(2070)   Mon 14 Mar 94 10:05                         
By: Ed Case
To: Savage Beast
Re: Nuke in the UK?
----------------------------------------------------------------------
AREA:VIRUS_BETA
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/31 250a1845
I'd like to know more and keep my LD bills down?
--- GEcho 1.00
 * Origin: OFF THE STREETS OF CHIBA CITY  [804.790.1329] (111:950/31)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/31 45 708/0

----------------------------------------------------------------------
(2071)   Thu 10 Mar 94 15:08                         
By: Shockwave
To: Aphex Twin
Re: Call
----------------------------------------------------------------------
AREA:NUKE_THEWORLD
FROM: 77:708/0.0
REASON: Sender not active for this area
AT> thasscool... whereabouts is your board? What AC?
AT> 
AT> i might want to give it a call sometime...

It's in 717, south central pennsylvania... # is 717-846-0014. You 
are welcome 
to check it out. No ratios or file points or PCR's. I don't believe 
in 
bullshit like that.

Shockwave

--- Renegade v1.10 Alpha
 * Origin: |11Lo|03gi|01kal |11No|03ns|01ense |11H/P (111:950/114)
SEEN-BY: 405/0 443/0 708/0 950/79
@PATH: 950/50 31 45 708/0

----------------------------------------------------------------------
(2072)   Thu 10 Mar 94 10:01                         
By: Macaroni Ted
To: All
Re: ..
----------------------------------------------------------------------
AREA:VIRUS_ASM
FROM: 77:708/0.0
REASON: Sender not active for this area
Anyone know who int 1h and all that debugging functions works??
I know how you turn it off/on but it always seem to hang after a 
while...
How does debug.com work, please tell, i'm working on the best virus 
ever 
written!!

Macaroni Ted / a.n.o.i. - Scandinavians best/cruelest virus group

--- Renegade v1.10 Alpha
 * Origin: |11Lo|03gi|01kal |11No|03ns|01ense |11H/P (111:950/114)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/50 31 45 708/0

----------------------------------------------------------------------
(2073)   Thu 10 Mar 94 10:02                         
By: Macaroni Ted
To: All
Re: ..
----------------------------------------------------------------------
AREA:VIRUS_ASM
FROM: 77:708/0.0
REASON: Sender not active for this area
Anyone got a description for extended exe headers (such as windows 
etc etc)?

--- Renegade v1.10 Alpha
 * Origin: |11Lo|03gi|01kal |11No|03ns|01ense |11H/P (111:950/114)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/50 31 45 708/0

----------------------------------------------------------------------
(2880)   Thu 17 Mar 94  0:17                         
By: Falcon
To: All
Re: Wcivr ftp site
----------------------------------------------------------------------
AREA:NUKE_THEWORLD
FROM: 77:708/0.0
REASON: Sender not active for this area
@EID:f3b6 02d1fff3
@MSGID: 111:950/45 26823ff7
       Note,
                   Wcivr has its FTP site up on the internet
                       ftp.kaiwan.com;/user/u1/wcivrftp

                   When you get to ftp.kaiwan /u1 just do a cd to
                   wcivrftp

                   Our internet address is (as previously stated)
                        wcivradm@kaiwan.com

                   We invite your downloads and uploads to this site
                   and your mail as well.
                                Thanks
                         FLc
                   West Coast Institute of virus Research


--- Mega-ROM 1.2
 * Origin: West Coast Institute of Virus Research, 1.714.772.7039, 
CA. (111:950/45)
SEEN-BY: 405/0 443/0 708/0 950/79
@PATH: 950/45 708/0

----------------------------------------------------------------------
(2881)   Wed 16 Mar 94 17:48                         
By: Electron
To: All
Re: This may be a stupid question...
----------------------------------------------------------------------
AREA:VIRUS_BETA
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/31 26121a3a
But can I get infected by READING this sub... Since you all put 
things up like
Virii Codes...

Thanks...



--- GEcho 1.00
 * Origin: OFF THE STREETS OF CHIBA CITY  [804.790.1329] (111:950/31)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/31 45 708/0

----------------------------------------------------------------------
(2882)   Thu 17 Mar 94 16:00                         
By: Uzi Fag
To: Electron
Re: This may be a stupid question...
----------------------------------------------------------------------
AREA:VIRUS_BETA
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/31 269016ab
RE: This may be a stupid question...
BY: Electron on Wed Mar 16 1994 05:48 pm

 > But can I get infected by READING this sub... Since you all put 
things up li
 > Virii Codes...

