Release 1.7

> Welcome to this release of VDAT. A lot has happened during and since the last release and with this editorial I will elaborate on the why and how of what happened.

> The start:

> VDAT has existed in one form or another since August 1995. It started out as an "see if I can do this" exercise of arranging diskettes full of viral information into one coherent, easily accessible file. This information was a by-product of my main activity, collecting computer viruses. It still is my main activity today although I sometimes find that VDAT uses a lot of the available spare time.

> I am the first to acknowledge that the first couple of releases were pretty lame but I think I managed to improve the product with every release. Somewhere during this process I decided that the DOS hypertext version I was releasing was just not good enough for some of the graphic features I wanted to include. Also it was a pain in the butt to update.

> When I started looking for an equivalent Windows based hypertext tool I came across a small database created with InfoCourier. After trying out the trial version for some time I concluded that using HTML was not only easy but a lot of HTML editing tools were available which made updating VDAT a lot less complicated. So I bought (no kidding) the full version of InfoCourier and started the conversion of VDAT for DOS to VDAT for Windows.

> Version 1.9 for DOS and version 1.0 for Windows were each other's equivalent and although some people asked me to maintain a DOS version soon I noticed keeping both updated was just not feasible and I decided to discontinue the DOS version.

> In the mean time the "phenomenon" of VDAT was finding it's way to more users, both in the VX scene and the among the general computer user. Most reactions I got were supportive and many people supplied me with material I could use for VDAT.

> Collecting:

> While keeping VDAT updated I was still very much into collecting viruses. The same way I wanted my viral information to be "organized" I had a system of collecting viruses. For my own purposes I created small subcollections that were often built around one single subject, either a particular VX group or a some specific virus technology like polymorphic engines. When I started making these collections available through a limited access website a lot of people contacted me with either requests or offers for trade.

> Originally my main supply for new viruses were well known VX BBS'es like Arrested Development, Chiba City, Black Axis and WCIVR. With the spread of Internet and the World Wide Web computer viruses were readily available for anyone who knew where and how to look.

> All this created a nice flow of new stuff that allowed me to release updates to my collections every once in a while. Although these collections and their updates were created for my own purposes many fellow collectors and maybe some newbie virus writers seem to enjoy them too. After a period of limited access I decided to make everything I produced available to whoever wanted it although I found that 10 Mb was not enough to run a satisfying website. My ISP during that period was very "open" about all this and I never had any complaints or requests to remove my virus files even though I had expected them.

> Since I had a "normal" job too and all this computer virus collecting was just a hobby not a lot of time was left to give my website the look I wanted it to have. All over the Web new virus sites popped up and died out, most with better looks than mine had. For a while the WCIVR had a gigantic number of computer viruses available for download, initially for free later they started using ratios. These were the fun times for collecting viruses.

> All my efforts of keeping my collections, my website and VDAT updated were decreasing the available time for keeping my virus collection up to date. Although I still collected viruses I could find no time to ID, scan and organize them properly. Also the increasing numbers of different viruses played havoc with my initial method of organizing my collection, it was all very time consuming.

> Although most reactions to my efforts were positive the number of negative reactions was increasing. Apparently some people felt that their intellectual property was violated when I decided to include some of their material in one of my collections. The lack of time, the collection that was in disarray, the effort of updating an unsatisfying website, the lack of available webspace and the increasing number of negative reactions caused me to rethink my goals. After an interim period of a website with only VDAT available I decided to fully pull the plug. The only thing I was going to release publicly in the future was VDAT and that would have its own website. Contrary to what most people thought the negative reactions were not the sole reason for me quitting my site, they were just the last straw.

> Post website:

> In the wake of all this I was flooded with e-mail and although I must say all of them were supportive some thought I was "giving in" and that I should "stand up" to the negative reactions. Like I mentioned the above, these reactions were not the main reason just the straw that broke the camel's back.

