> Name: NoMercy Excel Generator
> Creator/Origin: Foxz / Indonesia
> AKA : NEG
> Type: Virus Creation Tool

> Known versions:

> > NEG 1.0 - January 1998

> Features:

> > Released by the creator of Crazybits Virus Construction Kit (CVCK) this is the world's first Excel Macro Virus creation kit. It features several payload and creates .BAS source files.

> Name: NOP Virus Creator
> Creator/Origin: Billy Belcebu / Spain
> AKA : NOPVC
> Type: Virus Creation Tool

> Known versions:

> > NOPVC 0.666 - November 1997
> > NOPVC 1.666 - December 1997

> Features:

> > Unreleased virus creation tools by some members of DDT. The development of the releases was explained in Billy Belcebu's article on the demise of DDT. Version 0.666 was based on routines from IVP and NRLG with some payloads added. Version 1.666 was similar although the virus engine was based on Wintermute's Apocalyptic virus from 29A#1.

> Name: NuKE's Randomic Life Generator
> Creator/Origin: Azrael / Argentina
> AKA : NRLG
> Type: Virus Creation Tool

> Known versions:

> > NRLG 0.66B - June 1994

> Features:

> > NuKE's Randomic Life Generator is an Argentinian virus creation tool released by a NuKE member who calls himself Azrael. Unlike PS-MPC's command line format it uses a user friendly interface similar to VCL and BW. More than 100 viruses produced with NRLG are known and most of them are detected by today's anti-virus products.

> Name: Odysseus Macro Virus Construction Kit
> Creator/Origin: Dark Shadow / Malaysia
> AKA : OMVCK
> Type: Virus Creation Tool

> Known versions:

> > OMVCK 1.0 - March 1998

> Features:

> > Generic tool that creates macro virus source codes (Word Basic) for Word For Windows 6 -7.

> > From the author's documentation:

> > "This construction kit produces an error free macro virus source code so that persons incapable of programming viruses can compile it into a working macro virus unlike some kits that produce code that cannot be compiled. Anywayz, you can modify the source code if you want to but please do not remove the [Created With Odysseus Version 1.0] marker in the macro virus source code. I spent 3 whole days on the project, at least I could do with some credit."

> Name: Overwriting Virus Construction Toolkit
> Creator/Origin: Virtual Daemon / SLAM / Unknown
> AKA : OVCT
> Type: Virus Creation Tool

> Known versions:

> > OVCT 1.0 - April 1997

> Features:

> > From the author's documentation:

> > "Overwritting Virus Construction Toolkit is a virus source generator program designed for makeing overwritting virii. The program is using a external configuration file (specified as the 1st parameter) for creating a virus. With this program can be created only overwritting virii!"

> > > -overwritting COM infector
> > > -save/restore file time/date/attributes
> > > -change current directory (to '..' for more infections)
> > > -checks for previous infections
> > > -COMMAND.COM infection
> > > -INT24h handler
> > > -Anti-Debugger
> > > -Encryption
> > > -Anti-Anti-Virus
> > > -create a .BAT file to compile fast your virus

> Name: Poison In A Pretty Pill
> Creator/Origin: Anti-State Tortoise / Unknown
> AKA : PIAPP
> Type: Virus Creation Tool

> Known versions:

> > PIAPP 1.0a - Unknown

> Features:

> > A macro virus generator with user selectable features by the creator of EMVCK:

> > > Infectious Grooves:

> > > - FileSaveAs Infectious
> > > - AutoOpen Intectious
> > > - FilePrint Infectious

> > > Copy Options:

> > > - Use Organizer Copy
> > > - Copy via Component Import

> > > Other Fun Stuff

> > > - Make HelpAbout Display Message
> > > - Replace Words In Active Document
> > > - Relabel harddisk
> > > - Randomly Knock Windows Down

> Name: Powerpoint Macro Generator
> Creator/Origin: Knowdeth / USA
> AKA : PMG
> Type: Virus Creation Tool

> Known versions:

> > PMG 1.1k - June 2000

> Features:

> > A DOS based virus generator for Powerpoint macro viruses. A limited number of user selectable features are available. By the creator of TSWSVK, SABV, WISK and WVSG. It was released with Metaphase Zine #2.

> Name: Phalcon-Skism Mass Produced Code Generator
> Creator/Origin: P/S / USA/Canada
> AKA : PS-MPC
> Type: Virus Creation Tool

> Known versions:

> > PS-MPC 0.90B - July 1992
> > PS-MPC 0.91B - August 1992

> Features:

> > The American virus group competing with NuKE, Phalcon/Skism, quickly answered the challenge of VCL and published its own virus generator, the Phalcon/Skism Mass-Produced Code
> > Generator or PS-MPC in issue 8 of 40Hex.
> > PS-MPC has been written by a member of P/S known as the Dark Angel. PS-MPC is considerably more functional than VCL, though not as showy. PS-MPC does not feature a user interface for it is used via an ASCII configuration file.
> > It is possible to make considerably advanced viruses with the PS-MPC. It is capable of creating memory-resident viruses which infect both COM- and EXE files. Furthermore, the viruses can be provided with a versatile encryption layer, which makes finding them a little more difficult. PS-MPC does not add activation routines to the viruses it creates as a default, but since it produces ready-made, well-documented assembler source code, those can be later added easily by even a novice programmer. On all accounts, PS-MPC is a more functional program than VCL.
> > Hundreds of viruses created with PS-MPC are known and after Aristotle (former NuKE) released his Metric Buttload of Code Generator which produced hundreds of slightly mutated PS-MPC viruses, the VX-scene was swamped with "variants of PS-MPC".

> Name: Primitive Trivial Generator
> Creator/Origin: ByteSV / Russia
> AKA : PTG
> Type: Virus Cloning Tool

> Known versions:

> > PTG 0.02 - February 2000

> Features:

> > Utility that produces varying ASM source codes of the Trivial family viruses.

