Interview with Q The Misanthrope
by Cicatrix
[September 1997]

How did you start out in computers?

In the 7th grade (1972), I was first introduced to a computer. Our school had a program where they took us to the University each Friday. We got to play on 110 baud teletypes. We learned BASIC. I knew then that I wanted a computer. I built my first computer: an Altair, 4K memory, No OS, in High School (1975). I sold it and built my second one: Processor Technologies S-100 mother board with 60K of Godbout memory, an IMSAI Front Panel, 2 Northstar 89k floppy drives with a Northstar Math Processor Board. It was a kick-ass system. I had Electric Pencil, BASIC, DEBUG and CPM. I was the only person to have a word processing system in High School (1976).

How and when did you start out in the virus scene?

I wrote my first Rabbit Program (Program that makes another Program then chains to it, fills the disk) in 1972 in BASIC. My first ASM virus was in 1992 (SNAFU) I only released it to Make-A-Fee. I now see that AVP now has it. I would like to get a copy of it, as none exist on my systems.

Have you written viruses? If so which would you like to take credit for?

SNAFU with 13 variations. (See above)

Gold-Bug, Da'Boys and XYZ or Pure.b as it is now called. (All three were released as a package that worked together) Gold-Bug was to be the best of all viruses with all sorts of features. Although Da'Boys seems to travel the best.

A bunch of variations on the XYZ virus followed. Pure, Purest, PurePlus, Funked, MUMZI!, XYZ-V2.

De'Bugger would blow the CMOS if the virus was debugged.

Shimmer1 and Shimmer2 were cool in that they were BAT, COM, EXE and Boot sectors all in one.

Q-Ball and 8-Ball were cool in that they did not have an executable extension (Not .EXE .COM or .SYS etc.)

Pure'cyst was my attempt to make a CMOS modifying boot sector virus that infected both MBR and DBR.

Purple Cum was a MBR and DBR boot sector virus that did not change the 655360 byte value in CHKDSK.

I_Owe was strange in that it only infected C:\IO.SYS

Winstart was to show a hole in the MS Windows program. (You shouldn't automatically launch a file.)

Winstart.Ditty was just a simple Batch File Worm.

Winstart.Ramble was a Batch File Worm released from a 123 Document.

Da'Boys.Q2 another variation.

Morality Play was to be a Good Virus and show the evils of the AV community.

HighJaq was a cool virus that was for Hacking a PC.

You_got_it and You_name_it were Windows 95 Boot sector viruses. (It might be in 29A-2.)

HMABoot will boot straight into HMA Memory. (It should be in 29A-2.) NULSpace is the newest and coolest way to hide your Virus. (It should be in 29A-2.)

Borg uses NULSpace, Winstart and You_got_it technology.

How do you name your viruses?

God tells me. I don't know. Whatever I feel like at the time. Da'Boys was written for the Dallas Cowboys winning the Super Bowl (I hate football.) Gold-Bug because the only string I could include was AU (chemical element for Gold) Purple Cum got it's name because it had to have RPL 3 bytes after the INT 2f handler for the 4A06h feature of INT 2f to work. Shimmer was named after Saturday Night Live's Television commercial. Pure'cyst was a play on words. HighJaq because your PC could become completely High Jacked (complete security invasion.)

Which programming languages do you know?

8080, 6800, 6502, 8086, C, Pascal, FORTRAN, APL, and BASIC.

What programming language do you like using the most?

Assembly of course.

Are you a member of a VX group?

More like a guest writer for 29A.

Which AV software do you like/respect the most? Which the least?

AVP rules. Make-A-Fee sucks.

What are your goals (VX wise)?

Do more bizarre stuff.

What is your view on the continuous 'war' between VX and AV.

I just fueled the flames with NUL Space residency. Good luck AV in solving this problem.

Where did you get you handle? What does it mean?

From Star Trek The Next Generation. Deja Q episode.

Picard: "Return that moon to its orbit."

Q: "I have no powers! Q, the ordinary!"

Picard: "Q, the liar! Q, the misanthrope!"

Q: "Q, the miserable, Q, the desperate! What must I do to convince you people?"

Worf: "Die."

Q: "Oh, very clever, Worf. Eat any good books lately?"

It doesn't mean anything.

What is your view on Virus Creation software (e.g. VCL, PS-MPC etc.)?

Lame to use, hard to write.

What is your view on macro viruses vs. assembly or HLL viruses?

I haven't yet ventured into the macro world. Don't really think I want to. I love tight code. You can't get that with macros.

Have you ever confirmed one of your viruses 'in-the-wild'?

Gold-Bug and Da'Boys. I didn't put them there. See what happens when you give loaded guns to idiots.

Which VX E-zine do you like to most? Which the least?

The most is the next one that comes out. I can't get enough of them. The least is in non-English because I don't know any other written language.

Which individual or what group do you like/respect in the VX world?