> After the demise of my main website I finally had some time to rearrange my virus collection. While doing so I found out that the lack of attention to my collection had caused me to fall behind in the numbers of viruses I had collected and I frantically looked for the missing material. Luckily some of my more solid contacts from the past came through and helped me out bringing my collection back up to speed.

> The main emphasis of my hobby is again collecting viruses and a by-product is the continued release of VDAT. My subcollections and their updates have stopped, maybe not forever but certainly for the near future. If they ever are reinstated they will not be available to the general collector but only to a select few.

> In the years I have been collecting viruses I have never been a member of a group. I always thought that maintaining the "middle-of-the-road" and being an independent produced the best results. Being a member of a particular group tends to limit access to work from another group. After the death of my website I found that at a certain point in one's virus collection it is impossible to add a substantial number of new viruses without being part of a certain traders world. That is why I decided for, and requested, membership of VTC (Virus Trading Center), the only such group around. Many of the members I knew from the past and although some have been members of virus writing groups none are actively producing viruses. I must say that it was a good move, the exchange of new virus material is solid and worthwhile.

> Future:

> So with my collection back on rails I found time again for this release of VDAT. VDAT also will need some changes in the future and I have been thinking about many possibilities. One of them is the use of the successor to InfoCourier called WebCompiler 98. Made by the same author and company as InfoCourier WebCompiler makes a big jump in available features, e.g. the use of frames, animated graphics and many more exciting possibilities. Something I wanted to do for this VDAT, a virus graphics gallery, will be postponed until the WebCompiler version because of that. Also the final compiled product is faster (it is 32 bit) and smaller than its predecessor. All of this of course comes for a price and some of you will call it a drawback.
> WebCompiler 98 is largely based on the Internet Explorer 4 core engine and because of that will require the user to have one of the following software configurations: Windows 95 + IE4, Windows 98, Windows NT4 + IE4 or Windows NT5 (Windows 2000). I know this will go against the grain of a lot of people that are not exactly supporters of anything containing the Microsoft logo so I have not made up my mind yet. Maybe I will create two versions (16 bit and 32 bit) but that would just be a repeat of the DOS version and the initial Windows version tale.
> Except for WebCompiler 98 I have not found a worthy successor to InfoCourier and I think that in the HTML world of today frames, animated graphics and other fancy features are a must. So just like computer viruses are moving to the 32-bit plane I think VDAT will eventually migrate to the same plane. This might cause some users to turn their backs on VDAT just because their software does not support it anymore but I'm sure they will follow later on.

> Another wish I have had since the initial release of the HTML version of VDAT is a web version of the program. It would be very easy to transfer VDAT to a website since everything is in HTML anyway. There are a couple of reasons why it has not happened. The uncompiled size of VDAT is approaching 13 Mb on its way to 14 Mb and it is hard to find free web space that size. Also some of the contents of VDAT will be considered too explicit by some webspace providers. Viral technology is still frowned upon or even considered illegal in some parts of this world. Maybe somewhere in the future I will find a generous, open-minded provider that will allow the online version of VDAT to be posted. Until that time the compiled version will have to do.

> This concludes my rant about some of the things that happened the last couple of months, I hope I have cleared things up a little for all of you that still had questions. Feel free to e-mail me with questions, positive or even negative suggestions for either VDAT or collecting computer viruses in general.

> The Virus Trading Center can be found at http://www.coderz.net/vtc/

> So long,

> Cicatrix
> January 1999

Release 1.8

> April 1st, April Fools Day.

