🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #4732

Clearing out old signatures (PC)

#4732
From: A. Padgett Peterson
Date: Tue, 22 Dec 1992 19:37
68 lines
2976 bytes
Enclosed is a DEBUG script that will create a 68 byte .COM file
(CLEAR.COM) that will zero out memory between the current load
position and the TOM. To use, extract the portion of this message
between the (cut here) lines and name it CLEAR.DEB (the portion
beginning with "a100" and ending with the blank line after the
"q" - NOTE: that last blank line must be there as must the blank
line following "JMP 102". 

Next run "DEBUG <CLEAR.DEB" When run there should be no errors.
This will create the program CLEAR.COM.

NOTE: It will not clear the disk buffers or any high/upper RAM
      nor will it remove any viruses that are properly resident
      in allocated space, it just clears free memory.

Weasel-words: this is FreeWare but carries no guarantee of fitness
              of any kind. Caveat etc. 

- ----beginning of CLEAR.DEB------------8<------cut here-------------
a100
JMP	010D                 ;skip around loop
MOV	ES,AX                
XOR	AX,AX                
MOV	DI,AX                
REPZ	                     ;clear out memory
STOSW	                     
MOV	AX,ES                ;replaced by CD 20 for last loop
RET	                     ;move stack to protected area
MOV	AX,0100              
MOV	SP,AX                
MOV	DX,CS                
MOV	SS,DX                ;make sure program does not get
ADD	DX,+20               ;overwritten until end
INT	12                   ;Find the TOM
MOV	CL,06                
ROL	AX,CL                
SUB	AX,1000              ;Can only clear 64k at a time
CMP	AX,DX                ;Make sure we are not back down
JBE	012E                 ;to where program is.
MOV	CX,8000              
CALL	0102                 ;if not, clear 64k
JMP	011F                 ;then try again
MOV	WORD PTR [010A],20CD ;last loop - put termination in 
SUB	DX,+0F               ;can overwrite most of program
MOV	AX,DX                
MOV	CL,03                ;DX contains amount of this segment
SHL	DX,CL                ;that is in use plus loop.
MOV	CX,8000              
SUB	CX,DX                ;Subtract from 64k gives amount to
JMP	0102                 ;clear. No return so JMP not CALL

rcx                                         
44
nclear.com
w
q

- ----------end of CLEAR.DEB---------8<--------cut here--------
             *
             |
            abc
           defgh               And a Merry Christmas to All,
          ijklmno
         pqrstuvwx                               Padgett
        yzabcdefghi
       jklmnopqrstuv
           wxyz
          __||__
Technical Details
Message-ID: <0017.9301051402.AA11929@barnabas.cert.org>
Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!rutgers!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!rutgers!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Clearing out old signatures (PC)
Message-ID: <0017.9301051402.AA11929@barnabas.cert.org>
Date: 22 Dec 92 19:37:55 GMT
Sender: virus-l@lehigh.edu
Lines: 68
Approved: news@netnews.cc.lehigh.edu