |nt gener|ic infec|
|00002460| 74 6f 72 20 6f 66 20 2e | 43 4f 4d 20 61 6e 64 20 |tor of .|COM and |
|00002470| 2e 45 58 45 20 66 69 6c | 65 73 2c 20 69 6e 63 6c |.EXE fil|es, incl|
|00002480| 75 64 69 6e 67 0a 0d 43 | 4f 4d 4d 41 4e 44 2e 43 |uding..C|OMMAND.C|
|00002490| 4f 4d 2e 0a 0d 0a 0d 45 | 61 63 68 20 74 69 6d 65 |OM.....E|ach time|
|000024a0| 20 61 20 70 72 6f 67 72 | 61 6d 20 69 6e 66 65 63 | a progr|am infec|
|000024b0| 74 65 64 20 77 69 74 68 | 20 74 68 65 20 33 38 32 |ted with| the 382|
|000024c0| 20 52 65 63 6f 76 65 72 | 79 20 76 69 72 75 73 20 | Recover|y virus |
|000024d0| 69 73 0a 0d 65 78 65 63 | 75 74 65 64 2c 20 74 68 |is..exec|uted, th|
|000024e0| 65 20 76 69 72 75 73 20 | 77 69 6c 6c 20 63 68 65 |e virus |will che|
|000024f0| 63 6b 20 74 68 65 20 63 | 75 72 72 65 6e 74 20 64 |ck the c|urrent d|
|00002500| 69 72 65 63 74 6f 72 79 | 20 66 6f 72 20 61 20 2e |irectory| for a .|
|00002510| 43 4f 4d 0a 0d 66 69 6c | 65 20 74 68 61 74 20 68 |COM..fil|e that h|
|00002520| 61 73 20 6e 6f 74 20 62 | 65 65 6e 20 69 6e 66 65 |as not b|een infe|
|00002530| 63 74 65 64 20 77 69 74 | 68 20 74 68 65 20 76 69 |cted wit|h the vi|
|00002540| 72 75 73 2e 20 20 49 66 | 20 69 74 20 66 69 6e 64 |rus. If| it find|
|00002550| 73 20 61 6e 0a 0d 75 6e | 69 6e 66 65 63 74 65 64 |s an..un|infected|
|00002560| 20 2e 43 4f 4d 20 66 69 | 6c 65 2c 20 69 74 20 77 | .COM fi|le, it w|
|00002570| 69 6c 6c 20 69 6e 66 65 | 63 74 20 69 74 2e 20 20 |ill infe|ct it. |
|00002580| 49 66 20 74 68 65 20 6f | 72 69 67 69 6e 61 6c 20 |If the o|riginal |
|00002590| 66 69 6c 65 20 77 61 73 | 0a 0d 6c 65 73 73 20 74 |file was|..less t|
|000025a0| 68 61 6e 20 33 38 32 20 | 62 79 74 65 73 20 69 6e |han 382 |bytes in|
|000025b0| 20 6c 65 6e 67 74 68 2c | 20 74 68 65 20 69 6e 66 | length,| the inf|
|000025c0| 65 63 74 65 64 20 66 69 | 6c 65 20 77 69 6c 6c 20 |ected fi|le will |
|000025d0| 6e 6f 77 20 62 65 20 33 | 38 32 0a 0d 62 79 74 65 |now be 3|82..byte|
|000025e0| 73 20 69 6e 20 6c 65 6e | 67 74 68 2e 20 20 46 69 |s in len|gth. Fi|
|000025f0| 6c 65 73 20 77 68 69 63 | 68 20 77 65 72 65 20 6f |les whic|h were o|
|00002600| 72 69 67 69 6e 61 6c 6c | 79 20 67 72 65 61 74 65 |riginall|y greate|
|00002610| 72 20 74 68 61 6e 20 33 | 38 32 20 62 79 74 65 73 |r than 3|82 bytes|
|00002620| 0a 0d 69 6e 20 6c 65 6e | 67 74 68 20 77 69 6c 6c |..in len|gth will|
|00002630| 20 6e 6f 74 20 73 68 6f | 77 20 61 6e 79 20 69 6e | not sho|w any in|
|00002640| 63 72 65 61 73 65 20 69 | 6e 20 6c 65 6e 67 74 68 |crease i|n length|
|00002650| 2e 20 20 49 6e 66 65 63 | 74 65 64 20 66 69 6c 65 |. Infec|ted file|
|00002660| 73 0a 0d 61 6c 77 61 79 | 73 20 68 61 76 65 20 74 |s..alway|s have t|
|00002670| 68 65 20 66 69 72 73 74 | 20 33 38 32 20 62 79 74 |he first| 382 byt|
|00002680| 65 73 20 6f 66 20 74 68 | 65 20 66 69 6c 65 20 6f |es of th|e file o|
|00002690| 76 65 72 77 72 69 74 74 | 65 6e 20 74 6f 20 63 6f |verwritt|en to co|
|000026a0| 6e 74 61 69 6e 0a 0d 74 | 68 65 20 76 69 72 75 73 |ntain..t|he virus|
|000026b0| 27 73 20 63 6f 64 65 2e | 0a 0d 0a 0d 4f 6e 63 65 |'s code.|....Once|
|000026c0| 20 61 6c 6c 20 2e 43 4f | 4d 20 66 69 6c 65 73 20 | all .CO|M files |
|000026d0| 69 6e 20 74 68 65 20 63 | 75 72 72 65 6e 74 20 64 |in the c|urrent d|
|000026e0| 69 72 65 63 74 6f 72 79 | 20 61 72 65 20 69 6e 66 |irectory| are inf|
|000026f0| 65 63 74 65 64 2c 20 74 | 68 65 20 6e 65 78 74 0a |ected, t|he next.|
|00002700| 0d 74 69 6d 65 20 61 6e | 20 69 6e 66 65 63 74 65 |.time an| infecte|
|00002710| 64 20 2e 43 4f 4d 20 66 | 69 6c 65 20 69 73 20 65 |d .COM f|ile is e|
|00002720| 78 65 63 75 74 65 64 20 | 74 68 65 20 76 69 72 75 |xecuted |the viru|
|00002730| 73 20 77 69 6c 6c 20 72 | 65 6e 61 6d 65 20 61 6c |s will r|ename al|
|00002740| 6c 0a 0d 2e 45 58 45 20 | 66 69 6c 65 73 20 74 6f |l...EXE |files to|
|00002750| 20 2e 43 4f 4d 20 66 69 | 6c 65 73 2e 20 20 54 68 | .COM fi|les. Th|
|00002760| 65 73 65 20 72 65 6e 61 | 6d 65 64 20 66 69 6c 65 |ese rena|med file|
|00002770| 73 2c 20 68 6f 77 65 76 | 65 72 2c 20 6d 61 79 20 |s, howev|er, may |
|00002780| 6f 72 20 6d 61 79 0a 0d | 6e 6f 74 20 6c 61 74 65 |or may..|not late|
|00002790| 72 20 62 65 63 6f 6d 65 | 20 69 6e 66 65 63 74 65 |r become| infecte|
|000027a0| 64 2e 0a 0d 0a 0d 53 79 | 6d 70 74 6f 6d 73 20 6f |d.....Sy|mptoms o|
|000027b0| 66 20 74 68 65 20 33 38 | 32 20 52 65 63 6f 76 65 |f the 38|2 Recove|
|000027c0| 72 79 20 76 69 72 75 73 | 20 62 65 69 6e 67 20 70 |ry virus| being p|
|000027d0| 72 65 73 65 6e 74 20 6f | 6e 20 61 20 66 69 6c 65 |resent o|n a file|
|000027e0| 20 61 72 65 20 74 68 61 | 74 0a 0d 74 68 65 20 70 | are tha|t..the p|
|000027f0| 72 6f 67 72 61 6d 20 77 | 69 6c 6c 20 6e 6f 74 20 |rogram w|ill not |
|00002800| 65 78 65 63 75 74 65 20 | 70 72 6f 70 65 72 6c 79 |execute |properly|
|00002810| 2e 20 20 49 6e 20 73 6f | 6d 65 20 63 61 73 65 73 |. In so|me cases|
|00002820| 2c 20 74 68 65 20 70 72 | 6f 67 72 61 6d 0a 0d 77 |, the pr|ogram..w|
|00002830| 69 6c 6c 20 68 61 6e 67 | 20 75 70 6f 6e 20 65 78 |ill hang| upon ex|
|00002840| 65 63 75 74 69 6f 6e 2c | 20 72 65 71 75 69 72 69 |ecution,| requiri|
|00002850| 6e 67 20 74 68 65 20 73 | 79 73 74 65 6d 20 74 6f |ng the s|ystem to|
|00002860| 20 62 65 20 72 65 62 6f | 6f 74 65 64 2e 20 20 49 | be rebo|oted. I|
|00002870| 6e 0a 0d 6f 74 68 65 72 | 20 63 61 73 65 73 2c 20 |n..other| cases, |
|00002880| 73 70 75 72 69 6f 75 73 | 20 63 68 61 72 61 63 74 |spurious| charact|
|00002890| 65 72 73 20 77 69 6c 6c | 20 61 70 70 65 61 72 20 |ers will| appear |
|000028a0| 6f 6e 20 74 68 65 20 73 | 79 73 74 65 6d 20 64 69 |on the s|ystem di|
|000028b0| 73 70 6c 61 79 0a 0d 61 | 6e 64 20 74 68 65 20 70 |splay..a|nd the p|
|000028c0| 72 6f 67 72 61 6d 20 77 | 69 6c 6c 20 6e 6f 74 20 |rogram w|ill not |
|000028d0| 72 75 6e 2e 20 20 4c 61 | 73 74 6c 79 2c 20 74 68 |run. La|stly, th|
|000028e0| 65 20 73 79 73 74 65 6d | 20 6d 61 79 20 64 6f 20 |e system| may do |
|000028f0| 6e 6f 74 68 69 6e 67 20 | 62 75 74 0a 0d 6c 65 61 |nothing |but..lea|
|00002900| 76 65 20 74 68 65 20 64 | 69 73 6b 20 64 72 69 76 |ve the d|isk driv|
|00002910| 65 20 73 70 69 6e 6e 69 | 6e 67 2c 20 72 65 71 75 |e spinni|ng, requ|
|00002920| 69 72 69 6e 67 20 74 68 | 65 20 73 79 73 74 65 6d |iring th|e system|
|00002930| 20 74 6f 20 62 65 20 70 | 6f 77 65 72 65 64 0a 0d | to be p|owered..|
|00002940| 6f 66 66 20 61 6e 64 20 | 72 65 62 6f 6f 74 65 64 |off and |rebooted|
|00002950| 2e 0a 0d 0a 0d 4f 63 63 | 61 73 69 6f 6e 61 6c 6c |.....Occ|asionall|
|00002960| 79 2c 20 74 68 65 20 33 | 38 32 20 52 65 63 6f 76 |y, the 3|82 Recov|
|00002970| 65 72 79 20 76 69 72 75 | 73 20 77 69 6c 6c 20 63 |ery viru|s will c|
|00002980| 6f 72 72 75 70 74 20 49 | 4f 2e 53 59 53 2c 20 6f |orrupt I|O.SYS, o|
|00002990| 6e 65 20 6f 66 0a 0d 74 | 68 65 20 68 69 64 64 65 |ne of..t|he hidde|
|000029a0| 6e 20 73 79 73 74 65 6d | 20 66 69 6c 65 73 2e 20 |n system| files. |
|000029b0| 20 4f 6e 63 65 20 74 68 | 69 73 20 63 6f 72 72 75 | Once th|is corru|
|000029c0| 70 74 69 6f 6e 20 68 61 | 73 20 6f 63 63 75 72 72 |ption ha|s occurr|
|000029d0| 65 64 2c 20 61 74 74 65 | 6d 70 74 73 0a 0d 74 6f |ed, atte|mpts..to|
|000029e0| 20 62 6f 6f 74 20 66 72 | 6f 6d 20 74 68 65 20 69 | boot fr|om the i|
|000029f0| 6e 66 65 63 74 65 64 20 | 64 69 73 6b 20 77 69 6c |nfected |disk wil|
|00002a00| 6c 20 66 61 69 6c 2e 0a | 0d 0a 0d 53 69 6e 63 65 |l fail..|...Since|
|00002a10| 20 74 68 65 20 66 69 72 | 73 74 20 33 38 32 20 62 | the fir|st 382 b|
|00002a20| 79 74 65 73 20 6f 66 20 | 69 6e 66 65 63 74 65 64 |ytes of |infected|
|00002a30| 20 66 69 6c 65 73 20 68 | 61 76 65 20 62 65 65 6e | files h|ave been|
|00002a40| 20 6f 76 65 72 77 72 69 | 74 74 65 6e 2c 0a 0d 74 | overwri|tten,..t|
|00002a50| 68 65 20 69 6e 66 65 63 | 74 65 64 20 66 69 6c 65 |he infec|ted file|
|00002a60| 73 20 63 61 6e 6e 6f 74 | 20 62 65 20 72 65 63 6f |s cannot| be reco|
|00002a70| 76 65 72 65 64 2e 20 20 | 54 68 65 20 6f 72 69 67 |vered. |The orig|
|00002a80| 69 6e 61 6c 20 33 38 32 | 20 62 79 74 65 73 20 6f |inal 382| bytes o|
|00002a90| 66 0a 0d 74 68 65 20 66 | 69 6c 65 20 61 72 65 20 |f..the f|ile are |
|00002aa0| 70 65 72 6d 61 6e 65 6e | 74 6c 79 20 6c 6f 73 74 |permanen|tly lost|
|00002ab0| 2e 20 20 49 6e 66 65 63 | 74 65 64 20 66 69 6c 65 |. Infec|ted file|
|00002ac0| 73 20 73 68 6f 75 6c 64 | 20 62 65 20 64 65 6c 65 |s should| be dele|
|00002ad0| 74 65 64 20 6f 72 0a 0d | 65 72 61 73 65 64 20 61 |ted or..|erased a|
|00002ae0| 6e 64 20 72 65 70 6c 61 | 63 65 64 20 77 69 74 68 |nd repla|ced with|
|00002af0| 20 62 61 63 6b 75 70 20 | 63 6f 70 69 65 73 20 6b | backup |copies k|
|00002b00| 6e 6f 77 6e 20 74 6f 20 | 62 65 20 66 72 65 65 20 |nown to |be free |
|00002b10| 6f 66 20 69 6e 66 65 63 | 74 69 6f 6e 2e 0a 0d 0a |of infec|tion....|
|00002b20| 0d 1a 1a 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002b30| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002b40| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002b50| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002b60| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002b70| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002b80| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002b90| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002ba0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002bb0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002bc0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002bd0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002be0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002bf0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002c00| 54 68 65 20 34 30 35 20 | 76 69 72 75 73 20 69 73 |The 405 |virus is|
|00002c10| 20 61 6e 20 6f 76 65 72 | 77 72 69 74 69 6e 67 20 | an over|writing |
|00002c20| 76 69 72 75 73 20 77 68 | 69 63 68 20 69 6e 66 65 |virus wh|ich infe|
