;本程序在Tasm下编译通过
;CIH文件型病毒检测消除程序
GOFIRST MACRO
XOR CX,CX
XOR DX,DX
MOV AX,4200H
INT 21H ;文件指针指到文件首
逆@风@者
ENDM
ALTERLINE MACRO
MOV DL,0DH
MOV AH,02H
INT 21H ;回车
MOV DL,0AH
MOV AH,02H
INT 21H ;换行
ENDM
COPYHANDLE MACRO
PUSH BX
MOV AH,45H
INT 21H ;复制文件把柄
MOV BX,AX
MOV AH,3EH
INT 21H ;关闭复制文件
POP BX
ENDM
DATA SEGMENT PARA PUBLIC 'DATA'
EXEFILE DB '*.EXE',00
DIRFILE DB '*.*',00
FILEBZ DB 00 ;文件标志(COM:00;EXE:FF)
DISKSGN DB 00 ;检测盘号
CURRDISK DB 00 ;当前盘号
DISKCHA DB 00,3AH,24H
DAT DB 256 DUP(24H) ;磁盘传送地址DISK TRANSPORT AREA
OVERMSG DB '所有CIH病毒已被清除！！！',0DH,0AH,24H

FILESUF DB 2000 DUP(0) ;存放被检测文件部份内容
PE_HEAD DB 4 DUP(0) ;存放PE HEAD指针
VIRSUF DB 1024 DUP(0) ;存放CIH病毒头块程序
VIRPOINT DB 4 DUP(0) ;存放CIH 首块及链表区首指针
SECNUM DB 00,00 ;Number of FILE SECTIONS
T_ENTRY DB 4 DUP(0) ; true Entry RVA
FILEMSG DB ' ( CIH virus) ',24H
CLEAMSG DB ' killed !!',0DH,0AH,24H
CL_ZERO DB 1024 DUP(0) ;清零数据

HZSM DB '正在扫描: ',24H
BLANK DB 60 DUP(20H),24H ;送空格
INITDIR DB "\",64 DUP(0) ;初始目录
CURRDIR DB "\ PE",00,63 DUP(24H) ;当前目录
UPDIR DB "..",00 ;上一级目录
DIRSUFF DB 4096 DUP(0) ;目录参数保留区
DIRSUFP DB 00,00 ;目录参数保留区指针
DIRNUM DB 01,00 ;盘中目录文件个数
EXENUM DB 00,00 ;盘中EXE文件个数
VIREXE DB 00,00 ;感染病毒EXE文件个数
DIRMSG DB "subdirectory number:",24H
EXEMSG DB "*.EXE numbers:",24H
ERRMSG DB "; which affected:",24H
DECSUF DB 11 DUP(0) ;二进制->十进制数存放区
TITL DB "CIH CLEAN ASM SOURCECODE TESTING",0dh,0ah
DB "kuibing kuibing@163.com",0DH,0AH,0dh,0ah
DB "The virus is a Parastic Virus which infects Windows 95/98 .EXE files",0DH,
0AH
DB 0DH,0AH,0dh,0ah,24H
BEGIN DB 07H,07H,"按任意键开始检测/清除病毒!!",0dh,0ah,24h
DATA ENDS
CODE SEGMENT PARA PUBLIC 'CODE'
ASSUME CS:CODE,DS:DATA,ES:DATA,SS:STACK
KILLCIH PROC FAR
MOV DI,0082H
MOV DL,[DI]
dec di
mov bl,[di]
PUSH DS
XOR AX,AX
PUSH AX
PUSH DS
MOV AX,DATA
MOV DS,AX
MOV ES,AX
MOV AX,STACK
MOV SS,AX
;确定检测盘号
cmp bl,0dh
jz disk2
AND DL,05FH
CMP DL,41H
JNZ DISK1
MOV BYTE PTR[DISKSGN],01H
MOV BYTE PTR[DISKCHA],41H
JMP DISK2
DISK1: CMP DL,42H
JNZ DISK3
MOV BYTE PTR[DISKSGN],02H
MOV BYTE PTR[DISKCHA],42H
JMP DISK2
DISK3: CMP DL,43H
JNZ DISK2
MOV BYTE PTR[DISKSGN],03H
MOV BYTE PTR[DISKCHA],43H
DISK2: MOV AH,19H
INT 21H ;取当前盘号
MOV BYTE PTR[CURRDISK],AL ;保存当前盘号
;
CMP BYTE PTR[DISKSGN],00H
JNZ DISK4
ADD AL,41H
MOV BYTE PTR[DISKCHA],AL
JMP DISK5
;
DISK4: MOV DL,BYTE PTR[DISKSGN]
DEC DL
MOV AH,0EH
INT 21H ;选择磁盘驱动器
;
DISK5: PUSH ES
MOV AX,0040H
MOV ES,AX
MOV DI,0087H
MOV AL,ES:[DI]
POP ES
CMP AL,00H
JZ CGA
MOV AX,0003H
JMP CLS
CGA: MOV AX,0006H
CLS: INT 10H ;清屏
MOV AH,09H
MOV DX,OFFSET TITL
INT 21H

MOV DX,OFFSET DAT ;磁盘传送首址->DX
MOV AH,1AH
INT 21H ;CREAT DAT
MOV AH,47H
MOV DL,BYTE PTR[DISKSGN]
MOV SI,OFFSET INITDIR 1
INT 21H ;保存初始目录名
MOV AH,3BH
MOV DX,OFFSET CURRDIR
INT 21H ;回到根目录
MOV BYTE PTR[FILEBZ],0FFH ;置EXE文件标志
MOV DX,OFFSET EXEFILE
;
CALL CLEA_VIRUS ;chesk and clear CIH virus
CALL CLE_SDIR ;检测各子目录下文件及消除
;
MOV AH,3BH
MOV DX,OFFSET INITDIR