 

                                 SOME WORDS

 


        Before  saying  anything I have to take a short break and thank all
 the people who helped me, directly or not in making all the stuff in here:

            Dics            - you rule!
            Virtual Daemon  - great buddy!

            All  members  from the SLAM group for supporting me and for
            not getting upset every time I had stupid idea ;-) Thanx guys...

        And  now a little about the articles in here... As much as I could,
 I  tried  to  correct them, justify them nicely and so on. I know you will
 hate  me  for not putting anything new here (the Ring0 article is missing)
 but  I  only released this to have it tested by all of you. Also for those
 who found my humble articles something interesting, they can watch them in
 a better way... And, of course, don't be mad if you still find mistakes or
 typoes  and  such.  They  have the same reason as the first ones: the fact
 that  I maybe was tired and the lack of time. Also, please know that it is
 not  very  easy  to make all this by your own... You need all the help you
 can get in bug checking and testing...

        Something  regarding  the  Portable  Executable  Infection article.
 some people told me they found a bug regarding the second method of adding
 a  new section. Frankly, I couldn't find the bug. Maybe my goat files were
 not  ok...  Anyhow, the message is: use section increase... It's much more
 reliable and much more hard to remove.

        About the old stuff in DOS:

 Whiplash 1.0

 This is an oldie but goldie. My first ever finished virus !!

 At  about  two  months since I started looking into viruses I came up with
 this  virus. It has a few nice things, but a lot of bugs. I release it for
 all  those  beginners to see how the first ever code will look and the way
 it will hang ;-)), and I release it as I don't care about DOS viruses now.
 This was coded in early 1997.

 Whiplash 2.0...

 This is an oldie but goldie. My first virus which actually worked !!

 Check it out... It's a full DOS COM/EXE infector, and runtime disinfector.
 It  has  a  few bugs which prevents it from spreading anyway. I decided to
 release it as I am thru with DOS viruses. It was written in early 1997.

 The WHIP3.ASM file even if it looks like a virus, it is not.

  It  is  only the beginning of a virus. I have never finished it because I
 moved  to  win32. Anyhow, the reason I present it up here is the fact that
 it is still special. When I started working on it I wanted it to be a very
 memory  stable  virus,  almost  imposible  to  remove  from memory without
 hanging the system.

  Therefore, this code does this:

        - alocates 4 different memory areas
        - moves parts of the virus in those areas
        - makes links thru interrupt bodies between areas
        - encrypts the memory zones in different ways.
        - everytime an interrupt is called the memory gets decryptes
        - there are different checksums on memory

  The  program  as  you  see  it here only goes resident stealth and when a
 program runs it displays:

        "An executable is about to be run..."

        That's all that it does!


        Also,  you  will nottice the now confirmed functional Win32 viruses
 Undertaker  and  Manowar.  In  Undertaker  you can see the use of the FPU.
 Taylor procedure I present in the Anti-emulation article.

        As  for the future I have some projects I work on: Ring0 residency,
 Process  spawn  recidency,  some virus related essays, the Multiple Opcode
 Fantasies 32bit (almost finished), and some more... So, I am preety busy.

        Regarding  MOF, you will not be able to compile it, unless you have
 the  asmwiz.lib  file  in  the  same  directory (get it from the net, it's
 freeware).  Also, for the win32 viruses you will need the pewrsec  utility
 written by JQwerty (get it from the 29A issue #2)...

        That's it for now...

        Here are all my grets:

                        antigen                     
                        aurodreph the drow          
                        automag                     
                        blue skull                  
                        b0z0                        
                        coke                        
                        cyberyoda                   
                        dark angel                  
                        dark fiber                  
                        darkman                     
                        dics                        
                        executioner                 
                        forms                       
                        gryio                       
                        hellfire                    
                        hellraiser                  
                        jacky qwerty                
                        kidchaos                    
                        lord natas                  
                        lovingod                    
                        qark                        
                        quantum                     
                        memory lapse                
                        metabolis                   
                        methyl                      
                        mr sandman                  
                        murkry                      
                        murphy                      
                        opic                        
                        overlord                    
                        raajat                      
                        raid                        
                        rp                          
                        shaitan                     
                        stealth warrior             
                        super                       
                        t2000                       
                        tcp                         
                        the unforgiven              
                        yesna                       
                        trigger                     
                        virogen                     
                        virtual daemon              
                        virus buster                
                        wild w0rker                 
                        wintermute                  
                        wizard555                   
                        zoom23                      


              Also I would like to salute the groups:

                       -       SLAM       -
                       -       IKX        -
                       -       29A        -
                       -       DDT        -
                       -     STEALTH      -
                       -   CODEBREAKERS   -


              And also my old time favorite groups that meant something:

                       -       VLAD       -
                       -  INSANE REALITY  -
                       -       P/S        -


              Special greetings go to:

                       !  Virtual Daemon  !
                       !     Darkman      !
                       !       DiCS       !
                       !  The Unforgiven  !
                       !    Mr.Sandman    !


              And all the guys on the Undernet #vir IRC channel...

              Good luck and be well, ppl !!!

                        All the Best,
                                      Ŀ
                                       Lord Julus - 1999 
                                      
