ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ» º Virus Simulation Suite Written by Joe Hirst º º British Computer Virus Research Centre (Tel: 0273-26105) º º 12 Guildford Street, Brighton, East Sussex, BN1 3LS, England º º (Tel: 0273-26105) º º º º Copyright (c) Joe Hirst 1988-93 º ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ These programs simulate the visual and aural effects of some of the PC viruses. They are public service freeware, which means that they are provided as a public service, and, although the copyright is retained, any person or company may use them for any legitimate purpose (commercial or otherwise). The only restrictions are that users may not attempt to alter the programs, and they may not state or imply that they have any exclusive rights to or control over the programs. All of these programs will check their own length before executing, and also perform a checksum test for corruption. If either of these tests fails the program will refuse to execute. The complete set of programs currently consists of: CASC-SIM.COM Cascade virus (standard activation) CSC-SIMX.COM Cascade virus (display only) DENZ-SIM COM Denzuk virus - single shot display FUMN-SIM.COM Jerusalen (2) (Fu Manchu) virus FUM-SIMD COM Jerusalen (2) (Fu Manchu) virus - single shot display FUM-SIMX.COM Jerusalen (2) (Fu Manchu) virus (censored) ITAL-SIM.COM Italian virus (standard activation) ITL-SIMX.COM Italian virus (display only) JERU-SIM.COM Jerusalem (1) virus OROP-SIM.COM Music virus ORO-SIMX.COM Music virus (minimum delay) YANK-SIM.COM Yankee Doodle virus (standard activation) YNK-SIMX.COM Yankee Doodle virus (display only) Many of these programs are TSRs, and in all such cases the program can be removed from memory by the <-> key combination. Some of them have a programmable builtin delay, and these may be called with a numeric parameter between 1 and 30 inclusive. This number represents the delay in minutes before displaying the simulation effect. If the program is called without a parameter a delay of one minute is assumed, except for the program ITL-SIMX where no parameter means no delay. In many cases the simulation can be switched off, and the delay reset, by the <+> key combination. The exception is the program ITL-SIMX when called without a parameter: in this case the <+> key combination toggles the display. Please note that the <+> & <-> refer to the grey keys right of the numeric key pad. CASC-SIM.COM Cascade virus (standard activation) This program simulates the display of the Cascade virus. Characters will fall down the screen until they encounter another character or a change in the background or foreground colours. The area of display affected will initially be one column. This will build up with successive displays until the full screen is affected. The delay before the first display will be random with a maximum of five minutes, and that between displays will be random with a maximum of one minute. CSC-SIMX.COM [n] Cascade virus (display only) This program simulates the display of the Cascade virus, but with a controlled delay. Characters will fall down the screen until they encounter another character or a change in the background or foreground colours. The area of display affected will be the full-screen. The delay before the first display, and that between displays, will be equal to the entered parameter in minutes, or one minute if no parameter is given. DENZ-SIM.COM Denzuk virus - single shot display This program is not a TSR, nor does it accept any parameters. It duplicates the visual display produced by the virus when Ctrl-Alt-Del is intercepted. FUMN-SIM.COM Jerusalen (2) (Fu Manchu) virus The virus intercepts the keyboard I/O interrupt, and certain words cause the addition of comments. These comments go into the keyboard buffer, not just on the screen. The trigger words include "Thatcher", "Botha", "Reagan", "Waldheim" and "Fu Manchu". In each case the trigger is the word (or words) followed by a space. The other trigger words are the two more explicit four-letter words (without a space). Be warned that this simulation, like the virus, uses explicit language. Ctrl-Alt-Del is intercepted and produces a message before the machine reboots. There is no reset with this program. FUM-SIMD.COM Jerusalen (2) (Fu Manchu) virus - single shot display This program is not a TSR, nor does it accept any parameters. It displays the message produced by the virus when Ctrl-Alt-Del is intercepted. FUM-SIMX.COM Jerusalen (2) (Fu Manchu) virus (censored) This program is exactly as described for FUMN-SIM.COM, except that the two four-letter words have been censored to "c***" and "f***", both on input and output. This version is intended for public demonstrations where it is felt that the full-blooded version would be inappropriate. ITAL-SIM.COM Italian virus (standard activation) This program simulates the display of the Italian virus, which is a single character "bouncing ball". The display will only activate under the same condition as the real virus, which is a disk access during a one second time "window" occurring every half hour. "Reset" will switch off the display again until the next such activation. ITL-SIMX.COM [n] Italian virus (display only) This program simulates the display of the Italian virus, which is a single character "bouncing ball". If called with a parameter there will be a delay before the display is activated equal to the parameter in minutes. Reset will switch off the display until this same delay has elapsed again. If called without a parameter the display will appear immediately, and reset will switch the display on and off JERU-SIM.COM [n] Jerusalem virus This program simulates Jerusalem virus. After the initial delay a portion of the screen (from row 5 column 5 to row 16 column 16) will be scrolled up two lines, creating a small black gap in the display. At this time a time wasting loop will be activated, and the processor will appear to be slowed down. Reset will switch off the slow-down effect, and re-institute the delay. If called with a parameter there will be a delay before the display is activated equal to the parameter in minutes. If called without a parameter, the delay will be one minute. Reset will switch off the display until this same delay has elapsed again. OROP-SIM.COM Music virus This program simulates audible effect of the Music virus. After an initial delay of five minutes it will start playing its cycle of three tunes, with a seven minute delay between tunes. This will continue until the machine is re-booted, or the program is removed from memory. ORO-SIMX.COM Music virus (minimum delay) This program simulates audible effect of the Music virus. The simulation is the same as OROP-SIM above, except that the five and seven minute delays have been changed to one second and half a minute respectively. YANK-SIM.COM Yankee Doodle virus (standard activation) This program simulates the audible effect of the Yankee Doodle virus, which is the tune "Yankee Doodle". The tune will only activate under the same condition as the real virus, which is at approximately 17.00 hours (five p.m.). YNK-SIMX.COM [n] Yankee Doodle virus (tune only) This program simulates the audible effect of the Yankee Doodle virus, which is the tune "Yankee Doodle". If called with a parameter there will be a delay before the tune is activated equal to the parameter in minutes. If called without a parameter, the delay will be one minute.