> Name: Random Anarchy HTML Constructor
> Creator/Origin: 1nternal / Australia
> AKA : RAHC
> Type: Virus Creation Tool

> Known versions:

> > RAHC 0.1 - December 1998
> > RAHC 0.2 - March 1999

> Features:

> > Author's note:

> > > HTML.rahC is an HTML file constructor which will construct HTML files containing VBScript routines in accordance to options chosen in a form displayed in an HTML document. The scripts generated have the capability to duplicate the HTML file they are contained in into other HTML documents in a virus like manner. HTML.rahC therefore, is not a virus, nor a virus constructor, and should not be detected as such, if the HTML files generated have the capability to replicate, this is the users doing, much like a macro written in Visual Basic, and only the generations should be detected as viruses. The engine is written entirely in VBScript and due to the encoding of the script, requires VBScript version 5 to execute. This is available for download from http://msdn.microsoft.com/scripting/. The generations generated are also entirely VBScript. Although it would have been possible to write the engine using VBA, Delphi, C++, JScript or any other language, VBScript was chosen for several reasons:

> > > - The interpreter nature of the language allows for plugins to be included and edited without having to re-compile.
> > > - VBScript is in my opinion probably the easiest language to use ActiveX controls with and is not as strongly typed. This made it the best choice for generated code, and it seemed more logical to have the generated code in the same language as the engine itself.
> > > - The syntax of VBScript seemed easier to generate than that of JavaScript.
> > > - The file system routines generated make use of ActiveX which is only available to IE, and IE is also the only browser to support VBScript. Other browsers will ignore the script, as they wouldn't be able to execute it anyway.

> > > However, JavaScript generations may have their use, as they are more universally supported, they would however not be able infect in browsers not supporting ActiveX. They could still however contain 'payloads' with custom triggers that would be able to execute in other browsers. I may, or may not, release a JavaScript version of the engine in the future with the capability to generate JavaScript based code.

> > Author's note on re-release (0.2):

> > > This a re-release of HTML.rahC, which no longer requires VBScript v5.0 because the encoding is no longer present. All functionality is still present, however this means that the engine will now function under VBScript v3.0 or above. I have also removed the extra items from the package, and the programming reference, because by looking at the source it should no longer be necessary.

> > > Properties | Generation Name: ID Tag: Generation Seed: (leave blank for random)
> > > Anti-AV Reghacks | Disable 'Current User' My Computer Zone Disable 'Local Machine' My Computer Zone
> > > Execution Probability | Only when offline (needed for FSO operations) Everytime On day of month On day of week Random 1/ Misc {If then}
> > > Code Options | Generate Junk Comment Lines Generate Junk Comments Random variable names
> > > Infection Probability | Only when offline (often not necessary) No Infection Everytime On day of month On day of week Random 1/ Misc {If then}
> > > File access method | Read Host using CreateTextRange(). (Required for default infect file routine) Text File Text Stream Random
> > > Infection | Select at least one *.HTML *.HTM *.HTT *.HTA Misc Extension
> > > Infect Folder Routine | Default CustomA (N/A) CustomB (N/A)
> > > Infect File Routine | Default CustomA (N/A) CustomB (N/A)
> > > Infect Folder Options* | Check if folder exists Check if file already infected
> > > Traversal | Single Directory Only Parent Directories
> > > Loop Options | Do...Loop Until Do...Loop While While...Wend (Will endless loop if ActiveX prompt fails)
> > > Infected Check | Test String Readline
> > > Target Directories | Infect Current directory Infect Hard Coded Directories (enter only as many as needed)
> > > PayLoad Trigger | Only when offline (often not necessary) Only Before Infection After Infection No Payload Everytime Trigger on day of month Trigger on day of week Random Trigger. 1/ Misc Trigger {If then}
> > > PayLoad Routine | Msgbox StatusBar Redirect URL Change Registry Key {RegWrite( )} Delete File: Misc Payload (Recommended) Type here a custom payload.

> Name: Replicating Batch Maker
> Creator/Origin: Wavefunc / USA
> AKA : RBM
> Type: Virus Creation Tool

> Known versions:

> > RBM - January 1997

> Features:

> > This creator uses a HTML, Java and frames capable browser to create batch file viruses. It was released as a follow-on to the Incredible Batch Bug maker (IBBM).

> Name: Resi Duo
> Creator/Origin: Cordoba / Argentina
> AKA : --
> Type: Virus Creation Tool

> Known versions:

> > Resi Duo - November 1995

> Features:

> > Included and integrated in the Resi Duo VX E-zine, this tool has user selectable anti AV procedures and generates compilable ASM files. Made by Code Rebel and Andromeda.

> Name: Satanic Brain
> Creator/Origin: Azrael / Argentina
> AKA : VCLSAT
> Type: Virus Creation Tool

> Known versions:

> > VCLSAT 1.0 - October 1993

> Features:

> > Satanic Brain Virus Toolkit is basically a cracked/hacked and translated version of VCL released by NuKE member Azrael. The following year the author released NuKE's Randomic Life Generator (NRLG).
> > Most viruses produced with Satanic Brain scan as VCL products.

> Name: Super Appending Batch VCK
> Creator/Origin: Knowdeth / USA
> AKA : SABV
> Type: Virus Creation Tool

> Known versions:

> > SABV 1.1k - October 1998

> Features:

> > Like BVGEN, IBBM and RBM this program generates replicating appending batch virus programs from user-specified parameters. By the creator of TSWSVK, PMG, WISK and WVSG

> Name: Sensi
> Creator/Origin: Del_Armg0 / France
> AKA : --
> Type: Mirc Worm Creation Tool

> Known versions:

> > Sensi 0.2 - May 1999
> > Sensi 1.1F(rench) - June 1999
> > Sensi 1.1E(nglish) - July 1999

> Features:

> > Tool capable of creating trojans, backdoors and worms for Mirc users. Release 1.1 is available in a French and English version.

