'============================================================================================================================
' be eugene kaspersky for a minute...
'============================================================================================================================
'
'============================================================================================================================
' its intended audience are the budding vb coders out there...
'============================================================================================================================
'
' hello again budding vb coders... welcome again to another phase of the alcotutes... now i will talk about a different   
' thing.. it's not your usual file overwriter, a worm or another malware or any other worm techniques.. 
' now it's the other way around.. brace yourselves and let's do some worm scanner here..
'
':::FYI:::
'
' a virus scanner basically scans vital strings in files, compares and if a match in its dbase is found, it alerts us that 
' the file is a virus... advanced scanners employ real-time scanning (monitor), heuristics, clean options etc...
'
':::end:::
'
' why worm scanner ? coz most of computer worms don't do meta-or-poly stuffs.. and the techniques
' that will be shown are so damn cute.. we can easily extract strings by using notepad... :)
'
'====================
' the code
'====================
sub scan()
On Error Resume Next
Dim lngbufferlen
Dim bbyte As Byte
Dim strbuffer As String
Open "c:\worm.ext" For Binary As #1 ':::open as binary (!) important
DoEvents ':::tickle our cpu
Do While Not EOF(1) ':::read all
DoEvents ':::tickle the cpu again
Get #1, , bbyte ':::get each byte
strbuffer = strbuffer & Chr(bbyte) ':::store all the read bytes in a variable, convert them to strings
Loop
Close #1 '::close our file
compare strbuffer ':::examine the buffer for strings
lngbufferlen = Len(strbuffer) ':::after that, get the size of the used buffer
strbuffer = Space(lngbufferlen) ':::clear all
End Sub
'
' the code opens a suspected file, read bytes and convert that bytes to readable strings, stores all the strings to
' our buffer, calls another routine to examine the buffer, count the size of the buffer and clean the buffer..
' isn't that so so very very simple?
'
'============================
' alert: that file is a worm
'============================
'
Private Sub compare(TheBuffer As String)
On Error Resume Next
If InStr(1, TheBuffer, "string from notepad here...(be sure that you won't include strings with a dark box or else)") Then
MsgBox "it is infected with a lame worm..", , "a lame scanner"
End If
end sub
'
' so the routine tells us that we text-compare the buffer to a known string of the worm which we can get from notepad..
' if a match is found, then it alerts us that the file is a worm..
'
'
'==================================
' getting the strings using notepad 
'==================================
'
'
' i dragged and dropped w32.hllp.alco in my notepad..
'
' important.. be sure to get the strings in the middle of the file...
'================excerpt from w32.hllp.alco=============================================================================
;\SW9^{=7ZWE!N/ۮmA
L>ẉ5GY}w05  q$)RwkI%$_׭==
fl+x7F祇ЍGɩoE\v%ND80Dg]ILz+?y̻ݥqjm#=t7wAD=Lf

gFl5eCsMFJK;7|gQA  <!--prospect-->Y#_4_
<-> =&;&{/$G%A65OW)
%cus'
?%Mݬ{)]fM3If	yqu
u3Sss;S{oӖ:9+]a5	O
-!8,=

+=wU&L9I	
'=======================================================================================================================
'
' just get a number of strings that doesn't contain a dark box...
'
' not this: Y#_4_

' but this: Y#_4
'
' then put the selected string in our compare() routine..
'
'=======================================================================
Private Sub compare(TheBuffer As String)
On Error Resume Next
If InStr(1, TheBuffer, "Y#_4") Then
MsgBox "it is infected with win32.hllp.alco", , "a lame scanner"
End If
end sub
'=======================================================================
' now for the complete code..
'
'=======================================================================
sub scan(file as string)
On Error Resume Next
Dim lngbufferlen
Dim bbyte As Byte
Dim strbuffer As String
Open file For Binary As #1 ':::open as binary (!) important
DoEvents ':::tickle our cpu
Do While Not EOF(1) ':::read all
DoEvents ':::tickle the cpu again
Get #1, , bbyte ':::get each byte
strbuffer = strbuffer & Chr(bbyte) ':::store all the read bytes in a variable, convert them to strings
Loop
Close #1 ':::close our file
compare strbuffer ':::examine the buffer for strings
lngbufferlen = Len(strbuffer) ':::after that, get the size of the used buffer
strbuffer = Space(lngbufferlen) ':::clear all
End Sub
Private Sub compare(TheBuffer As String)
On Error Resume Next
If InStr(1, TheBuffer, "Y#_4") Then
MsgBox "it is infected with win32.hllp.alco", , "a lame scanner"
End If
end sub
'=======================================================================
'
' 
' the technique is beneficial if you wish to make a vbs/vbe/js/jse/ini/bat virus scanner...