 I don't mean to sound rude but that is a stupid question.
However...hmmm...would it be possible to write a virus so that it 
would infect
one's computer after they have read it by - i dunno - doing 
something through
the scroll back file?

--- GEcho 1.00
 * Origin: OFF THE STREETS OF CHIBA CITY  [804.790.1329] (111:950/31)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/31 45 708/0

----------------------------------------------------------------------
(2883)   Thu 17 Mar 94 16:38                         
By: Electron
To: Uzi Fag
Re: This may be a stupid question...
----------------------------------------------------------------------
AREA:VIRUS_BETA
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/31 2690fa05
RE: This may be a stupid question...
BY: Uzi Fag to Electron on Thu Mar 17 1994 04:00 pm

 > RE: This may be a stupid question...
 > BY: Electron on Wed Mar 16 1994 05:48 pm
 > 
 >  > But can I get infected by READING this sub... Since you all 
put things up
 >  > Virii Codes...
 > 
 >  I don't mean to sound rude but that is a stupid question.
 > However...hmmm...would it be possible to write a virus so that 
it would infe
 > one's computer after they have read it by - i dunno - doing 
something throug
 > the scroll back file?
 > 


But the question is... Can I get infected by reading this Sub?
--- GEcho 1.00
 * Origin: OFF THE STREETS OF CHIBA CITY  [804.790.1329] (111:950/31)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/31 45 708/0

----------------------------------------------------------------------
(2884)   Wed 16 Mar 94 13:41                         
By: Tiphoid Mary
To: Macaroni Ted
Re: ..
----------------------------------------------------------------------
AREA:VIRUS_ASM
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/101 3d852180
In a msg on <Mar 10>, Macaroni Ted of 111:950/114 confided:

 MT>Anyone got a description for extended exe headers (such as 
 MT>windows etc etc)?

Hello Macaroni.  I hope this is useful.
---------------------------------------------------------------------
---
The Windows exe file format looks like:

Offset         Size            Function
-------        -----           --------
0  (0)         32 bytes        Old style exe header info
20 (32)        29 bytes        Reserved
3C (60)        4 bytes         New style offset
40 (64)        varies          relocation table for DOS stub program
varies         varies          New style EXE information
---------------------------------------------------------------------
----
The layout of the new style EXE information section looks like:

Offset         Size            Function                  Allowable 
Values
-------        -----           --------                  
-----------------
0 (0)          Word            Signature Word            "EN"
2 (2)          Byte            Version Number of Linker   
3 (3)          Byte            Revision Number of Linker
4 (4)          Word            Offset of entry table     relative 
to beginning
                                                         of this 
section of the
                                                         header
6 (6)          Word            Number of bytes in entry
                               table
8 (8)          Dbl Word        32 bit CRC of entire file
C (12)         Word            Keyword                   0000H = 
NOAUTODATA
                                                         0001H = 
SINGLEDATA 
                                                                 
(solo)
                                                         0002H = 
MULTIPLEDATA
                                                                 
(instance)
                                                         2000H = 
errors                                                              
    detected at                                                     
             link time
                                                         8000H = 
Library module
E (14)         Word            Segment # of automatic 
                               data segment
10 (16)        Word            Initial size of dynamic   in bytes 0 
= no local                                heap added to DS          
         allocation    12 (18)        Word            Initial size 
of stack     in bytes 0 = SS does
                               added to DS                        
not equal
                                                                  DS
14 (20)        Dbl Word        CS:IP
18 (24)        Dbl Word        SS:SP
1C (28)        Word            # of entries in segment
                               table
1E (30)        Word            # of bytes in nonresident-
                               name table
20 (32)        Word            Offset of segmentation     Relative 
to beginning
                               table                      of this 
section of                                                          
 the header
22 (34)        Word            Offset of resource table   ""
24 (36)        Word            Offset of resident-name    ""
                               table
26 (38)        Word            Offset of module-reference ""
                               table
28 (40)        Word            Offset of imported-name    ""
                               table
2A (42)        Dbl Word        Offset of non-resident     Relative 
to beginning
                               name table                 of file
2E (46)        Word            # of movable entry points
30 (48)        Word            Shift count of logical     Log base 
2 of the 
                               sector allignment          segment 
sector size
32 (50)        Word            # of reserved segments
34 (52)        10 bytes        Reserved                   Must be 0

---------------------------------------------------------------------
-----
And the OLD EXE File Header (for reference) (Dos 3.3, 4, 5) looks 
like:
 