> Name: Simple Batch Virus Maker
> Creator/Origin: Duke / Russia
> AKA : SBVM
> Type: Virus Creation Tool

> Known versions:

> > SBVM 0.01 - January 1999
> > SBVM 0.02d - April 1999

> Features:

> > Version 0.01of this simple Russian virus maker was released with issue #4 of the DVL e-zine. It is a CLI operated generator that creates batch viruses through a user configurable .CFG file. Version 0.02d was released with issue #6 of the DVL e-zine and is based on a Word 97 template and also creates batch viruses.They were created by the author of DPOG, DPVG, CTMWVCK and DVL. A hacked version of release 0.02d of this kit is known as MSCC.

> Name: Simple COM Virus Generator
> Creator/Origin: Respawned Evil / Russia
> AKA : SCVG
> Type: Virus Creation Tool

> Known versions:

> > SCVG - December 1999

> Features:

> > Very unstable (still found no working copy) virus generator that creates COM viruses using a configuration INI file.

> Name: SiCem Virus Creation Lab
> Creator/Origin: SiC / Unknown
> AKA : SICEM
> Type: Virus Cloning Tool

> Known versions:

> > SICEM - March 1994

> Features:

> > Very simple generic virus generator that creates viruses that are similar to the viruses created with IVP.

> Name: $moothie's Macro Virus Creator 2000
> Creator/Origin: $moothie / Unknown
> AKA : SMVC2000
> Type: Virus Cloning/Creation Tool

> Known versions:

> > SMVC2000 1.0 - July 2000
> > SMVC2000 2.0 Beta - August 2000
> > SMVC2000 2.001 - September 2000

> Features:

> > While version 1.0 only has a limited number of user selectable features versions 2.0 offers multiple infection techniques, stealth, polymorphism, retro functions and multiple payloads. Version 1.0 has lengthy graphical startup and shutdown effects (version 2.0 shutdown effects only) and both should produce ASCII source codes on the user's desktop.

> Name: Senna Spy Internet Worm Generator
> Creator/Origin: Senna Spy / Brasil
> AKA : SSIWG
> Type: Script Worm Creation Tool

> Known versions:

> > SSWIG 2000 1.0 - February 2000

> Features:

> > Similar to VBS Anthology (Evolution), Windows Scripting Host Virus Generator and The Simple WinScript Virus Kit this kit creates VBS script files. Similar to VBS Anthology (Evolution) these scripts have worm like features and work thru e-mail.

> Name: The Simple WinScript Virus Kit
> Creator/Origin: Knowdeth / USA
> AKA : TSWSVK
> Type: Script Virus Creation Tool

> Known versions:

> > TSWSVK 1.1k - June 1999

> Features:

> > This program generates replicating overwriting WinScript viruses from user-specified parameters. By the creator of PMG, SABV, WISK and WVSG

> > Author's note:

> > "This is a "Simple" menu drive visual application for creating WinScript virii "Also Know as" VBS virii. This program generates replicating overwriteing Winscript virus programs from user-specified parameters. Basicly "EG. Fill in the Blank and press Make Virus" :-) These Virii are based off the of The modifyed form of VBS.Rabbit virus AS ID by AVP - "plug for _rod_ " ;-) Specail thanks to Lord Natas/CodeBreakers for makeing VBS.Rabbit in the first place and getting the whole VBS thing started! Hopefully some one will get a copy of this and pick up a intrest in a new programing style of HLL."

> Name: Skywalker's Virus Creation Laboratory
> Creator/Origin: Skywalker / Russia
> AKA : SkyVCL
> Type: Virus Creation Tool

> Known versions:

> > SkyVCL 1.0 - August 1996

> Features:

> > This generic DOS based virus creator from Russia.has several user selectable payloads and has the option of creating appending COM viruses, encrypted COM viruses or resident EXE viruses. A Russian and English translated version are known.

> > Translated version.

> Name: Sphinx Virus Generator
> Creator/Origin: Sir-X / Philippines?
> AKA : SVG
> Type: Virus Cloning Tool

> Known versions:

> > SVG 1.0 - June 1998

> Features:

> > Like Virugene by the same author this creator is basically a dropper tool that creates viruses in three different (user selectable) variants. It uses datafiles and personalized copies of TASM and TLINK and to decrease chances of detection it uses the Golden Cicade Abnormal Engine (GCAE) and ICE (Compression engine).

> Name: SkamWerks Labs Word Concept Construction Kit
> Creator/Origin: SkamWerks / Skammy
> AKA : --
> Type: Virus Creation Tool

> Known versions:

> > Word Concept Construction Kit 1.0a - January 1997
> > Word Concept Construction Kit 1.0b - January 1997
> > Word Concept Construction Kit 1.1 - February 1997
> > Word Concept Construction Kit 1.1b - February 1997

> Features:

> > This 32-bit (Win95/NT) Microsoft Word For Windows macro virus or trojan creator uses the Win95 wizard technology to create viruses or trojans. Many options, like what Auto macros to use, are selectable. A limited number of payloads is provided. For the more advanced user it is possible to use a design shell to create or modify macro viruses. The program can create both source codes or infected documents.

> Name: The Macro Access Kit
> Creator/Origin: Angelskitten / Unknown
> AKA : TMAK
> Type: Virus Cloning Tool

> Known versions:

> > TMAK 1.0 - June 2000

> Features:

> > Generic cloning tool that creates/modifies a preset source code for Access 97 viruses by using HTML/Forms coding. It was released with Metaphase Zine #2.

> Name: The Pascal Overwriting Kit
> Creator/Origin: GzR / Unknown
> AKA : TPOK
> Type: Virus Cloning Tool

> Known versions:

> > TPOK 1.0 - August 2000

> Features:

> > This simple kit creates varying samples of .PAS source codes of overwriting viruses. Activation day and displayed message text are user selectable. To create a working virus some modification of the code by the user is required. By the creator of IBWK.