|00002c30| 63 74 73 20 6f 6e 6c 79 | 20 2e 43 4f 4d 20 66 69 |cts only| .COM fi|
|00002c40| 6c 65 73 0a 0d 69 6e 20 | 74 68 65 20 43 3a 20 64 |les..in |the C: d|
|00002c50| 72 69 76 65 20 72 6f 6f | 74 20 64 69 72 65 63 74 |rive roo|t direct|
|00002c60| 6f 72 79 2e 20 20 49 66 | 20 74 68 65 20 6c 65 6e |ory. If| the len|
|00002c70| 67 74 68 20 6f 66 20 74 | 68 65 20 2e 43 4f 4d 20 |gth of t|he .COM |
|00002c80| 66 69 6c 65 20 77 61 73 | 0a 0d 6f 72 69 67 69 6e |file was|..origin|
|00002c90| 61 6c 6c 79 20 6c 65 73 | 73 20 74 68 61 6e 20 34 |ally les|s than 4|
|00002ca0| 30 35 20 62 79 74 65 73 | 2c 20 74 68 65 20 72 65 |05 bytes|, the re|
|00002cb0| 73 75 6c 74 69 6e 67 20 | 69 6e 66 65 63 74 65 64 |sulting |infected|
|00002cc0| 20 66 69 6c 65 20 77 69 | 6c 6c 0a 0d 68 61 76 65 | file wi|ll..have|
|00002cd0| 20 61 20 6c 65 6e 67 74 | 68 20 6f 66 20 34 30 35 | a lengt|h of 405|
|00002ce0| 20 62 79 74 65 73 2e 20 | 20 54 68 69 73 20 76 69 | bytes. | This vi|
|00002cf0| 72 75 73 20 63 75 72 72 | 65 6e 74 6c 79 20 63 61 |rus curr|ently ca|
|00002d00| 6e 6e 6f 74 20 72 65 63 | 6f 67 6e 69 7a 65 0a 0d |nnot rec|ognize..|
|00002d10| 2e 43 4f 4d 20 66 69 6c | 65 73 20 74 68 61 74 20 |.COM fil|es that |
|00002d20| 61 72 65 20 61 6c 72 65 | 61 64 79 20 69 6e 66 65 |are alre|ady infe|
|00002d30| 63 74 65 64 2c 20 73 6f | 20 69 74 20 77 69 6c 6c |cted, so| it will|
|00002d40| 20 61 74 74 65 6d 70 74 | 20 74 6f 20 69 6e 66 65 | attempt| to infe|
|00002d50| 63 74 0a 0d 74 68 65 6d | 20 61 67 61 69 6e 2e 0a |ct..them| again..|
|00002d60| 0d 0a 0d 54 68 65 20 34 | 30 35 20 76 69 72 75 73 |...The 4|05 virus|
|00002d70| 20 64 6f 65 73 6e 27 74 | 20 63 61 72 72 79 20 61 | doesn't| carry a|
|00002d80| 6e 20 61 63 74 69 76 61 | 74 69 6f 6e 20 64 61 74 |n activa|tion dat|
|00002d90| 65 2c 20 61 6e 64 20 64 | 6f 65 73 6e 27 74 20 64 |e, and d|oesn't d|
|00002da0| 6f 0a 0d 61 6e 79 74 68 | 69 6e 67 20 62 75 74 20 |o..anyth|ing but |
|00002db0| 72 65 70 6c 69 63 61 74 | 65 20 69 6e 20 74 68 65 |replicat|e in the|
|00002dc0| 20 43 3a 20 64 72 69 76 | 65 20 72 6f 6f 74 20 64 | C: driv|e root d|
|00002dd0| 69 72 65 63 74 6f 72 79 | 2e 20 20 48 6f 77 65 76 |irectory|. Howev|
|00002de0| 65 72 2c 0a 0d 73 69 6e | 63 65 20 69 74 20 6f 76 |er,..sin|ce it ov|
|00002df0| 65 72 77 72 69 74 65 73 | 20 74 68 65 20 66 69 72 |erwrites| the fir|
|00002e00| 73 74 20 34 30 35 20 62 | 79 74 65 73 20 6f 66 20 |st 405 b|ytes of |
|00002e10| 2e 43 4f 4d 20 66 69 6c | 65 73 2c 20 69 6e 66 65 |.COM fil|es, infe|
|00002e20| 63 74 65 64 0a 0d 66 69 | 6c 65 73 20 61 72 65 20 |cted..fi|les are |
|00002e30| 6e 6f 74 20 72 65 63 6f | 76 65 72 61 62 6c 65 20 |not reco|verable |
|00002e40| 65 78 63 65 70 74 20 62 | 79 20 72 65 70 6c 61 63 |except b|y replac|
|00002e50| 69 6e 67 20 74 68 65 6d | 20 66 72 6f 6d 20 75 6e |ing them| from un|
|00002e60| 69 6e 66 65 63 74 65 64 | 0a 0d 62 61 63 6b 75 70 |infected|..backup|
|00002e70| 73 20 6f 72 20 6d 61 73 | 74 65 72 20 64 69 73 74 |s or mas|ter dist|
|00002e80| 72 69 62 75 74 69 6f 6e | 20 64 69 73 6b 73 2e 0a |ribution| disks..|
|00002e90| 0d 0a 0d 1a 1a 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002ea0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002eb0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002ec0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002ed0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002ee0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002ef0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002f00| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002f10| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002f20| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002f30| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002f40| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002f50| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002f60| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002f70| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002f80| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002f90| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002fa0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002fb0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002fc0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002fd0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002fe0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00002ff0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003000| 54 68 65 20 34 30 38 20 | 76 69 72 75 73 20 77 61 |The 408 |virus wa|
|00003010| 73 20 73 75 62 6d 69 74 | 74 65 64 20 69 6e 20 4f |s submit|ted in O|
|00003020| 63 74 6f 62 65 72 2c 20 | 31 39 39 31 2e 20 20 34 |ctober, |1991. 4|
|00003030| 30 38 20 69 73 20 61 20 | 6d 65 6d 6f 72 79 0a 0d |08 is a |memory..|
|00003040| 72 65 73 69 64 65 6e 74 | 20 69 6e 66 65 63 74 6f |resident| infecto|
|00003050| 72 20 6f 66 20 2e 43 4f | 4d 20 66 69 6c 65 73 2c |r of .CO|M files,|
|00003060| 20 69 6e 63 6c 75 64 69 | 6e 67 20 43 4f 4d 4d 41 | includi|ng COMMA|
|00003070| 4e 44 2e 43 4f 4d 2e 0a | 0d 0a 0d 54 68 65 20 66 |ND.COM..|...The f|
|00003080| 69 72 73 74 20 74 69 6d | 65 20 61 20 70 72 6f 67 |irst tim|e a prog|
|00003090| 72 61 6d 20 69 6e 66 65 | 63 74 65 64 20 77 69 74 |ram infe|cted wit|
|000030a0| 68 20 34 30 38 20 69 73 | 20 65 78 65 63 75 74 65 |h 408 is| execute|
|000030b0| 64 2c 20 74 68 69 73 20 | 76 69 72 75 73 0a 0d 77 |d, this |virus..w|
|000030c0| 69 6c 6c 20 69 6e 73 74 | 61 6c 6c 20 69 74 73 65 |ill inst|all itse|
|000030d0| 6c 66 20 6d 65 6d 6f 72 | 79 20 72 65 73 69 64 65 |lf memor|y reside|
|000030e0| 6e 74 20 69 6e 20 6c 6f | 77 20 61 76 61 69 6c 61 |nt in lo|w availa|
|000030f0| 62 6c 65 20 73 79 73 74 | 65 6d 20 6d 65 6d 6f 72 |ble syst|em memor|
|00003100| 79 2e 0a 0d 54 68 65 72 | 65 20 77 69 6c 6c 20 62 |y...Ther|e will b|
|00003110| 65 20 6e 6f 20 63 68 61 | 6e 67 65 20 69 6e 20 74 |e no cha|nge in t|
|00003120| 6f 74 61 6c 20 73 79 73 | 74 65 6d 20 6f 72 20 61 |otal sys|tem or a|
|00003130| 76 61 69 6c 61 62 6c 65 | 20 66 72 65 65 20 6d 65 |vailable| free me|
|00003140| 6d 6f 72 79 0a 0d 61 73 | 20 69 6e 64 69 63 61 74 |mory..as| indicat|
|00003150| 65 64 20 62 79 20 74 68 | 65 20 44 4f 53 20 43 48 |ed by th|e DOS CH|
|00003160| 4b 44 53 4b 20 70 72 6f | 67 72 61 6d 2e 20 20 49 |KDSK pro|gram. I|
|00003170| 6e 74 65 72 72 75 70 74 | 73 20 38 30 2c 20 38 32 |nterrupt|s 80, 82|
|00003180| 2c 20 38 33 2c 20 38 35 | 2c 0a 0d 38 38 2c 20 38 |, 83, 85|,..88, 8|
|00003190| 39 2c 20 38 41 2c 20 38 | 43 2c 20 38 45 2c 20 39 |9, 8A, 8|C, 8E, 9|
|000031a0| 31 2c 20 39 33 2c 20 39 | 35 2c 20 39 36 2c 20 39 |1, 93, 9|5, 96, 9|
|000031b0| 38 2c 20 39 43 2c 20 39 | 45 2c 20 41 30 2c 20 41 |8, 9C, 9|E, A0, A|
|000031c0| 31 2c 20 41 32 2c 20 41 | 33 2c 20 41 35 2c 0a 0d |1, A2, A|3, A5,..|
|000031d0| 41 37 2c 20 41 38 2c 20 | 41 41 2c 20 41 43 2c 20 |A7, A8, |AA, AC, |
|000031e0| 41 46 2c 20 42 34 2c 20 | 42 38 2c 20 61 6e 64 20 |AF, B4, |B8, and |
|000031f0| 42 42 20 77 69 6c 6c 20 | 61 6c 6c 20 62 65 20 68 |BB will |all be h|
|00003200| 6f 6f 6b 65 64 20 62 79 | 20 74 68 65 20 76 69 72 |ooked by| the vir|
|00003210| 75 73 0a 0d 69 6e 20 61 | 76 61 69 6c 61 62 6c 65 |us..in a|vailable|
|00003220| 20 66 72 65 65 20 6d 65 | 6d 6f 72 79 2e 0a 0d 0a | free me|mory....|
|00003230| 0d 4f 6e 63 65 20 34 30 | 38 20 69 73 20 6d 65 6d |.Once 40|8 is mem|
|00003240| 6f 72 79 20 72 65 73 69 | 64 65 6e 74 2c 20 69 74 |ory resi|dent, it|
|00003250| 20 77 69 6c 6c 20 69 6e | 66 65 63 74 20 61 6e 79 | will in|fect any|
|00003260| 20 2e 43 4f 4d 20 70 72 | 6f 67 72 61 6d 2c 0a 0d | .COM pr|ogram,..|
|00003270| 69 6e 63 6c 75 64 69 6e | 67 20 43 4f 4d 4d 41 4e |includin|g COMMAN|
|00003280| 44 2e 43 4f 4d 2c 20 77 | 68 65 6e 20 74 68 65 79 |D.COM, w|hen they|
|00003290| 20 61 72 65 20 65 78 65 | 63 75 74 65 64 2e 20 20 | are exe|cuted. |
|000032a0| 49 6e 66 65 63 74 65 64 | 20 2e 43 4f 4d 0a 0d 70 |Infected| .COM..p|
|000032b0| 72 6f 67 72 61 6d 73 20 | 77 69 6c 6c 20 69 6e 63 |rograms |will inc|
|000032c0| 72 65 61 73 65 20 69 6e | 20 73 69 7a 65 20 62 79 |rease in| size by|
|000032d0| 20 34 30 38 20 62 79 74 | 65 73 20 77 69 74 68 20 | 408 byt|es with |
|000032e0| 74 68 65 20 76 69 72 75 | 73 20 62 65 69 6e 67 0a |the viru|s being.|
|000032f0| 0d 6c 6f 63 61 74 65 64 | 20 61 74 20 74 68 65 20 |.located| at the |
|00003300| 65 6e 64 20 6f 66 20 74 | 68 65 20 69 6e 66 65 63 |end of t|he infec|
|00003310| 74 65 64 20 66 69 6c 65 | 2e 20 20 54 68 65 72 65 |ted file|. There|
|00003320| 20 77 69 6c 6c 20 62 65 | 20 6e 6f 20 76 69 73 69 | will be| no visi|
|00003330| 62 6c 65 0a 0d 63 68 61 | 6e 67 65 20 69 6e 20 74 |ble..cha|nge in t|
|00003340| 68 65 20 66 69 6c 65 27 | 73 20 64 61 74 65 20 61 |he file'|s date a|
|00003350| 6e 64 20 74 69 6d 65 20 | 69 6e 20 74 68 65 20 44 |nd time |in the D|
|00003360| 4f 53 20 64 69 73 6b 20 | 64 69 72 65 63 74 6f 72 |OS disk |director|
|00003370| 79 0a 0d 64 69 73 70 6c | 61 79 2e 0a 0d 0a 0d 53 |y..displ|ay.....S|
|00003380| 79 73 74 65 6d 73 20 69 | 6e 66 65 63 74 65 64 20 |ystems i|nfected |
|00003390| 77 69 74 68 20 34 30 38 | 20 77 69 6c 6c 20 65 78 |with 408| will ex|
|000033a0| 70 65 72 69 65 6e 63 65 | 20 77 72 69 74 65 20 70 |perience| write p|
|000033b0| 72 6f 74 65 63 74 20 65 | 72 72 6f 72 73 20 77 68 |rotect e|rrors wh|
|000033c0| 65 6e 0a 0d 61 74 74 65 | 6d 70 74 69 6e 67 20 74 |en..atte|mpting t|
|000033d0| 6f 20 65 78 65 63 75 74 | 65 20 70 72 6f 67 72 61 |o execut|e progra|
|000033e0| 6d 73 20 66 72 6f 6d 20 | 77 72 69 74 65 2d 70 72 |ms from |write-pr|
|000033f0| 6f 74 65 63 74 65 64 20 | 64 69 73 6b 65 74 74 65 |otected |diskette|
|00003400| 73 2e 0a 0d 41 64 64 69 | 74 69 6f 6e 61 6c 6c 79 |s...Addi|tionally|
|00003410| 2c 20 73 6f 6d 65 20 70 | 72 6f 67 72 61 6d 73 20 |, some p|rograms |
