Payback is a full stealth memory resident virus coded by Priest. It infects the master boot records of floppy disks. It appeared shortly after Satanbug and was written in retaliation for the arrest of members of the British 'ARCV' virus writing group.
When a disk infected with Payback is run, the virus sets up the stack and 'DS' (data segment) register. Payback then allocates 1kb of memory by decrementing the 16-bit WORD at 0:413h (BIOS size of conventional memory) and hook INT 13h (BIOS Disk Services) directly in the IVT (interrupt vector table). Payback then copies itself to this newly allocated memory after hooking INT 13h. Once copied over Payback continues execution in this new copy and load the original (uninfected) boot sector back to 0:7C00h (load address of a boot sector) using INT 13h/AH=02h (Read Sector). The instructions to set registers CX and DX for this INT 13h calls are modified by the virus on each infection to reflect the correct location of the original sector on that disk.
![Malicious Life Podcast: Fred Cohen, The Godfather of Computer Viruses [ML B-Side]](https://www.cybereason.com/hubfs/Malicious-Life-episode-1.png)