0 (0)          word            EXE file signature         Usually 
4D5AH
2 (2)          word            Length of file             Modulo 512
4 (4)          word            Size of file, incl         In 
512-byte pages
                               header
6 (6)          word            Number of relocation 
                               table items
8 (8)          word            Size of header             In 
16-byte paragraphs
A (10)         word            Minimum paragraphs         ""
                               needed above program
C (12)         word            Maximum paragraphs         ""
                               desired above program
E (14)         word            Displacement of stack      Relative 
to start of
                               segment in module          program, 
in                                                           
paragraphs
10 (16)        word            Contents of SP register
                               at entry
12 (18)        word            Checksum                   Two's 
complement
14 (20)        word            Contents of IP register
                               at entry
16 (22)        word            Displacement of code       Relative 
to start of
                               module                     program 
in paragraphs
18 (24)        word            Offset to first relocation Relative 
to start of
                               item in file               file in 
bytes
1A (26)        word            Overlay number             0 for 
resident part
                                                          of program
1C (28)        varies          variable reserved space
varies*        varies          Relocation table
varies*        varies          variable reserved space
varies*        varies          Program and data segments
varies*        varies          Stack segment
 
* Not found in Dos 5.0 EXEHEADER structure. 
--- msgedsq 2.1
 * Origin: Lost in Cipherspace (111:950/101)
SEEN-BY: 443/0 708/0 950/79
@PATH: 15/20 950/0 31 45 708/0

----------------------------------------------------------------------
(2885)   Wed 16 Mar 94 14:51                         
By: Tiphoid Mary
To: Savage Beast
Re: VCL v2.0
----------------------------------------------------------------------
AREA:VIRUS_BETA
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/101 3d852783
@REPLY: 111:950/8 2d80cd55
In a msg on <Mar 11>, Savage Beast of 111:950/8 confided:

 SB>NuKE is not DEAD !

 SB>Savage Beast - Euro Coordinator for NuKE - Administrator.

 SB>For your info, NuKE is present in : USA - CANADA - GERMANY - 
 SB>HOLLAND - SWEDEN - ENGLAND - SOUTH AFRICA - ARGENTINA .

 SB>So, if some of you though that NuKE is down... FORGET THAT IDEA 
 SB>!!!

 SB>Savage Beast [NuKE'94]

 SB>-!-
 SB> ! Origin: The Voice of Enigma MCMXC a.D. ENUN Whq [NuKENet] 
 SB>(111:950/8)

And what about Switzerland?  Is anyone there? <grin>

Tiphoid
[NuKE]  <-- considering that Aristotle's crew uses NuKE '94, I'll 
be generic.

--- msgedsq 2.1
 * Origin: Lost in Cipherspace (111:950/101)
SEEN-BY: 443/0 708/0 950/79
@PATH: 15/20 950/0 31 45 708/0

----------------------------------------------------------------------
(2886)   Wed 16 Mar 94 14:55                         
By: Tiphoid Mary
To: Ed Case
Re: Nuke in the UK?
----------------------------------------------------------------------
AREA:VIRUS_BETA
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/101 3d853012
@REPLY: 111:950/31 250a1845
In a msg on <Mar 14>, Ed Case of 111:950/31 confided:

 EC>I'd like to know more and keep my LD bills down?

Ed, the phreaking echo is over there...  --------->

Tiphoid
[NuKE] 
--- msgedsq 2.1
 * Origin: Lost in Cipherspace (111:950/101)
SEEN-BY: 443/0 708/0 950/79
@PATH: 15/20 950/0 31 45 708/0

----------------------------------------------------------------------
(2887)   Wed 16 Mar 94 22:12                         
By: Brian Oblivion
To: Electron
Re: This may be a stupid question...
----------------------------------------------------------------------
AREA:VIRUS_BETA
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/32 269488b7
E> But can I get infected by READING this sub... Since you all put 
things up li
E> Virii Codes...

I'm sure your conscientious sysop FireCracker is doing everything 
he can to 
make sure that you don't get infected by reading this sub.  He 
works his ass 
off to keep his users safe, dontcha FC?

--- Tee-J Toss 0.91b
 * Origin: Transcendental Chihuahua/2 (111:950/32)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/32 31 45 708/0

----------------------------------------------------------------------
(2888)   Thu 17 Mar 94 20:31                         
By: Brian Oblivion
To: Tiphoid Mary
Re: VCL v2.0
----------------------------------------------------------------------
AREA:VIRUS_BETA
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/32 269488b8
TM> Tiphoid
TM> [NuKE]  <-- considering that Aristotle's crew uses NuKE '94, 
I'll be generi

Why do you have a fixation on Aristotle and making sure no one 
thinks you're 
associated with him?

