-------------------------------------------
From: Manuel del Rio Furio
To: Daniel Villalba
Subject: Re: Virus nuevo
Date: Thursday, December 10, 1998 1:07 PM
-------------------------------------------
Efectivamente se trata de un virus nuevo.
Del laboratorio me envian lo siguiente:
It seems to have the following features: multipartite, encrypted (both
file and MBR), memory resident (Int 8h, 21h), uses anti-debugging
tricks, has encrypted text inside, COM/EXE infector, uses extended memory...
Currently I am unable to replicate this virus because it crashes the
system immediately after execution and corrupts MBR. Please ask the customer to send more samples if he has any. Did he disinfect this file with some AV ? Did he run it on his system ?
Dadas las caracteristicas me piden mas archivos infectados y una copia
del sector de arranque. Puedes obtenerla eljecutando el bat anexo.
Por favor, envianos esto cuanto antes.
Saludos
Manuel del Rio furió
------------------------------------------------------
Código del archivo getmbr.bat
@echo off
REM MHH//DF 1995
echo This batch file reads the MBR of the first hard drive to a file.
pause
echo a300 > .\getboot.scr
echo mov ax, 201 >> .\getboot.scr
echo mov bx, 100 >> .\getboot.scr
echo mov cx, 1 >> .\getboot.scr
echo mov dx, 80 >> .\getboot.scr
echo int 13 >> .\getboot.scr
echo int 3 >> .\getboot.scr
echo. >> .\getboot.scr
echo g=300 >> .\getboot.scr
echo rbx >> .\getboot.scr
echo 0 >> .\getboot.scr
echo rcx >> .\getboot.scr
echo 200 >> .\getboot.scr
echo nmbr.boo >> .\getboot.scr
echo w >> .\getboot.scr
echo q >> .\getboot.scr
debug.exe < getboot.scr > nul
del getboot.scr > nul
echo Boot sector is now in file MBR.BOO
|
