Đó là lý do tại sao vi-rút được gần như đồng nghĩa với sự hủy diệt bừa bãi. Tuy nhiên, chúng ta phải nhận ra rằng các virus máy tính không phải là vốn phá hoại. Các tính năng thiết yếu của một chương trình máy tính làm cho nó được phân loại như là một vi-rút | 48 The Little Black Book of Computer Viruses absolute offset of the first byte of the virus in the program segment and stores it in an easily accessible variable. Next comes an important anti-detection step The master control routine moves the Disk Transfer Area DTA to the data area for the virus using DOS function 1A Hex mov dx OFFSET DTA mov ah 1AH int 21H This move is necessary because the search routine will modify data in the DTA. When a COM file starts up the DTA is set to a default value of an offset of 80 H in the program segment. The problem is that if the host program requires command line parameters they are stored for the program at this same location. If the DTA were not changed temporarily while the virus was executing the search routine would overwrite any command line parameters before the host program had a chance to access them. That would cause any infected COM program which required a command line parameter to bomb. The virus would execute just fine and host programs that required no parameters would run fine but the user could spot trouble with some programs. Temporarily moving the DTA eliminates this problem. With the DTA moved the main control routine can safely call the search and copy routines call FIND_FILE jnz EXIT_VIRUS Call INFECT EXIT VIRUS try to find a file to infect jump if no file was found else infect the file Finally the master control routine must return control to the host program. This involves three steps Firstly restore the DTA to its initial value offset 80H mov dx 80H mov ah 1AH int 21H Case Number One A Simple COM File Infector 49 Next move the first five bytes of the original host program from the data area START_CODE where they are stored to the start of the host program at 100H Finally the virus must transfer control to the host program at 100H. This requires a trick since one cannot simply say jmp 100H because such a jump is relative so that instruction won t be jumping to 100H as soon as the virus moves to another .