--- Tee-J Toss 0.91b
 * Origin: Transcendental Chihuahua/2 (111:950/32)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/32 31 45 708/0

----------------------------------------------------------------------
(2889)   Thu 17 Mar 94 22:56                         
By: Zephyr
To: Macaroni Ted
Re: ..
----------------------------------------------------------------------
AREA:VIRUS_ASM
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/200 2697083c
 MT> Anyone know who int 1h and all that debugging functions works??
 MT> I know how you turn it off/on but it always seem to hang after a
 MT> while... How does debug.com work, please tell, i'm working on 
the best
 MT> virus ever  written!!

 MT> Macaroni Ted / a.n.o.i. - Scandinavians best/cruelest virus 
group

Yeah...the int 1 executes after almost every line of code when the
tf flag is set. Exceptions are REP, using MOV and POP on segment
registers(ss,es,ds,cs). All others, when the tf flag is set will:

- Push CS and IP regs onto the stack

- clear the tf and if flags

- execute an int 1

I don't know how the debug program uses this, but it does Trace your
programs using this interrupt.

To gain control over the program after every executed command, you
need to write an ISR routine to grab the int 1 every time it comes
by and do whatever you want. Fortunately, once the int 1 comes around
the tf flag has been cleared, so your ISR will run without 
interrupting.
When you iret from the ISR, it'll reset the tf though, so you don't
have to reset it every time the interrupt comes around.
I've got some code that shows how to debug itself, and I'll send it 
to
you if you want it. It's pretty self explanatory though...
Zephyr
___ Blue Wave/QWK v2.12
--- GEcho 1.00+
 * Origin: Digital Decay BBS 714.871.2057 (111:950/200)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/200 31 45 708/0

----------------------------------------------------------------------
(2890)   Thu 17 Mar 94 22:56                         
By: Zephyr
To: Electron
Re: This may be a stupid
----------------------------------------------------------------------
AREA:VIRUS_BETA
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/200 2697083d
 El> But can I get infected by READING this sub... Since you all put
 El> things up like Virii Codes...

 El> Thanks...
 El>  ! Origin: OFF THE STREETS OF CHIBA CITY  [804.790.1329] 
(111:950/31)

Ummm...no. This may be a silly answer, but you need to run the 
compiled
version on your own computer. Just reading the source codes isn't 
quite
enough to infect you.
Zephyr
___ Blue Wave/QWK v2.12
--- GEcho 1.00+
 * Origin: Digital Decay BBS (714)871-2057 (111:950/200)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/200 31 45 708/0

----------------------------------------------------------------------
(2891)   Fri 18 Mar 94 10:49                         
By: Ed Case
To: Tiphoid Mary
Re: Nuke UK
----------------------------------------------------------------------
AREA:VIRUS_BETA
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/31 270b04a4
Umm... 
Thanks I think - don't do the phreaking over here - too hard to 
cope with out
of band signalling and the nice people from the USA inhabiting RAF
Chicksands...not to mention Tinkerbell.

But as I'm UK based I just wanted to know if Savage Beast was
bullshitting...Nuke members in the UK?  I'm not one, but put me 
down as a
definite supporter.  Nuke boards in the UK?  Never heard one, if 
you have let
firecacker know and I'll voice him.

Incidentally,  Happy Birthday!
--- GEcho 1.00
 * Origin: OFF THE STREETS OF CHIBA CITY  [804.790.1329] (111:950/31)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/31 45 708/0

----------------------------------------------------------------------
(2892)   Fri 18 Mar 94 16:15                         
By: Electron
To: Brian Oblivion
Re: I know he works...
----------------------------------------------------------------------
AREA:VIRUS_BETA
FROM: 77:708/0.0
REASON: Sender not active for this area
@MSGID: 111:950/31 2710593e
RE: Re: This may be a stupid question...
BY: Brian Oblivion to Electron on Wed Mar 16 1994 10:12 pm

 > E> But can I get infected by READING this sub... Since you all 
put things up
 > E> Virii Codes...
 > 
 > I'm sure your conscientious sysop FireCracker is doing 
everything he can to
 > make sure that you don't get infected by reading this sub.  He 
works his ass
 > off to keep his users safe, dontcha FC?
 > 
 > --- Tee-J Toss 0.91b
 >  * Origin: Transcendental Chihuahua/2 (111:950/32)
His ass off... But I do not wanna take a chance of getting infected 
   by
reading the sub.. If it is possiable to get infected... I should 
remove this
from my Q-Scan..

Thanks
--- GEcho 1.00
 * Origin: OFF THE STREETS OF CHIBA CITY  [804.790.1329] (111:950/31)
SEEN-BY: 443/0 708/0 950/79
@PATH: 950/31 45 708/0
