
Ŀ
                                                                    
                        
                                    
                           
                                          
Ĵ
                                  5                           
ٰ



                           6.357.008
                      襭, 12  2002 .

         
            .
                         (࠭ ࠣ)

**********  ॢ: Constantin E. Climentieff aka DrMAD **************

ࠡ稪: 襭;  . (ਤ, ୨)
: Symantec Corp. (㯥⨭, ୨)
. : 935577
।⠢: 23 ᥭ 1997 .


                                [. . .]


 ।  ᬮ७:

    1. ⮤ ⥪஢   ஢  䠩,  騩  ᥡ
᫥騥 蠣:
    - ।      ॣ  ஢ 䠩,   ஬
, ⭮, ;
    -      ࠩ      ॣ    楫
  ᫥    ࠩ     ॣ  ᭮ 
६ ᫥⥫᪮ 䠧;
    - 樮஢  㫨㥬 樨  ᥪ樨 ;
    - ।,  ⢨⥫쭮       ६   䠧   ᫥
㫨㥬  㦥 㫨஢;
    - ᫨    ,   ।祭      㫨஢,   㦥
㫨஢  ६ ᫥⥫᪮ 䠧,   㫨஢
᫥ 㫨஢ .

    2. ⮤ ⮤ 1,   ஬  ᫥㥬  ॣ  
 ஢ 䠩.

    3. ⮤  ⮤  1,    ஬ ᫥㥬 ॣ 
砫 ஢ 䠩.

    4. ⮤ ⮤ 1,   ஬  蠣  樨      
ࠩ     ॣ  楫  ᫥  
 ॣ  ६ 䠧 ᫥ ।   ᫥騥
蠣:
    - ।,     ⢨⥫쭮        㫨㥬    
ᯮ  ࠭ ॣ;
    - ᫨ 㫨㥬   ࠭  ॣ,      
㫨.

    5. ⮤ ⮤ 4,  ।  ᫥騥 蠣:
    - ।, ⠫  - ᬮ७ ;
    -   ᫨  ⠪    ⠫,    樮஢  
᫥饩 ᬮ७ ⢨, ⠭ ⥪饣 ﭨ 
CPU  ࠭ ﭨ,  ᮮ⢥饥 ᫥饩 ᬮ७
⢨.

    6. ⮤ ⮤ 5,  ।  ᫥騥 蠣:
    - ᫨    ⠫  ᬮ७  ⢥,    ।   -
⠫     㫨஢ ᥪ   ॣ;
    -   ᫨  ⠪  ᥪ  ⠫,   ६饭 㪠⥫  
砫 ,   , ।祭  樨 
  CPU  室 ﭨ.

    7. ⮤ ⮤ 4,  ஬  権 砥:
    - ।,    ⥫쭮 樥;
    - 䨪஢  ⥫쭮  樨,  ᫨ ।祭 
樨  믮 ⥫ .

    8. ⮤ ⮤ 4,  ஬  権 砥:
    - ।,   㫨㥬  뢠;
    - ᫨  뢠,   ஢ १    ࠡ,  
ॠ쭮 뢠  믮.

    9. ⮤ ⮤ 4,  ஬  権 砥:
    - ।,   㫨㥬    
  ࠩ     ॣ;
    -  ᫨  ⠪ ,   ७ࠢ    㣮
ᥣ S.

    10. ⮤ ⮤ 9,  ஬  権 砥:
    - ।, ⢨⥫쭮  㫨㥬  ।
⥭   , ७ࠢ  ᥣ S;
    -  ᫨  ⠪,  ७ࠢ ⥭  ᥣ S.

    11. ⮤ ⮤  4,    ஬    権  砥
᫥騥 蠣:
    - ।,  ⢨⥫쭮   㫨㥬    砥
砫  ⢨ ⬠;
    -  ᫨  ⠪,      ᬮ७  ࠭  
室        ﭨ   CPU,  ᮮ⢥饥 ⮩
窥.

    12. ⮤  ⥪஢   ୮         ணࠬ,
騩:
    -   ⠯ 樨 権 ᬠਢ ணࠬ, ⮡
  ஢ 㠫쭮 ⥫;
    - ।    ண ᬠਢ ணࠬ,
 ஬  ஢ 㠫쭮 ⥫;
    - ன  ⠯  樨  権        ॣ
ᬠਢ ணࠬ,  ஬  㠫쭮 ⥫;
    - 業  ⥫  権    ६ ࢮ  ண
⠯ 樨  楫 ⥪஢  .

    13. ⮤  ⮤  12,      ⠯  樨 稭 
ࢮ 樨  窥 室 砥 ணࠬ.