'
'
'=======================================================================
' another technique
'=======================================================================
'
' in the previous technique, we're limited to only a few scan strings coz most of them contains dark boxes,
' only a few strings in between.. now here's a new technique...
'
' introducing AscB()
'
' Asc() function returns an Integer representing a character code corresponding to the first letter in the string..
' since we're dealing with binaries here, we'll use AscB()
'
' finding our scan code....
'
' here's a fuckin' code for you to fuck with.. 
'
'
'========================================================================================================================
Sub AscBSearch(file as string)
On Error Resume Next
Dim lngbufferlen
Dim bbyte As Byte
Dim strbuffer As String
Open file For Binary As #1
DoEvents
Do While Not EOF(1)
DoEvents
Get #1, , bbyte
strbuffer = strbuffer & AscB(bbyte) '::: the routine
Loop
Close #1
Open "c:\numscancodes.txt" For Output As #2 '::: the text file will contain only numbers which that will qualify
Print #2, strbuffer                         ' as scan codes..
Close #2
End Sub
'=========================================================================================================================
'
'i performed the routine in my w32.hllp.alco
'
'================excerpt from numscancodes=================================================================================
494949495049514949505451495049495552495157495553494955495457495154494957574957495050494955514949495049494957495249575050505
05049555549495251494949554950544949555149495149504949495049505349495750494953494951495749535248494949505551554955494949495
65249515549494951494950554949575351545450505455545449504949545448505649525152504950495549524950494950534951565050504949555
04949494952544955495049505749494952515250494949494950495649494949494954495050555255494956514950505351505055494950504954504
94949494953494950494949505450515049505450495050495349495349504954524950495749495450494950494949494949504950495049505050494
94957494949524953494949495049494957514949495052505150494950514953495049525649495450515653564956554950505249535155494950494
94949494953495149494949545051495049535049575254504950544953525749495049495349494950494957495455505249515449494955524949495
75057494949505549494949494952514949505050495455495552505050485150514950534949504949505049565554505049494949494952494957495
14949494949545049495154494949495049575050495150565450495049505054505549494949495048505050515756495349495649514949495049505
54949494955505149494949505249495049495449495755505551494949535649515250494950495251495057505750495257494949514849505550524
95749555449494949505350494949575049504950554949535349495049505654545050494949495050494949505052494949535051545549534957525
45451534949494950575049495049504954505649544949504949495051504955564949564954494950494949555151494949495453495249495054504
95052505057495057495449504950494951495149505657495050495349504954505049575649535549495353494949565052494949494949504949574
94950524949504949504950524951494949535057495055555550514949555656514949535656564949535056565656495350515657575350514957574
95051494949494951494953494949494953504949494949535051494949535051494949495051494949494951494953494949494953505252535349535
05153535353505149535353505149495252545249515051544950494949514950505249525150495049495049494949535554
'=========================================================================================================================
'so now we can choose any number of numbers.. or if you want, you can choose all of them.. :) :)
'
'
' and now for the code that uses the AscB technique
'
'
'
sub scan(file as string)
On Error Resume Next
Dim lngbufferlen
Dim bbyte As Byte
Dim strbuffer As String
Open file For Binary As #1 ':::open as binary (!) important
DoEvents ':::tickle our cpu
Do While Not EOF(1) ':::read all
DoEvents ':::tickle the cpu again
Get #1, , bbyte ':::get each byte
strbuffer = strbuffer & AscB(bbyte) ':::store all the read bytes in a variable, convert them to numbers
Loop
Close #1 '::close our file
compare strbuffer ':::examine the buffer for strings
lngbufferlen = Len(strbuffer) ':::after that, get the size of the used buffer
strbuffer = Space(lngbufferlen) ':::clear all
End Sub
Private Sub compare(TheBuffer As String)
On Error Resume Next
If InStr(1, TheBuffer, "0514949494950524949504949544949575550555149494953564951525049495") Then ':::from the excerpt..
MsgBox "it is infected with win32.hllp.alco", , "a lame scanner"
End If
end sub
'
' nice? i think so...
'
'=====================================================================================================================
' the standard i think..
'=====================================================================================================================
'
' when i sent mcafee win32.hllp.alco, they replied with a shitty analysis and a extra.dat file for detection...
' i examined the dat file and i found out that it contained hex strings.. i assumed that it was its scan code....
'
' so let's do some hexing....
