Interview with Lord Julus
by Renegade
[January 1999]

Normally nobody gets into the VX by accident.When and especially why did you choose to enter upon this career ?

> Hello!! First of all, lemme tell you I am an "always learning" kind of guy. By this I mean I always like to search, research, discover and test new things. And, as programming represents what I like to do mostly, I keep on searching and researching this area. Virus writting offers me the chance to try all diferent aspects of programming... By virus writting and researching I get in touch, sort of speak, with all insides of the computers. We got to admit that because of viruses, many new technologies for data storage, data encryption and security appeared. So, I choosed being a VXer because when you want to learn you need a goal. The virus provides me that goal... By it, I learn...

What do you think about the virus writer's position in this society ? Why aren't they accepted ? Is it only a question of ignorance ?

> The problem was discussed over and over again and as we speak I am writing an article called "Perusing the virus writer mentality" which will be ready soon... The virus writer's position in the society will _always_ be the one of a paria... This because in the human mind, even if there are levels off good and levels of bad, sometimes when it comes to consider somebody people seem to throw everybody in the same bucket... If you kick a priest you are really a bad guy... If you break a window... still the bad guy... It doesn't matter that one action is more cruel than the other. So, as long as the virus will exist as it is (a piece of code that attaches itself to other programs' images), the virus writer will be considered a bad person. He will always be the one that invaded honorable people's computers... And this way of thinking comes, yes, sometimes out of ignorance. If one is not smart enough to make a virus, he sure feels preety bad when he realizes somebody else was capable of making something that conquered his system. I say that yes, its a certainity that the virus writer will always be considered an anti-social person.

"Lord Julus", why did you choose this name ?

> The story goes like this: three years and a half ago, when I first discovered the IRC I didn't quite know anything about it... So I looked up the help and made a /list and then I joined a channel which had more people logged on to... Suddenly I saw all the people that where there had nice nicks like: Sir something, Count, Marquis, Baron, etc... Anyway, I quickly typed /nick Lord Julus... Actually I wanted to be Julius, but so it came... ;-) Anyway, I stick to that... I also used another nick from time to time and that's Viking Child...

Which programming languages do you use ?

> Mostly ASM. I'm also a Borland Pascal programmer. I use C++ only for strange things... Lately as I moved towards win32 I started using Visual C++ and Delphi... But still ASM is my love... I sometimes use Visual Basic too for some quick visual thigies...

Where do you live and how is the situation of the virus scene in your land ?

> Romania, that's my country... The situation of the virus scene here is that it doesn't exist ;-(( The only virus writers which I know of are Virtual Daemon (leader of SLAM), Alex (writer of Alex viruses), RP & MuRPhy (authors of RP.family and Dodgy). But only I and VeeDee are curently joined to a virus group and we share knoledge. Virus makers still exist (there are quite many romanian viruses), but I haven't got a clue who they are... But we have some AV dudes who make some romanian products (RAV and AVX - rav*.exe and avx.exe for retro routines ;-)))))

Tell us something about your last projects...The Undertaker and, of course, Manowar...

> I finaly decided I completely move to win32, therefore I left unfinished most of my DOS work... I uploaded on my page my Whiplash viruses, but not the multipartite Whiplash, which only had the BOOT infection routine ready. The MOF polymorphic engine is still one thing I am proud of but it didn't get used probably because of the way I made it into a demo and hard to take out... Anyway, the demo files generated by MOF are "recognized" by AVP as MbrKiller virus... Hahahaha... and there is nothing to raise even 1 flag there!!! MOF32 is under work and almost ready... It's a very neat poly I based my second poly article on... I use some smart arrays to generate any kind of instructions...

The win32 work consists until now of two major projects:

1. UNDERTAKER is a win32 virus that does this:
   - searches for the Kernel32
   - searches for windows APIS
   - locates 3 files in current directory, windows directory and system directory and infects them by increasing the last section
   - it is not polymorphic, but it uses a FPU encryption (actually FPU.Taylor which calculates EXP(x) and uses the result in encryption)...
   - I think it works ok on all win32 platforms... but I didn't check it on something else than win95...
   - has no payload, but a message window
2. MANOWAR is a win32 ring0 resident virus:
   - it only works on win95/98
   - it gets ring0 by modifying the IDT
   - uses VxD calls to get heap and goes resident
   - hook the File System API
   - on every .EXE file open it infects them
   - uses SEH frame and error checking
   - has no payload or message

> Also I have under work a great project called PExIC (Portable Executable Infector Creator) which is a win32 virus mass creator. It will be pretty nice! For now I finished only the IDE fully written in ASM...

