

		   Unknown Entry Point Infecting Engine
		   

  
  

᫥ ⠯ ࠧ  ᮢ  ᫥ 
ᥣ  ࢮ  뫨 ࠧࠡ⪨  䥪⨢ ࠭
 졥 ⨢ ⨢ᮢ,  筮    㣮 ४騥

᫨  ࠭ ⠯ ᭮ ஡ 뫮 㦥   ᪥,
   த Mutation Engine  ஡ 뫠  襩 
襭 .

 饥 ६ ᭮ ᭮   ।⠢
  .     ᢮ Mutation  ⨫ 
⮨    ਯ ,     

᫥ ᪨ ਥ   ᨥ ⨪
ࠢ   ᥭ   ਪ  


   ⮤
  

᭮ ஡    ࠢ  ணࠬ 
। ࠧ  ᫥ 㧪 (ࠢ 窠 室) 
 㯠   ।⢥   .

 楯 墠뢠 ࠢ  ணࠬ  ᠬ 砫,
⠫ ᭮饩 ᨮ,   ॡ饩 ᯠਢ

 ⮤  ⮬  । ࠢ   ⢫  
ᠬ 砫 ,  ந  ६
᭮ 楫 ⮤  ⮬ ⮡ ⨪ ஢ ᭮ 
ॠ쭮 ணࠬ   ࠫ   । ࠢ  
᫨  믮 ,      ணࠬ !

  ᫨   ᥭ    㤥  ᯮ
࠭.⢥  易   -
 @$ 祣  ⠬ ⨫,᫨   楯  ᪥


   ॠ
  

  ⠢  ⥫ ॣࠬ 室    ந쭮 

筮 । ࠢ     ᥣ⭮ -
  Jmp far Seg:Offs , Call far Seg:Offs .
 ਥ  ᯮ짮 call far -  ⥪  
 맮     砥  ணࠬ (.), 
jmp far 諮  ࠭  ⥫  Jmp'a .

 ॠ    ᯮᮡ -

ਬ ।⢥  ⥫  ந쭮   ᪮쪮
  室   - ⪨ 祢 -   ࠭
 ஧  宬

 ਥ -   㦥 饣 맮  ணࠬ 
   맮 :

ਬ:
1)	   饬  ⥫ ࠬ  9Ah -  Call Far
	   塞  室   - ஡   -
	    ࠭ :

	  mov	al,9Ah <--  ,  ணࠬ
	  ...		     Far Call

2)  䥪⨢  筮    Call Far
१ ⠡ ᥣ ᮢ   -    Header'a
室   ᬮਬ ᫨  $-3 ⮨  9Ah ,  筮
⥯ ⭮  ⢥ত   Far Call

	 $-3		 $
	 9Ah,Ofs,Ofs,Relocation

   ⠪:    mov   dl,9Ah
			     nop  <--  㣠 ⮢ 
			     mov   ax,Relocation
			     mov   ds,ax

      Far Call

3)   ,  䥪⨢  ⠪ ⮤:
    ⥫ ணࠬ 饬 ⠭ C/Pascal  楤
   ⮬ 饬   

 ES:LineAddr	 push	bp		   .
		 mov	bp,sp		   .
		 .			   .
		 .			   Call Far Seg:Offs  <Ŀ
		 .			   ८ࠧ  ᥣ 
		 pop	bp
		 retf	[imm8]

    塞     室  뢠   䠩
      ⢥ ࠭


  ஡   祬  
  

  ࠢ 窨 ७ 뢠 ⢥ 室 ணࠬ
 ࢠ⢮ . ⮡   ஢  ﭨ  
 쭥襩 ࠢ쭮 ࠡ ணࠬ ࠭ 室 ﭨ,
 ᫥ ⮣    ᤥ  㦭 ⠭   த
室 ணࠬ - Call Far RealSeg:RealOffs

 ࠭ ﭨ    ,⠪  ⭮ 
  뢠 .  - ࠭  ॣ஢

  ⭮  ணࠬ    । ࠢ 

   ॠ
  

 Unknown Entry Point ॠ   -  

 OpenFile , Call UEPinfect , SetRealTime , CloseFile

   ⠭ 䨪 ࠦ - ⠭ ᠬ

 UEP.ASM  -  ࢮ砫쭮   ᠭ UEP 쨬 ᯮᮡ ,
   䠩 ⠭ Appending'
   ᥡ ࠩ  ᯮᮡ   ⠭⭮ ࠦ
 ணࠬ       ᥡ   ᮬ

 UEP_V2.ASM  -	楤 ᪠  ࠦ Far Proc  
न쭮  ⮤ ࠦ -  뢠  Header'
 ணࠬ .

      ४஢ Reloc ⮢     ⥫ ணࠬ
      ᭮  ।   Reloc ⮢
       Header'e  .᫨  ᫮  믮
      䠩 㤥 ᪮४஢ ࠢ쭮  㤥 ࠡᯮᮡ

  UEP  ⠢  稭 魮 ⮣ ⬠(  )

 UEP_V3.ASM  -	楤 ᪠  ࠦ Far Proc  
 ᯮᮡ ४஢ Reloc ⮢  ⠭

 DUMB_UEP.ASM  -  १     ᨩ UEP .
 ⮨  ࠭   ࢮ  DUMB.COM ᪮,
ᠫ    10  ⠪  ᬮ ⠬ ᮡ   


   ⮢
  

뫮 ஢  30' 䠩  UEP_v2 , UEP_v3 .

UEP_v2:  ࠡᯮ묨 䠩   ⠭ -⮢  Header'e
UEP_v3:  䠩  ࠡᯮᮡ묨

஥堢    AVP 3.0  DRWEB' 4.00 , 㫨  EXE.Virus
 30' 䠩 AVP 㦨    , WEB    !!!

  砭
  

  ॡ i386   -   8086 &#@ 㦥 

  ॠ  ண  㤨 -   ଠ,  ⠪ , 誠 

 ਢ ᥬ ଥࠬ.
   ᭠  DOS ३  ஭ ⠤ ... :)

				       ᨡ
				        '98
				       NSTU.[]