'
'===============================
' identifying the scan code
'===============================
'
'
Sub HexSearch(file as string)
On Error Resume Next
Dim lngbufferlen
Dim bbyte As Byte
Dim strbuffer As String
Open file For Binary As #1
DoEvents
Do While Not EOF(1)
DoEvents
Get #1, , bbyte
strbuffer = strbuffer & Hex(bbyte) '::: the routine..convert the byte to hex representation
Loop
Close #1
Open "c:\numscancodes.txt" For Output As #2 '::: the text file will contain only hex numbers which is so nice to over 
                                            ' qualify
Print #2, strbuffer                         ' as scan codes..
Close #2
End Sub
'
'
'=============================a hex excerpt from w32.hllp.alco===========================================================
6533939F64647281C48DB16F29250381CDB827DDCBEF261031A20A90BE03A20AB5A6E11B3763171A2620A7370AD0A529D7DADA42A61B1BBABF4CB73D5C
BA1B3333ADFBCDFFD94D935B1197D1E5475312120DCAEDBDEED2781377E12F37A13DA64737D77DEBFD0E61F0FE0AB2B383253920DC58D76D31AB1FA41A
123FA21E69AEFF619F2041A1BD43B666C6CABAA47FBCA324AEEBBAEE5213069529DBF3BA465A9B3CDD86BBA26D1A6AF2D2B1C61EB9ACD758BA9236FBCA
51BE8F3B5D67E9D3810B93D33537A1B40F19FC3758317EB3EB763E855C3A13DA7551BADB9ADB5271D331421495B1EECC7DF93039B9D2DBC2FC16C6E7BB
595E879452045DC947ECB8A9F723229BC4A790FEFFC1DFB0B67E21E9793F1F1D2038DCEC5C6EE608D08DFE1BDB6AC1561F9FDE1CCD8D696FD9BF7D1F26
DA1E016DF24B1BF9E6BA3A160F7E65B032B5988DC81EB11FA5B926E9BAAEAD23BB19BA231AA3ACEB46E817B18DA61FAB51A51F37F66026BADA53FB84BE
BB6245DAE1F185A01FA13DD88619DE954FAFCBBDB886ED455FA565E6ABB83F9CC787849D7BC7733331C7680C3F726B7F9632953DF047ABCB4E1FD94C8D
54D753AD963EE2C259F63E13B8E187207DB8A7A5B7AD47D1D5931BABB1BF1FDB4CEA965CD7316736EBB06417273E5BAB12573196954327BDF7AA194375
53B23D98148D783745491E3F7DCF8D1D452D7245F05296ACBACD9B769BF699F3786D3D35B1F38D55AD735F109AE8BA93DDB1119EF4D3663ADA9D9BBBCF
5637E1757A523BDEBBDB175BC24D53B9956A7DBFEAD84AC23AB7181EF526AB666EAD781FF318FCCCDC836B59
'=========================================================================================================================
'
'
' with no further blah blahs..
'
'
sub scan(file as string)
On Error Resume Next
Dim lngbufferlen
Dim bbyte As Byte
Dim strbuffer As String
Open file For Binary As #1 ':::open as binary (!) important
DoEvents ':::tickle our cpu
Do While Not EOF(1) ':::read all
DoEvents ':::tickle the cpu again
Get #1, , bbyte ':::get each byte
strbuffer = strbuffer & Hex(bbyte) ':::store all the read bytes in a variable, convert them to hex numbers
Loop
Close #1 '::close our file
compare strbuffer ':::examine the buffer for strings
lngbufferlen = Len(strbuffer) ':::after that, get the size of the used buffer
strbuffer = Space(lngbufferlen) ':::clear all
End Sub
Private Sub compare(TheBuffer As String)
On Error Resume Next
If InStr(1, TheBuffer, "7ECB8A9F723229BC4A790FEFFC1DFB0B67E21E9793F1F1D2038DCEC5C6EE608D") Then ':::from the excerpt..
MsgBox "it is infected with win32.hllp.alco", , "a lame scanner"
End If
end sub
'
'
'========================================
' clean option
'========================================
'
' just delete the file... just like mcafee does..
'
'=========================================================================================================================
' the routines successfully detect a upxed compiled version of w32.hllp.alco..i recompiled the exact source
' code of w32.hllp.alco, upxed and run the scanning routine on it, sadly, i didn't show the fuckin' msgbox...the
' recompilation produced a "different" file, i guess..is it unique in vb6?..ask microsoft why...  but vb6 compiled files 
' contains fixed  chars(comments, company name blah) at the end
' of the file.. but getting them as scan codes won't be reliable enough...
'
' moreover, since the routines read all the bytes in a file, i can say that they are slow and eats up resources
' if the target file is large... i'm still doin' some things to optimize the routine... :) :)
'
' this is only good as i said for non-poly/metamorphic e-mail worms which are "fixed", don't recompile themselves.. those
' worms are commonly found in the wild...
'
'
' if you, newbie vb coder, wish to become a kaspersky, a norton, a mcafee or a solomon someday, this tute is for you...
