;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ; Odessa.B virus ; (C) Opic [CodeBreakers '98] ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ;Odessa.B variant is a continuation of Odessa (aka opic.727) ; ;Odessa.B's NEW features: ; ;-Odessa.B will NOW infect .Exe files present on any floppy disks ; undetectably (due to a critical error handler). It does so after ; the current HDD is infected. When Odessa.B is present on a floppy ; disk it will move imediatly to the HDD to insure infection of new systems. ;Thus making it a viable floppy born virus (one of the few outside of the ;BS/MBR families) ; ;-an expanded encryption loop ; ;-some minor bug fixes, and optimisations. ; ;Infected files grow approximatly: 745 bytes ; ;Old features: ; ;-Exe file infector ;-directory transversal via dotdot ;-is Windows compatable (ie: will not infect: Windows NE, PE, LE files ect.) ;-some anti-emulation ;-payload criteria: the virus will activate its payload on ; either the 13th or the 6th of any given month provided the seconds ; are below 30. ; ;-payload: when activated the virus will beep 6 times before the ; infected file is run. I choose this more subtle payload because ;it is easily missed, and only creates a bit of curiosity at most. ;which is a good aspect since the fact that all infected files will ;try to access the floppy drive before running also brings some curious. ;Its also somewhat humerous because the telltale signs of this virus ;are also what many non-computer literate people constantly write to ;AVers about complaining of (to which the AVs constant reply is: ;false alarm. There is a signature line: ;Odessa.B (c) Opic [Codebreakers 1998] ;I have left for the AV to rename for me, as it is never displayed ;(hell i figure their gonna anyways :P ). ; ;detected: Not detected by TBAV as second gen. ; ;%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%