    14. ⮤ ⮤  12,    ன    樨  稭  
樨,   ।⢥   ᫥饩     ᫥  樥,
㫨஢  ࢮ ⠯.

    15. ⮤  ⮤  15,      ६  ࢮ  ⠯  樨
      ஢뢠 ᭮ ⥫,  ᪫  
஢;      ⮬  砥  ன  ⠯  樨  稭  
樨, 饩  窥 室 ᫥㥬 ணࠬ.

    16. ⮤ ⮤ 12,  ।, ⢨⥫쭮  ᭮
⥫ ஢,  ।⢮ । 뢭 ᥪ樨 ⮢ 
,  뫨 १ᠭ  ६ ࢮ ⠯ 樨.

    17.    ୮   ⥬  ⮤  ⥪஢  
ᮢ 砥 ᫥騥 蠣:
    -  権 ᫥㥬 ணࠬ;
    - 業 ᬠਢ  権    ६  樨  
㦥  ᮢ;
    - ⠭ 業 ᫨ ⨫    
 ⥫ 権.

    18. ⮤  ⮤ 17,     砥  
ࠦ ᨬ.

    19. ⮤ ⮤ 17,     砥  
襭 ணࠬ  । ணࠬ ॣ.

    20. ⮤    ⮤   17,            砥
ॢਧ  訡.

    21. ⮤  ⮤  17,        砥  맮
㭪樨, 㤠  ⥪饩 窨.

    22. ⮤ ⮤ 17,  祭 ⥫쭮 樥 
ࠢ ᮤন ॣ  祩   ᨣன 䠩
.

    23. ⮤ ⮤ 17,  祭 ⥫쭮 樥 
    䠩  ।  ⢠   ⮢,   ᮮ⢥饣
  ⮢  窨 室   䠩 ᫥㥬 ணࠬ.

    24. ⮤ ⮤ 17,  祭 ⥫쭮 樥 
室 (SEEK)   䠩,  ᫥騩      樨
JMP.

    25. ⮤  ⮤  24,      SEEK  ।   
,   JMP 믮  ࠢ  襥 ﭨ.

    26. ⮤ ⮤ 17,  祭 ⥫쭮 樥 
  ⢠ ⮢,  ࠢ ࠧ ,   뢠몥
 ᮤঠ ਧ .

    27. ⮤ ⮤ 17,  祭 ⥫쭮 樥 
宦  ᯮ塞 䠩  ⥫ ᫥㥬 ணࠬ.

    28. ⮤ ⮤ 17,  祭 ⥫쭮 樥 
 ᯮ塞 䠩  ⠫.

    29. ⮤ ⮤ 17,  祭 ⥫쭮 樥 
᫥  䨪 奬 । .

    30. ⮤ ⮤ 17,  祭 ⥫쭮 樥 
       権   뫪   ப,      ६
ਡ⥫쭮  ⠪    ⢮ ⮢,   ⢮ ⮢ 
窨 室   䠩 ᫥㥬 ண.

    31. ⮤ ⥪஢   ᫥㥬 ணࠬ, 騩
蠣 ⥪஢ ⢨ 樨 室 (seek)   䠩,
᫥饩      樨  JMP,    SEEK । ࠧ 
,  JMP ந  ࠢ  襥 ﭨ.

                               ᠭ.

                             1. ਫ

                         A. 孨᪠ 

     ⥭ ⭮  ⨢᭮ ணࠬ ᯥ祭.
  ⭮,   ⥭ ⭮  ணࠬ ᯥ祭
 ⥪஢    ᮢ    ᯮ짮
樨  ⢥ ⥫.

                      B.  ଠ

    孮 㦥  ᮢ   ࠧ
 ⠪ ⥣ਨ  ,  ਬ,  ᪠஢  ᨣ,  ஢ઠ
楫⭮,      ᭮   ஢થ 楫⭮ ⥪஢
 ᮢ (⠪  뢠  ⨪).    ࠧ  
㦤  ⥣ਨ ⨢᭮ 孮.

    ஢ ᨣ      ⨢   ணࠬ  ᭮  
᪠஢ 䠩  ᪠ ᨣ    ᮢ.  
।⠢   ᮡ  ᫥⥫쭮  ⮢,      
㦥    ᭮  ணࠬ  ,       祣.   ⮡
"" ᨣ,  ᮫   ।⥫쭮 ஠஢
.   ⮫쪮  ᨣ 㤥 ।,   뢠  
        ᨣ,  묨    ⨢᭠
ணࠬ.  ⨢᭠ ணࠬ ᪠  ⥫  ணࠬ
(ᯮ塞  䠩,  㧮       㬥),
⮡  㦨  ⢨  ᭮  ᨣ.   ᫨   ᨣ
㦥,  ⮣ ணࠬ ⠫ ࠦ.  ⨢ 砥
ணࠬ ⠥ ஢.

