Article View: comp.virus
Article #4732Clearing out old signatures (PC)
From: A. Padgett Peterson
Date: Tue, 22 Dec 1992 19:37
Date: Tue, 22 Dec 1992 19:37
68 lines
2976 bytes
2976 bytes
Enclosed is a DEBUG script that will create a 68 byte .COM file
(CLEAR.COM) that will zero out memory between the current load
position and the TOM. To use, extract the portion of this message
between the (cut here) lines and name it CLEAR.DEB (the portion
beginning with "a100" and ending with the blank line after the
"q" - NOTE: that last blank line must be there as must the blank
line following "JMP 102".
Next run "DEBUG <CLEAR.DEB" When run there should be no errors.
This will create the program CLEAR.COM.
NOTE: It will not clear the disk buffers or any high/upper RAM
nor will it remove any viruses that are properly resident
in allocated space, it just clears free memory.
Weasel-words: this is FreeWare but carries no guarantee of fitness
of any kind. Caveat etc.
- ----beginning of CLEAR.DEB------------8<------cut here-------------
a100
JMP 010D ;skip around loop
MOV ES,AX
XOR AX,AX
MOV DI,AX
REPZ ;clear out memory
STOSW
MOV AX,ES ;replaced by CD 20 for last loop
RET ;move stack to protected area
MOV AX,0100
MOV SP,AX
MOV DX,CS
MOV SS,DX ;make sure program does not get
ADD DX,+20 ;overwritten until end
INT 12 ;Find the TOM
MOV CL,06
ROL AX,CL
SUB AX,1000 ;Can only clear 64k at a time
CMP AX,DX ;Make sure we are not back down
JBE 012E ;to where program is.
MOV CX,8000
CALL 0102 ;if not, clear 64k
JMP 011F ;then try again
MOV WORD PTR [010A],20CD ;last loop - put termination in
SUB DX,+0F ;can overwrite most of program
MOV AX,DX
MOV CL,03 ;DX contains amount of this segment
SHL DX,CL ;that is in use plus loop.
MOV CX,8000
SUB CX,DX ;Subtract from 64k gives amount to
JMP 0102 ;clear. No return so JMP not CALL
rcx
44
nclear.com
w
q
- ----------end of CLEAR.DEB---------8<--------cut here--------
*
|
abc
defgh And a Merry Christmas to All,
ijklmno
pqrstuvwx Padgett
yzabcdefghi
jklmnopqrstuv
wxyz
__||__
Technical Details
Message-ID:
<0017.9301051402.AA11929@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!rutgers!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!rutgers!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson) Newsgroups: comp.virus Subject: Clearing out old signatures (PC) Message-ID: <0017.9301051402.AA11929@barnabas.cert.org> Date: 22 Dec 92 19:37:55 GMT Sender: virus-l@lehigh.edu Lines: 68 Approved: news@netnews.cc.lehigh.edu