frisk@RHI.HI.IS (Fridrik Skulason) (09/21/89)
I recently gave a copy of a Anti-Ping-Pong program to a person with an
infected computer. He had seen the bouncing ball on the screen some
time earlier and contacted me.
Much to my (and his) surprise, the program refused to remove the virus,
saying:
This boot sector is not infected with the Italian virus.
When I took a closer look I discovered the following:
1) He was using a '286 machine (but normally Ping-Pong only
works on '88 or '86 machines)
2) The ball could be activated as normally. (By typing TIME 0,
followed by a command that will cause a read)
3) The signature in the boot sector was identical (1357).
4) A NOP byte had been placed in the middle of the string this
program used for identification.
5) The code had been modified a bit, and the most significant change
was that the MOV CS,AX instruction had been replaced with a
sequence of instructions to do the same thing.
I will publish a full report soon - but I just wanted to know if anybody
else has heard of this variant.