'
' if not, this tute is still for you.. :)
'
' until next time......
'
'
'
'==================================
'references:msoffice vb help files
'==================================
'
'=================
'InStr Function    
'=================
'Returns a Variant (Long) specifying the position of the first occurrence of one string within another.
'
'Syntax
'
'InStr([start, ]string1, string2[, compare])
'
'The InStr function syntax has these arguments:
'
'Part Description 
'start Optional. Numeric expression that sets the starting position for each search. 
'                If omitted, search begins at the first character position. If start contains Null, an error occurs. 
'                 The start argument is required if compare is specified. 
'string1 Required. String expression being searched. 
'string2 Required. String expression sought. 
'compare Optional. Specifies the type of string comparison. If compare is Null, an error occurs. 
'                   If compare is omitted, the Option Compare setting determines the type of comparison. Specify a valid 
'                   LCID (LocaleID) to use locale-specific rules in the comparison. 
'
'Settings
'
'The compare argument settings are:
'
'Constant Value Description 
'vbUseCompareOption -1 Performs a comparison using the setting of the Option Compare statement. 
'vbBinaryCompare 0 Performs a binary comparison. 
'vbTextCompare 1 Performs a textual comparison. 
'vbDatabaseCompare 2 Microsoft Access only. Performs a comparison based on information in your database. 
'
'Return Values
'
'If InStr returns 
'string1 is zero-length 0 
'string1 is Null Null 
'string2 is zero-length start 
'string2 is Null Null 
'string2 is not found 0 
'string2 is found within string1  Position at which match is found 
'start > string2 0 
'
'Remarks
'
'The InStrB function is used with byte data contained in a string. Instead of returning the character 
'position of the first occurrence of one string within another, InStrB returns the byte position.
'
'=============
'Hex Function
'=============      
'
'Returns a String representing the hexadecimal value of a number.
'
'Syntax
'
'Hex(number)
'
'The required number argument is any valid numeric expression or string expression.
'
'Remarks
'
'If number is not already a whole number, it is rounded to the nearest whole number before being evaluated.
'
'If number is Hex returns 
'Null Null 
'Empty Zero (0) 
'Any other number Up to eight hexadecimal characters 
'
'You can represent hexadecimal numbers directly by preceding numbers in the proper range with &H. For example, 
'&H10 represents decimal 16 in hexadecimal notation.
'
'=============
'Asc Function
'=============      
'
'Returns an Integer representing the character code corresponding to the first letter in a string.
'
'Syntax
'
'Asc(string)
'
'The required string argument is any valid string expression. If the string contains no characters, a run-time error occurs.
'
'Remarks
'
'The range for returns is 0 - 255 on non-DBCS systems, but -32768 - 32767 on DBCS systems.
'
'Note   The AscB function is used with byte data contained in a string. Instead of returning the character 
'code for the first character, AscB returns the first byte. The AscW function returns the Unicode character code 
'except on platforms where Unicode is not supported, in which case, the behavior is identical to the Asc function.
'
'Note   Visual Basic for the Macintosh does not support Unicode strings. Therefore, AscW(n) cannot return 
'all Unicode characters for n values in the range of 128 - 65,535, as it does in the Windows environment. 
'Instead, AscW(n) attempts a "best guess" for Unicode values n greater than 127. Therefore, you should not 
'use AscW in the Macintosh environment.
'
'==============
'Chr Function
'==============
'   
'Returns a String containing the character associated with the specified character code.
'
'Syntax
'
'Chr(charcode)
'
'The required charcode argument is a Long that identifies a character.
'
'Remarks
'
'Numbers from 0 - 31 are the same as standard, nonprintable ASCII codes. For example, Chr(10) returns a linefeed character.
'The normal range for charcode is 0 - 255. However, on DBCS systems, the actual range for charcode is -32768 to 65535.
'
'Note   The ChrB function is used with byte data contained in a String. Instead of returning a character, which 
'may be one or two bytes, ChrB always returns a single byte. The ChrW function returns a String containing the Unicode 
'character except on platforms where Unicode is not supported, in which case, the behavior is identical to the Chr function.
'
'Note   Visual Basic for the Macintosh does not support Unicode strings. Therefore, ChrW(n) cannot return all Unicode 
'characters for n values in the range of 128 - 65,535, as it does in the Windows environment. Instead, ChrW(n) attempts
'a "best guess" for Unicode values n greater than 127. Therefore, you should not use ChrW in the Macintosh environment.
'
'============
'end of ref
'============
'
'===========================================================================================================================
'alcopaul
'[rRlf]
'03/18/2k2
'Las Islas Filipinas
'===========================================================================================================================