> Now I work on a new virus... I realized that Ring0 cannot offer a WinNT compatibility therefore I am trying to make a process spawner, combined with a new technique I found (using the Process32First and Process32Next to locate the running processes and as they close they get infected)... It'll be out in a month or so...

Where do you search for inspiration for writing something of new ?

> I guess I let myself go with the flow... If I hear that maybe something new is possible, I try to make it... Usualy I use a lot of books and text files I have info in... I try to gather as much info as I can...

You are a member of SLAM. Other groups you've worked in/with ? Are there particular goals you and SLAM want to achieve ?

> Yep... But the fact is that I don't know how much the SLAM group will still be as it is now... We are thinking to start over under a different name... Who knows what is going to happen... I didn't work with anybody else (Mr.Sandman published my first article in 29A#2), I tried to form my own one year ago (HVC - Hottest Virus Congregation), but I couldn'd find people at the time so I gave up... Here people are more shy...

Will the 32-bit OSs prevent beginners from learning asm and writing viruses ? Won't they rather choose the "easy" way of macro than studying asm ?

> 16bit asm is also difficult. Actually the ones who start directly by studying the 32bit programming will learn it faster then those who are masters of the 16bit... That's because the old 16bit environment pulls you back... And, I have to say: 32bit programming is WAY more easy than 16 bit programming... I mean, let's be serious... you don't have to remember difficult parameters and many interrupt numbers, or ports... All you need is a book with the API names and argument (Win32 help does it), push arguments on the stackand call it by the name (which is more than logic). Also all the addressing modes possible makes it way more easy!!! And the tricks... well every system has tricks... once you learned the basics finding tricks is a game... So, I think that win32 viruses will overrun the 16 bit viruses in less than 2 years... And one thing about macro: I HATE IT!!!!!

Have you ever considered to move totally to other scenes like hacking or something like that ?

> Well... no... I think hacking is less fun... and more time consuming. I think I'll stick to VX for now...

Are there things you dislike within the VX ?

> Yes: the fact that sometimes there are intra-VX fights (virus writers or virus groups have a sort of a fight for supremacy). This only leads to group breaks, members flee and a general impression that the VX scene is a little childish. Conclusion: we don't have enough unity... Also I don't like at all destructive activity. Viruses are fun, but only until they kill...

Special criteria of choosing your virus' names ?

> Nope... Just what gets thru my mind... Manowar is the name of my all time favorite heavy metal band... I am thinking of making a Manowar serie...

Does the VX have an influence on your life/friends ? Has it changed ?

> No! My life didn't change a bit... I have thousand of friends, a gorgeous girlfriend named Moniue, I have enough time to go to the sea-side, mountains, bars and so... I think it's a good equiliber (how do I spell this? ;-))) between my life and my virus research...

Do you want to make an appeal to anyone ?(beginners, ex-writers, whole scene)

> I think it's a human quality to like to make an appeal. Those who don't want it are introvertites or selfish persons... Yes I like it... Sometimes maybe too much. I admit it's a bad characteristic of mine... But I always admit that in my stuff there exist the knowledge of hundred others I admire and respect... Any beginner "likes" people who seem to know more... I remember when I was a completely beginner and I looked up at people which I find out later that were not quite as I imagined... So I like to tell people exactly what I know, where do I know it, why is it useful and how to use it... If they like it or not... it's their bussiness...

What else do you do when you aren't coding a virus ?

> I graduated the college in 1997 and I work now. I also write SF stories and poems... I adore the actress Sandra Bullock and I have a lot of posters with her... In most of my free time I listen music (Manowar, DIO, Rainbow, Deep Purple, Black Sabbath, etc...).

Where can you be reached ?

> My e-mail is: lordjulus@geocities.com

> My VX page is here:

> http://members.tripod.com/~lordjulus
> http://members.xoom.com/Julus [mirror - may not work]

> My poems page:

> http://www.geocities.com/Athens/Forum/1395

Any greetings ?

> Firstly the entire SLAM group who adopted me ;-))))) Then:

> The Unforgiven
> Mr.Sandman
> Darkman

> Gr8 guys!!!

Thank you for your availability

> Always! Feel free to correct any spelling or grammar mistake...

> CU!!!

> Lord Julus.