Reply to thread

Message

<blockquote data-quote="sepik" data-source="post: 912601" data-attributes="member: 74435">[URL unfurl=&quot;true&quot;]https://webcache.googleusercontent.com/search?q=cache:Jfk159KBuukJ:[URL]https://threats.kaspersky.com/en/threat/Virus.DOS.Whale/+&amp;cd=5&amp;hl=fi&amp;ct=clnk&amp;gl=fi[/URL][/URL]Mother of all viruses, still not properly reverse-engineered. It can display many, many other things. Its a piece of an art in coding!pop&nbsp; &nbsp;&nbsp; ax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; POP 0xE9CF into AX registerxor&nbsp; &nbsp;&nbsp; ax,020C&nbsp; &nbsp;&nbsp; ; decrypt 0xEBC3 in AX (0xc3&nbsp; RET)cs:mov&nbsp; &nbsp;&nbsp; [trap],al&nbsp;&nbsp; ; try to overwrite INT 3 with RETadd&nbsp; &nbsp;&nbsp; ax,020C&nbsp; &nbsp;&nbsp; ; fill the prefetch queueIN&nbsp; &nbsp; &nbsp; AL,21OR&nbsp; &nbsp; &nbsp; AL,02OUT&nbsp; &nbsp;&nbsp; 21,ALInstruction 0040601A&nbsp; E807000000&nbsp; &nbsp; &nbsp;&nbsp; call&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 00406026h 0040601F&nbsp; 34F4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; xor&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; al,F4 00406021&nbsp; F0A4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; lock&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsb 00406023&nbsp; 288C085EB934AC&nbsp;&nbsp; sub&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; [eax+ecx-53CB46A2],cl 0040602A&nbsp; 0200.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; al,[eax] &quot; [eax+ecx-53CB46A2],cl&quot; wow!</blockquote>

[QUOTE="sepik, post: 912601, member: 74435"] [URL unfurl="true"]https://webcache.googleusercontent.com/search?q=cache:Jfk159KBuukJ:[URL]https://threats.kaspersky.com/en/threat/Virus.DOS.Whale/+&cd=5&hl=fi&ct=clnk&gl=fi[/URL][/URL] Mother of all viruses, still not properly reverse-engineered. It can display many, many other things. Its a piece of an art in coding! pop ax ; POP 0xE9CF into AX register xor ax,020C ; decrypt 0xEBC3 in AX (0xc3 RET) cs: mov [trap],al ; try to overwrite INT 3 with RET add ax,020C ; fill the prefetch queue IN AL,21 OR AL,02 OUT 21,AL Instruction 0040601A E807000000 call 00406026h 0040601F 34F4 xor al,F4 00406021 F0A4 lock movsb 00406023 288C085EB934AC sub [eax+ecx-53CB46A2],cl 0040602A 0200. add al,[eax] " [eax+ecx-53CB46A2],cl" wow! [/QUOTE]

Verification