> Name: Ultras Construction Kit
> Creator/Origin: Ultras / Russia
> AKA : UCK
> Type: Virus Creation Tool

> Known versions:

> > UCK 1.0 - April 1998
> > UCK 1.0b - May 1998
> > UCK 2.0 - November 1998

> Features:

> > Virus creation program that creates macro viruses for Word 6.0 - 7.0. It has several user selectable features and payloads. Release 2.0 is a bugfix and adds 2 payloads.

> > Author's notes:

> >     Here is and my first constructor, it very small but does viruses with
> >     good payload below I their describe.

> >     Infect: AutoOpen - this macros main and its no in menu.
> >             AutoClose - additional macros.
> >             AutoNew - additional macros.
> >             AutoExit - additional macros.
> >             AutoExec - additional macros.

> >     KillAV: Destroys all popular AntiVirus.

> >     PayLoad: New Icon - changes icons on document.
> >              Kill Desktop - not display icons on desktop.
> >              Exit Windows - Exit Windows.
> >              Document Info - Puts in field of the document.
> >              Kill Windows95 - deletes vmm32.vxd hereon kill windows95.
> >              Message Box - Message Box.
> >              Set Password - puts password on your choice.
> >              Registers in Word - registers word on your name.
> >              Random Password - puts free password.
> >              Kill Windows Files - deletes folders windows.
> >              Kill Program Files - deletes folders programm files.
> >              Kill Dll - deletes on mask .dll files in windows\system directory.

> >     Stealth: at openings ToolsMacro or ToolsCustomize or FileTemplates infects system.

> Name: Unknown's Virus Creator
> Creator/Origin: Executioner / Canada
> AKA : UVC
> Type: Virus Creation Tool

> Known versions:

> > UVC 1.00 B - January 1997

> Features:

> > This virus generator was incorporated in the second issue of the e-zine "Turmoil" released by Living Turmoil in May 1997.

> > A quote from the author:

> > This is a recent product, which is somewhat of a mutation engine for a very simple virus. The idea behind it is, why make a generator that can produce a thousand different types of virus, yet have all of them so simple that they ca be detected by any scanner after they make a few thousand samples? Instead, take one virus, and permute it in such a way that it is extremely difficult to detect generically without writing some sort of advanced heuristic, probably with a code analyser?

> > So the UVC was born.

> > There are only a few instructions that are permuted, specifically the following:

> > > MOV register, immmediate operand
> > > MOV memory, immediate operand
> > > XCHG reg, reg
> > > CMP reg, imm
> > > SUB reg, reg
> > > SHR reg, imm
> > > SHL reg, imm
> > > MOVSB

> Name: VBS Anthology
> Creator/Origin: VBS Guy / Unknown
> AKA : --
> Type: Script Worm Creation Tool

> Known versions:

> > VBS Evolution 1.0 - May 2000
> > VBS Anthology 1.0a - May 2000
> > VBS Anthology 1.21 - May 2000

> Features:

> > Created during the "I Love You" virus/worm hype this kit creates VBS script worms for Windows Scripting Host (WSH). An early version was named "Evolution". This kit is similar to the Windows Scripting Host Virus Generator, The Simple WinScript Virus Kit and Senna Spy Internet Worm Generator 2000 (SSIWG).

> Name: VBS Virus Kreator
> Creator/Origin: Unknown / Bosnia Herzegovina
> AKA : VBSVK
> Type: Script Worm Creation Tool

> Known versions:

> > VBSVK 1.0 - August 1999

> Features:

> > Largely unknown. Script worm generator with several replication options all displayed using the Yugoslav language.

> Name: VBS Worms Generator
> Creator/Origin: [K]Alamar / Argentina
> AKA : VBSWG
> Type: Script Worm Creation Tool

> Known versions:

> > VBSWG 0.01 - June 2000
> > VBSWG 0.80 - July 2000
> > VBSWG 0.90 - July 2000
> > VBSWG 0.91 - July 2000
> > VBSWG 0.95 - July 2000
> > VBSWG 1.00 - July 2000
> > VBSWG 1.10 - July 2000
> > VBSWG 1.50 - July 2000
> > VBSWG 1.50b - August 2000

> Features:

> > Script worm generator with several replication options, primarily aimed at Outlook, Mirc and Pirch.

> > Author's note(version 1.5):

> > > Features:

> > > Start with windows:
> > > This make the worm be executed every time windows is started, so your worm can try to infect or spread every day.

> > > Worm backup:
> > > It's just for having a copy of the worm in a safe place, so you can be sure that it will not be lost.

> > > Outlook Replication:
> > > Send as attachment: It uses the same function that all the vbs's, js's or any other kind of worm, it sends a message, that you can define, with the worm attached to every person in the user's address list.

> > > Send in html code: The worm is added to the html code of the message, so, when the person views it, they're infected!

> > > Mirc replication:
> > > Search for mirc.ini(what means that the mirc is there) in the most commons folders (programfiles\mirc, c:\mirc, c:\mirc32) and if it is found, the worm create "script.ini" in that folder, that script make the mirc sends the worm to every person that join to a channel. (see "If found Mirc, infect.")

> > > Pirch replication:
> > > Same as mirc, but for pirch (i haven't tested the script cause i haven't got pirch, please someone test it and tell me if this work).

> > > Infect Files:
> > > The worm will search for all the hard drives (and the network drives too, i think) for files with the extencion that you want (in this version only .vbs and vbe are searched) and copy overwrite him with itself.
> > > *If found Mirc, infect:
> > > This will make the worm to search also for mirc.ini, so if it find him, it will infect the folder where mirc is. This method works 100% of the times.

> > > 'To do a search for all the computer could take over 5 minutes, depending of the hard drive size.

> > > Payloads:
> > > These are stuff that you can add to the worm to be done.