|00003420| 77 68 69 63 68 20 72 65 | 71 75 69 72 65 20 63 6f |which re|quire co|
|00003430| 6d 6d 61 6e 64 20 6c 69 | 6e 65 20 69 6e 70 75 74 |mmand li|ne input|
|00003440| 20 77 69 6c 6c 0a 0d 72 | 65 63 65 69 76 65 20 65 | will..r|eceive e|
|00003450| 72 72 6f 72 20 6d 65 73 | 73 61 67 65 73 20 61 73 |rror mes|sages as|
|00003460| 20 74 68 6f 75 67 68 20 | 74 68 65 20 63 6f 6d 6d | though |the comm|
|00003470| 61 6e 64 20 6c 69 6e 65 | 20 69 6e 70 75 74 20 77 |and line| input w|
|00003480| 61 73 20 6e 6f 74 0a 0d | 72 65 63 65 69 76 65 64 |as not..|received|
|00003490| 2e 0a 0d 0a 0d 34 30 38 | 20 64 6f 65 73 20 6e 6f |.....408| does no|
|000034a0| 74 20 61 70 70 65 61 72 | 20 74 6f 20 64 6f 20 61 |t appear| to do a|
|000034b0| 6e 79 74 68 69 6e 67 20 | 62 65 73 69 64 65 73 20 |nything |besides |
|000034c0| 72 65 70 6c 69 63 61 74 | 65 2e 0a 0d 0a 0d 1a 1a |replicat|e.......|
|000034d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000034e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000034f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003500| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003510| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003520| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003530| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003540| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003550| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003560| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003570| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003580| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003590| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003600| 54 68 65 20 34 32 32 20 | 4f 76 65 72 77 72 69 74 |The 422 |Overwrit|
|00003610| 69 6e 67 20 76 69 72 75 | 73 20 77 61 73 20 73 75 |ing viru|s was su|
|00003620| 62 6d 69 74 74 65 64 20 | 69 6e 20 4d 61 72 63 68 |bmitted |in March|
|00003630| 2c 20 31 39 39 33 2e 20 | 20 49 74 73 20 6f 72 69 |, 1993. | Its ori|
|00003640| 67 69 6e 0a 0d 6f 72 20 | 70 6f 69 6e 74 20 6f 66 |gin..or |point of|
|00003650| 20 69 73 6f 6c 61 74 69 | 6f 6e 20 69 73 20 75 6e | isolati|on is un|
|00003660| 6b 6e 6f 77 6e 2e 20 20 | 34 32 32 20 4f 76 65 72 |known. |422 Over|
|00003670| 77 72 69 74 69 6e 67 20 | 69 73 20 61 20 6d 65 6d |writing |is a mem|
|00003680| 6f 72 79 0a 0d 72 65 73 | 69 64 65 6e 74 20 6f 76 |ory..res|ident ov|
|00003690| 65 72 77 72 69 74 69 6e | 67 20 76 69 72 75 73 20 |erwritin|g virus |
|000036a0| 77 68 69 63 68 20 69 6e | 66 65 63 74 73 20 2e 43 |which in|fects .C|
|000036b0| 4f 4d 20 70 72 6f 67 72 | 61 6d 73 2c 20 62 75 74 |OM progr|ams, but|
|000036c0| 20 6e 6f 74 0a 0d 43 4f | 4d 4d 41 4e 44 2e 43 4f | not..CO|MMAND.CO|
|000036d0| 4d 2e 0a 0d 0a 0d 57 68 | 65 6e 20 74 68 65 20 66 |M.....Wh|en the f|
|000036e0| 69 72 73 74 20 34 32 32 | 20 4f 76 65 72 77 72 69 |irst 422| Overwri|
|000036f0| 74 69 6e 67 20 69 6e 66 | 65 63 74 65 64 20 70 72 |ting inf|ected pr|
|00003700| 6f 67 72 61 6d 20 69 73 | 20 65 78 65 63 75 74 65 |ogram is| execute|
|00003710| 64 2c 20 74 68 69 73 0a | 0d 76 69 72 75 73 20 77 |d, this.|.virus w|
|00003720| 69 6c 6c 20 69 6e 73 74 | 61 6c 6c 20 69 74 73 65 |ill inst|all itse|
|00003730| 6c 66 20 6d 65 6d 6f 72 | 79 20 72 65 73 69 64 65 |lf memor|y reside|
|00003740| 6e 74 20 61 73 20 61 20 | 6c 6f 77 20 73 79 73 74 |nt as a |low syst|
|00003750| 65 6d 20 6d 65 6d 6f 72 | 79 0a 0d 54 53 52 20 6f |em memor|y..TSR o|
|00003760| 66 20 61 70 70 72 6f 78 | 69 6d 61 74 65 6c 79 20 |f approx|imately |
|00003770| 31 2c 31 32 30 20 62 79 | 74 65 73 2e 20 20 49 6e |1,120 by|tes. In|
|00003780| 74 65 72 72 75 70 74 20 | 32 31 20 77 69 6c 6c 20 |terrupt |21 will |
|00003790| 62 65 20 68 6f 6f 6b 65 | 64 0a 0d 62 79 20 74 68 |be hooke|d..by th|
|000037a0| 65 20 76 69 72 75 73 20 | 69 6e 20 6d 65 6d 6f 72 |e virus |in memor|
|000037b0| 79 2e 0a 0d 0a 0d 4f 6e | 63 65 20 74 68 65 20 34 |y.....On|ce the 4|
|000037c0| 32 32 20 4f 76 65 72 77 | 72 69 74 69 6e 67 20 76 |22 Overw|riting v|
|000037d0| 69 72 75 73 20 69 73 20 | 6d 65 6d 6f 72 79 20 72 |irus is |memory r|
|000037e0| 65 73 69 64 65 6e 74 2c | 20 69 74 20 77 69 6c 6c |esident,| it will|
|000037f0| 20 69 6e 66 65 63 74 0a | 0d 6f 6e 65 20 2e 43 4f | infect.|.one .CO|
|00003800| 4d 20 70 72 6f 67 72 61 | 6d 20 65 61 63 68 20 74 |M progra|m each t|
|00003810| 69 6d 65 20 61 20 44 4f | 53 20 44 49 52 20 63 6f |ime a DO|S DIR co|
|00003820| 6d 6d 61 6e 64 20 69 73 | 20 65 78 65 63 75 74 65 |mmand is| execute|
|00003830| 64 2e 20 20 54 68 65 0a | 0d 63 6f 6d 6d 61 6e 64 |d. The.|.command|
|00003840| 20 6f 75 74 70 75 74 20 | 6f 66 20 74 68 65 20 44 | output |of the D|
|00003850| 4f 53 20 44 49 52 20 63 | 6f 6d 6d 61 6e 64 20 77 |OS DIR c|ommand w|
|00003860| 69 6c 6c 20 61 6c 73 6f | 20 62 65 20 61 66 66 65 |ill also| be affe|
|00003870| 63 74 65 64 2c 20 75 73 | 75 61 6c 6c 79 0a 0d 77 |cted, us|ually..w|
|00003880| 69 74 68 20 6f 6e 65 20 | 2e 43 4f 4d 20 66 69 6c |ith one |.COM fil|
|00003890| 65 20 6e 61 6d 65 20 62 | 65 69 6e 67 20 72 65 70 |e name b|eing rep|
|000038a0| 65 61 74 65 64 20 6d 75 | 6c 74 69 70 6c 65 20 74 |eated mu|ltiple t|
|000038b0| 69 6d 65 73 2e 0a 0d 0a | 0d 50 72 6f 67 72 61 6d |imes....|.Program|
|000038c0| 73 20 69 6e 66 65 63 74 | 65 64 20 77 69 74 68 20 |s infect|ed with |
|000038d0| 74 68 65 20 34 32 32 20 | 4f 76 65 72 77 72 69 74 |the 422 |Overwrit|
|000038e0| 69 6e 67 20 76 69 72 75 | 73 20 77 69 6c 6c 20 6e |ing viru|s will n|
|000038f0| 6f 74 20 68 61 76 65 20 | 61 6e 79 0a 0d 66 69 6c |ot have |any..fil|
|00003900| 65 20 6c 65 6e 67 74 68 | 20 69 6e 63 72 65 61 73 |e length| increas|
|00003910| 65 20 61 73 20 74 68 65 | 20 76 69 72 75 73 20 77 |e as the| virus w|
|00003920| 69 6c 6c 20 6f 76 65 72 | 77 72 69 74 65 20 34 32 |ill over|write 42|
|00003930| 32 20 62 79 74 65 73 20 | 6c 6f 63 61 74 65 64 0a |2 bytes |located.|
|00003940| 0d 73 6f 6d 65 77 68 65 | 72 65 20 69 6e 20 74 68 |.somewhe|re in th|
|00003950| 65 20 6d 69 64 64 6c 65 | 20 6f 66 20 74 68 65 20 |e middle| of the |
|00003960| 68 6f 73 74 20 66 69 6c | 65 2e 20 20 54 68 65 20 |host fil|e. The |
|00003970| 6f 6e 65 20 65 78 63 65 | 70 74 69 6f 6e 20 69 73 |one exce|ption is|
|00003980| 20 74 68 61 74 0a 0d 66 | 69 6c 65 73 20 77 68 69 | that..f|iles whi|
|00003990| 63 68 20 77 65 72 65 20 | 6f 72 69 67 69 6e 61 6c |ch were |original|
|000039a0| 6c 79 20 73 6d 61 6c 6c | 65 72 20 74 68 61 6e 20 |ly small|er than |
|000039b0| 74 68 65 20 76 69 72 75 | 73 20 69 74 73 65 6c 66 |the viru|s itself|
|000039c0| 20 77 69 6c 6c 0a 0d 62 | 65 63 6f 6d 65 20 6f 76 | will..b|ecome ov|
|000039d0| 65 72 20 36 35 4b 20 62 | 79 74 65 73 20 69 6e 20 |er 65K b|ytes in |
|000039e0| 73 69 7a 65 20 61 66 74 | 65 72 20 69 6e 66 65 63 |size aft|er infec|
|000039f0| 74 69 6f 6e 2e 20 20 54 | 68 65 20 66 69 6c 65 27 |tion. T|he file'|
|00003a00| 73 20 64 61 74 65 20 61 | 6e 64 0a 0d 74 69 6d 65 |s date a|nd..time|
|00003a10| 20 69 6e 20 74 68 65 20 | 44 4f 53 20 64 69 73 6b | in the |DOS disk|
|00003a20| 20 64 69 72 65 63 74 6f | 72 79 20 77 69 6c 6c 20 | directo|ry will |
|00003a30| 68 61 76 65 20 62 65 65 | 6e 20 75 70 64 61 74 65 |have bee|n update|
|00003a40| 64 20 74 6f 20 74 68 65 | 20 63 75 72 72 65 6e 74 |d to the| current|
|00003a50| 0a 0d 73 79 73 74 65 6d | 20 64 61 74 65 20 61 6e |..system| date an|
|00003a60| 64 20 74 69 6d 65 20 77 | 68 65 6e 20 69 6e 66 65 |d time w|hen infe|
|00003a70| 63 74 69 6f 6e 20 6f 63 | 63 75 72 72 65 64 2e 20 |ction oc|curred. |
|00003a80| 20 4e 6f 20 74 65 78 74 | 20 73 74 72 69 6e 67 73 | No text| strings|
|00003a90| 20 61 72 65 0a 0d 76 69 | 73 69 62 6c 65 20 77 69 | are..vi|sible wi|
|00003aa0| 74 68 69 6e 20 74 68 65 | 20 76 69 72 61 6c 20 63 |thin the| viral c|
|00003ab0| 6f 64 65 2e 0a 0d 0a 0d | 50 72 6f 67 72 61 6d 73 |ode.....|Programs|
|00003ac0| 20 69 6e 66 65 63 74 65 | 64 20 77 69 74 68 20 74 | infecte|d with t|
|00003ad0| 68 65 20 34 32 32 20 4f | 76 65 72 77 72 69 74 69 |he 422 O|verwriti|
|00003ae0| 6e 67 20 76 69 72 75 73 | 20 77 69 6c 6c 20 6e 6f |ng virus| will no|
|00003af0| 74 20 66 75 6e 63 74 69 | 6f 6e 0a 0d 70 72 6f 70 |t functi|on..prop|
|00003b00| 65 72 6c 79 20 77 68 65 | 6e 20 65 78 65 63 75 74 |erly whe|n execut|
|00003b10| 65 64 2e 0a 0d 0a 0d 1a | 1a 00 00 00 00 00 00 00 |ed......|........|
|00003b20| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003b30| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003b40| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003b50| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003b60| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003b70| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003b80| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003b90| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003ba0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003bb0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003bc0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003bd0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003be0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003bf0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003c00| 54 68 65 20 34 33 39 20 | 76 69 72 75 73 20 77 61 |The 439 |virus wa|
|00003c10| 73 20 72 65 63 65 69 76 | 65 64 20 69 6e 20 41 75 |s receiv|ed in Au|
|00003c20| 67 75 73 74 2c 20 31 39 | 39 32 2e 20 20 49 74 20 |gust, 19|92. It |
|00003c30| 69 73 20 6f 72 69 67 69 | 6e 61 6c 6c 79 20 66 72 |is origi|nally fr|
|00003c40| 6f 6d 0a 0d 50 6f 6c 61 | 6e 64 2e 20 20 34 33 39 |om..Pola|nd. 439|
|00003c50| 20 69 73 20 61 20 6d 65 | 6d 6f 72 79 20 72 65 73 | is a me|mory res|
|00003c60| 69 64 65 6e 74 20 69 6e | 66 65 63 74 6f 72 20 6f |ident in|fector o|
|00003c70| 66 20 2e 43 4f 4d 20 70 | 72 6f 67 72 61 6d 73 2c |f .COM p|rograms,|
