Сообщение от
SDA
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
Кому интересно - вот тоже самое в виде x86 Assembly Code Listing (все цифры шестнадцатиричные):
Код:
xxxx:0100 58 POP AX
xxxx:0101 354F21 XOR AX,214F
xxxx:0104 50 PUSH AX
xxxx:0105 254041 AND AX,4140
xxxx:0108 50 PUSH AX
xxxx:0109 5B POP BX ;--> Places 0140 in BX
xxxx:010A 345C XOR AL,5C
xxxx:010C 50 PUSH AX
xxxx:010D 5A POP DX ;--> Places 011C in DX
xxxx:010E 58 POP AX
xxxx:010F 353428 XOR AX,2834
xxxx:0112 50 PUSH AX
xxxx:0113 5E POP SI
xxxx:0114 2937 SUB [BX],SI ;--> changes bytes at 140-141
xxxx:0116 43 INC BX
xxxx:0117 43 INC BX
xxxx:0118 2937 SUB [BX],SI ;--> changes bytes at 142-143
xxxx:011A 7D24 JGE 0140 ;--> Jumps over data string to
; the last two instructions
xxxx:011C 45 49 43 41 52 2D 53 54 41 EICAR-STA
xxxx:0125 4E 44 41 52 44 2D 41 4E 54 NDARD-ANT DATA STRING
xxxx:012E 49 56 49 52 55 53 2D 54 45 IVIRUS-TE which is displayed
xxxx:0137 53 54 2D 46 49 4C 45 21 24 ST-FILE!$ by the program.
xxxx:0140 CD21 INT 21 ;--> DOS Function 09h:
; Displays the text.
xxxx:0142 CD20 INT 20 ;--> Program Termination funct.
Paul