Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!samsung!rex!ukma!cs.widener.edu!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: jaenichen@rz.informatik.uni-hamburg.dbp.de (Matthias Jaenichen) Newsgroups: comp.virus Subject: Virus-Construction-Set (VCS 1.0) (PC) Message-ID: <0007.9103201343.AA20555@ubu.cert.sei.cmu.edu> Date: 18 Mar 91 08:49:00 GMT Sender: Virus Discussion List Lines: 21 Approved: krvw@sei.cmu.edu On the Hannover-fair "CeBit" a Virus-Construction-Set for MS-DOS was found in a BBS. The BBS is a German system called "ZERBERUS". The program was uploaded in Hamburg. The Box-Sysops are informed and will (hopefully) delete the entries. It is possible to build a virus that will display a massage at a selectable generation-count. At the same time the files "CONFIG.SYS" and "AUTOEXEC.BAT" will be deleted. The virus will be given the name "VCS-1.0". The virus extends programs by 1077 Bytes. The following string can be found at offset 50h:"A5 A5 A4 68 00 C1 C3 8A" At the end of the virus "C:\AUTOEXEC.BAT" and "C:\CONFIG.SYS" Codeanalysis will begin soon after the fair. - ---------------------------------------------------------------------------- Best wishes form Hamburg \\ // /==#==\ /==\ Matthias Jaenichen \\ // # / VTC-Hamburg \\// # # e-mail: jaenichen@rz.informatik.uni-hamburg.dbp.de \/ _#_ \==/ - ----------------------------------------------------------------------------