|00003c80| 0a 0d 69 6e 63 6c 75 64 | 69 6e 67 20 43 4f 4d 4d |..includ|ing COMM|
|00003c90| 41 4e 44 2e 43 4f 4d 2e | 0a 0d 0a 0d 54 68 65 20 |AND.COM.|....The |
|00003ca0| 66 69 72 73 74 20 74 69 | 6d 65 20 61 20 70 72 6f |first ti|me a pro|
|00003cb0| 67 72 61 6d 20 69 6e 66 | 65 63 74 65 64 20 77 69 |gram inf|ected wi|
|00003cc0| 74 68 20 74 68 65 20 34 | 33 39 20 76 69 72 75 73 |th the 4|39 virus|
|00003cd0| 20 69 73 20 65 78 65 63 | 75 74 65 64 2c 0a 0d 74 | is exec|uted,..t|
|00003ce0| 68 65 20 34 33 39 20 76 | 69 72 75 73 20 77 69 6c |he 439 v|irus wil|
|00003cf0| 6c 20 69 6e 73 74 61 6c | 6c 20 69 74 73 65 6c 66 |l instal|l itself|
|00003d00| 20 6d 65 6d 6f 72 79 20 | 72 65 73 69 64 65 6e 74 | memory |resident|
|00003d10| 20 61 74 20 74 68 65 20 | 74 6f 70 20 6f 66 0a 0d | at the |top of..|
|00003d20| 73 79 73 74 65 6d 20 6d | 65 6d 6f 72 79 20 62 75 |system m|emory bu|
|00003d30| 74 20 62 65 6c 6f 77 20 | 74 68 65 20 36 34 30 4b |t below |the 640K|
|00003d40| 20 44 4f 53 20 62 6f 75 | 6e 64 61 72 79 2e 20 20 | DOS bou|ndary. |
|00003d50| 54 6f 74 61 6c 20 73 79 | 73 74 65 6d 20 61 6e 64 |Total sy|stem and|
|00003d60| 0a 0d 61 76 61 69 6c 61 | 62 6c 65 20 66 72 65 65 |..availa|ble free|
|00003d70| 20 6d 65 6d 6f 72 79 2c | 20 61 73 20 69 6e 64 69 | memory,| as indi|
|00003d80| 63 61 74 65 64 20 62 79 | 20 74 68 65 20 44 4f 53 |cated by| the DOS|
|00003d90| 20 43 48 4b 44 53 4b 20 | 70 72 6f 67 72 61 6d 2c | CHKDSK |program,|
|00003da0| 0a 0d 77 69 6c 6c 20 68 | 61 76 65 20 64 65 63 72 |..will h|ave decr|
|00003db0| 65 61 73 65 64 20 62 79 | 20 32 2c 30 36 34 20 62 |eased by| 2,064 b|
|00003dc0| 79 74 65 73 2e 20 20 49 | 6e 74 65 72 72 75 70 74 |ytes. I|nterrupt|
|00003dd0| 20 32 31 20 77 69 6c 6c | 20 62 65 20 68 6f 6f 6b | 21 will| be hook|
|00003de0| 65 64 0a 0d 62 79 20 74 | 68 65 20 76 69 72 75 73 |ed..by t|he virus|
|00003df0| 20 69 6e 20 6d 65 6d 6f | 72 79 2e 0a 0d 0a 0d 4f | in memo|ry.....O|
|00003e00| 6e 63 65 20 74 68 65 20 | 34 33 39 20 76 69 72 75 |nce the |439 viru|
|00003e10| 73 20 69 73 20 6d 65 6d | 6f 72 79 20 72 65 73 69 |s is mem|ory resi|
|00003e20| 64 65 6e 74 2c 20 69 74 | 20 77 69 6c 6c 20 69 6e |dent, it| will in|
|00003e30| 66 65 63 74 20 2e 43 4f | 4d 20 70 72 6f 67 72 61 |fect .CO|M progra|
|00003e40| 6d 73 2c 0a 0d 69 6e 63 | 6c 75 64 69 6e 67 20 43 |ms,..inc|luding C|
|00003e50| 4f 4d 4d 41 4e 44 2e 43 | 4f 4d 2c 20 77 68 65 6e |OMMAND.C|OM, when|
|00003e60| 20 74 68 65 79 20 61 72 | 65 20 65 78 65 63 75 74 | they ar|e execut|
|00003e70| 65 64 20 6f 72 20 6f 70 | 65 6e 65 64 2e 20 20 49 |ed or op|ened. I|
|00003e80| 6e 66 65 63 74 65 64 0a | 0d 70 72 6f 67 72 61 6d |nfected.|.program|
|00003e90| 73 20 77 69 6c 6c 20 68 | 61 76 65 20 61 20 66 69 |s will h|ave a fi|
|00003ea0| 6c 65 20 6c 65 6e 67 74 | 68 20 69 6e 63 72 65 61 |le lengt|h increa|
|00003eb0| 73 65 20 6f 66 20 34 33 | 39 20 62 79 74 65 73 20 |se of 43|9 bytes |
|00003ec0| 77 69 74 68 20 74 68 65 | 0a 0d 76 69 72 75 73 20 |with the|..virus |
|00003ed0| 62 65 69 6e 67 20 6c 6f | 63 61 74 65 64 20 61 74 |being lo|cated at|
|00003ee0| 20 74 68 65 20 65 6e 64 | 20 6f 66 20 74 68 65 20 | the end| of the |
|00003ef0| 66 69 6c 65 2e 20 20 54 | 68 65 20 70 72 6f 67 72 |file. T|he progr|
|00003f00| 61 6d 27 73 20 64 61 74 | 65 0a 0d 61 6e 64 20 74 |am's dat|e..and t|
|00003f10| 69 6d 65 20 69 6e 20 74 | 68 65 20 44 4f 53 20 64 |ime in t|he DOS d|
|00003f20| 69 73 6b 20 64 69 72 65 | 63 74 6f 72 79 20 6c 69 |isk dire|ctory li|
|00003f30| 73 74 69 6e 67 20 77 69 | 6c 6c 20 6e 6f 74 20 62 |sting wi|ll not b|
|00003f40| 65 20 61 6c 74 65 72 65 | 64 2e 0a 0d 0a 0d 54 68 |e altere|d.....Th|
|00003f50| 65 20 34 33 39 20 76 69 | 72 75 73 20 64 6f 65 73 |e 439 vi|rus does|
|00003f60| 6e 27 74 20 61 70 70 65 | 61 72 20 74 6f 20 64 6f |n't appe|ar to do|
|00003f70| 20 61 6e 79 74 68 69 6e | 67 20 62 65 73 69 64 65 | anythin|g beside|
|00003f80| 73 20 72 65 70 6c 69 63 | 61 74 65 2e 0a 0d 0a 0d |s replic|ate.....|
|00003f90| 1a 1a 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003fa0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003fb0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003fc0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003fd0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003fe0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003ff0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004000| 54 68 65 20 35 30 30 20 | 76 69 72 75 73 20 77 61 |The 500 |virus wa|
|00004010| 73 20 73 75 62 6d 69 74 | 74 65 64 20 69 6e 20 41 |s submit|ted in A|
|00004020| 75 67 75 73 74 2c 20 31 | 39 39 32 2e 20 20 54 68 |ugust, 1|992. Th|
|00004030| 69 73 20 76 69 72 75 73 | 20 69 73 20 61 0a 0d 6d |is virus| is a..m|
|00004040| 65 6d 6f 72 79 20 72 65 | 73 69 64 65 6e 74 20 69 |emory re|sident i|
|00004050| 6e 66 65 63 74 6f 72 20 | 6f 66 20 2e 43 4f 4d 20 |nfector |of .COM |
|00004060| 70 72 6f 67 72 61 6d 73 | 2c 20 69 6e 63 6c 75 64 |programs|, includ|
|00004070| 69 6e 67 20 43 4f 4d 4d | 41 4e 44 2e 43 4f 4d 2e |ing COMM|AND.COM.|
|00004080| 0a 0d 0a 0d 57 68 65 6e | 20 74 68 65 20 66 69 72 |....When| the fir|
|00004090| 73 74 20 35 30 30 20 69 | 6e 66 65 63 74 65 64 20 |st 500 i|nfected |
|000040a0| 70 72 6f 67 72 61 6d 20 | 69 73 20 65 78 65 63 75 |program |is execu|
|000040b0| 74 65 64 2c 20 74 68 69 | 73 20 76 69 72 75 73 20 |ted, thi|s virus |
|000040c0| 77 69 6c 6c 0a 0d 69 6e | 73 74 61 6c 6c 20 69 74 |will..in|stall it|
|000040d0| 73 65 6c 66 20 6d 65 6d | 6f 72 79 20 72 65 73 69 |self mem|ory resi|
|000040e0| 64 65 6e 74 20 69 6e 20 | 61 76 61 69 6c 61 62 6c |dent in |availabl|
|000040f0| 65 20 66 72 65 65 20 73 | 79 73 74 65 6d 20 6d 65 |e free s|ystem me|
|00004100| 6d 6f 72 79 2e 0a 0d 53 | 69 6e 63 65 20 74 68 65 |mory...S|ince the|
|00004110| 20 76 69 72 75 73 20 64 | 6f 65 73 20 6e 6f 74 20 | virus d|oes not |
|00004120| 72 65 73 65 72 76 65 20 | 74 68 65 20 6d 65 6d 6f |reserve |the memo|
|00004130| 72 79 20 69 74 20 6f 63 | 63 75 70 69 65 73 2c 20 |ry it oc|cupies, |
|00004140| 61 6e 64 20 64 6f 65 73 | 6e 27 74 0a 0d 6b 65 65 |and does|n't..kee|
|00004150| 70 20 6f 74 68 65 72 20 | 70 72 6f 67 72 61 6d 73 |p other |programs|
|00004160| 20 66 72 6f 6d 20 6f 76 | 65 72 77 72 69 74 69 6e | from ov|erwritin|
|00004170| 67 20 69 74 20 69 6e 20 | 6d 65 6d 6f 72 79 2c 20 |g it in |memory, |
|00004180| 69 6e 66 65 63 74 65 64 | 20 73 79 73 74 65 6d 73 |infected| systems|
|00004190| 0a 0d 6d 61 79 20 65 78 | 70 65 72 69 65 6e 63 65 |..may ex|perience|
|000041a0| 20 66 72 65 71 75 65 6e | 74 20 73 79 73 74 65 6d | frequen|t system|
|000041b0| 20 68 61 6e 67 73 2e 0a | 0d 0a 0d 4f 6e 63 65 20 | hangs..|...Once |
|000041c0| 74 68 65 20 35 30 30 20 | 76 69 72 75 73 20 69 73 |the 500 |virus is|
|000041d0| 20 6d 65 6d 6f 72 79 20 | 72 65 73 69 64 65 6e 74 | memory |resident|
|000041e0| 2c 20 69 74 20 77 69 6c | 6c 20 69 6e 66 65 63 74 |, it wil|l infect|
|000041f0| 20 2e 43 4f 4d 20 70 72 | 6f 67 72 61 6d 73 2c 0a | .COM pr|ograms,.|
|00004200| 0d 69 6e 63 6c 75 64 69 | 6e 67 20 43 4f 4d 4d 41 |.includi|ng COMMA|
|00004210| 4e 44 2e 43 4f 4d 2c 20 | 77 68 65 6e 20 74 68 65 |ND.COM, |when the|
|00004220| 79 20 61 72 65 20 65 78 | 65 63 75 74 65 64 2e 20 |y are ex|ecuted. |
|00004230| 20 49 6e 66 65 63 74 65 | 64 20 70 72 6f 67 72 61 | Infecte|d progra|
|00004240| 6d 73 0a 0d 77 69 6c 6c | 20 68 61 76 65 20 61 20 |ms..will| have a |
|00004250| 66 69 6c 65 20 6c 65 6e | 67 74 68 20 69 6e 63 72 |file len|gth incr|
|00004260| 65 61 73 65 20 6f 66 20 | 35 30 30 20 62 79 74 65 |ease of |500 byte|
|00004270| 73 20 77 69 74 68 20 74 | 68 65 20 76 69 72 75 73 |s with t|he virus|
|00004280| 20 62 65 69 6e 67 0a 0d | 6c 6f 63 61 74 65 64 20 | being..|located |
|00004290| 61 74 20 74 68 65 20 62 | 65 67 69 6e 6e 69 6e 67 |at the b|eginning|
|000042a0| 20 6f 66 20 74 68 65 20 | 69 6e 66 65 63 74 65 64 | of the |infected|
|000042b0| 20 70 72 6f 67 72 61 6d | 2e 20 20 54 68 65 20 66 | program|. The f|
|000042c0| 69 6c 65 27 73 20 64 61 | 74 65 0a 0d 61 6e 64 20 |ile's da|te..and |
|000042d0| 74 69 6d 65 20 69 6e 20 | 74 68 65 20 44 4f 53 20 |time in |the DOS |
|000042e0| 64 69 73 6b 20 64 69 72 | 65 63 74 6f 72 79 20 6c |disk dir|ectory l|
|000042f0| 69 73 74 69 6e 67 20 77 | 69 6c 6c 20 6e 6f 74 20 |isting w|ill not |
|00004300| 62 65 20 61 6c 74 65 72 | 65 64 2e 0a 0d 0a 0d 54 |be alter|ed.....T|
|00004310| 68 65 20 35 30 30 20 76 | 69 72 75 73 20 63 61 6e |he 500 v|irus can|
|00004320| 6e 6f 74 20 64 65 74 65 | 72 6d 69 6e 65 20 77 68 |not dete|rmine wh|
|00004330| 65 6e 20 69 74 20 68 61 | 73 20 70 72 65 76 69 6f |en it ha|s previo|
|00004340| 75 73 6c 79 20 69 6e 66 | 65 63 74 65 64 20 61 0a |usly inf|ected a.|
|00004350| 0d 70 72 6f 67 72 61 6d | 2c 20 73 6f 20 72 65 69 |.program|, so rei|
|00004360| 6e 66 65 63 74 69 6f 6e | 20 6f 66 20 66 69 6c 65 |nfection| of file|
|00004370| 73 20 6d 61 79 20 6f 63 | 63 75 72 2e 20 20 45 61 |s may oc|cur. Ea|
|00004380| 63 68 20 72 65 69 6e 66 | 65 63 74 69 6f 6e 20 6f |ch reinf|ection o|
|00004390| 66 20 61 0a 0d 70 72 6f | 67 72 61 6d 20 77 69 6c |f a..pro|gram wil|
|000043a0| 6c 20 72 65 73 75 6c 74 | 20 69 6e 20 61 6e 20 61 |l result| in an a|
|000043b0| 64 64 69 74 69 6f 6e 61 | 6c 20 35 30 30 20 62 79 |dditiona|l 500 by|
|000043c0| 74 65 73 20 62 65 69 6e | 67 20 61 64 64 65 64 20 |tes bein|g added |
|000043d0| 74 6f 20 74 68 65 0a 0d | 70 72 6f 67 72 61 6d 2e |to the..|program.|
|000043e0| 0a 0d 0a 0d 1a 1a 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000043f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004400| 54 68 65 20 35 31 32 20 | 76 69 72 75 73 20 69 73 |The 512 |virus is|
|00004410| 20 6e 6f 74 20 74 68 65 | 20 73 61 6d 65 20 61 73 | not the| same as|
|00004420| 20 74 68 65 20 6f 72 69 | 67 69 6e 61 6c 20 46 72 | the ori|ginal Fr|
