tailieunhanh - The Little Black Book of Computer Viruses phần 5

không phải là khả năng của mình để phá hủy dữ liệu, nhưng khả năng của mình để giành quyền kiểm soát của máy tính và tạo một bản sao đầy đủ chức năng của chính nó. nó DOS để ở ngoài. May mắn thay, có thể được thực hiện bằng cách thay đổi bảng FAT cho DOS rằng những lĩnh vực trên đĩa là xấu. | 66 The Little Black Book of Computer Viruses Passing Control to the Host The final step the virus must take is to pass control to the host program without dropping the ball. To do that all the registers should be set up the same as they would be if the host program were being executed without the virus. We already discussed setting up cs ip and ss sp. Except for these only the ax register is set to a specific value by DOS to indicate the validity of the drive ID in the FCB s in the PSP. If an invalid identifier . D when a system has no D drive is in the first FCB at 005C al is set to FF Hex and if the identifier is valid al 0. Likewise ah is set to FF if the identifier in the FCB at 006C is invalid. As such ax can simply be saved when the virus starts and restored before it transfers control to the host. The rest of the registers are not initialized by DOS so we need not be concerned with them. Of course the DTA must also be moved when the virus is first fired up and then restored when control is passed to the host. Since the host may need to access parameters which are stored there moving the DTA temporarily is essential since it avoids overwriting those parameters during the search operation. WARNING Unlike the TIMID virus INTRUDER contains no notice that it is infecting a file. It contains nothing but routines that will help it reproduce. Although it is not intentionally destructive it is extremely infective and easy to overlook. . . and difficult to get rid of once it gets started. Therefore DO NOT RUN THIS VIRUS except in a very carefully controlled environment. The listing in Appendix B contains the code for the virus. A locator program FINDINT is also supplied so if you do run the virus you ll be able to see which files have been infected by it. Case Number Three A Simple Boot Sector Virus The boot sector virus can be the simplest or the most sophisticated of all computer viruses. On the one hand the boot sector is always located in a very specific place