> > > - Message: shows a message box whit the text and the picture that you want.
> > > - Open web address: open the web address that you want.
> > > - Crash System: Creates 1Mb variables until the system goes down of memory
> > > - Crash System 2: Runs notepads until the system crash
> > > - When?: with this you can tell the worm when do you want to execute the payloads.

> > > Save as default:
> > > If you click this button in any window, the options selected are going to be the same every time you run the program, i think that it's nice.

> > > Extras:

> > > - Anti deletion method: The worm load all his source in memory, and if the worm is deleted is created again. The worm keeps running in memory.
> > > - Crypt code: The code of the worm is encrypted and nobody know what it says!.
> > > - Download end execute files: Put the address of a file that you want to download to the infected user machine, and that will be put as the startup site for Ie, and if the person downloads it, will be executed The code is taken fro mthe Iloveyou worm, and have some modifycations.

> Name: Virus Creation 2000
> Creator/Origin: Havoc The Chaos / USA
> AKA : VC2000
> Type: Virus Creation Tool

> Known versions:

> > VC2000 0.95 - not released
> > VC2000 0.96 - December 1993
> > VC2000 0.97 - January 1994

> Features:

> > Author's note:
> > "The Virus Creation 2000 System (VC2000), is a virus creator designed for complex code generation, great configurability, and ease of use. There is only one file that you need, VC2000.EXE (which is presently under 22k). After asking you a series of questions, it will then create a MASM/TASM compatible assembly source code of your virus, along with a "MAKEVIR.BAT" which helps speed things along a bit. Another great option, is the virus detector, which you can custom configure. This will trap an interrupt, and when the virus calls the interrupt with DX equaling what you set it for, it will warn you and give you an option to halt the program."
> > Version 0.97 comes with one virus and a VC2000 detector. The produced code does not contain any activation routines.

> Name: Virus Creation Laboratory
> Creator/Origin: NuKE / USA
> AKA : VCL
> Type: Virus Creation Tool

> Known versions:

> > VCL 1.0 - July 1992

> Features:

> > Late in summer 1992 the next virus toolkit software was published: the Virus Creation Laboratory or VCL. Behind VCL stands the Nowhere Man, a member of the American group of virus writers, NuKE. VCL is quite a remarkable product: it features a colorful graphical interface of nearly commercial quality with mouse control and drop-down menus, it is installed with a separate installation program and it is supplied with quite accurate and well-written documentation. VCL also contains the ICO and PIF files, with which it can be handily installed in the Windows Program Manager.
> > It is possible to easily create several different kinds of viruses with VCL. From the menus one can choose between a COM file -infecting, a companion virus or an overwriting one. In addition to those, Trojan Horses and Logical Bombs can also be made with VCL. The Virus Creation Laboratory is an application of considerable versatility. By using it, it is possible to define exact activation conditions for a virus made with it, those being, for example, the date, time of the day, the number of infected files, a computer's country code, the version of DOS or the amount of available RAM.
> > VCL presents many alternatives for the activation routine of a virus or a Trojan Horse. Selections mentioned on the menu are crashing the computer, a corruption of files, the printing of a freely chosen text on the screen or printer, the overwriting of whole disks and the playing of a music sample that can be freely composed. In addition to this, the user can add routines to the program's menu. When a user has chosen the desired options, VCL creates the assembler-language source code of a virus or a Trojan Horse on the disk. The user can, if he so wishes, edit it still further before compiling it into an executable form.
> > Despite its great versatility, VCL has not become very popular among virus hobbyists. There are many reasons for this, but the most important probably is that the majority of anti-virus programs were able to find almost all the viruses made by VCL soon after it had been published. In fact, F-PROT recognized most of them even before VCL had been analyzed at all. The functionality of VCL at the hands of virus tinkers is further reduced by the fact that it occasionally makes viruses that do not work at all - most of the source codes it creates cannot even be compiled with an assembler compiler. The Nowhere Man has, however, announced that he is working on a new version of the program - a possible VCL for Windows is also speculated in the documentation of VCL 1.0.
> > There are many interesting details to be found in the extensive documentation of VCL. Among other things, the Nowhere Man forbids the makers of anti-virus software from extracting search character strings from VCL or the viruses made by it. The initial package came with 8 viruses made with VCL and by now numerous viruses made with VCL are roaming the VX-boards.
> > In April 1994 Firecracker (then NuKE) released his VCL Mutator intended to make VCL viruses unscannable again.

> Name: Virus Construction Set
> Creator/Origin: VDV / Germany
> AKA : VCS
> Type: Virus Creation Tool

> Known versions:

> > VCS English - 1990/91
> > VCS German - 1990/91

> Features:

> > Virus Construction Set, or VCS, published in 1990, was the first program whose sole purpose was the creation of viruses. VCS is of German make, and its authors have announced themselves as Verband Deutscher Virenliebhaber, which translates as "The German Association of Virus Lovers".
> > As a program, the VCS is quite simple: the user is asked to give the name of the text file the will be linked into the virus and the number of generations after which the virus should activate. After this, the program creates a file called VIRUS.COM on the disk.

> > A created virus has a basic construction that is always the same and easily recognizable. The virus infects other COM files and activates after the predefined number of infections. Then it overwrites the files C:\AUTOEXEC.BAT and C:\CONFIG.SYS and prints the text that was linked to it
> > when it was made.

> > The viruses created by VCS contain one slightly advanced feature: they check whether an anti-virus program called FluShot Plus is active in memory and will not spread if that is the case.
> > Both an English and a German version of the Virus Construction Set have been made.
> > Around 15 variants of viruses made with VCS are known.

> Name: Virus Draftion Center
> Creator/Origin: Unknown / Unknown
> AKA : VDC
> Type: Virus Creation Tool

> Known versions:

> > VDC 0.99B - March 1996

> Features:

> > This creator made looks very similar to Mnemonix' virus creator Biological Warfare. It has similar features and routines but is buggy and will not run under Windows 95.

