KOLLYWABBLES VIRUS NEWSLETTER NUMBER 1, VOLUME 1 (written in DOS's EDIT. Perhaps the best program ever written.) DISCLAIMER: The information contained in this newsletter is for information purposes only. ...in the beginning This is my first newsletter of any sort, you aren't gonna find some graphical newsletter reading "interface", or any interface for that matter. Pull down menus and icons are for lamers, and I also don't have the time nor the motivation to waste my time writing an interface. You just have to use your trusty ol' DOS TEXT reader. Our lesson for the day Seeing that this is my first newsletter for viruses, I guess I'll make this issue about an introduction to viruses. This newsletter will be different than 40HEX, NukE Infojournal, Crypt Nesletter, etc. It will focus on what's going on the virus world (as I know it), basics to virus writing, and rarely will it contain source code. Who am I? My name is Kollywabbles, as you probably may or may not have noticed, and I have some sort of a fettish with viruses. They fascinate me, and whenever I see such a work of art as I did when the Dark Avengers viruses first came out, I set out to find a copy, and then study it to find out how he did what he did. I have been in the virus world for a while now, and someday I guess I will come out of it, but for now, I'm gonna help all of you to appreciate the complexity and imagination that some of those viruses out there have. Viruses. Created by a breed of sub-human hatemongers? Okay, I agree that a virus that contains destructive code is nothing but computer vandalism, and true, there is no such thing as a non-destructive virus. No such weapon has caused more fear in the hearts of todays computer users than that of a computer virus. Well, why do I like them? I find that computer viruses are getting to become more like living organisms than ever before. I am fascinated at the way they can reproduce or spawn, encrypt or mutate, protect themselves, and all of the various tricks that they use to be stealthy in their actions. One of these days, all the computers in the world are gonna crash, because somebody has written a virus that has unoticedly infected everybody in the world because it has been passed around for years. Such a virus would have no noticeable symptoms, no noticeable code in memory, and no noticeable effect on files or boot sectors. Then one day, WHAM! Mark my words, it'll happen. Viruses in general Most computer viruses out there start out as freshly assembled .COM files. When executed, they will begin encrypting themselves, and mutating inside a new host. Here are some of the abilities of viruses: Some go memory resident, and infect files when they are run, opened, closed, copied, etc. Such a virus could infect every file when opened on an anti- virus scanner, like the Dark Avenger and 1963 viruses. Some are runtime viruses, that when run, will find a host and infect them. The process starts all over when an infected program is run. There are thou- sands of these viruses, because they seem to be easiest to write. Some viruses can infect all of the files in a direcotry simply because you used the "DIR" command to view them, like the Corporate Life Virus, or Creeping Death. Some viruses infect the disk, and not the files. Those are called MBR/boot sector viruses. Examples would be Stoned, Monkey, etc. Some viruses infect by merely copying their code to a .COM file with the same name as the program you just tried to run, or will find a program and make a .COM file with the same name. Little Brother viruses, etc. There are endless possibilities to the methods a virus could use to infect a host computer. Some collect coins, some collect stamps... ...while I collect computer viruses. I have quite a large collection of them, and there really is no way for me to have all of them, seeing as how there are new viruses coming out every week. One of these days I gonna catch up, and all I will have to do is get a copy of a new virus once it comes out. (Damn, one of those army recruiters just called me and I lost my train of thought, I hate those guys). Umm.. oh yeah, well I was just about to tell you how to start yourself up a collection of viruses. I started by down- loading copies of virus newsletters that had virus source code in them. Virus source code is written in DOS TEXT (assembly), so all you have to do is cut and paste the source from the newsletter. Then you run Turbo Assembler on them, link the OBJ file, run EXE2BIN (depends on virus), and viola! Screeeeeech! WAIT A MINUTE! What about you guys that don't know what I'm talking about? Is there such a group of people?!? Well, you have to obtain Borlands Turbo Macro Assembler (TASM.EXE), and Borlands Turbo Linker (TLINK.EXE), and Microsoft's Execute 2 Binary (EXE2BIN.EXE). No hacker or virus writer would be caught dead without a running copy of these programs. Sources for these invaluable programs: TASM and TLINK can be obtained from- the Borland support BBS a copy of a canned virus generator (later explained) your friend a programming BBS EXE2BIN can be obtained from- any of the before sources DOS 5.0 (yes, it was included with DOS 5.0) note, exe2bin.exe is a DOS 5.0 program, so if you aren't running DOS 5.0, you must have SETVER loaded in your config.sys file. Other sources for viruses The majority (98%) of my viruses were obtained from calling virus BBSes in the US. They might be a little hard to find, but there are a couple that have hundreds of megabytes filled with viruses ripe for downloading. Downloading viruses isn't a tedious process though, for most viruses run around 1000-5000 bytes or less. Do the math, I'm not gonna tell you the time it takes to DL 10,000 viruses with a 14.4 modem. I can tell you however, you are looking at about 2-3 hours. Better get some money stored up if you're making LD calls to these places. (i'm telling this to you because I didn't have money to reimburse my dad for the calls, and I got BUSTED!!) Most long distance calls should be made around midnight for a couple of reasons. 1- Your parents don't know you are making the call, 'cause they are asleep. 2- LD calls cost about 50% less at midnight. 3- SysOps are asleep, and they don't know you are leeching BIG TIME from them. By the way, I am almost 19, and I still live with my parents. But that will all change very soon since I am moving out! Writing Viruses I recommend learning to write viruses the way that I did. Why, because that's how I learned to do it. Well, I started out by downloading a "canned virus generator". These utilities will create a basic, working virus that will have the traits that you specify. Some of these programs are, the V.C.L., the G2 virus creator, PS-MPC, IVP, etc. There are hundreds of 'em out there. All you do is create the virus, then start studying the code, splicing code from other viruses together, then you'll get to know a little assembly. Then, I got a book on assembly, written by Patricia Hoffman, the anti-virus guru (ironic, isn't it?). I read the book a couple of times, and then started to get a more in-depth understanding of the code that I was staring at on the screen. That's the magical moment, when you realize you could possibly write a virus on your own. Then, well practice makes perfect! And the rest they say, is history. STAY TUNED FOLKS, FOR FURTHER ISSUES OF KOLLYWABBLES VIRUS NEWSLETTER. Next Issue- The BEER virus. Great taste, or less filling? (Just kidding, I don't know what I'm gonna write about next, I havent thought that far ahead. I don't even know what to have for lunch today.)