Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!wuarchive!usc!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: deepak@shakti.ernet.in
Newsgroups: comp.virus
Subject: EB21 or PrintScreen virus (PC)
Message-ID: <0004.9012041821.AA14135@ubu.cert.sei.cmu.edu>
Date: 3 Dec 90 05:06:23 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 22
Approved: krvw@sei.cmu.edu

Recently we encountered a virus, SCAN detects whom as PrintScreen
Virus.  This virus is a boot sector based virus and writes in the hard
disk if the machine is booted with an infected floppy. If one reads
the code, its first instruction is EB21, this code uses interrupt 5
and 6D, to my wonder, how does it write in the harddisk? because no
encounters of interrupt 13 are seen.  Does any one know about it?  The
detector which we had installed (on the basis of int 13 had been
bypassed!)  Can the hard-disk be written without use of BIOS int 13?
(We have XT & ATs)

Has any one experienced similar phenomena?
thanks.

- -------------------------------------------------------------------------
       /\           Quality is the continuing stimulus which causes us to
      /  )          create the world in which we live.
      ( /           All of it.
       V            Every last bit.
     _/\_
    |    |o
    |    |0.
    |    |                                      deepak@shakti.ernet.in


Brought to you by Super Global Mega Corp .com