> Name: Virus Factory
> Creator/Origin: Sirius / Germany
> AKA : VF
> Type: Virus Cloning Tool

> Known versions:

> > VF 1.0 - October 1994

> Features:

> > Basic user shell to generate the source code to the Ebbelwoi 34 virus by Sirius. When executed the program thru two random virus knowledge questions determines if it should give the user access. It continues by asking for a virus name, an author name and a source file name. It concludes by generating a "personalized" source code.

> Name: Virus Generator Tool
> Creator/Origin: Andry Christianz / Indonesia
> AKA : VGT
> Type: Virus Cloning Tool

> Known versions:

> > VGT 1.0B - March 1997

> Features:

> > This very basic DOS based boot sector virus dropper is just a borderline virus creation tool since it drops one and the same boot sector virus (Den-Zuk) to a diskette every time.

> Name: Virus Kit
> Creator/Origin: Stalker-X / NuKE / RSA
> AKA : VKIT
> Type: Virus Creation Tool

> Known versions:

> > VKIT 1.0 - August 1995

> Features:

> > Simple generic virus creation tool to create viruses capable of infecting Windows 3.1 .EXE executables. User can input a text string and can set internal infection counter. Later evolved into the Windows Virus Engine (WVE) by the same author.

> Name: Virus Laboratory for DOS
> Creator/Origin: Damien / Unknown
> AKA : VLAB
> Type: Virus Creation Tool

> Known versions:

> > VLAB 2.0 - March 1996

> Features:

> > A 1996 addition to the the virus creation market this package creates A86 compatible source codes. It comes with two demo viruses and has several user selectable feautures.

> Name: Virus Lab Creations
> Creator/Origin: Trixter / USA
> AKA : VLC
> Type: Virus Creation Tool

> Known versions:

> > VLC 1.1 - March 1995

> Features:

> > A 1995 addition to the the virus creation market this 1Mb package came complete with compiler and linker. The tool was coded by Trixter and White Cracker of HTC '95. No viruses produced with the kit are known.

> Name: Virus MaKer Lab
> Creator/Origin: Il Tagliaerbe / Italy
> AKA : VMK
> Type: Virus Creation Tool

> Known versions:

> > VMK 1.0 - 1994/1995

> Features:

> > Very simple, generic virus generator that creates viruses that will infect the first 10 directories of the disk. The user can select some basic payloads, activation dates, a message to display and the file to infect.

> Name: Virus Making Laboratory
> Creator/Origin: BzZ / Russia
> AKA : VML
> Type: Virus Creation Tool

> Known versions:

> > VML 1.2b - August 1998

> Features:

> > DOS based virus generator with several user selectable features and payloads.

> Name: VicodinES Macro-Poppy Construction Kit
> Creator/Origin: VicodinES / USA
> AKA : VMPCK
> Type: Virus Creation Tool

> Known versions:

> > VMPCK 1.0a - January 1998
> > VMPCK 1.0b - February 1998
> > VMPCK 1.0c - July 1998
> > VMPCK 1.0d - September 1998

> Features:

> > After DW97MVCK this kit is the second Word for Windows 97 Macro Virus construction kit. It has many advanced and user selectable features. Version 1.0b has additional payloads that enable a dropping function for existing Windows 95 viruses and a phone dialer function. Version 1.0c adds SR-1 compatibility.Version 1.0d was released as part of the VicodinES Infection Suite (VWIS) that combines all of VicodinES' macro virus tools.

> > > From the author's documentation:

> > >     The options available in this kit (1.0b) are the following

> > >     Infection via :

> > >         AutoOpen
> > >         AutoExec
> > >         AutoClose
> > >         AutoExit
> > >         Edit|Find
> > >         File|Close
> > >         File|Exit
> > >         File|Print
> > >         File|Save
> > >         File|SaveAs
> > >         Tools|Options
> > >         Tools|Macro - stealth infection
> > >         File|Templates - stealth infection
> > >         View|VBCode - stealth infection

> > >     Stealth options :

> > >         Basic stealth hooks
> > >         Stealth hooks with an infection routine
> > >         Stealth hooks with a payload
> > >         Stealth hooks with a payload and an infection routine
> > >         add a fake error message to the Stealth hook
> > >         delete the Tools|Macro and Files|Templates options from Word

> > >     Payload trigger options :

> > >         Triggered by invoking a stealth menu
> > >         Triggered by random number
> > >         Triggered by a time/date

> > >     Payload options :

> > >         Kill active document
> > >         Phone Dialer
> > >         Close Windows95
> > >         Endless print loop
> > >         Replace selected words
> > >         Launch a URL
> > >         Drop A File Virus
> > >             -[Anxiety ]
> > >             -[Cabanas ]
> > >             -[Dogpaw  ]
> > >             -[Lizard  ]
> > >             -[Memorial]
> > >             -[Navrhar ]
> > >             -[Red Team]

> > >     Extra code :

> > >         IconDisco
> > >         Read-Only Template Remover
> > >         Change The Document Properties
> > >         Help|About message box
> > >         Birthday Greeting message box
> > >         Random message box
> > >         Network Drives Dropper Option
> > >         Agressive Find-Infect Routine

> > >     Improvements :

> > >         Code is now Windows NT "aware"

> > >     The options available in this kit (1.0c) are the following

> > >     Infection via :

> > >             AutoOpen
> > >             AutoExec
> > >             AutoClose
> > >             AutoExit
> > >             Edit|Find
> > >             File|Close
> > >             File|Exit
> > >             File|Print
> > >             File|Save
> > >             File|SaveAs
> > >             Tools|Options
> > >             Tools|Macro - stealth infection
> > >             File|Templates - stealth infection
> > >             View|VBCode - stealth infection

> > >     Stealth options :

> > >             Basic stealth hooks
> > >             Stealth hooks with an infection routine
> > >             Stealth hooks with a payload
> > >             Stealth hooks with a payload and an infection routine
> > >             add a fake error message to the Stealth hook
> > >             delete the Tools|Macro and Files|Templates options from Word