> But regardless of that a new release of VDAT. A lot a new information has been added and as I predicted, VDAT is getting bigger and bigger. I have had some reactions and suggestions regarding this size issue. One of them suggested deleting many of the lame and ripped off tutorials which, I agree, would reduce the size of the final product quite a bit. The same person suggested deleting interviews with "morons which haven't done shit for the scene". I must say I agree to a large extent with his views on the quality of some of the material addressed. But it is not my intent to make VDAT some kind of Master Tutorial for which I will apply some quality filter to new material. As I explained many times before, VDAT is a database of computer virus related material. That means good or bad, right or wrong, grammatically correct or not, anything can be included. One filter I do apply is version related. I will update material like Wildlists or other specific material that is updated regularly. This applies to material that is of no use when newer information is available. I know there are some grey (or gray depending on which side of the Atlantic you're on) areas but than it is easy, in the end there is only one person that determines what will be in VDAT and you all know who that is.

> Something I want to reitterate is that VDAT is not meant to rob anyone, VX or AV, of their intellectual property. It is meant solely as a database of virus scene facts. Where possible I leave names of authors or origins in place for all to read. I'm not looking to take credit for someone else's work.

> VDAT should be available online (on a trial basis) at http://c5.hakker.com/vdat. The online version reflects compiled version 1.7 and should be identical. The intent is NOT to update the online version between compiled releases, that would mean too much effort and spare time I do not have. Also as of compiled version 1.8 the online version will always lag one release. This is done to leave some incentive to get the latest version, don't ask me why, it doesn't make me any richer but it is what I want to do.

> Recently members of VTC have been actively looking for additional material like specific virus engines, kits and tools that were either not in their collection or not in VDAT. Some "WANTED" lists have been passed around and I must say that the initial response was promising. So if you have some viral material (engines, kits, tools) that is on the WANTED list or something that is NOT included in VDAT contact one of the VTC members and we will make it worth your while. For a recent WANTED list visit Tally's Virus Link Reference at http://www.coderz.net/tally. For the latest Virus links visit the same site or check out the internal VDAT version.

> Cicatrix
> April 1999

Release 1.9

> And one more is released.

> VDAT is not perfect, far from it. Every day I or someone else catch some kind of error or untruth. Apparently people like VDAT to be accurate, as do I. So if you know something that could help increase the accuracy do not hesitate to contact me, preferably via e-mail. One example of such an inaccuray might be the interview with someone posing as the author of the CIH virus. Although I can not find hard evidence that proves the interview was a hoax enough doubt has been created for me to decide to pull the interview. Some people have contacted me with remarks and questions that raised the doubt about this interview. Last month's press coverage about the identification of the author of CIH also contained information that raised similar doubt. Thus the decision to pull the interview. For those who missed it: you have to get a copy of VDAT 1.8. It is the only release that has the interview in question.

> Time or the lack of it.

> Lack of time is an increasing limiting factor in both collecting viruses and preparing a new release of VDAT. Since this is still a hobby that does not pay the bills I have go to work too. This work claims an increasing part of the available daily time so sometimes the proper organization of my virus collection and of VDAT has to play a secondary role. Luckily a lot of my contacts in the scene specifically my fellow members of VTC help me get material I might have missed.

> VDAT Online was aborted, mainly due to this lack of time and of proper web space. It might be back, maybe even in the near future. You just have to keep your eyes and ears out.

> Future

> This might be the last new release of VDAT for quite some time and no, I'm not quitting. In the near future I might be away from "home" for an extended period of time, probably up to several months. I will try to keep in touch with the scene enough to collect the necessary information for a next release of VDAT but as I mentioned before time is scarce, especially when away from home and maybe away from Internet. I will do the best I can but it is possible that the next release of VDAT will not appear before January 2000.

> Cicatrix
> July 1999

Release 2.000.0

> The time has arrived. Contrary to what I stated in my last editorial this will be the last PUBLIC release of VDAT. After a little more than 4 years with 10 releases for DOS and 11 for Windows/HTML I have decided to quit releasing VDAT to the general public.

> I will not go into a lot of detail on the "Why?" but I have always stated I would quit when it would stop being fun. Events and incidents during the last year have drastically decreased the fun I was having creating this product. The virus scene is a mess and the small measure of maturity and common decency that existed in it has all but evaporated. There are of course always exceptions and I hope these exceptions will continue to be worthwhile.

