Path: utzoo!utgpu!news-server.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: woody@chinacat.Unicom.COM (Woody Baker @ Eagle Signal) Newsgroups: comp.virus Subject: Re: Infected? (PC) Message-ID: <0009.9008301334.AA25774@ubu.cert.sei.cmu.edu> Date: 26 Aug 90 05:08:18 GMT Sender: Virus Discussion List Lines: 17 Approved: krvw@sei.cmu.edu Watkins@np1a.bristol.ac.uk (Steff) writes: > With response to James Li (Uk.AC.OXFORD) .... > > It looks like you have had a case of INT 26 (I Believe) calls. This causes an > absolute disk-write of some area of preogram memory onto the disk. > A> Some of your source code contains an INT 26H call that it shouldn't. MSDOS 4.x has monkeyed around rather severly with the int 25 and int 226 call If the CX register is ffff (an illegal value under dos 3.x) it presumes that the registers are used diffrently in order to support the new 32 bit fat table. This may cause severe system crashes and file corruptions. Cheers Woody