From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Clearing out old signatures (PC)
Message-ID: <0017.9301051402.AA11929@barnabas.cert.org>
Date: 22 Dec 92 19:37:55 GMT
Sender: virus-l@lehigh.edu
Lines: 68
Approved: news@netnews.cc.lehigh.edu

Enclosed is a DEBUG script that will create a 68 byte .COM file
(CLEAR.COM) that will zero out memory between the current load
position and the TOM. To use, extract the portion of this message
between the (cut here) lines and name it CLEAR.DEB (the portion
beginning with "a100" and ending with the blank line after the
"q" - NOTE: that last blank line must be there as must the blank
line following "JMP 102". 

Next run "DEBUG <CLEAR.DEB" When run there should be no errors.
This will create the program CLEAR.COM.

NOTE: It will not clear the disk buffers or any high/upper RAM
      nor will it remove any viruses that are properly resident
      in allocated space, it just clears free memory.

Weasel-words: this is FreeWare but carries no guarantee of fitness
              of any kind. Caveat etc. 

- ----beginning of CLEAR.DEB------------8<------cut here-------------
a100
JMP     010D                 ;skip around loop
MOV     ES,AX                
XOR     AX,AX                
MOV     DI,AX                
REPZ                         ;clear out memory
STOSW                        
MOV     AX,ES                ;replaced by CD 20 for last loop
RET                          ;move stack to protected area
MOV     AX,0100              
MOV     SP,AX                
MOV     DX,CS                
MOV     SS,DX                ;make sure program does not get
ADD     DX,+20               ;overwritten until end
INT     12                   ;Find the TOM
MOV     CL,06                
ROL     AX,CL                
SUB     AX,1000              ;Can only clear 64k at a time
CMP     AX,DX                ;Make sure we are not back down
JBE     012E                 ;to where program is.
MOV     CX,8000              
CALL    0102                 ;if not, clear 64k
JMP     011F                 ;then try again
MOV     WORD PTR [010A],20CD ;last loop - put termination in 
SUB     DX,+0F               ;can overwrite most of program
MOV     AX,DX                
MOV     CL,03                ;DX contains amount of this segment
SHL     DX,CL                ;that is in use plus loop.
MOV     CX,8000              
SUB     CX,DX                ;Subtract from 64k gives amount to
JMP     0102                 ;clear. No return so JMP not CALL

rcx                                         
44
nclear.com
w
q

- ----------end of CLEAR.DEB---------8<--------cut here--------
             *
             |
            abc
           defgh               And a Merry Christmas to All,
          ijklmno
         pqrstuvwx                               Padgett
        yzabcdefghi
       jklmnopqrstuv
           wxyz
          __||__