    ஢ ᨣ   ⨢ᮬ       ஢
    ⨯          ஢ ⥫
" ࠡ뢠",  ᫨ ࠢ쭮 ⢫.      ,
⮫쪮  ,      㦥 ।  㦥   
ᨣ,    㦥,  ᯮ  ᪠஢  ᨣ.
஬ ⮣,    ᨣ   ४஢, ⮡
㦨 ᠬ ᫥ .

    ஢ઠ 楫⭮    (    ନ    Norton    Anti-Virus    -
"inoculation"),   -   孨,      ன  ।⥫쭮  ᭨
"⯥⪨ 楢" ணࠬ (믮塞 䠩,  㧮 ᥩ)
  ।,        䠩  室    ஢
ﭨ.   ⯥⪨ 楢  筮  ᭨  ᫥  ⮣,  
   㤥   ᪠஢    ᪠஬,    ࠭
ࠦ .   ⯥⪨ 楢 ⥬ ࠭ 
   ᫥饩 ஢ન 楫⭮.

     祭  ᫥饩  ஢ન 楫⭮ ⨢᭠ ணࠬ
஢,   ணࠬ  ⯥⪨ 楢.  ᫨ ணࠬ
  ᮮ⢥  ᢮  ⯥ ,   ⨢᭠ ணࠬ
筮 ᯮ  ⢥  ⥫,  ⮡  ।  -  
䨪  宦        ணࠬ.  ᫨
䨪  - 䥪樨 ᮬ,  ⨢᭠  ணࠬ
筮   ।०   짮⥫    䨪樨    ।⠢
짮⥫  ࠢ ०, ᫨  .

    ᪮ ஢ઠ 楫⭮  ᪠  ᨣ, 
  ᯮ짮,  ⮡ 㦨   () 
 ⨯.  ஢ઠ 楫⭮ 㠫쭠, ᪮  筮
 ࠦ ணࠬ,      㦥,
᫨   ⯥⪮ 楢  ணࠬ ࠢ쭮 ᮧ 
ন.    ,  ஢ઠ 楫⭮  ࠡ⠥,  ᫨
      ᢮    ᮢ    ६      
   ⯥⪮   楢.   ࠦ   ᭠  ணࠬ,
⯥⪨ 楢 ன ࠭           㣨
묨 ணࠬ,  㤥 ᭮ ,   ன  
ࠧ 㣨 ணࠬ.  ஬ ⮣,    㦨
஢મ  楫⭮,    祭 㤭  ⨢᭮ ணࠬ
।  -    뫮  ஦  ᮬ     짮⥫
(ਬ,  짮⥫  ᪮४஢ ணࠬ,  ⠭
    ᪮४஢ 䠩).  ᫨  ।
    ᤥ ⨢᭮ ணࠬ,   짮⥫ 
 맢, ⮡ ਭ 襭,   짮⥫ 筮
, ⮡ ᤥ .

    ⥪஢,    ᭮     ஢થ  楫⭮  (⠪
뢠 "᪨"),  ᯮ,  ⮡ 㦨  
      -  ஢ન  楫⭮ ଠ樨.
᪠ ⨢᭠ ணࠬ 砥  ⥫  ணࠬ
(ᯮ塞   䠩,   㧮筠   ,  㬥    ᮬ)  
  ணࠬ  ,  ⮡  ।  -      
  .  ᫨ ⥫ ணࠬ  宦 ,  
짮⥫ ᮮ頥   䥪樨.

    ᪮ ᭮  㦥     㦨      
  ,        ஠஢  ⨢묨
᫥⥫ﬨ,  ᪮      ᯮ     ᨣ.
᪮ ᪠ 孨  ᯮ ଠ  楫⭮,
  ॡ ⯥⪮  楢  ணࠬ,    㦭    
࠭,   室  ⮬ ﭨ.

    ᪮ ᭮  㦥   ஢ 
᪮   ᪮.  ᭮  ࠧ稥    ⨬  
奬  㦥  ⮬,   ᪨ ⮤ ᯮ 
CPU,  ᪨ ⮤ .

                          I. ᪠ ⨪

     ᪮ ⥪஢ ᮢ ⨢᭠  ணࠬ 
   ⥫쭮  ணࠬ  ᫥⥫쭮  権,  
⨯     ᮢ.      ⫨稥         ᨣ,   
᫥⥫쭮     ᮮ⢥  -  ⭮  .
 ⮣,    騩 ࠪ, ᯥ  
ࠧ ᮢ.