> The recent explosion of the number of virus traders has certainly muddied the waters of virus collecting. The number of websites offering virus trading has almost quadrupled in the last couple of months and it seems that this growth will continue for a while. It has not done the core goal of virus collecting much good. A lot of junk is being traded and personalities, morals and values have clashed. It is one of the reasons I have decided to lay low for a while, I have had enough of the bickering and name calling. When I started collecting viruses ratios were used just like now, but ultimately when push came to shove much more was shared than now. People were often inclined to help the new guy on the block, now it almost seems virus trading is like the stock market: a matter of plusses and minuses.

> I will still update the VDAT product for my own purposes and it will remain available to most of the insiders of the scene. The update cycle will no longer be 3 months but it will be determined by the available spare time, it might be more but also less than 3 months. The only way for the general user to obtain an unrestricted copy of VDAT is to get me something from my wanted list

> As of January 11th 2000 my website supporting VDAT will cease to exist and my e-mail account will be closed. My new e-mail address will be cicatrix@worldmail.nl or vdat@crosswinds.net. Distribution of future releases will be on a case by case basis. The VDAT home page will move and can be found using the http://vdat.cjb.net URL redirector.

> SOR (StartOfRant):

> I just want to say something about this millennium hype/hoax that is happening as I release this edition of VDAT. The transition from 1999 to 2000 might be nice "round number" occasion to have extra celebrations but as far as I am concerned the next millennium does not start until January 1st 2001. Assuming there was no year 0 (zero) the year 1 was the first year of the 1st century and the 1st millennium. Consequently the year 1001 was the 1st year of the 2nd millennium and the year 2001 will be the 1st year of the 3rd millennium. Also the correct term for the 2-digit versus 4-digit date annotation problem in computers should be the Year 2000 bug (or Y2k) and NOT the Millennium bug (or even worse Millennium virus) as some people call it. So celebrate all you want but don't call the year 2000 the 21st century or the next millennium, those won't start for another year. And BTW, January 1st 2000 is just another day of the week: I'll still get out of bed the same way, I'll still have to walk the dog and my pay won't change. So what is all the fuss about?

> > More material to convince the non believers:

> > http://psyche.usno.navy.mil/millennium/whenls.html
> > http://members.tripod.com/~PHILKON/millennium.html

> For those wondering about the version number of this release: the similarity with the year of release and my statement above is just coincidental :-), future releases will be numbered using the Y.EAR.# format. Consequently the next release will be 2.000.1 and the first release of next year will be 2.001.0 etc. etc. As you notice I do use 0 (zero).

> EOR (EndOfRant)

> Cicatrix
> January 2000

Release 2.000.1

> By using a popular patch utility this edition of VDAT is the first version that is "patchable" from a previous version of VDAT. For now it will only work when updating VDAT 2.000.0 to 2.000.1, but maybe later I will release patches to older versions of VDAT. The "patch" will decrease the download/online time necessary to get a new VDAT release and should accomodate those that have been complaining about the size of VDAT. I would like to have some feedback/ideas on this new feature, maybe other uses of this feature are possible.

> VDAT distribution blues (continued):

> I have had, read and heard many reactions to my decision to limit the distribution of VDAT. Some were understanding, some were angry and most were disappointed. Many misunderstood the intent of my decision but since I can not explain it any better than I did in the last release I am not going to explain it all over again. Suffice to say that the limitation on distribution is for the general "Gee-see-what-I-found" user only, for many not much will change. Those of you that read this are welcome to this new edition of VDAT and I hope you will find it useful. I have no illusions about the issued key files being kept confidential, I can only ask you to keep the file to yourself, there is no way I can force you.

> VDAT inclusion parameters:

> The choice of subjects and the decisions on what to include in VDAT are getting more blurred every day. Not only is size a consideration but also the situation that more and more activities in the VX scene are becoming mixed with non-VX matters.

