Contact on GitHub

Ashton

In a few words...

This virus does not have a description.

The following symptoms may happen: Mess with the floppy after 5 replications, and with the harddrive as soon as a Getbpb() calls on it is performed

Details

  • Replication: on any floppy only bootsector where the virus signature ('AS' in the first OEM word) is not found
  • Bootcode size: 480 bytes.
  • Resident address: 0x140.
  • Start address: 0x1e.
  • Stealth address: 0x600.
  • Attached vectors: hdv_bpb, undocumented reset resident routine.
  • Reset resistance: yes.
  • TOS: all.

What's special ?

  • Technically speaking, nothing much, it uses a generation counter, the classic hdv_bpb vector and undocumented reset resident routine header. The code focuses on the symptoms which are pretty destructive, write 'ASHTON' on a random number of sectors.
  • the code uses multiple counters:
  • a generation counter (GENERATION_COUNTER, in the virus code to be persisted)
  • an in-memory counter (FLOPPY_ACCESS_COUNTER) set to 5 at start, tested to 0 to trigger the hardrive mayhem, decremented at each Getbpb(). After being triggered the coutner won't be reset until the memory is cleaned.
  • an in-memory counter (NON_VIRUS_COUNTER), cleared at each Getbpb() calls, incremented if the virus is not on disk and in case of read/write errors if this counter is not 0, it will also decrement the FLOPPY_ACCESS_COUNTER ;

Fun facts

  • There is a kind of backdoor, if a RTS is located at 0x180, the virus won't install
  • There a message in the bootsector : "With the lights out it's less dangerous. NEVERMIND". Probably a sarcastic hint, don't power on your hard drive when this virus is around.

See the virus in action!