
 [ Version History ]
 
 At the moment i try to release a newer version every week,
 still got enough cool features to implement, so don't worry ;)

 *Version 0.42 - 06-10-2001
  Added Selfmailing by infecting a file inside the windows 
  directory and send this file around with a new name using
  a vbs script.

 *Version 0.41 - 28-09-2001
  Added pre-process residency in three types. The first one
  is a generic hooker, hooking stuff like MoveFile, CopyFile..
  the second one hooks the SearchPath API, and the third one
  is hooking the SetCurrentDirectoryA API.
  Removed the splash screen, making the kit a lot smaller =)

 *Version 0.40 - 21-09-2001
  Checked the entire code to make the viruses even more variable
  than before and found several things i could improve !  
  Also fixed several bugs :P

 *Version 0.39 - 16-09-2001
  Added EPO which searches for "mov eax, fs:[00000000]", which
  sets up an SEH frame, and replaces it with a call to the virus.
  Another EPO Type added, which can be found in "99 Ways to die"
  by Bumblebee/29a it looks for a call ( 0E9h ) and checks if it
  points to a stack set-up frame.
  Added EPO Type IV , which searches for the end of a
  procedure ( pop edi, pop esi, pop ebx, leave, ret ) as seen in
  Win32.HIV by Benny/29A.

 *Version 0.38 - 14-09-2001
  Took a bit longer this time, I spend most of my weeks to meet
  my girlfriend and get drunk ;)
  Host encryption fixed.. seems as if I did some last minute changes
  wrong last version :((
  Added simple Entry Point Obscurity, which places a jump to the
  virus in the original first 5 Bytes of the victim during infection,
  and patches this afterwards.
  Added some real EPO, which searches for 
  a "push ebp; mov ebp, esp; sub esp.." and replaces it with a call
  to the virus. More EPO Stuff will follow.
  Fixed some problems with section increasing

 *Version 0.37 - 24-08-2001
  Some bugs with directory traversal fixed
  Added possibility to encrypt some part of the original hosts code,
  which makes it harder to remove the virus

 *Version 0.36 - 17-08-2001
  RAV seems to detect the kit too, but I wasnt able to test :(
  pewrsec no longer necessairy, placed the virus inside
  the .data section
  Kernel can also be searched by using fixed values
  Fixed a bug concerning simple CRC and DirectoryTraversal
  Fixed a bug when using more than 10 API's ( forgot the d
   for decimal in the equ statement :P )

 *Version 0.35 - 10-08-2001
  Found out that Norman Anti Virus detects NGVCK 0.27 as 
  W32/NGVCK.1_0 ... too stupid to get the right version number
  and too stupid to have a look at the website of the author to
  get the previous ( and next ) releases ... this behaviour will
  never lead to anything good :P
  Added Directory Traversal Upwards, starting from C:\
  ( had no possibility to test it, but I'll get a second hdd soon )

 *Version 0.34 - 03-08-2001
  Some changes in the Decryptor.
  Some bugfixes in Directory Traversal, and downward traversal
  added.
  Possibility to remove file attributes before infection and thus
  able to infect write protected files.

 *Version 0.33 - 27-07-2001
  Little bug in the infection by adding a section fixed.
  Bug inside the API search fixed
  Encryption made more variable, the old algorithm did not allow
  all possible variations of neg, not, ror, xor, add... :)  

 *Version 0.32 - 18-07-2001
  I made a new user interface, to make it easier to
  choose the settings, without clicking through a dozend windows.
  Infection and API Search Type can now be selected.
  A lot of stuff is now also more random, and the code was
  opimized during the same time, making the kit smaller =)

 *Version 0.31 - 13-07-2001
  Last week i was too busy with university, but this week
  I added infection by adding a new section, and luckily I
  got this done bevore friday, so I can get drunk on my birthday =)
  Might still be a bit buggy, but I promise to try to fix this
  next week and make it at least a bit variable...

 *Version 0.30 - 29-06-2001
  Hrhr, seems as if Mr. Kasperky wants to play, he added
  the Constructor.Win32.NGVCK to the virus database, but
  he just detects the Kit, not the generated viruses, the
  heuristic still just shows a suspicion... Eugene, I am
  very very disappointed ! I expected more from you and your
  team, we both know that this kit will generate much stronger
  viruses soon ( a month or two ) until then you should detect
  'em all, I know you are able to do this. Mail me for questions .. ;)
  Included a slightly different Kernel Search Method
  and made other stuff more different. Mostly the API Search
  and the kernel search.

