Videos

I have always been fascinated with computer virii. My first exposure to computer virii was back in 1994, when my 360KB floppy disk got infected by STONED. The hype around virii was so much and I was so misinformed, I kept that infected disk in the jacket, away from all other diskettes I owned for 2 weeks!! No, I am not kidding.

Gokul, (owner of Port Bit Systems/Trichy, who was my first computer teacher) looked like a hero to me, when he could magically clean the infection by running a command line DOS McAfee. Man,those days were cool! Later when I started learning x86 assembly and DOS internals, I got fully absorbed in to the wonder world of DOS virii. (I still have the first DOS anti-virus program I wrote – "(C) Brain" remover – somewhere in my old HDD). "Computer Viruses: Prevention, detection and cure" by Rajneesh Kapur was my first viruses book; An excellent one! This is out of print now, can’t even find it in the original publishers site.

One virus I fondly remember to this day, is the famous (!?) CASCADE virus (a.k.a Raindrop/17xx). This virus was a non-overwriting, resident COM infector. When triggered it made the characters in the screen fall in to a nice heap at the bottom. (Remember, we were in the command line mode then!). It was kind of cool to see this cascading action.

Cascade was the first virus to use encryption. The virus consisted of two parts – the virus body and an encryption routine. The latter encrypted the body of the virus so that it appeared different in every infected file. After loading the file, control was transferred to the decryption routine which decoded the virus body and transferred control to it. Unlike future polymorphic viruses, Cascade encoded only the body of the virus. The size of the infected file was used as the decryption key. Since the decryption routine remained unchanged, antivirus programs detected the virus with ease.

If you have never seen the virus in action, look at the screen shots below:

More >