MS-DOS Viruses in Action | Hacker News Reader

MS-DOS Viruses in Action

wired.com

72 pointsadamnemecek20 comments

40Hex was an ezine about viruses. People might be interested in reading documents from back then. http://www.textfiles.com/magazines/40HEX/

I can also recommend the 29A magazine and z0mbie's website - http://z0mbie.host.sk/.

I was as a 15-year-old briefly involved with Phalcon/Skism, the group that produced 40Hex. I also wrote a couple of ASM DOS viruses. They weren't intended to destroy anything, just sort of adolescent graffiti in x86 machine code form.

I only have a bit of code left from that period, some of which is here:

http://adam.ierymenko.name/ye_olde_source_code.html

No viruses, but some IRC hacks I wrote around the same time.

I still have the "Little Black book of computer viruses". I just got my first AT computer then (a 486DX). Very entertaining stuff that was...

http://home.swipnet.se/smaffy/asm/info/vir.pdf

swipnet is still alive :-)

The difference between viruses then (most did little real harm, left your computer in perfectly working state, and were meant to show off the skills of the writer) and now (network zombies used to make people money, or replace web content with ads) is kind of depressing.

To be honest, back then most computers didn't have a direct connection to the online world.. and even if they did, it was rarely always-on.

But it's not all sunshine and roses, do you remember the scourge of toll-dialer viruses (that made your dial-up modem call a toll number that bills by the minute, money going to the attacker) from back in the day? There were a rare few that could even figure out ways to silence your dial-up tone so you wouldn't be guaranteed to instantly find out you'd been infected..

That was just an AT command:

  ATM0

That's assuming DOS had the right drivers for your card loaded, and that your card respected that option... I came across many that didn't, esp. the "cheap" knockoffs of the leading brands.

Drivers? Do you mean software-modems? Majority of the modems AFAIK were hardware modems which just connect over the COM ports, and you can echo any command there.

> most did little real harm, left your computer in perfectly working state, and were meant to show off the skills of the writer

Maybe on UNIX or something but viruses I remember from the early 90's were zeroing HDD, replacing files with the same text or rebooting every 5 minutes.

I'd venture to say that except for ransomware today's viruses and trojans are more discrete and do less harm to the user because if the user notices them he's going to take action to remove them and that weakens the botnet or the ad delivery collective system which seem to be what viruses and trojan writers really want to have.

>I'd venture to say that except for ransomware today's viruses and trojans are more discrete and do less harm to the user because if the user notices them he's going to take action to remove them and that weakens the botnet or the ad delivery collective system which seem to be what viruses and trojan writers really want to have.

You're right, that certainly is the goal, but IME almost never achieved. I've cleaned up quite a few infections and almost all of them have caused some kind of system instability or another. Virus writers have surprisingly shoddy programming skills.

>and were meant to show off the skills of the writer

I believe that is just nostalgia. I have reverse engineered a few and almost all of them are badly designed, make assumptions about the state of the OS/datastructures (that turn out to be false sometimes, causing them to crash) and do things that are trivial for any intermediate low-level programmer. Commonly - modify command.com or other executables to load itself when executed (some tricky viruses even removed their modifications from those EXEs once they were memory resident) , plop some executable code in the bootsector, hook into some i/o interrupt, install itself as a TSR, etc

Modern malware is equally buggy, but will do things that are much much more sophisticated - due to the arms race between antivirus folks and malware writers. Especially the techniques they use to thwart being live-debugged, or identified as malware are pretty ingenious. A lot of DRM tech. (securom comes to mind) does similar crazy stuff as well - in addition to causing system instability.

INT 13(CD13) - feel the power to format the hard drive in less than 8 bytes of code. Good old days :)

No reference to the stoned virus? I remember that being extremely widespread, despite not having the Internet to easily propagate it.

I wonder how many of these run in DOSBOX

You may be able to get them working in a FreeDOS virtual machine.

Awesome how much creativity these hackers had. The graphics are surprisingly pretty amazing for some of this stuff.

The awkward moment when I clicked on a web page with MS virus in action, while browsing the awesome gifs, the site decided to play ad suddenly like this ( http://i.imgur.com/6I3WTUX.png)...

I remember this. All these 'viruses' are from a book about virus. I still have it somewhere in my hometown. It had a floppy with demo programs.

Wired has really run out of content to post :)

Reply on news.ycombinator.com