8326442@awiwuw11.wu-wien.ac.at (12/28/90)
Environment : MS-DOS 4.01 , 286 NEAT-Motherboard at 20 MHz with 1 WS ,
BIOS from CHips & Technologies
2 MB RAM (80 ns , 2 Banks of 1 MBit Chips )
a Seagate ST296N SCSI Drive and
a Seagate ST02 SCSI adaptor-card
an EVA/1024 8-bit Vga-card with 512K , Tseng Chipset
( max 1024 * 768 * 16)
a noname Multisync-Monitor
My Problem sounds trivial,unbelievable but it's serious somehow.
I tried to simulate a virus in memory to force a warning when
scanning memory with McAffee's Scan V71c option /m for scanning
memory for all known viruses.
to do so , i wrote a very short assembler program , which does nothing than
1 ) get the old msdos interrupt ( Int 21h )
2 ) save this interrupt in it's code
3) set the msdos interrupt to its own code
4) if function 4b is called with 'FFh' in AL-register
the answer should be '55aa' in the bx-register
sounds quite simple .
BUT when i try to get the int 21h pointer , I always receive junk from the
interrupt call ( AX = 2521h or 35 one is get the other set , then int 21h).
its the same rusult whether i watch with a debugger or not ( i tried Quaid's
Analyzer, Turbo Debugger V 1.0, MS Codeview 5.1 ) .
i even tried to read the interupt vector table manually , but that also
failed.
When i tried something similar on my older system ( ST225 mfm instead of SCSi
and 640 KB , Running at 10 Mhz 0 WS ) it worked well. NAturally all tools
which manipulate the interrupt-vectors work fine, just my self-written program
doesn't.
is there anybody out there with a solution , it's driving me crazy .
martin zejma from vienna, austria
please e-mail to me , 'cause i'm no regular reader of this newsgroup