|00004430| 69 64 61 79 20 54 68 65 | 20 31 33 74 68 20 43 4f |iday The| 13th CO|
|00004440| 4d 0a 0d 76 69 72 75 73 | 2e 20 20 54 68 65 20 35 |M..virus|. The 5|
|00004450| 31 32 20 76 69 72 75 73 | 20 77 61 73 20 6f 72 69 |12 virus| was ori|
|00004460| 67 69 6e 61 6c 6c 79 20 | 69 73 6f 6c 61 74 65 64 |ginally |isolated|
|00004470| 20 69 6e 20 42 75 6c 67 | 61 72 69 61 20 69 6e 0a | in Bulg|aria in.|
|00004480| 0d 4e 6f 76 65 6d 62 65 | 72 2c 20 31 39 38 39 2c |.Novembe|r, 1989,|
|00004490| 20 62 79 20 56 65 73 73 | 65 6c 69 6e 20 42 6f 6e | by Vess|elin Bon|
|000044a0| 74 63 68 65 76 2e 20 20 | 49 74 20 69 6e 66 65 63 |tchev. |It infec|
|000044b0| 74 73 20 2e 43 4f 4d 20 | 66 69 6c 65 73 2c 0a 0d |ts .COM |files,..|
|000044c0| 69 6e 63 6c 75 64 69 6e | 67 20 43 4f 4d 4d 41 4e |includin|g COMMAN|
|000044d0| 44 2e 43 4f 4d 2c 20 69 | 6e 73 74 61 6c 6c 69 6e |D.COM, i|nstallin|
|000044e0| 67 20 69 74 73 65 6c 66 | 20 6d 65 6d 6f 72 79 20 |g itself| memory |
|000044f0| 72 65 73 69 64 65 6e 74 | 20 77 68 65 6e 20 74 68 |resident| when th|
|00004500| 65 0a 0d 66 69 72 73 74 | 20 69 6e 66 65 63 74 65 |e..first| infecte|
|00004510| 64 20 70 72 6f 67 72 61 | 6d 20 69 73 20 72 75 6e |d progra|m is run|
|00004520| 2e 20 20 41 66 74 65 72 | 20 62 65 63 6f 6d 69 6e |. After| becomin|
|00004530| 67 20 6d 65 6d 6f 72 79 | 20 72 65 73 69 64 65 6e |g memory| residen|
|00004540| 74 2c 20 61 6e 79 0a 0d | 2e 43 4f 4d 20 66 69 6c |t, any..|.COM fil|
|00004550| 65 20 6f 70 65 6e 65 64 | 20 66 6f 72 20 61 6e 79 |e opened| for any|
|00004560| 20 72 65 61 73 6f 6e 20 | 77 69 6c 6c 20 62 65 63 | reason |will bec|
|00004570| 6f 6d 65 20 69 6e 66 65 | 63 74 65 64 20 69 66 20 |ome infe|cted if |
|00004580| 69 74 73 0a 0d 75 6e 69 | 6e 66 65 63 74 65 64 20 |its..uni|nfected |
|00004590| 6c 65 6e 67 74 68 20 69 | 73 20 61 74 20 6c 65 61 |length i|s at lea|
|000045a0| 73 74 20 35 31 32 20 62 | 79 74 65 73 2e 0a 0d 0a |st 512 b|ytes....|
|000045b0| 0d 53 79 73 74 65 6d 73 | 20 69 6e 66 65 63 74 65 |.Systems| infecte|
|000045c0| 64 20 77 69 74 68 20 74 | 68 65 20 35 31 32 20 76 |d with t|he 512 v|
|000045d0| 69 72 75 73 20 6d 61 79 | 20 65 78 70 65 72 69 65 |irus may| experie|
|000045e0| 6e 63 65 20 70 72 6f 67 | 72 61 6d 20 63 72 61 73 |nce prog|ram cras|
|000045f0| 68 65 73 0a 0d 64 75 65 | 20 74 6f 20 75 6e 65 78 |hes..due| to unex|
|00004600| 70 65 63 74 65 64 20 65 | 72 72 6f 72 73 2c 20 61 |pected e|rrors, a|
|00004610| 73 20 77 65 6c 6c 20 61 | 73 20 73 79 73 74 65 6d |s well a|s system|
|00004620| 20 68 61 6e 67 73 2e 20 | 20 44 61 6d 61 67 65 20 | hangs. | Damage |
|00004630| 6d 61 79 20 6f 63 63 75 | 72 0a 0d 74 6f 20 69 6e |may occu|r..to in|
|00004640| 66 65 63 74 65 64 20 66 | 69 6c 65 73 20 69 66 20 |fected f|iles if |
|00004650| 74 68 65 20 73 79 73 74 | 65 6d 20 75 73 65 72 20 |the syst|em user |
|00004660| 72 75 6e 73 20 43 48 4b | 44 53 4b 20 77 69 74 68 |runs CHK|DSK with|
|00004670| 20 74 68 65 20 2f 46 0a | 0d 70 61 72 61 6d 65 74 | the /F.|.paramet|
|00004680| 65 72 20 61 73 20 74 68 | 65 20 6c 65 6e 67 74 68 |er as th|e length|
|00004690| 20 6f 66 20 74 68 65 20 | 70 72 6f 67 72 61 6d 20 | of the |program |
|000046a0| 69 6e 20 74 68 65 20 64 | 69 72 65 63 74 6f 72 79 |in the d|irectory|
|000046b0| 20 65 6e 74 72 79 20 77 | 69 6c 6c 0a 0d 6e 6f 74 | entry w|ill..not|
|000046c0| 20 6d 61 74 63 68 20 74 | 68 65 20 61 63 74 75 61 | match t|he actua|
|000046d0| 6c 20 64 69 73 6b 20 73 | 70 61 63 65 20 75 73 65 |l disk s|pace use|
|000046e0| 64 2e 20 20 43 48 4b 44 | 53 4b 20 77 69 6c 6c 20 |d. CHKD|SK will |
|000046f0| 74 68 65 6e 20 61 64 6a | 75 73 74 20 74 68 65 0a |then adj|ust the.|
|00004700| 0d 66 69 6c 65 20 61 6c | 6c 6f 63 61 74 69 6f 6e |.file al|location|
|00004710| 20 74 61 62 6c 65 2c 20 | 72 65 73 75 6c 74 69 6e | table, |resultin|
|00004720| 67 20 69 6e 20 64 61 6d | 61 67 65 64 20 66 69 6c |g in dam|aged fil|
|00004730| 65 73 2e 0a 0d 0a 0d 54 | 68 65 20 76 69 72 75 73 |es.....T|he virus|
|00004740| 27 73 20 61 6c 69 61 73 | 20 6f 66 20 22 4e 75 6d |'s alias| of "Num|
|00004750| 62 65 72 20 6f 66 20 74 | 68 65 20 42 65 61 73 74 |ber of t|he Beast|
|00004760| 22 20 76 69 72 75 73 20 | 69 73 20 62 65 63 61 75 |" virus |is becau|
|00004770| 73 65 20 74 68 65 0a 0d | 61 75 74 68 6f 72 20 6f |se the..|author o|
|00004780| 66 20 74 68 65 20 76 69 | 72 75 73 20 75 73 65 64 |f the vi|rus used|
|00004790| 20 61 20 73 69 67 6e 61 | 74 75 72 65 20 6f 66 20 | a signa|ture of |
|000047a0| 74 65 78 74 20 36 36 36 | 20 6e 65 61 72 20 74 68 |text 666| near th|
|000047b0| 65 20 65 6e 64 20 6f 66 | 20 74 68 65 0a 0d 76 69 |e end of| the..vi|
|000047c0| 72 75 73 20 74 6f 20 64 | 65 74 65 72 6d 69 6e 65 |rus to d|etermine|
|000047d0| 20 69 66 20 74 68 65 20 | 66 69 6c 65 20 69 73 20 | if the |file is |
|000047e0| 61 6c 72 65 61 64 79 20 | 69 6e 66 65 63 74 65 64 |already |infected|
|000047f0| 2e 20 20 53 69 6e 63 65 | 20 35 31 32 20 61 64 64 |. Since| 512 add|
|00004800| 73 0a 0d 69 74 73 20 76 | 69 72 61 6c 20 63 6f 64 |s..its v|iral cod|
|00004810| 65 20 74 6f 20 74 68 65 | 20 65 6e 64 20 6f 66 20 |e to the| end of |
|00004820| 69 6e 66 65 63 74 65 64 | 20 66 69 6c 65 73 2c 20 |infected| files, |
|00004830| 69 74 20 69 73 20 65 61 | 73 79 20 74 6f 20 76 65 |it is ea|sy to ve|
|00004840| 72 69 66 79 0a 0d 74 68 | 61 74 20 61 20 66 69 6c |rify..th|at a fil|
|00004850| 65 20 69 73 20 69 6e 66 | 65 63 74 65 64 20 62 79 |e is inf|ected by|
|00004860| 20 74 68 65 20 35 31 32 | 20 76 69 72 75 73 20 62 | the 512| virus b|
|00004870| 79 20 63 68 65 63 6b 69 | 6e 67 20 66 6f 72 20 74 |y checki|ng for t|
|00004880| 68 61 74 0a 0d 73 69 67 | 6e 61 74 75 72 65 2e 0a |hat..sig|nature..|
|00004890| 0d 0a 0d 1a 1a 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000048a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000048b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000048c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000048d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000048e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000048f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004900| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004910| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004920| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004930| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004940| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004950| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004960| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004970| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004980| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004990| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000049a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000049b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000049c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000049d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000049e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000049f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004a00| 54 68 65 20 35 35 37 20 | 76 69 72 75 73 20 77 61 |The 557 |virus wa|
|00004a10| 73 20 72 65 63 65 69 76 | 65 64 20 69 6e 20 4a 75 |s receiv|ed in Ju|
|00004a20| 6c 79 2c 20 31 39 39 32 | 2e 20 20 49 74 73 20 6f |ly, 1992|. Its o|
|00004a30| 72 69 67 69 6e 20 6f 72 | 20 70 6f 69 6e 74 20 6f |rigin or| point o|
|00004a40| 66 0a 0d 69 73 6f 6c 61 | 74 69 6f 6e 20 69 73 20 |f..isola|tion is |
|00004a50| 75 6e 6b 6e 6f 77 6e 2e | 20 20 54 68 69 73 20 76 |unknown.| This v|
|00004a60| 69 72 75 73 20 69 73 20 | 61 20 6d 65 6d 6f 72 79 |irus is |a memory|
|00004a70| 20 72 65 73 69 64 65 6e | 74 20 69 6e 66 65 63 74 | residen|t infect|
|00004a80| 6f 72 20 6f 66 0a 0d 2e | 45 58 45 20 70 72 6f 67 |or of...|EXE prog|
|00004a90| 72 61 6d 73 2e 0a 0d 0a | 0d 57 68 65 6e 20 74 68 |rams....|.When th|
|00004aa0| 65 20 66 69 72 73 74 20 | 35 35 37 20 69 6e 66 65 |e first |557 infe|
|00004ab0| 63 74 65 64 20 70 72 6f | 67 72 61 6d 20 69 73 20 |cted pro|gram is |
|00004ac0| 65 78 65 63 75 74 65 64 | 2c 20 74 68 69 73 20 76 |executed|, this v|
|00004ad0| 69 72 75 73 20 77 69 6c | 6c 0a 0d 69 6e 73 74 61 |irus wil|l..insta|
|00004ae0| 6c 6c 20 69 74 73 65 6c | 66 20 6d 65 6d 6f 72 79 |ll itsel|f memory|
|00004af0| 20 72 65 73 69 64 65 6e | 74 20 61 74 20 74 68 65 | residen|t at the|
|00004b00| 20 74 6f 70 20 6f 66 20 | 73 79 73 74 65 6d 20 6d | top of |system m|
|00004b10| 65 6d 6f 72 79 20 62 75 | 74 20 62 65 6c 6f 77 0a |emory bu|t below.|
|00004b20| 0d 74 68 65 20 36 34 30 | 4b 20 44 4f 53 20 62 6f |.the 640|K DOS bo|
|00004b30| 75 6e 64 61 72 79 2e 20 | 20 54 6f 74 61 6c 20 73 |undary. | Total s|
|00004b40| 79 73 74 65 6d 20 61 6e | 64 20 61 76 61 69 6c 61 |ystem an|d availa|
|00004b50| 62 6c 65 20 66 72 65 65 | 20 6d 65 6d 6f 72 79 2c |ble free| memory,|
|00004b60| 20 61 73 0a 0d 69 6e 64 | 69 63 61 74 65 64 20 62 | as..ind|icated b|
|00004b70| 79 20 74 68 65 20 44 4f | 53 20 43 48 4b 44 53 4b |y the DO|S CHKDSK|
|00004b80| 20 70 72 6f 67 72 61 6d | 2c 20 77 69 6c 6c 20 68 | program|, will h|
|00004b90| 61 76 65 20 64 65 63 72 | 65 61 73 65 64 20 62 79 |ave decr|eased by|
|00004ba0| 20 36 32 34 0a 0d 62 79 | 74 65 73 2e 20 20 49 6e | 624..by|tes. In|
|00004bb0| 74 65 72 72 75 70 74 20 | 32 31 20 77 69 6c 6c 20 |terrupt |21 will |
|00004bc0| 62 65 20 68 6f 6f 6b 65 | 64 20 62 79 20 74 68 65 |be hooke|d by the|
|00004bd0| 20 35 35 37 20 76 69 72 | 75 73 20 69 6e 20 6d 65 | 557 vir|us in me|
|00004be0| 6d 6f 72 79 2e 0a 0d 0a | 0d 4f 6e 63 65 20 74 68 |mory....|.Once th|
|00004bf0| 65 20 35 35 37 20 76 69 | 72 75 73 20 69 73 20 6d |e 557 vi|rus is m|
|00004c00| 65 6d 6f 72 79 20 72 65 | 73 69 64 65 6e 74 2c 20 |emory re|sident, |
|00004c10| 69 74 20 77 69 6c 6c 20 | 69 6e 66 65 63 74 20 2e |it will |infect .|