> > >     Payload trigger options :

> > >             Triggered by invoking a stealth menu
> > >             Triggered by random number
> > >             Triggered by a time/date

> > >     Payload options :

> > >             Kill active document
> > >             Phone Dialer
> > >             Close Windows95
> > >             Endless print loop
> > >             Replace selected words
> > >             Launch a URL
> > >             Drop The Earthquake Simulator

> > >     Extra code :

> > >             IconDisco
> > >             Read-Only Template Remover
> > >             Change The Document Properties
> > >             Help|About message box
> > >             Birthday Greeting message box
> > >             Random message box
> > >             Change The Hard Drive Label
> > >             Network Drives Dropper Option
> > >             Agressive Find-Infect Routine

> > >     Improvements :

> > >             Code is now Windows NT "aware"
> > >             Code is now 100% SR-1 Compatable

> Name: Virus Maker Lab TM
> Creator/Origin: Gamer / Unknown
> AKA : VMT
> Type: Virus Creation Tool

> Known versions:

> > VMT 1.0b - July 1999

> Features:

> > Simple, generic virus creation tool. This initial beta version can only produce one virus. It uses debug to compile an internal script.

> Name: VicodinES Word Infection Suite
> Creator/Origin: VicodinES / USA
> AKA : VWIS
> Type: Virus Creation Tool

> Known versions:

> > VWIS 1.0 - September 1998.

> Features:

> > This latest tool by VicodinES combines/integrates a new version of VMPCK, VSMP and VVSC

> Name: Virus Generator
> Creator/Origin: Sir-X / Philippines?
> AKA : Virugene
> Type: Virus Cloning Tool

> Known versions:

> > Virugene 1.0 - January 1998

> Features:

> > This creator is basically a dropper tool that enables the user to create several existing viruses. It uses datafiles and personalized copies of TASM and TLINK. The in .DAT format enclosed viruses are PS-MPC, Clone, Lite and PSI related. The Sphinx Virus Generator (SVG) by the same author works similarly.

> Name: Virus Generator On Line
> Creator/Origin: Mad Daemon / Unknown
> AKA : VGOL
> Type: Virus Creation Tool

> Known versions:

> > VGOL - April-December 1998

> Features:

> > The first online virus creator that uses CGI scripts to create simple DOS viruses. The virus creator presents a HTML form with user selectable virus features. At the end it will compile a VG.GCI file that is a virus.

> > Author's info: Welcome to the Virus Generator On-Line

> > Hello! This is the first virus generator on the web. Do you want to have your own virus? Are you too lazy to learn assembler and write virus yourself? Are you afraid of downloading ms-dos virus generators? Never mind. I have created virus generator on the web for you. Just set virus parameters in your web browser and cgi-script on the server makes the virus for you. It's so easy. Then you can execute the virus on machine of somebody you don't like.

> > VGOL is 100% linux. Cgi script variable QUERY_STRING is first processed with a parser that extracts parameters, the parameters are passed to the processor. The processor chooses which parts of code should be included and which not - the output of the processor is a virus source code. It is assembled with linux assembler AS86.

> > Look for it here [December 1998]

> Name: VisuaLand Word Virus Generator
> Creator/Origin: Milky Wahyudi Widjaya / Indonesia
> AKA : VLWVG
> Type: Virus Creation Tool

> Known versions:

> > VLWVG 1.0 - January 1997

> Features:

> > Unknown. Word for Windows macro virus creation tool. One virus created with the 'tool', Visualand, is known. The existence of this tool is possibly a hoax, the named/quoted creator denies his involvement and will not take credit for it.

> Name: Virus Replication Generator
> Creator/Origin: Hyperhybrid / Sweden?
> AKA : VRG
> Type: Virus Creation Tool

> Known versions:

> > VRG 1.1 - July 1996

> Features:

> > This basic DOS based virus generator creates compilable ASM source files or VRG configuration files. It has a limited number of payloads, an activation time/date is user selectable and it claims antiTBAV and FPROT stealth features.

> Name: Word 97 Macro Virii Creation Kit
> Creator/Origin: jackie twoflower / Austria
> AKA : W97MVCK
> Type: Virus Creation Tool

> Known versions:

> > W97MVCK1.0 - May 1999

> Features:

> > Released as a tribute to VicodinES' work (VMPCK and VWIS) this is a German/Austrian Word 97 macro virus generator. It is SR-1 compatible, has 10 user selectable payloads and has two polymorphic options (APMRS by Pyro and SPS, an APMRS derivative by jackie twoflower). After installation it adds a new menu called "Word 97 Macro Virii Creation Kit" to Word 97. By the author of LiME.

> Name: WolfDEM's Batch Virus Creator
> Creator/Origin: WolfDEM / Unknown
> AKA : WBVC
> Type: Virus Creation Tool

> Known versions:

> > WBVC 1.0 - July 2000

> Features:

> > Generic batch virus creator with a limited number of user selectable features. It needs VBRUN300.DLL to function.

> Name: Worm IRC Script Kit
> Creator/Origin: Knowdeth / USA
> AKA : WISK
> Type: Script Worm Creation Tool

> Known versions:

> > WISK 1.1k - July 1999

> Features:

> > Author's Note:

> > This is a "Simple" menu driven visual application for creating mIRC Worms. This program generates replicating mIRC Worm like programs from user-specified parameters. Basicly "EG. Fill in the Blank and press Make Worm" :-) Hopefully some one will get a copy of this and pick up a interest in programing HLL. New versions of mIRC do not support this type of worm at all only version 5.3x and before which use the same download dir as the mIRC program is located."

> > It was released with Metaphase Zine #2. By the creator of PMG, TSWSVK, SABV and WVSG .

