论文部分内容阅读
近几个月来在我们的Novell网上发现有些.EXE文件长度增加,少数程序不能执行,DOS报告是EXE文件出错。经分析,原因是染上了病毒,由于该病毒末尾有CRACK NOVELL字符,又利用Novell的一个漏洞对Novell网安全性构成威胁,故暂命名为Crack Novell病毒,该病毒用SCAN CPAV KILL KV300 AV95等均查不出。 该病毒只感染EXE文件,链接于文件尾部,驻留内存后在运行文件时感染。文件被感染后,文件头中的文件长度,文件字符累加和及初始IP CS值被改,文件增长1024～1039不等。由于病毒无表现模块,若不注意,较难发现。 此病毒的特点在于对Novell网安全性的破坏。病毒通过修改MCB链驻留内存高端后拦截了INT 2IH的4BH子功能
In recent months there have been some .EXE file sizes found on our Novell network that add up to few programs that can not be executed. DOS reports an error with the EXE file. Analysis of the reason is infected with the virus, as the end of the virus CRACK NOVELL character, but also a vulnerability using Novell Novell network security poses a threat, so tentatively named Crack Novell virus with the SCAN CPAV KILL KV300 AV95, etc. Can not find out. The virus is only infected with EXE files, links to the tail of the file, resides in the memory when running the file infection. After the file is infected, the length of the file in the file header, the cumulative character of the file, and the initial IP CS value are changed. The file size grows from 1024 to 1039. Due to the virus no performance module, if not pay attention, harder to find. This virus is characterized by the destruction of Novell network security. The virus intercepts the 4BH subfunction of INT 2IH after the MCB chain resides in high memory