 *Version 0.29 - 22-06-2001
  Included CRC32 Api Search as seen in Billy Belecebs
  Windows Virus Writing Guide.

 *Version 0.28 - 15-06-2001
  Added a simple CRC Api Search, and will expand this
  to an additional CRC32 Api Search Method to make the virus
  more variable in structure ( and opcode of course )

 *Version 0.27 - 01-06-2001
  More (stupid) bugs fixed, caused by more variability i added
  last thursday.. maybe i should never add something the last day
  before the release =)
  I also added a slightly different api search routine, which does
  not compute the length of the names during searching, but has fixed
  values.
  In addition to this i also prepared the addition of crc based api
  searching.
 
 *Version 0.26 - 27-05-2001
   3 in the Api Find
   2 in the Find Files   
 
   ...all in all 40 viruses created and tested, and just
   5 bugs found ( and corrected.. seems good =)

 *Version 0.25 - 18-05-2001
   Removed the SEH part and put Antidebugging and Anti Bait together
   Fixed 2 bugs in the find files routine
   Fixed a bug inside the encryption routine
   And got another on inside the infection routine.
   ... two inside the Api Find Routine

   Slowly i got the impression, someone is sneeking every night into
   my room and adding newer bugs :P


 *Version 0.24 - 11-05-2001
   I found a lot this time, don't know wheter it is good, because i found
   the bugs, or bad, because this means all releases before just suck.. :P

   Fixed 3 bugs in the find files routines, 2 bugs in the encryption routines,
   2 bugs in the api search routine. And one bug each in the api found,
   anti soft ice check and anti bait check routines.
   Never give me asm code in the night and ask me to debug it please =)

 *Version 0.23 - 07-05-2001
   Fixed a bug in the Delta Handle routine
   Fixed a bug in the movRegisterValue routine
   Fixed malplaced comments

 *Version 0.22 MTX#3 Release - 19-02-2001
   Just minor changes, I got no time at the moment :(
   University means lots of work...

 *Version 0.21 - 31-01-2001
   Removed some really stupid bugs from the encryption routine
   and made it more variable. I also added an SEH anti debugging
   trick and included some trash code to make it more variable.

 *Version 0.20 - 16-01-2001
   I added encryption ( even if it is not completely random ), but
   just simple algorithms, nothing with a key, but XOR and SUB/ADD
   will follow soon =) Hope I can do this till friday, so I can give out
   a first beta to some ppl. Every opcode except the ones in the crypt
   routines are random, so no simple scanstring can be choosen. But the
   ones inside the crypt routine will be made variable too.
 
 *Version 0.14 - 08-01-2001
   Ok, there are round about 99% of the opcodes random
   ( they can be replaced by another ), the few others are either
   "ret"s ( which i will replace tomorrow ) or an instruction, with 
   at least one random parameter ( register / offset / constant ),
   so there are maybe 20 Bytes static, but these are always at a 
   different place and in a different order, so I think they will 
   not make a reliable scanstring... ;)
   But I will remove them too... But first I want to add some
   other viral tricks ( anti-debugging, anti-bait, encryption )
   which the user might select to include. ( This will also change
   the behavior of the viruses )

 *Version 0.13 - 25-12-2000
   Ok, now 3/4 are completely random, will continue with the rest...

 *Version 0.12 - 18-12-2000
   The output is now ok, and understandable ;) I added a lot of comments
   and formatted them. Got not much time at the moment to work on the
   engine itself, because I still got to find some x-mas presents and
   i got more work at university. So I just worked over 1/4 of the current engine
   to make it more variable, but till now, I found at least one replacement for
   every opcode and structure inside the 3 modules.

 *Version 0.10 - 13-13-2000
   The Kit works stable ! All generated Viruses work, infect the current and
   ( if choosen ) the windows and system directory. I will now read some poly
   tutors and papers to improve the randomness of it, and made some improvements
   of the really crappy output-design ;)

 *Version 0.02 - 11-12-2000
   Most generated viruses work ! ( so I hope I can finish this basis of the kit this week ) 
   I found out that the Digital Hackers' Alliance Randomized Encryption Generator [DREG]
   which was created by Gothmog/DHA also tried to create viruses this way. Due to the
   fact that all samples from him get detected, I'll try to give my best to avoid this ;)
   I will take a look at his VCK and hope to learn from his output.
   ( heh, Gothmog, if you are still around, give me a call.. :P )

 *Version 0.00 - 20-11-2000
   Generates simple Win32 Viruses
   NOP is the only trash instruction
   lot's of bugs ;(
