Virus.DOS.AsmVirus

Class Virus
Platform DOS
Description

Technical Details


It is a dangerous nonmemory resident overwriting virus. It searches for
.ASM files, renames the file with BAK file name extension, then overwrites
the .ASM file with the hexadecimal code of the virus that is converted to
ASM format. The result of infection looks as follows:


.MODEL TINY
.CODE
ORG 256
a:
DB 0FCh
DB 0B4h

< the hexadecimal code of the virus >

ENDS
END a

When that file is assembled, the result is a copy of the virus.


The virus contains the internal text strings:


0123456789ABCDEF.MODEL TINY
.CODE
ORG 256
a:
ENDS
END a
h
DB
*.asm bak 0