|00004c20| 45 58 45 20 70 72 6f 67 | 72 61 6d 73 0a 0d 77 68 |EXE prog|rams..wh|
|00004c30| 65 6e 20 74 68 65 79 20 | 61 72 65 20 65 78 65 63 |en they |are exec|
|00004c40| 75 74 65 64 2e 20 20 49 | 6e 66 65 63 74 65 64 20 |uted. I|nfected |
|00004c50| 70 72 6f 67 72 61 6d 73 | 20 77 69 6c 6c 20 68 61 |programs| will ha|
|00004c60| 76 65 20 61 20 66 69 6c | 65 20 6c 65 6e 67 74 68 |ve a fil|e length|
|00004c70| 0a 0d 69 6e 63 72 65 61 | 73 65 20 6f 66 20 35 35 |..increa|se of 55|
|00004c80| 37 20 74 6f 20 35 36 36 | 20 62 79 74 65 73 20 77 |7 to 566| bytes w|
|00004c90| 69 74 68 20 74 68 65 20 | 76 69 72 75 73 20 62 65 |ith the |virus be|
|00004ca0| 69 6e 67 20 6c 6f 63 61 | 74 65 64 20 61 74 20 74 |ing loca|ted at t|
|00004cb0| 68 65 0a 0d 65 6e 64 20 | 6f 66 20 74 68 65 20 66 |he..end |of the f|
|00004cc0| 69 6c 65 2e 20 20 54 68 | 65 20 70 72 6f 67 72 61 |ile. Th|e progra|
|00004cd0| 6d 27 73 20 64 61 74 65 | 20 61 6e 64 20 74 69 6d |m's date| and tim|
|00004ce0| 65 20 69 6e 20 74 68 65 | 20 44 4f 53 20 64 69 73 |e in the| DOS dis|
|00004cf0| 6b 0a 0d 64 69 72 65 63 | 74 6f 72 79 20 6c 69 73 |k..direc|tory lis|
|00004d00| 74 69 6e 67 20 77 69 6c | 6c 20 68 61 76 65 20 62 |ting wil|l have b|
|00004d10| 65 65 6e 20 75 70 64 61 | 74 65 64 20 74 6f 20 74 |een upda|ted to t|
|00004d20| 68 65 20 63 75 72 72 65 | 6e 74 20 73 79 73 74 65 |he curre|nt syste|
|00004d30| 6d 20 64 61 74 65 0a 0d | 61 6e 64 20 74 69 6d 65 |m date..|and time|
|00004d40| 20 77 68 65 6e 20 69 6e | 66 65 63 74 69 6f 6e 20 | when in|fection |
|00004d50| 6f 63 63 75 72 72 65 64 | 2e 20 20 4f 6e 65 20 74 |occurred|. One t|
|00004d60| 65 78 74 20 73 74 72 69 | 6e 67 20 6f 63 63 75 72 |ext stri|ng occur|
|00004d70| 73 20 69 6e 20 61 6c 6c | 0a 0d 69 6e 66 65 63 74 |s in all|..infect|
|00004d80| 65 64 20 70 72 6f 67 72 | 61 6d 73 3a 0a 0d 0a 0d |ed progr|ams:....|
|00004d90| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 22 | | "|
|00004da0| 58 5b 59 5a 5d 22 0a 0d | 0a 0d 54 68 65 20 35 35 |X[YZ]"..|..The 55|
|00004db0| 37 20 76 69 72 75 73 20 | 64 6f 65 73 6e 27 74 20 |7 virus |doesn't |
|00004dc0| 61 70 70 65 61 72 20 74 | 6f 20 64 6f 20 61 6e 79 |appear t|o do any|
|00004dd0| 74 68 69 6e 67 20 62 75 | 74 20 72 65 70 6c 69 63 |thing bu|t replic|
|00004de0| 61 74 65 2e 0a 0d 0a 0d | 1a 1a 00 00 00 00 00 00 |ate.....|........|
|00004df0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004e00| 54 68 65 20 35 37 32 20 | 76 69 72 75 73 20 77 61 |The 572 |virus wa|
|00004e10| 73 20 72 65 63 65 69 76 | 65 64 20 69 6e 20 41 70 |s receiv|ed in Ap|
|00004e20| 72 69 6c 2c 20 31 39 39 | 32 2e 20 20 49 74 73 20 |ril, 199|2. Its |
|00004e30| 6f 72 69 67 69 6e 20 6f | 72 20 70 6f 69 6e 74 20 |origin o|r point |
|00004e40| 6f 66 0a 0d 69 73 6f 6c | 61 74 69 6f 6e 20 69 73 |of..isol|ation is|
|00004e50| 20 75 6e 6b 6e 6f 77 6e | 2e 20 20 54 68 69 73 20 | unknown|. This |
|00004e60| 76 69 72 75 73 20 69 73 | 20 61 20 6d 65 6d 6f 72 |virus is| a memor|
|00004e70| 79 20 72 65 73 69 64 65 | 6e 74 20 69 6e 66 65 63 |y reside|nt infec|
|00004e80| 74 6f 72 20 6f 66 0a 0d | 2e 45 58 45 20 70 72 6f |tor of..|.EXE pro|
|00004e90| 67 72 61 6d 73 2e 0a 0d | 0a 0d 54 68 65 20 66 69 |grams...|..The fi|
|00004ea0| 72 73 74 20 74 69 6d 65 | 20 61 20 70 72 6f 67 72 |rst time| a progr|
|00004eb0| 61 6d 20 69 6e 66 65 63 | 74 65 64 20 77 69 74 68 |am infec|ted with|
|00004ec0| 20 74 68 65 20 35 37 32 | 20 76 69 72 75 73 20 69 | the 572| virus i|
|00004ed0| 73 20 65 78 65 63 75 74 | 65 64 2c 0a 0d 74 68 69 |s execut|ed,..thi|
|00004ee0| 73 20 76 69 72 75 73 20 | 77 69 6c 6c 20 69 6e 73 |s virus |will ins|
|00004ef0| 74 61 6c 6c 20 69 74 73 | 65 6c 66 20 6d 65 6d 6f |tall its|elf memo|
|00004f00| 72 79 20 72 65 73 69 64 | 65 6e 74 20 61 74 20 74 |ry resid|ent at t|
|00004f10| 68 65 20 74 6f 70 20 6f | 66 20 73 79 73 74 65 6d |he top o|f system|
|00004f20| 0a 0d 6d 65 6d 6f 72 79 | 20 62 75 74 20 62 65 6c |..memory| but bel|
|00004f30| 6f 77 20 74 68 65 20 36 | 34 30 4b 20 44 4f 53 20 |ow the 6|40K DOS |
|00004f40| 62 6f 75 6e 64 61 72 79 | 2e 20 20 54 6f 74 61 6c |boundary|. Total|
|00004f50| 20 73 79 73 74 65 6d 20 | 61 6e 64 20 61 76 61 69 | system |and avai|
|00004f60| 6c 61 62 6c 65 0a 0d 66 | 72 65 65 20 6d 65 6d 6f |lable..f|ree memo|
|00004f70| 72 79 2c 20 61 73 20 69 | 6e 64 69 63 61 74 65 64 |ry, as i|ndicated|
|00004f80| 20 62 79 20 74 68 65 20 | 44 4f 53 20 43 48 4b 44 | by the |DOS CHKD|
|00004f90| 53 4b 20 70 72 6f 67 72 | 61 6d 2c 20 77 69 6c 6c |SK progr|am, will|
|00004fa0| 20 68 61 76 65 0a 0d 64 | 65 63 72 65 61 73 65 64 | have..d|ecreased|
|00004fb0| 20 62 79 20 31 2c 30 32 | 34 20 62 79 74 65 73 2e | by 1,02|4 bytes.|
|00004fc0| 20 20 49 6e 74 65 72 72 | 75 70 74 73 20 32 31 20 | Interr|upts 21 |
|00004fd0| 61 6e 64 20 32 34 20 77 | 69 6c 6c 20 62 65 20 68 |and 24 w|ill be h|
|00004fe0| 6f 6f 6b 65 64 20 62 79 | 0a 0d 74 68 65 20 35 37 |ooked by|..the 57|
|00004ff0| 32 20 76 69 72 75 73 20 | 69 6e 20 6d 65 6d 6f 72 |2 virus |in memor|
|00005000| 79 2e 0a 0d 0a 0d 4f 6e | 63 65 20 74 68 65 20 35 |y.....On|ce the 5|
|00005010| 37 32 20 76 69 72 75 73 | 20 69 73 20 6d 65 6d 6f |72 virus| is memo|
|00005020| 72 79 20 72 65 73 69 64 | 65 6e 74 2c 20 69 74 20 |ry resid|ent, it |
|00005030| 77 69 6c 6c 20 69 6e 66 | 65 63 74 20 2e 45 58 45 |will inf|ect .EXE|
|00005040| 20 70 72 6f 67 72 61 6d | 73 0a 0d 61 73 20 74 68 | program|s..as th|
|00005050| 65 79 20 61 72 65 20 65 | 78 65 63 75 74 65 64 2e |ey are e|xecuted.|
|00005060| 20 20 49 6e 66 65 63 74 | 65 64 20 70 72 6f 67 72 | Infect|ed progr|
|00005070| 61 6d 73 20 77 69 6c 6c | 20 68 61 76 65 20 61 20 |ams will| have a |
|00005080| 66 69 6c 65 20 6c 65 6e | 67 74 68 0a 0d 69 6e 63 |file len|gth..inc|
|00005090| 72 65 61 73 65 20 6f 66 | 20 35 37 32 20 62 79 74 |rease of| 572 byt|
|000050a0| 65 73 20 77 69 74 68 20 | 74 68 65 20 76 69 72 75 |es with |the viru|
|000050b0| 73 20 62 65 69 6e 67 20 | 6c 6f 63 61 74 65 64 20 |s being |located |
|000050c0| 61 74 20 74 68 65 20 65 | 6e 64 20 6f 66 0a 0d 74 |at the e|nd of..t|
|000050d0| 68 65 20 69 6e 66 65 63 | 74 65 64 20 66 69 6c 65 |he infec|ted file|
|000050e0| 2e 20 20 54 68 65 20 70 | 72 6f 67 72 61 6d 27 73 |. The p|rogram's|
|000050f0| 20 64 61 74 65 20 61 6e | 64 20 74 69 6d 65 20 69 | date an|d time i|
|00005100| 6e 20 74 68 65 20 44 4f | 53 20 64 69 73 6b 0a 0d |n the DO|S disk..|
|00005110| 64 69 72 65 63 74 6f 72 | 79 20 77 69 6c 6c 20 68 |director|y will h|
|00005120| 61 76 65 20 62 65 65 6e | 20 75 70 64 61 74 65 64 |ave been| updated|
|00005130| 20 74 6f 20 74 68 65 20 | 73 79 73 74 65 6d 20 64 | to the |system d|
|00005140| 61 74 65 20 61 6e 64 20 | 74 69 6d 65 20 77 68 65 |ate and |time whe|
|00005150| 6e 0a 0d 69 6e 66 65 63 | 74 69 6f 6e 20 6f 63 63 |n..infec|tion occ|
|00005160| 75 72 72 65 64 2e 0a 0d | 0a 0d 49 74 20 69 73 20 |urred...|..It is |
|00005170| 75 6e 6b 6e 6f 77 6e 20 | 69 66 20 35 37 32 20 64 |unknown |if 572 d|
|00005180| 6f 65 73 20 61 6e 79 74 | 68 69 6e 67 20 62 65 73 |oes anyt|hing bes|
|00005190| 69 64 65 73 20 72 65 70 | 6c 69 63 61 74 65 2e 0a |ides rep|licate..|
|000051a0| 0d 0a 0d 1a 1a 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000051b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000051c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000051d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000051e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000051f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005200| 54 68 65 20 35 39 35 20 | 76 69 72 75 73 20 77 61 |The 595 |virus wa|
|00005210| 73 20 72 65 63 65 69 76 | 65 64 20 69 6e 20 53 65 |s receiv|ed in Se|
|00005220| 70 74 65 6d 62 65 72 2c | 20 31 39 39 32 2e 20 20 |ptember,| 1992. |
|00005230| 49 74 73 20 6f 72 69 67 | 69 6e 20 6f 72 0a 0d 70 |Its orig|in or..p|
|00005240| 6f 69 6e 74 20 6f 66 20 | 69 73 6f 6c 61 74 69 6f |oint of |isolatio|
|00005250| 6e 20 69 73 20 75 6e 6b | 6e 6f 77 6e 2e 20 20 54 |n is unk|nown. T|
|00005260| 68 65 20 35 39 35 20 76 | 69 72 75 73 20 69 73 20 |he 595 v|irus is |
|00005270| 61 20 6e 6f 6e 2d 72 65 | 73 69 64 65 6e 74 0a 0d |a non-re|sident..|
|00005280| 64 69 72 65 63 74 20 61 | 63 74 69 6f 6e 20 69 6e |direct a|ction in|
|00005290| 66 65 63 74 6f 72 20 6f | 66 20 2e 43 4f 4d 20 70 |fector o|f .COM p|
|000052a0| 72 6f 67 72 61 6d 73 2c | 20 69 6e 63 6c 75 64 69 |rograms,| includi|
|000052b0| 6e 67 20 43 4f 4d 4d 41 | 4e 44 2e 43 4f 4d 2e 0a |ng COMMA|ND.COM..|
|000052c0| 0d 0a 0d 57 68 65 6e 20 | 61 20 70 72 6f 67 72 61 |...When |a progra|
|000052d0| 6d 20 69 6e 66 65 63 74 | 65 64 20 77 69 74 68 20 |m infect|ed with |
|000052e0| 74 68 65 20 35 39 35 20 | 76 69 72 75 73 20 69 73 |the 595 |virus is|
|000052f0| 20 65 78 65 63 75 74 65 | 64 2c 20 74 68 65 20 35 | execute|d, the 5|
|00005300| 39 35 0a 0d 76 69 72 75 | 73 20 77 69 6c 6c 20 69 |95..viru|s will i|
|00005310| 6e 66 65 63 74 20 6f 6e | 65 20 2e 43 4f 4d 20 70 |nfect on|e .COM p|
|00005320| 72 6f 67 72 61 6d 20 6c | 6f 63 61 74 65 64 20 69 |rogram l|ocated i|
|00005330| 6e 20 74 68 65 20 63 75 | 72 72 65 6e 74 0a 0d 64 |n the cu|rrent..d|
|00005340| 69 72 65 63 74 6f 72 79 | 2e 20 20 49 66 20 61 6c |irectory|. If al|
|00005350| 6c 20 6f 66 20 74 68 65 | 20 2e 43 4f 4d 20 66 69 |l of the| .COM fi|
|00005360| 6c 65 73 20 69 6e 20 74 | 68 65 20 63 75 72 72 65 |les in t|he curre|
|00005370| 6e 74 20 64 69 72 65 63 | 74 6f 72 79 20 61 72 65 |nt direc|tory are|
|00005380| 0a 0d 61 6c 72 65 61 64 | 79 20 69 6e 66 65 63 74 |..alread|y infect|
|00005390| 65 64 2c 20 74 68 65 20 | 76 69 72 75 73 20 77 69 |ed, the |virus wi|
|000053a0| 6c 6c 20 73 65 61 72 63 | 68 20 66 6f 72 20 61 20 |ll searc|h for a |
|000053b0| 2e 43 4f 4d 20 70 72 6f | 67 72 61 6d 20 69 6e 20 |.COM pro|gram in |
|000053c0| 74 68 65 0a 0d 43 3a 20 | 64 72 69 76 65 20 72 6f |the..C: |drive ro|