    ਬ, ᫥      ᫥⥫쭮      c権     x86
(ய Intel)   ᯮ짮   䠩:

ᥬ                  設 
MOV DX, ????               BA ?? ??
MOV AX, 3D02               B8 02 3D
INT 21                     CD 21

     "??"  ,          ࠧ  ࠧ
.  ⢥⢥,  ᫥ ᫥⥫쭮  㨩  
 x86   ᯮ짮    䠩:

ᥬ                  設 
MOV DX, ????               BA ?? ??
MOV CX, ????               B9 ?? ??
MOV AX, 4000               B8 00 40
INT 21                     CD 21

     "??" ᭮ ᮮ⢥ ६ ⠬.

    ⨢᭠ ணࠬ          ᪮    ⨪    
᫥⥫쭮 ⮢ ⨯ ,   , ⥬ 
祭        ᭮    䥪樨,    ᭮       
᫥⥫쭮.    ਬ,    ᫨    ⨢᭠    ணࠬ,
ᯮ  ⨪,  㦨   䠩,
᫥  ﬨ ⥭  ,   ⠪    ᨬ  ப
"VIRUS"      ணࠬ,         ࠯⠢,    䠩
஢  ᮬ.

     (ᠬ騥)                 
஢   ⥫.  ᫥⥫쭮 権,  
।  ᮯ  ,        㦥   
஢   䠩.   ⮬     ⨢  ணࠬ,
믮騥 ᪮ ⥪஢,  ।⥫쭮  ஢뢠
ணࠬ   CPU.

    ᬮ   ,    ᪨  ⨪     쭮
묨,    ᯮ ⮫쪮 讥 ⢮ ࠧ
ਠ⮢   ᮯ  権.  ਬ,  ᮯ⥫  
⠢ ⠬ 樨  ᫥⥫쭮 뢠 䠩:

ᥬ                  設 
MOV AX, 3D02               B8 02 3D
MOV DX, ????               BA ?? ??
INT 21                     CD 21

          த  ਬ,  ᮯ⥫    
ࠤ쭮  樨 , ⨯:

ᥬ                  設 
MOV AX, 3E00               B8 00 3E
SUB AX, 0100               2D 00 01
MOV DX, 1234               BA 34 12
ADD AL, 02                 04 02
INT 21                     CD 21

     ࠧ,   ᪠  ⨪    ᮤঠ    ᥡ
讥 ⢮ ਠ⮢  ᮯ  権,  ⮡  ॠ쭮
㦨  ᮯ  .  ᯮ짮    
࠭  쭮  ⢠    権    
  ॠ㥬.    ஡  ⠭  㠫쭥,  ᫨
ᮯ⥫ ᯮ  "  ᮢ",    ६
  ᮢ,    ६蠭 ⤥ 樨 
ᥪ樨 ,      䥪⨢  .    ⢮
ᮢ   ਢ  訬 ᫮  ⪥ ᯮ짮
  ᪠  ⨪.

                      II. ᪠ ⨪

     ᪮   ⨪   ⨢᭠   ணࠬ   㫨
⥫   ணࠬ      㠫쭮   ।       
㫨㥬묨 ﬨ  ।   ⢨. ᮯ
⢨  ।  ࠭  ᥭ  ⠫.   ⠫
   ⢨,   ᪨    ⨪        ।,
⢨⥫쭮    ᫥㥬  ணࠬ  룫廊  宦    .
⢥,  ᫨      ஢  ᭮  ⥫,  
᪨ ⮤ 樨    ஢ ।
⥬,      ᮯ묨  ⢨ﬨ  (⨥  䠩,
 䠩,  ...).

    ᪠ ⨪    㦨  ⢮  ࠧࠧ
⠭ -  ⢨  ࠧ  ,  祬  ᪨
᪨ ⮤.  ਬ,  ᬮਬ ᪮ ⥪஢
䠩 権.  直 ࠧ,    뢠  뢠    室
樨,  ᪠  ⨪ ஢ 祭  ॣ.  
祭 ।  ⢨,  ஥ ᫥㥬  ணࠬ  
ॡ   믮    樮  ⥬.    ᪠  
⭮⥫쭮   ᪮   ⨪,   ,   ࠦ騩   楫
ணࠬ,        ।  祭   ॣ
 ᯮᮡ.    ,    뢠    맢,
ॣ      ᮤঠ    ।  祭,  
ࠪਧ  ⢨.  ᪠ ⨪   ⮫쪮
᫥ 祭 ॣ஢   맮 뢠.