> Hacking, cracking and computer viruses are getting more and more interconnected, VX groups are widening their range of interests (ASM, Cybernetic Crew, UCSI, ZeroGravity etc.), hacking groups are expanding in VX related subjects (Net Rage Gerrilleros, FCF, BHA, Top Device E-zine) and last but not least AV companies are supporting detection of not just viruses but the wider phenomenon called "malware". The enormous increase in the number of "backdoors", "trojans" and other "security tools" has forced these companies to detect these utililties. Many virus collections are cluttered with these non-viruses just because they are detected by AV sofware. Contrary to fully functional and viable "single file" viruses most samples that are ID'd as a "backdoors" are not functional without any of the accompanying files included in the originally distributed archive. The detected software thus becomes "cripled" and is just some binary code that some AV software generate "hits" on.

> Many so called "pro-VX" websites are muddying the waters by also including "backdoor" and "trojan" material. I have the impression that some webmasters don't even know the difference between these files and functional viruses. There are too many mixups in terminology, even in the scene itself. (A backdoor is not a virus although viruses can theoretically have backdoor features, a trojan is not a virus although a virus can be distributed as a trojan or can have a trojan as payload). I have no intention of including any "backdoor", "trojan" or other non-virus related material in future releases of VDAT. Although for trading purposes I had to "bow to the majority" and include these "backdoor" and "trojan" hits in my virus collection, I will try to keep VDAT as "clean" as possible.

> I make subjective choices on what to enter in the "Engines & Tools" section. Many viruses contain polymorphic or mutation routines. Some of these routines are portable to other viruses and are called "engines", some routines are so embedded in a virus that they are not portable without major modifications. Basically all "Engines & Tools" that are in some way named by their authors will be included in VDAT. Some "engines" that might be portable but are not named will not be included in VDAT since there is no effective way to identify or refer to these properly (eg polymorphic routines or engines used in viruses such Natas, Cocaine etc.)

> "People are cranking-out poly engines like maniacs, just so Cicatrix can shove yet another 3 letter acronym on his Engine list" / T-2000"

> Judging from this quote I'm part of some large "cause-and-effect" loop. I find it hard to believe VDAT is the reason people program polymorphic engines or other virus related utilities. Some might spend a little extra time naming their creations just so the name "sounds" right (e.g. MeDriPolEn) but I don't think an entry in VDAT is a goal in creating/developing such routines.

> Future of VDAT:

> As you have noticed it has taken 4 months for a new VDAT release to appear. Personally I kind of like this interval since it allows for some time to gather new information (there are often extended periods of inactivity in the VX scene) and people don't have to download 8+ Mb's that contain just minor updates. I'm still thinking about releasing an uncompiled HTML version (easier and smaller updates) but I have not made up my mind yet. Also there have been (for now minor) lapses in my own motivation to continue this project (often synchronous with periods of inactivity in the scene) but I think there still is some kind of future for VDAT.

> Cicatrix
> May 2000

Release 2.000.2

> VDAT distribution blues (the never ending story):

> Apparently there are still some morons out there that have not gotten the message. The release of VDAT to the general public is and never has been an acquired constitutional right. The fact that it has been free for all to use for the last years was meant as a gesture of goodwill and does not give this general public the right of ownership. So to those who think my act of limiting distribution is an injustice and think this move robs them of an acquired right I say: TOUGH!!

> Generally reactions have been understanding and sympathetic and the majority of requests for a key has been given one, even without any reciprocal donations. Below you will find a short statistic on honoured and refused requests. Many of you will maybe ask: "If it is so easy to get one, why a key at all?" Well let me tell you, it will get harder in the future. I already have encountered situations were a key was given with the understanding that some reciprocal favour was expected in the future and were this reciprocal favour, when asked for, was never honoured. These people have been placed on my personal "black list" and will not get any future cooperation (also read: key file) from me. They will join some individuals who in the past have expressed threats and immature attitudes towards me personally.