|000053d0| 6f 74 20 64 69 72 65 63 | 74 6f 72 79 20 74 6f 20 |ot direc|tory to |
|000053e0| 69 6e 66 65 63 74 2e 20 | 20 49 6e 66 65 63 74 65 |infect. | Infecte|
|000053f0| 64 20 70 72 6f 67 72 61 | 6d 73 20 77 69 6c 6c 20 |d progra|ms will |
|00005400| 68 61 76 65 20 61 0a 0d | 66 69 6c 65 20 6c 65 6e |have a..|file len|
|00005410| 67 74 68 20 69 6e 63 72 | 65 61 73 65 20 6f 66 20 |gth incr|ease of |
|00005420| 35 39 39 20 62 79 74 65 | 73 20 77 69 74 68 20 74 |599 byte|s with t|
|00005430| 68 65 20 76 69 72 75 73 | 20 62 65 69 6e 67 20 6c |he virus| being l|
|00005440| 6f 63 61 74 65 64 20 61 | 74 0a 0d 74 68 65 20 65 |ocated a|t..the e|
|00005450| 6e 64 20 6f 66 20 74 68 | 65 20 66 69 6c 65 2e 20 |nd of th|e file. |
|00005460| 20 54 68 65 20 70 72 6f | 67 72 61 6d 27 73 20 64 | The pro|gram's d|
|00005470| 61 74 65 20 61 6e 64 20 | 74 69 6d 65 20 69 6e 20 |ate and |time in |
|00005480| 74 68 65 20 44 4f 53 20 | 64 69 73 6b 0a 0d 64 69 |the DOS |disk..di|
|00005490| 72 65 63 74 6f 72 79 20 | 6c 69 73 74 69 6e 67 20 |rectory |listing |
|000054a0| 77 69 6c 6c 20 68 61 76 | 65 20 62 65 65 6e 20 75 |will hav|e been u|
|000054b0| 70 64 61 74 65 64 20 74 | 6f 20 74 68 65 20 63 75 |pdated t|o the cu|
|000054c0| 72 72 65 6e 74 20 73 79 | 73 74 65 6d 20 64 61 74 |rrent sy|stem dat|
|000054d0| 65 0a 0d 61 6e 64 20 74 | 69 6d 65 20 77 68 65 6e |e..and t|ime when|
|000054e0| 20 69 6e 66 65 63 74 69 | 6f 6e 20 6f 63 63 75 72 | infecti|on occur|
|000054f0| 72 65 64 2e 20 20 54 68 | 65 72 65 20 69 73 20 6f |red. Th|ere is o|
|00005500| 6e 65 20 74 65 78 74 20 | 73 74 72 69 6e 67 20 76 |ne text |string v|
|00005510| 69 73 69 62 6c 65 0a 0d | 77 69 74 68 69 6e 20 74 |isible..|within t|
|00005520| 68 65 20 76 69 72 61 6c | 20 63 6f 64 65 20 69 6e |he viral| code in|
|00005530| 20 69 6e 66 65 63 74 65 | 64 20 70 72 6f 67 72 61 | infecte|d progra|
|00005540| 6d 73 3a 0a 0d 0a 0d 20 | 20 20 20 20 20 20 20 20 |ms:.... | |
|00005550| 20 20 20 20 20 20 22 3f | 3f 3f 3f 3f 3f 3f 3f 43 | "?|???????C|
|00005560| 4f 4d 22 0a 0d 0a 0d 49 | 74 20 69 73 20 75 6e 6b |OM"....I|t is unk|
|00005570| 6e 6f 77 6e 20 69 66 20 | 35 39 35 20 64 6f 65 73 |nown if |595 does|
|00005580| 20 61 6e 79 74 68 69 6e | 67 20 62 65 73 69 64 65 | anythin|g beside|
|00005590| 73 20 72 65 70 6c 69 63 | 61 74 65 2e 0a 0d 0a 0d |s replic|ate.....|
|000055a0| 1a 1a 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000055b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000055c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000055d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000055e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000055f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005600| 54 68 65 20 36 32 31 20 | 76 69 72 75 73 20 77 61 |The 621 |virus wa|
|00005610| 73 20 72 65 63 65 69 76 | 65 64 20 69 6e 20 4e 6f |s receiv|ed in No|
|00005620| 76 65 6d 62 65 72 2c 20 | 31 39 39 31 2e 20 20 49 |vember, |1991. I|
|00005630| 74 73 20 6f 72 69 67 69 | 6e 20 61 6e 64 20 70 6f |ts origi|n and po|
|00005640| 69 6e 74 0a 0d 6f 66 20 | 6f 72 69 67 69 6e 61 6c |int..of |original|
|00005650| 20 69 73 6f 6c 61 74 69 | 6f 6e 20 61 72 65 20 75 | isolati|on are u|
|00005660| 6e 6b 6e 6f 77 6e 2e 20 | 20 36 32 31 20 69 73 20 |nknown. | 621 is |
|00005670| 61 20 6e 6f 6e 2d 72 65 | 73 69 64 65 6e 74 2c 20 |a non-re|sident, |
|00005680| 64 69 72 65 63 74 0a 0d | 61 63 74 69 6f 6e 20 69 |direct..|action i|
|00005690| 6e 66 65 63 74 6f 72 20 | 6f 66 20 2e 43 4f 4d 20 |nfector |of .COM |
|000056a0| 66 69 6c 65 73 2c 20 69 | 6e 63 6c 75 64 69 6e 67 |files, i|ncluding|
|000056b0| 20 43 4f 4d 4d 41 4e 44 | 2e 43 4f 4d 2e 0a 0d 0a | COMMAND|.COM....|
|000056c0| 0d 57 68 65 6e 20 61 20 | 70 72 6f 67 72 61 6d 20 |.When a |program |
|000056d0| 69 6e 66 65 63 74 65 64 | 20 77 69 74 68 20 36 32 |infected| with 62|
|000056e0| 31 20 69 73 20 65 78 65 | 63 75 74 65 64 2c 20 74 |1 is exe|cuted, t|
|000056f0| 68 65 20 76 69 72 75 73 | 20 77 69 6c 6c 20 73 65 |he virus| will se|
|00005700| 61 72 63 68 0a 0d 74 68 | 65 20 63 75 72 72 65 6e |arch..th|e curren|
|00005710| 74 20 64 72 69 76 65 20 | 61 6e 64 20 64 69 72 65 |t drive |and dire|
|00005720| 63 74 6f 72 79 20 66 6f | 72 20 61 6e 20 75 6e 69 |ctory fo|r an uni|
|00005730| 6e 66 65 63 74 65 64 20 | 2e 43 4f 4d 20 70 72 6f |nfected |.COM pro|
|00005740| 67 72 61 6d 20 74 6f 0a | 0d 69 6e 66 65 63 74 2e |gram to.|.infect.|
|00005750| 20 20 57 68 65 6e 20 74 | 68 65 20 66 69 72 73 74 | When t|he first|
|00005760| 20 75 6e 69 6e 66 65 63 | 74 65 64 20 70 72 6f 67 | uninfec|ted prog|
|00005770| 72 61 6d 20 69 73 20 6c | 6f 63 61 74 65 64 2c 20 |ram is l|ocated, |
|00005780| 69 74 20 77 69 6c 6c 20 | 62 65 0a 0d 69 6e 66 65 |it will |be..infe|
|00005790| 63 74 65 64 20 62 79 20 | 74 68 65 20 36 32 31 20 |cted by |the 621 |
|000057a0| 76 69 72 75 73 2e 20 20 | 49 6e 66 65 63 74 65 64 |virus. |Infected|
|000057b0| 20 70 72 6f 67 72 61 6d | 73 20 69 6e 63 72 65 61 | program|s increa|
|000057c0| 73 65 20 69 6e 20 73 69 | 7a 65 20 62 79 0a 0d 36 |se in si|ze by..6|
|000057d0| 32 31 20 62 79 74 65 73 | 20 77 69 74 68 20 74 68 |21 bytes| with th|
|000057e0| 65 20 76 69 72 75 73 20 | 62 65 69 6e 67 20 6c 6f |e virus |being lo|
|000057f0| 63 61 74 65 64 20 61 74 | 20 74 68 65 20 65 6e 64 |cated at| the end|
|00005800| 20 6f 66 20 74 68 65 20 | 69 6e 66 65 63 74 65 64 | of the |infected|
|00005810| 0a 0d 66 69 6c 65 2e 20 | 20 54 68 65 20 66 6f 6c |..file. | The fol|
|00005820| 6c 6f 77 69 6e 67 20 74 | 65 78 74 20 73 74 72 69 |lowing t|ext stri|
|00005830| 6e 67 73 20 77 69 6c 6c | 20 62 65 20 66 6f 75 6e |ngs will| be foun|
|00005840| 64 20 77 69 74 68 69 6e | 20 74 68 65 20 76 69 72 |d within| the vir|
|00005850| 61 6c 0a 0d 63 6f 64 65 | 20 69 6e 20 69 6e 66 65 |al..code| in infe|
|00005860| 63 74 65 64 20 70 72 6f | 67 72 61 6d 73 3a 0a 0d |cted pro|grams:..|
|00005870| 0a 0d 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |.. | |
|00005880| 20 22 3f 3f 3f 3f 3f 3f | 3f 3f 43 4f 4d 22 0a 0d | "??????|??COM"..|
|00005890| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 22 | | "|
|000058a0| 2a 2e 43 4f 4d 22 0a 0d | 20 20 20 20 20 20 20 20 |*.COM"..| |
|000058b0| 20 20 20 20 20 20 20 22 | 57 61 74 65 72 20 64 65 | "|Water de|
|000058c0| 74 65 63 74 65 64 20 69 | 6e 20 6d 61 74 68 2d 63 |tected i|n math-c|
|000058d0| 6f 2d 70 72 6f 63 65 73 | 73 6f 72 22 0a 0d 20 20 |o-proces|sor".. |
|000058e0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 22 50 41 | | "PA|
|000058f0| 52 49 54 59 20 45 52 52 | 4f 52 22 0a 0d 20 20 20 |RITY ERR|OR".. |
|00005900| 20 20 20 20 20 20 20 20 | 20 20 20 20 22 53 79 73 | | "Sys|
|00005910| 74 65 6d 20 68 61 6c 74 | 65 64 22 0a 0d 20 20 20 |tem halt|ed".. |
|00005920| 20 20 20 20 20 20 20 20 | 20 20 20 20 22 53 6f 6d | | "Som|
|00005930| 65 74 68 69 6e 67 20 77 | 6f 6e 64 65 72 66 75 6c |ething w|onderful|
|00005940| 20 68 61 73 20 68 61 70 | 70 65 6e 65 64 2c 20 79 | has hap|pened, y|
|00005950| 6f 75 72 20 50 43 20 69 | 73 20 61 6c 69 76 65 2e |our PC i|s alive.|
|00005960| 2e 2e 22 0a 0d 0a 0d 49 | 74 20 69 73 20 75 6e 6b |.."....I|t is unk|
|00005970| 6e 6f 77 6e 20 77 68 61 | 74 20 36 32 31 20 64 6f |nown wha|t 621 do|
|00005980| 65 73 20 62 65 73 69 64 | 65 73 20 72 65 70 6c 69 |es besid|es repli|
|00005990| 63 61 74 65 2e 0a 0d 0a | 0d 1a 1a 00 00 00 00 00 |cate....|........|
|000059a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000059b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000059c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000059d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000059e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000059f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005a00| 54 68 65 20 36 34 36 20 | 76 69 72 75 73 20 77 61 |The 646 |virus wa|
|00005a10| 73 20 64 69 73 63 6f 76 | 65 72 65 64 20 69 6e 20 |s discov|ered in |
|00005a20| 4f 63 74 6f 62 65 72 2c | 20 31 39 39 30 2e 20 20 |October,| 1990. |
|00005a30| 49 74 73 20 6f 72 69 67 | 69 6e 20 69 73 0a 0d 75 |Its orig|in is..u|
|00005a40| 6e 6b 6e 6f 77 6e 2e 20 | 20 54 68 69 73 20 76 69 |nknown. | This vi|
|00005a50| 72 75 73 20 69 73 20 61 | 20 6e 6f 6e 2d 72 65 73 |rus is a| non-res|
|00005a60| 69 64 65 6e 74 20 69 6e | 66 65 63 74 6f 72 20 6f |ident in|fector o|
|00005a70| 66 20 2e 43 4f 4d 20 66 | 69 6c 65 73 2c 0a 0d 69 |f .COM f|iles,..i|
|00005a80| 6e 63 6c 75 64 69 6e 67 | 20 43 4f 4d 4d 41 4e 44 |ncluding| COMMAND|
|00005a90| 2e 43 4f 4d 2e 0a 0d 0a | 0d 57 68 65 6e 20 61 20 |.COM....|.When a |
|00005aa0| 66 69 6c 65 20 69 6e 66 | 65 63 74 65 64 20 77 69 |file inf|ected wi|
|00005ab0| 74 68 20 74 68 65 20 36 | 34 36 20 76 69 72 75 73 |th the 6|46 virus|
|00005ac0| 20 69 73 20 65 78 65 63 | 75 74 65 64 2c 20 74 68 | is exec|uted, th|
|00005ad0| 65 20 76 69 72 75 73 20 | 77 69 6c 6c 0a 0d 69 6e |e virus |will..in|
|00005ae0| 66 65 63 74 20 6f 6e 65 | 20 6f 74 68 65 72 20 2e |fect one| other .|
|00005af0| 43 4f 4d 20 66 69 6c 65 | 20 69 6e 20 74 68 65 20 |COM file| in the |
|00005b00| 63 75 72 72 65 6e 74 20 | 64 69 72 65 63 74 6f 72 |current |director|
|00005b10| 79 2e 20 20 49 6e 66 65 | 63 74 65 64 20 66 69 6c |y. Infe|cted fil|
|00005b20| 65 73 0a 0d 77 69 6c 6c | 20 69 6e 63 72 65 61 73 |es..will| increas|
|00005b30| 65 20 69 6e 20 73 69 7a | 65 20 62 79 20 36 34 36 |e in siz|e by 646|
|00005b40| 20 62 79 74 65 73 2c 20 | 77 69 74 68 20 74 68 65 | bytes, |with the|
|00005b50| 20 76 69 72 75 73 20 62 | 65 69 6e 67 20 6c 6f 63 | virus b|eing loc|
|00005b60| 61 74 65 64 20 61 74 0a | 0d 74 68 65 20 65 6e 64 |ated at.|.the end|
|00005b70| 20 6f 66 20 74 68 65 20 | 69 6e 66 65 63 74 65 64 | of the |infected|
|00005b80| 20 66 69 6c 65 2e 0a 0d | 0a 0d 49 6e 66 65 63 74 | file...|..Infect|
|00005b90| 65 64 20 66 69 6c 65 73 | 20 63 61 6e 20 62 65 20 |ed files| can be |