    ᬮ   ,    ᪠  ᪠ 孨 - 襥
⨦   ᯮ ᮯ  ⢨, 
 ࠩ   ஡.  㦤 .

    -, த      ॡ ०,  祬
ᮯ ⢨ ந.  ਬ,      믮
宫⮩  横  50000  ࠧ  ।  饭    䠩.   ⮬ 砥
஬  ᫮  権      㫨஢  ०,  祬
筥 ᮡ⢥ ࠡ  䠩.    ⢥ 
⨢ ணࠬ.

    -,   ⨢ ⮫쪮   뮫
।   ந  ᫮.  ਬ,  ᬮਬ  ᫥騩
ᥢ :

    1.   䠩  ⥪饬 ⠫,     ७
".com" (*.com).
    2. ᫨ 䠩  㦥, ३   4.
    3.  ࠢ   ணࠬ.
    4. ᫨ 䠩  祬 1000 ⮢ , ३   3.
    5. ᫨ 䠩   稢  "EL", ३   3.
    6.  䠩.
    7.   3 .
    8. ३   䠩.
    9.     䠩. 10.  ...

    ᫨ ᪠  ⨪   㫨஢  ணࠬ,
ࠦ ⠪ ᮬ,   㥬 筥     1,    ஬
㪠뢠,    室  室    *.com  䠩   ⥪饬
⠫.   ⨢᭠ ணࠬ  묨஢ 맮 DOS  
 ,  䨪⨢ *.com ணࠬ 뫠 㦥.

    ᫥⢨,     4,    㪠,  ⮡  ⨫
ࠢ    ணࠬ,  ᫨ 䨪⨢ *.com ணࠬ
  䠩  ࠧ   1000 ⮢.   ⨢᭠ ணࠬ
ᮡࠥ ஢ ⠪ ந쭮 ᫮?

     ⨢᭠ ணࠬ 㤥 ⫨   䨪⨢ *.com
ணࠬ      䠩   ࠧ    ࠩ    1000  ⮢.
᫥⢨,    5,   㪠뢠,  ⮡    頫
ࠢ           ணࠬ,  ᫨  䠩    
稢  "EL". , ᫨  ਩  祭 (ਬ,
䠩  - "FOO.COM"  稢  "OO"),    
  । ࠢ   ணࠬ.

     ࠧ,        祭  "ࠧ稢"     ᢮
 ஢,  ᫨  ਩ ( ਬ,  - 5-
᫮ )  祭,        믮  ᢮  饥
.   ⥫쭮,   ᪠  ᪠  ⨢᭠
ணࠬ  ஭ 饥     㦨 .

    -,   ⮫쪮    "אַ  ⢨"  (  ਬ,
ਬ,  㦤 ) ࠦ 㣨 ணࠬ ࠧ  ᪥
ࠦ ணࠬ,   १   ⠭ ᥡ
   १  ࠡ稪  뢠    ᫥,    室饥
뢠  㤥  맢.  ᫥  ⠭  ᥡ    १
ࠡ稪   뢠,  १    頥  ࠢ  
 ணࠬ.

    ᪠ ᪠ ⨢᭠ ணࠬ 稭 
  窥  室  ᫥㥬  ணࠬ.      ,  䥪樮
  ( ,  ࠦ 㣨 ணࠬ)  
 ⨣ ।⢥.  ⮣, 騩  
믮 ⮫쪮  믮 뢠,  墠祭 ᮬ,
  ⠪  饭    樮  ⥬    ᤥ 
㣮 ணࠬ,   ᫥㥬.

    ,  ᫨ ᪠  ᪠  ⨢᭠  ணࠬ
㫨   ࠦ   ணࠬ  ᪮  㣮  ,  䥪樮
     ⨣,   ⠪ ࠧ,  ⥫
 ⢨   㦥묨.

                       II.   

     ᠭ  ஡,    뫨  ८    ।
ࠧࠡ⪥.    ࠧࠡ⪠  ⭮    ⮤  ᪮
⨪    ।祭    ⥪஢  ᮢ 
  䠧 믮:  䠧 ஢,  䠧  ᫥  
䠧   業.     䠧  ஢  -  㫨஢  ॡ㥬
⢮ 権,  室   ஢ ᮡ⢥
⥫.    䠧  ᫥  -  㫨஢    
⨦ ᥪ樨   ॣ  ணࠬ,      ᮤঠ
.    䠧  業  - ஠஢  ⥫쭮
⢨    ६  ஢      ᫥      ।
஢ ணࠬ.


                   III.   

                                [. . .]

------------------------------------------------------------------------
ॢ: Constantin E. Climentieff aka DrMAD