> Statistics on key file distribution (as of September 10th 2000):

> Scene | Issued | Refused | Blacklisted
> VX Active Coders | 48 | - | 1
> VX Retired Coders | 3 | - | -
> VX Traders | 23 | 2 | 1
> AV | - | - | -
> Other | 6 | 58 | 1
> Totals | 80 | 60 | 3

> issued and refused

> I'm sure that this key I have issued or the key protection in general can easily be cracked (I have seen one very easy example already), almost anything can be cracked given enough know how, time and tools. Those that can crack it are welcome to it, they apparently have enough knowledge to use the material portrayed inside VDAT.

> The key is primarily meant as a limiting measure and a trading incentive but there are some people out there that have nothing whatsoever to do with the scene, they just like to read VDAT. Mainly for those people I have decided to release the key to the current VDAT whenever a new version is about to be released. That way all can read VDAT, be it sometimes with some delay.

> For those that genuinely like using and reading VDAT (inside and outside the scene) you are welcome to it, even if some of you might not always have the latest release. For those that keep on bitching and moaning, grow up and leave me alone. Again, VDAT was initially meant for me and me alone, I did not force it upon anyone. So even if no one wants or gets VDAT anymore I'd still be putting the same effort into it. The level of maturity that radiates from some of the mail I have been getting on this subject tends to confirm the image that most of the outsiders have of the virus scene. Really, the threats, slurs and name calling don't hurt too much, it apparently is almost required reading in the virus scene of the present. You will find some positive and some negative "post key file" quotes below:

> > "I am a follower of your VDAT "magazine" and I am saddened that it will be no longer be public in it's next release. "

> > "I recently visited your page, and i just read about the decision you made... but then i can't blame you. It's completely understandable."

> > "When i saw you have decided to limitate the distribution of vdat, i was disappointed. I understand your reasons but i think knowledge must be spread and not limitated to an elite."

> > "On the one hand I understand your decision, but on the other hand many newbies will worry for all the information which they can't get. "

> > "...and of coz i'm fully disagree with your idea of the key file... "

> > "What you need to do is make sure that VDAT keeps up the same quality as it has had in the past until i find something to send you ;-) "

> > And for those that understand German a reaction of someone that was refused a key :

> > "HEY ALTER, WAS BIST DU EIGENDLICH FÜR EIN SCHEISS WICHSER???? ICH DACHTE WIR SOLLTEN ZUSAMMENHALTEN!!!!!!!! ICH WEISS NICHT WAS FÜR PROBLEME HAST? ICH BIN JETZT ERST ANGEFANGEN MIT DEM SCHREIBEN VON VIEREN! DU SCHREIBST WELCHE UND ICH WILL ES. KENNST DU EBOLA.A??? ICH WÜRDE AUFPASSEN WAS DU IN ZUKUNFT AUF DEINEM RECHNER MACHTS!!! KÖNNTE SCHIEF GEHEN. WIE ALT BIST DU EIGENDLICH DAS DU DICH HIER SO KACKE AUFFÜRHST??? ZUFÄHLICH KANN ICH GANZ GU CRACKEN. DEINE VDAT IST NICHT SEHR GUT DAGEGEN GESCHÜTZT: UND SCHON BRAUCH ICH KEIN KEY FILE MEHR!!!!!!!!!!!!!"
> > [No comment]

> VDAT inclusion parameters (continued):

> During the recent "I Love You" hype I asked myself if I wanted to include a reference to worms in VDAT. Especially the continuing inability of the media to use the correct terminology (virus vs worm) made me think about were to draw the line. Like I mentioned in my last editorial this line is getting more blurred every day.

> Worms and viruses are different but one of the things they share made me decide to include worm related material in VDAT. Contrary to Trojan Horses and so called Backdoors both worms and viruses have replicatory capabilities, they multiply or procreate. Therefore a reference to the "I Love You" outbreak was included and worm creations kits were also added.

> Cicatrix
> September 2000