|00005ba0| 65 61 73 69 6c 79 20 69 | 64 65 6e 74 69 66 69 65 |easily i|dentifie|
|00005bb0| 64 20 61 73 20 74 68 65 | 79 20 77 69 6c 6c 20 61 |d as the|y will a|
|00005bc0| 6c 77 61 79 73 20 65 6e | 64 20 77 69 74 68 0a 0d |lways en|d with..|
|00005bd0| 74 68 65 20 68 65 78 20 | 73 74 72 69 6e 67 3a 20 |the hex |string: |
|00005be0| 22 45 41 46 30 46 46 46 | 46 46 46 22 2e 0a 0d 0a |"EAF0FFF|FFF"....|
|00005bf0| 0d 54 68 69 73 20 76 69 | 72 75 73 20 61 70 70 65 |.This vi|rus appe|
|00005c00| 61 72 73 20 74 6f 20 64 | 6f 20 6e 6f 74 68 69 6e |ars to d|o nothin|
|00005c10| 67 20 65 78 63 65 70 74 | 20 72 65 70 6c 69 63 61 |g except| replica|
|00005c20| 74 65 2e 0a 0d 0a 0d 1a | 1a 00 00 00 00 00 00 00 |te......|........|
|00005c30| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005c40| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005c50| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005c60| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005c70| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005c80| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005c90| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005ca0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005cb0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005cc0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005cd0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005ce0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005cf0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005d00| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005d10| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005d20| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005d30| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005d40| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005d50| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005d60| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005d70| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005d80| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005d90| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005da0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005db0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005dc0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005dd0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005de0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005df0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00005e00| 54 68 65 20 36 36 41 20 | 76 69 72 75 73 20 77 61 |The 66A |virus wa|
|00005e10| 73 20 72 65 63 65 69 76 | 65 64 20 69 6e 20 41 70 |s receiv|ed in Ap|
|00005e20| 72 69 6c 2c 20 31 39 39 | 32 2e 20 20 49 74 73 20 |ril, 199|2. Its |
|00005e30| 6f 72 69 67 69 6e 20 6f | 72 20 70 6f 69 6e 74 20 |origin o|r point |
|00005e40| 6f 66 0a 0d 69 73 6f 6c | 61 74 69 6f 6e 20 61 72 |of..isol|ation ar|
|00005e50| 65 20 75 6e 6b 6e 6f 77 | 6e 2e 20 20 54 68 69 73 |e unknow|n. This|
|00005e60| 20 76 69 72 75 73 20 69 | 73 20 61 20 6d 65 6d 6f | virus i|s a memo|
|00005e70| 72 79 20 72 65 73 69 64 | 65 6e 74 20 69 6e 66 65 |ry resid|ent infe|
|00005e80| 63 74 6f 72 20 6f 66 0a | 0d 2e 43 4f 4d 20 66 69 |ctor of.|..COM fi|
|00005e90| 6c 65 73 2c 20 69 6e 63 | 6c 75 64 69 6e 67 20 43 |les, inc|luding C|
|00005ea0| 4f 4d 4d 41 4e 44 2e 43 | 4f 4d 2e 0a 0d 0a 0d 57 |OMMAND.C|OM.....W|
|00005eb0| 68 65 6e 20 61 20 70 72 | 6f 67 72 61 6d 20 69 6e |hen a pr|ogram in|
|00005ec0| 66 65 63 74 65 64 20 77 | 69 74 68 20 74 68 65 20 |fected w|ith the |
|00005ed0| 36 36 41 20 76 69 72 75 | 73 20 69 73 20 65 78 65 |66A viru|s is exe|
|00005ee0| 63 75 74 65 64 2c 20 74 | 68 69 73 20 76 69 72 75 |cuted, t|his viru|
|00005ef0| 73 0a 0d 77 69 6c 6c 20 | 73 65 61 72 63 68 20 74 |s..will |search t|
|00005f00| 68 65 20 63 75 72 72 65 | 6e 74 20 64 69 72 65 63 |he curre|nt direc|
|00005f10| 74 6f 72 79 20 74 6f 20 | 6c 6f 63 61 74 65 20 61 |tory to |locate a|
|00005f20| 6c 6c 20 70 72 65 76 69 | 6f 75 73 6c 79 0a 0d 75 |ll previ|ously..u|
|00005f30| 6e 69 6e 66 65 63 74 65 | 64 20 2e 43 4f 4d 20 66 |ninfecte|d .COM f|
|00005f40| 69 6c 65 73 2e 20 20 41 | 73 20 74 68 65 20 75 6e |iles. A|s the un|
|00005f50| 69 6e 66 65 63 74 65 64 | 20 2e 43 4f 4d 20 66 69 |infected| .COM fi|
|00005f60| 6c 65 73 20 61 72 65 20 | 66 6f 75 6e 64 2c 20 74 |les are |found, t|
|00005f70| 68 65 0a 0d 76 69 72 75 | 73 20 77 69 6c 6c 20 69 |he..viru|s will i|
|00005f80| 6e 66 65 63 74 20 74 68 | 65 6d 2e 0a 0d 0a 0d 50 |nfect th|em.....P|
|00005f90| 72 6f 67 72 61 6d 73 20 | 69 6e 66 65 63 74 65 64 |rograms |infected|
|00005fa0| 20 77 69 74 68 20 74 68 | 65 20 36 36 41 20 76 69 | with th|e 66A vi|
|00005fb0| 72 75 73 20 77 69 6c 6c | 20 68 61 76 65 20 61 20 |rus will| have a |
|00005fc0| 66 69 6c 65 20 6c 65 6e | 67 74 68 0a 0d 69 6e 63 |file len|gth..inc|
|00005fd0| 72 65 61 73 65 20 6f 66 | 20 35 31 32 20 62 79 74 |rease of| 512 byt|
|00005fe0| 65 73 20 77 69 74 68 20 | 74 68 65 20 76 69 72 75 |es with |the viru|
|00005ff0| 73 20 62 65 69 6e 67 20 | 6c 6f 63 61 74 65 64 20 |s being |located |
|00006000| 61 74 20 74 68 65 20 65 | 6e 64 20 6f 66 20 74 68 |at the e|nd of th|
|00006010| 65 0a 0d 69 6e 66 65 63 | 74 65 64 20 66 69 6c 65 |e..infec|ted file|
|00006020| 2e 20 20 54 68 65 20 70 | 72 6f 67 72 61 6d 27 73 |. The p|rogram's|
|00006030| 20 64 61 74 65 20 61 6e | 64 20 74 69 6d 65 20 69 | date an|d time i|
|00006040| 6e 20 74 68 65 20 44 4f | 53 20 64 69 73 6b 0a 0d |n the DO|S disk..|
|00006050| 64 69 72 65 63 74 6f 72 | 79 20 6c 69 73 74 69 6e |director|y listin|
|00006060| 67 20 77 69 6c 6c 20 68 | 61 76 65 20 62 65 65 6e |g will h|ave been|
|00006070| 20 75 70 64 61 74 65 64 | 20 74 6f 20 74 68 65 20 | updated| to the |
|00006080| 63 75 72 72 65 6e 74 20 | 73 79 73 74 65 6d 0a 0d |current |system..|
|00006090| 64 61 74 65 20 61 6e 64 | 20 74 69 6d 65 2e 0a 0d |date and| time...|
|000060a0| 0a 0d 54 68 65 20 66 6f | 6c 6c 6f 77 69 6e 67 20 |..The fo|llowing |
|000060b0| 74 65 78 74 20 73 74 72 | 69 6e 67 73 20 63 61 6e |text str|ings can|
|000060c0| 20 62 65 20 66 6f 75 6e | 64 20 77 69 74 68 69 6e | be foun|d within|
|000060d0| 20 61 6c 6c 20 36 36 41 | 20 69 6e 66 65 63 74 65 | all 66A| infecte|
|000060e0| 64 0a 0d 70 72 6f 67 72 | 61 6d 73 3a 0a 0d 0a 0d |d..progr|ams:....|
|000060f0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 22 | | "|
|00006100| 36 36 41 22 0a 0d 20 20 | 20 20 20 20 20 20 20 20 |66A".. | |
|00006110| 20 20 20 20 20 22 2a 2e | 43 4f 4d 22 0a 0d 20 20 | "*.|COM".. |
|00006120| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 22 3f 3f | | "??|
|00006130| 3f 3f 3f 3f 3f 3f 43 4f | 4d 22 0a 0d 0a 0d 54 68 |??????CO|M"....Th|
|00006140| 65 20 22 36 36 41 22 20 | 74 65 78 74 20 73 74 72 |e "66A" |text str|
|00006150| 69 6e 67 20 69 73 20 75 | 73 65 64 20 62 79 20 74 |ing is u|sed by t|
|00006160| 68 65 20 76 69 72 75 73 | 20 74 6f 20 64 65 74 65 |he virus| to dete|
|00006170| 72 6d 69 6e 65 20 69 66 | 20 74 68 65 0a 0d 66 69 |rmine if| the..fi|
|00006180| 6c 65 20 77 61 73 20 70 | 72 65 76 69 6f 75 73 6c |le was p|reviousl|
|00006190| 79 20 69 6e 66 65 63 74 | 65 64 2c 20 61 6e 64 20 |y infect|ed, and |
|000061a0| 69 73 20 6c 6f 63 61 74 | 65 64 20 61 74 20 74 68 |is locat|ed at th|
|000061b0| 65 20 65 6e 64 20 6f 66 | 20 74 68 65 0a 0d 66 69 |e end of| the..fi|
|000061c0| 6c 65 2e 0a 0d 0a 0d 50 | 72 6f 67 72 61 6d 73 20 |le.....P|rograms |
|000061d0| 69 6e 66 65 63 74 65 64 | 20 77 69 74 68 20 74 68 |infected| with th|
|000061e0| 65 20 36 36 41 20 76 69 | 72 75 73 20 6d 61 79 20 |e 66A vi|rus may |
|000061f0| 66 61 69 6c 20 74 6f 20 | 65 78 65 63 75 74 65 20 |fail to |execute |
|00006200| 70 72 6f 70 65 72 6c 79 | 2c 0a 0d 6f 72 20 75 6e |properly|,..or un|
|00006210| 75 73 75 61 6c 20 65 72 | 72 6f 72 20 6d 65 73 73 |usual er|ror mess|
|00006220| 61 67 65 73 20 6d 61 79 | 20 6f 63 63 75 72 2c 20 |ages may| occur, |
|00006230| 73 75 63 68 20 61 73 20 | 22 54 6f 6f 20 6d 61 6e |such as |"Too man|
|00006240| 79 20 66 69 6c 65 73 20 | 6f 70 65 6e 22 2e 0a 0d |y files |open"...|
|00006250| 0a 0d 1a 1a 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006260| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006270| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006280| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006290| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000062a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000062b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000062c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000062d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000062e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000062f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006300| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006310| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006320| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006330| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006340| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006350| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006360| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006370| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006380| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00006390| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000063a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000063b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000063c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000063d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000063e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000063f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
+--------+-------------------------+-------------------------+--------+--------+
Only 25.0 KB of data is shown above.