VLAD comes to mind. I respect anyone who pushes the envelope, takes risks and invents something new.

In the AV world?

Eugene Kaspersky seems to have his act together. He can analyze my code pretty good.

Which individual or what group do you like/respect outside the VX or the AV world?

I respect anyone who pushes the envelope, takes risks and invents something new. The Wright brothers, Montgolfier brothers, Edison, the person who invented the zipper or bubble gum, etc.

What is your view on destructive payloads in viruses?

I don't like destructive payloads. Trash the data is bad. Mess with the user is good. Make the hardware malfunction weirdly is good.

Do you think there is such a thing as a 'good' virus?

Been there, done that. I made a virus for this very question. The Morality Play virus will only attach itself to software copied to floppy that is executed on another PC (different BIOS date and drive C: serial number) If the pirated software is over 90 days old it would delete itself. It stops software piracy. The morality play was whether the AV community would stop it with the premise: "If something immoral is stopping something that is illegal, should something good interfere with it and allow that which is illegal to continue?"

What do you do in 'real' life?

This is real life. I aint in cyber-space yet. Part of my work involves removing viruses and being a virus expert also doing network security.

Do people outside the VX scene know what you do (parents, girlfriend etc.)?

No, not a one. Everyone in prison will tell you they are there because they told someone.

Do you do other computer stuff outside VX (Hacking, phreaking, warez etc.)?

Stopped phreaking in 1977. Didn't like the Sheriff and two Ma'Bell guys showing up at my accomplices house with a warrant to search for his black box. Kinda put me off phreaking. But I did hack the credit bureaus. (TRW, CBI, Trans Union and Chilton) Made about 30+ factitious people with wonderful credit. Went to prison. Not fun. What is warez? Is it just breaking software? If that is what it is then I still do that.

Should viruses be illegal? Is there a difference between creation and spreading?

I always assume that most everything I do is illegal. I was surprised to find otherwise. Is there a difference between making and using a gun? Guns can be fun and safe. Viruses can be fun and safe. Guns can kill people. Viruses can kill data. It all depends on the idiot using it.

Describe the perfect virus.

Can't be detected or removed. When 29A-2 comes out you will be able to play with a perfect virus (NULSpace.)

What is your view on Windows (95)

A lot better that Windows 3.11.

What is your advice for people just starting out?

Read every VX E-Zine. Try something, change it and keep evolving it until it works very well. Learn assembly. Learn how to optimize code. Read Ralf Browns Interrupt list and all the files that come with it.

Where can you be reached if at all?

q_the_misanthrop@hotmail.com No Spams please.

Any greets?

I am a loner so I don't know many people. Qark, Quantum and Sandman come to mind.

Any other comments?

Yes. To Sarah Gordon: It is very obvious why Virus writers write Viruses: it is a power trip, no other reason. It has nothing to do with adolescence, I am an old fart, I know better. The reason the average writer seems to stop is because they normally are not smart enough to come up with something new.

Short responses to the following names or words:

    - Dark Avenger          Rules
    - Dark Angel            Rules
    - Sarah Gordon          See above
    - Fridrik Skulason      No Comment
    - Alan Solomon          No Comment
    - WordBasic/VBA         No Comment
    - VDAT                  Rules
    - VSUM                  Sucks
    - Assembler             Rules
    - NuKE                  Rules
    - Phalcon Skism         Rules
    - VLAD                  Rules
    - Immortal Riot         Rules
    - Trident               Rules
    - Polymorphic           Rules
    - Stealth               Rules
    - I hate......          Rules
    - I love......          Sucks
    - Internet              Rules
    - IRC                   Sucks
    - Sex                   Rules and Sucks
    - World War 3           No Comment

From what part of the world are you?

The land part. It is currently called the United States of America.

Would you ever release a virus creator?

I kinda did. Gold-Bug had something like 14 options to turn on and off so it could compile into different forms.

Have you done any tutorials?

Two, HMA residency (something I do a lot) and Hide and Seek: Hiding in NUL-Space. Both should be in 29A-2.

Have you made any engines (polymorphic, mutation)?

No. Gold-Bug was Oligomorphic (Only 2 bytes constant.)

What are future projects VX wise? Are you still active?

Don't know. Yes, I am still active but on the reserve list.

Describe yourself.

Male, 38, divorced, remarried, one kid, 6 felonies, 2 patents, dull as shit.

Anything else.

Give this a try:

    Windows 95, DOS Box, MD\"NUL         "

Fun wasn't it.

Try this as well:

Windows 95, DOS Box, MD\ADMIN$, My Computer, Drive C:, Right Click on ADMIN$, Sharing, Share as ADMIN$, Full access, No password, OK, DOS Box, RD\ADMIN$. Your PC is now wide open to anyone on the network using NETWATCH.EXE, Administer, Select Server and choose your PC's name. That might be a good payload for a virus.