> Name: Word Macro Virus Construction Kit
> Creator/Origin: Nightmare Joker / SLAM / Germany
> AKA : WMVCK
> Type: Virus Creation Tool

> Known versions:

> > WMVCK 1.1 (German) - August 1996
> > WMVCK 1.1 (English) - December 1996
> > WMVCK 97 (German) - July 1998

> Features:

> > This is a macro word utility for creating Macro.Word (Word 6 /95) viruses.
> > It contains the macros: DAT1,DAT2, DAT3, DAT4, DAT5, DAT6, DAT7, DAT8, DAT9, DAT10, DAT11, DAT12, DAT13, DAT14, DAT15, DAT16, DAT17, DAT18, AutoExec, AutoOpen.

> > Like many Word 6/95 (WordBasic) viruses that were converted to Word 97 (VBA) the Word 97 version of this kit is a conversion of the initial German version and uses the "WordBasic" instruction in the VBA environment.

> > This constructor can create macro viruses containing the following ten virus droppers:

> > > 1 = Casino Virus - Casino.2330
> > > 2 = Media Markt Virus - VCL.Markt.1533
> > > 3 = MTE.Shocker - MtE.Shocker
> > > 4 = Sirius.Alive - Sirius.Alive.4608
> > > 5 = SMEG.Queeg - Smeg
> > > 6 = Tequila - Tequila
> > > 7 = Virogen - VICE.05.Code.3952
> > > 8 = Uniform [Boot Virus] - Uniform
> > > 9 = Bizatch/Vlad - Win95.Boza.c.(intended)
> > > 10 = Tremor - Tremor

> > The generator generates essentially one and the same virus. The user is allowed only to change the message that gets appended to the printed documents and to select which one of the 10 possible DOS viruses is to be dropped by the macro virus. It generates infected Word documents.

> > The initial generator works only on the German version of Word (and generates German language specific WordMacro viruses) A later English version was released. In December 1996 the same author released the Demolition Kit, the macro virus generator follow-on.

> > Both Versions:

> Name: Word Macro Virus Hamburger
> Creator/Origin: Bie / Taiwan
> AKA : WMVH
> Type: Virus Creation Tool

> Known versions:

> > WMVH 1.0 - February 1997

> Features:

> > This is the first Macro Virus Generator created in Taiwan and using the Chinese version of MS-Word. It came with one demo virus. It plays the theme of "Mission Impossible".
> > User selectable payloads are droppers for the following viruses:

> > > Stoned
> > > Taboo
> > > MacGyver
> > > Terror
> > > AntiEXE
> > > Typo

> Name: Windows Scripting Host Virus Generator
> Creator/Origin: Bumblebee / Spain
> AKA : WSHVGEN
> Type: Script Virus Creation Tool

> Known versions:

> > WSHVGEN - May 1999

> Features:

> > Similar to IBBM, RAHC. RBM and VGOL this generator allows for online virus creation. The generator creates Windows script viruses and can be found here [May 1999].

> > Author's note:

> > "WSHVGen is a small script generator -this version only for VBS- that allows you to make simple viruses that work in WSH. You need a net-browser that supports javascript to use it. WSHVGen is easy to use: Fill the following form to generate a new script. Note than Infection Sign must include only:- @ · # $ % | ª º ç ¦ * like symbols. The generated virus infects all VBS files in current directory. If not infects at least one file, then shows a payload (a popup message). Too simple, just to learn. "

> Name: Windows Virus Engine
> Creator/Origin: Stalker-X / NuKE / RSA
> AKA : WVE
> Type: Virus Creation Tool

> Known versions:

> > WVE 1.0 - August 1995

> Features:

> > Simple generic virus creation tool to create viruses capable of infecting Windows 3.1 .EXE executables. User can include a text string and a predefined bomb/trigger. It is based on VKIT by the same author and it is one of the few Windows oriented virus tools around.

> Name: Word97 VBA SR1 Generator
> Creator/Origin: Knowdeth / USA
> AKA : WVSG
> Type: Virus Creation Tool

> Known versions:

> > WVSG 1.1k - June 2000

> Features:

> > A DOS based virus generator for Word97 (SR1 compatible) macro viruses. A limited number of user selectable features are available. By the creator of TSWSVK, SABV, PMG and WISK.

> Name: X-Factor Virus Generator
> Creator/Origin: Xarabas / Darkness Sons
> AKA : XFVG
> Type: Virus Cloning Tool

> Known versions:

> > XFVG 1.01 - December 1998

> Features:

> > Very simple, generic virus cloning tool that produces an overwriting virus.

> Name: Ye Olde Funky Virus Generator
> Creator/Origin: Greyfire / USA
> AKA : YOFVG
> Type: Virus Creation Tool

> Known versions:

> > YOFVG 1.0 - March 1996

> Features:

> > Author's quote: "YOFVG is a simple virus hacking kit, much like VCS (the very first virus maker) and VKit100 (allows you to make a windows virus). It took about an hour to write, including the virus code, and it was written in quickbasic. :< (Excluding the virus, which was, of course, written in asm.)

> Name: ZeMacroKiller98 Macro Virus Construction Kit
> Creator/Origin: ZeMacroKiller98 / France
> AKA : ZMK98MVCK
> Type: Virus Creation Tool

> Known versions:

> > ZMK98MVCK - June 1998

> Features:

> > Simple Word 97 macro virus creator by a French macro virus writer.

> > Author's note:

> > "You can use 4 payloads: delete system file, message box, assistant and password You can infect template on AutoOpen, AutoClose, AutoNew and document on AutoOpen, AutoClose, FileSaveAs and FileSave You can choose which macro calls the payload: AutoOpen, AutoClose, AutoNew, AutoExit."

> Name: Zweiblum's Macro Virus Terror Kit
> Creator/Origin: Zweilblum / Austria
> AKA : ZMVTK
> Type: Virus Creation Tool

> Known versions:

> > ZMVTK1.0a - Unknown 1999

> Features:

> > This macro virus generator is a predecessor to LiME and has multiple user selectable triggers, payloads and functions. It generates .BAS source codes and supports MS Word and MS Excel.