home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
HPAVC
/
HPAVC CD-ROM.iso
/
VIRDCOLL.ZIP
/
SUBURBS.ZIP
/
SUBURBS.DOC
< prev
Wrap
Text File
|
1997-07-26
|
949b
|
19 lines
Virus name: Suburbs
Virus author: Virtual Daemon
Virus group: SLAM
Size of virus: 400 bytes
Type of virus: resident encrypted COM infector
General comments: - INT 21h handler (infect on 4bh=execute)
- use 80286 instructions
- use the free space at the end of the interrupt table
at 0:0200h
- restore file time/date/attributes
- the old JMP instruction is encrypted
- INT24h handler (errors will not be displayed)
Author's comments:
The virus is kind of lame. It was made only for researching purposes. It
doesn't have any kind of action, it only replicates himself. The major
difference between other resident virii is that Suburbs use the free space
from the end of interrupt table, therefore it can not be seen with programs
like MEM or TSRLIST, and it doesn't take 1 Kb from memory (413h) leaving
you with only 639K.