🚀 go-pugleaf

hello virus-proofed community |

Last week i found the ( or a ) oh-so-old-but-never-found Yankee Doodle
Virus at a friend , savely jailed on a floppy disk.

I worked through the code quite heavy ,found nothing unbelieveable
clever but : after copying the virus-code to the top of memory ( i
worked hard to figure out the meaning of TOM in recent issues) , it
gets the size of the absolute system memory for DOS from a word in the
BIOS-segment ( 280h) multiplies this by various things to get the end
of memory ( A000:0000 )

AND THEN ::: checksums 61 words starting from A000:014E ( or 012E ,
i'm not sure without the source next to me ) , simply adding all these
61 words together , and if the result is something like 0b52 , it
writes a jump instruct ion into high memory , pointing to a small
procedure which changes Int 13h (disk interupt).

On my system ( a 286 Neat with 2 MB Ram running at 20 MHz 1 WS ) there
is nothing accessible after a000:0000 , everything just HIGH-VALUE
(FFh), not possible to change a byte .

I tried using Shadow RAM enabled at A000  , but that also failed .

SO THE ONE AND ONLY QUESTION :

Are there systems where this part of memory is accessible or would the
virus just overwrite a resident other virus when the value in the
BIOS-segment is below 280h due to a previous (already running)
infection ?

                                 Please many answers and soon , i'm puzzled

                                 Sincerly yours , Martin

+-----------------------------------------------------------------------+
| Martin Zejma                                8326442 @ AWIWUW11.BITNET |
|                                                                       |
| Wirtschaftsuniversitaet Wien  ---   Univ. of Economics Vienna/Austria |
+-----------------------------------------------------------------------+